Function at 0x140006ee0
Capabilities:
Accept command line arguments
Print debug messages
Query environment variable
Terminate process

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xb0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0xb0], rdi
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor esi, esi
mov dword [rbp + 0x30], 0x20
mov qword [rbp + 0x38], rsi
mov dword [rbp + 0x48], esi
mov qword [rbp + 0x18], rsi
mov dword [rbp + 0x40], 7
mov dword [rbp + 0x44], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, 2
mov dword [rbp + 0x10], esi
mov r15d, esi
mov r14, rax
mov qword [rbp + 8], rbx
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp + 0x20], rax
test rax, rax
jne 0x140006f7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140016a50]
jmp 0x140006fa3
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
test eax, eax
jne 0x140006faa
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140016a18]
mov edx, eax
call fcn.140006b70
xor r9d, r9d
mov qword [rsp + 0x30], rsi
lea rcx, str.CONIN_
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140008130], rax
cmp rax, 0xffffffffffffffff
jne 0x140007001
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1400169e0]
mov edx, eax
mov dword [0x140008140], eax
call fcn.140006b70
jmp 0x14000700b
mov dword [0x140008144], 3
mov qword [rsp + 0x30], rsi
lea rcx, str.CONOUT_
xor r9d, r9d
mov r8d, ebx
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140008110], rax
cmp rax, 0xffffffffffffffff
jne 0x140007061
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1400169a0]
mov edx, eax
mov dword [0x140008120], eax
call fcn.140006b70
jmp 0x14000706b
mov dword [0x140008124], 3
lea rsi, [0x140008100]
mov r12, rbx
lea rdi, str.INPUT
nop dword [rax]
mov ecx, dword [rsi]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov qword [rsi - 0x10], rax
cmp rax, 0xffffffffffffffff
jne 0x1400070bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rdx, r13d
lea rcx, [0x140016960]
shl rdx, 5
mov r8d, eax
mov dword [rsi], eax
add rdx, rdi
call fcn.140006b70
jmp 0x140007189
test rax, rax
jne 0x1400070db
movsxd rdx, r13d
lea rcx, [0x140016928]
shl rdx, 5
add rdx, rdi
call fcn.140006b70
jmp 0x140007189
mov rcx, rax
test r13d, r13d
jne 0x140007142
lea rdx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x140007100
mov dword [0x1400080c4], 3
jmp 0x140007189
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1400168f8]
mov edx, eax
call fcn.140006b70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, r12d
jne 0x14000712b
mov dword [0x1400080c4], r12d
jmp 0x140007189
test eax, eax
jne 0x140007189
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140007189
lea rcx, [0x1400168c8]
jmp 0x140007182
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x14000715c
mov dword [rsi + 4], 1
mov dword [rsi + 8], 1
jmp 0x140007189
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
jne 0x14000716d
mov dword [rsi + 4], r15d
jmp 0x140007189
cmp eax, 6
jne 0x14000717b
mov dword [rsi + 4], 3
jmp 0x140007189
lea rcx, [0x140016890]
mov edx, eax
call fcn.140006b70
sub rsi, 0x20
dec r13d
jns 0x140007080
mov ebx, 1
mov rdi, r14
mov r12d, r15d
cmp byte [r14], r15b
je 0x140007211
test r15d, r15d
jne 0x1400071d8
movzx eax, byte [rdi]
cmp al, 0x20
je 0x1400071b6
cmp al, 9
jne 0x1400071d8
xor r12d, r12d
nop dword [rax]
movzx eax, byte [rdi + 1]
inc rdi
cmp al, 0x20
je 0x1400071c0
cmp al, 9
je 0x1400071c0
cmp al, r12b
je 0x140007211
inc ebx
jmp 0x1400071fa
movzx eax, byte [rdi]
cmp al, 0x5c
jne 0x1400071e5
xor r12d, 1
jmp 0x1400071f7
test r12d, r12d
jne 0x1400071f4
cmp al, 0x22
jne 0x1400071f4
xor r15d, 1
jmp 0x1400071f7
xor r12d, r12d
inc rdi
cmp byte [rdi], 0
jne 0x1400071a6
test r15d, r15d
je 0x140007211
lea rcx, [0x140016858]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [rbx + 1]
movabs r15, 0xffffffffffffff0
shl rcx, 3
sub rcx, r14
lea rax, [rcx + rdi + 1]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140007236
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400075b0
sub rsp, rcx
mov eax, ebx
lea r12, [rsp + 0x40]
shl rax, 3
lea rdx, [rax + r12 + 8]
sub rax, r14
lea rcx, [rax + r12 + 8]
nop dword [rax]
movzx eax, byte [r14]
inc r14
mov byte [rcx + r14 - 1], al
