Function at 0x140001b00
Capabilities:
Accept command line arguments
Get disk information
Get file size
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rdi + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001b34
mov dword [rax], 0x89
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x140001d07
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareStringW]
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMessageW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PeekMessageW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindow]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
int1
out dx, al
invalid
invalid
fisub word [rcx + 0x33]
sub dword [rcx - 0x3a], 0x4028a431
xchg esp, eax
xor edx, 0x34
xor al, 0x5d
xor al, 0x5d
lodsd eax, dword [rsi]
cli
pop rbp
out dx, al
cmp eax, 0x19d96ec5
movabs al, byte [0x57037931869d2e1a]
jns 0x1400045f7
push rdi
jns 0x1400045f7
push rdi
insb byte [rdi], dx
xchg ecx, eax
stosb byte [rdi], al
invalid
retf
pop rax
movabs dword [0x1116fa6475687f9d], eax
je 0x14000467d
or eax, 0x1a26601c
xchg esi, eax
and ecx, 0xffffff99
cmpsd dword [rsi], dword [rdi]
sbb dl, byte [rsi - 0x58661e7d]
cmc
invalid
adc ebx, dword [rax - 0x59278d71]
jb 0x14000461b
cmpsb byte [rsi], byte [rdi]
pop rdi
and al, 0xa1
xor dl, byte [rdi + 0x23722007]
invalid
and byte [rdx + 0x23], dh
invalid
jno 0x1400046a8
invalid
push rsp
lodsd eax, dword [rsi]
jne 0x1400046db
sar byte [rax + rbp*4 + 0x6b7a7fc5], cl
jp 0x1400046d4
invalid
invalid
cdq
retf 0xb294
xchg byte [rdi], al
push 0xffffffffffd0f3a5
mov esp, 0xc51ed2dd
invalid
invalid
invalid
sahf
invalid
sub esp, dword [rbx - 0x4c1d6e7f]
lea edi, [rdi + 0x41]
xchg edi, eax
fidivr dword [rbp + rbp*2 + 0xee91f39]
je 0x14000465e
jbe 0x140004647
or al, 0xd7
sahf
invalid
std
mov esi, 0x6e059bc9
sahf
pop rbp
rcr byte [rcx], 1
cmp eax, 0x5071d8d4
lodsb al, byte [rsi]
je 0x1400046eb
movabs eax, dword [0xc5fe5f02fd91c813]
adc ecx, eax
xchg ecx, eax
std
add bl, byte [rdi - 2]
invalid
inc ch
imul byte [rdi - 0x12133c84]
invalid
imul esp, dword [rdi + 0x1c37130b], 0xffffffc8
test cl, dl
movabs byte [0x424b30af539ab33], al
sbb edi, dword [rbp + rbx*4 + 0x5054a3cc]
int3
movabs dword [0xa5767724260a5054], eax
invalid
mov r15b, 0x73
jae 0x140004747
invalid
xchg edx, eax
sub dword [0xf300202c], esp
invalid
add eax, 0xe31427db
jo 0x14000474e
test ebp, edi
mov dl, 0x47
adc dword [rbx - 0x13], 0xfffffff8
fcmovne st(0), st(1)
push rbx
adc bl, byte [rax + 0x5c1f82dd]
invalid
invalid
pop rsp
mov dword [rbx - 0x1a], edx
jae 0x1400046e2
invalid
invalid
and al, 0x58
cli
jae 0x1400046c8
mov al, 0x89
mov dword [rbp + 0x65], ebx
pop rbp
sti
sti
pop rsi
invalid
enter 0x740c, 1
jns case.0x140001d1f.17
fadd dword [r10 - 0x5a]
enter 0xffffffffffffc7e0, 0x12
add dword [rsi + 0xab8371], eax
stosd dword [rdi], eax
add cl, dh
stosd dword [rdi], eax
add cl, dh
stosb byte [rdi], al
js 0x1400047e2
mov r15b, byte [0xc2abdc55]
test al, 0xdd
pop rsi
wait
sti
fld qword [r10 + 0x34]
xor al, 0x5b
xor al, 0x5b
and al, 0x96
invalid
invalid
push rbp
xor eax, 0xa835564e
test al, 0x4f
adc ecx, dword [rdx - 0xc6ea880]
and eax, 0x80bd582
pop rcx
xchg edx, eax
xor al, 0x32
mov bl, 0x5b
pop rbp
adc byte [rdi + 0x22ba027e], bh
invalid
ja 0x14000481d
retf
nop
cdq
sub al, 0x80
fbld tbyte [0xec9025a7]
loop str.wXe
invalid
sub dh, cl
invalid
stosd dword [rdi], eax
mov word [rbp + 0x151ff0ee], ds
push rbp
retf