test al, al
jne 0x140007260
xor r13d, r13d
mov qword [r12], rdx
movzx eax, byte [rdx]
mov rdi, rdx
mov r9d, r13d
mov r8d, r13d
mov esi, r13d
test al, al
je 0x14000732c
mov r10, r12
test r9d, r9d
jne 0x1400072c6
cmp al, 0x20
je 0x14000729e
cmp al, 9
jne 0x1400072c6
mov r8d, r13d
mov byte [rdi], r8b
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x20
je 0x1400072a4
cmp al, 9
je 0x1400072a4
cmp al, r8b
je 0x14000732c
inc esi
add r10, 8
mov rdi, rdx
mov qword [r10], rdx
jmp 0x140007321
cmp al, 0x5c
jne 0x1400072d1
inc r8d
mov byte [rdi], al
jmp 0x14000731b
cmp al, 0x22
jne 0x140007316
lea eax, [r8 + 1]
inc rdx
mov ecx, eax
shr rcx, 1
sub rdi, rcx
test r8b, 1
je 0x1400072f5
mov byte [rdi], 0x22
inc rdi
mov r8d, r13d
jmp 0x140007321
test r9d, r9d
je 0x14000730d
cmp byte [rdx], 0x22
jne 0x14000730d
mov byte [rdi], 0x22
inc rdi
mov r8d, r13d
inc rdx
jmp 0x140007321
xor r9d, 1
mov r8d, r13d
jmp 0x140007321
mov r8d, r13d
mov byte [rdi], al
inc rdi
inc rdx
movzx eax, byte [rdx]
test al, al
jne 0x140007291
mov byte [rdi], r13b
inc esi
mov qword [r12 + rsi*8], r13
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov rbx, rax
test rax, rax
jne 0x14000735c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140016820]
mov edx, eax
call fcn.140006b70
jmp 0x1400073f3
mov rdx, rax
movzx eax, byte [rax]
mov r8d, r13d
test al, al
je 0x1400073f3
nop dword [rax]
cmp al, 0x3d
je 0x140007377
inc r8d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
add rdx, rcx
movzx eax, byte [rdx]
test al, al
jne 0x140007370
test r8d, r8d
je 0x1400073f3
lea ecx, [r8 + 1]
shl rcx, 3
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400073a8
mov rax, r15
and rax, 0xfffffffffffffff0
call fcn.1400075b0
sub rsp, rax
mov r11d, r13d
lea rdx, [rsp + 0x40]
mov r9, rbx
mov qword [rbp + 0x18], rdx
mov r10, rdx
cmp byte [r9], 0x3d
je 0x1400073d6
mov qword [r10], r9
inc r11d
add r10, 8
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r9
repne scasb al, byte [rdi]
not rcx
add r9, rcx
cmp byte [r9], al
jne 0x1400073c6
mov eax, r11d
mov qword [rdx + rax*8], r13
call fcn.140006ad0
mov r8, qword [rbp + 0x18]
mov rdx, r12
mov ecx, esi
call fcn.140006748
mov esi, eax
call fcn.140006ad0
test rbx, rbx
je 0x140007433
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
test eax, eax
jne 0x140007433
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1400167e8]
mov edx, eax
call fcn.140006b70
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140007458
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
jne 0x140007458
lea rcx, [0x1400167b8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rbp]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
mov dword [rbp], eax
test eax, eax
jne 0x140007480
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140016780]
jmp 0x140007551
cmp eax, 1
jne 0x140007558
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
test eax, eax
jne 0x1400074b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140016748]
jmp 0x140007551
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 0x38], rax
test rax, rax
jne 0x1400074d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140016710]
jmp 0x140007551
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140007558
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_FlashWindowEx]
mov edx, 0x12c
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Beep]
test eax, eax
jne 0x140007520
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1400166e8]
mov edx, eax
call fcn.140006b70
nop word [rax + rax]
lea r9, [rbp]
lea rdx, [rbp + 0x50]
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
test eax, eax
je 0x140007544
cmp word [rbp + 0x50], 1
jne 0x140007520
jmp 0x140007558
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1400166b0]
mov edx, eax
call fcn.140006b70
lea rdi, [0x140008130]
mov eax, 2
mov rcx, qword [rdi]
cmp rcx, 0xffffffffffffffff
je 0x14000758f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14000758b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140016680]
mov edx, eax
call fcn.140006b70
mov rax, qword [rbp + 8]
sub rdi, 0x20
dec rax
mov qword [rbp + 8], rax
jne 0x140007564
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_ExitProcess]