Function at 0x14002c784
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
xor r12d, r12d
mov r13, rax
cmp dword [0x140053844], r12d
jne 0x14002cabf
lea eax, [r12 + 1]
mov dword [0x140053844], eax
test r13, r13
je 0x14002cabf
and dword [rsp + 0x78], r12d
lea rdx, [rsp + 0x78]
mov rcx, r13
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14002cabf
xor ecx, ecx
mov rsi, rax
mov dword [rsp + 0x80], ecx
cmp ecx, dword [rsp + 0x78]
jge 0x14002caae
mov rcx, qword [rsi]
lea rdx, str._RunOnce:
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14002c86d
lea rdx, str._prefetch
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14002ca9c
lea rdx, str._prefetch:1
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x14002ca9c
and dword [rdi + 0x68], 0
jmp 0x14002cabf
mov rcx, qword [rsi]
lea rdx, str._NoService
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x14002c864
mov rcx, qword [rsi]
lea rdx, str._DefaultService
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x14002ca2e
mov rcx, qword [rsi]
lea rdx, str._DownloadService
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x14002ca2e
mov rcx, qword [rsi]
lea rdx, str._ServiceInfo
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
mov rcx, qword [rsi]
test rax, rax
je 0x14002c9ea
mov edx, 0x3a
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x14002ca9c
lea r15, [rax + 2]
mov rcx, r15
call fcn.140019eb0
test eax, eax
je 0x14002ca9c
mov rdx, r12
mov rcx, rdi
xor ebp, ebp
call fcn.14002b2b4
mov rbx, rax
test rax, rax
jne 0x14002c94e
mov ecx, 0x140
call fcn.1400012cc
test rax, rax
je 0x14002c947
mov rcx, rax
call fcn.140029458
mov rbx, rax
jmp 0x14002c949
xor ebx, ebx
mov ebp, 1
and dword [rdi + 0x68], 0
test rbx, rbx
je 0x14002ca9c
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14002aaec
mov r15d, eax
test eax, eax
js 0x14002c9c1
xor edx, edx
mov rcx, rbx
call fcn.14002c4fc
test eax, eax
je 0x14002c9c1
mov rdx, rbx
mov rcx, rdi
call fcn.140029a3c
mov r15d, eax
test eax, eax
js 0x14002c99c
xor ebp, ebp
mov rcx, rdi
call fcn.14002d51c
jmp 0x14002c9b3
test ebp, ebp
jne 0x14002c9b3
mov rdx, rbx
mov rcx, rdi
call fcn.14002cadc
lea ecx, [rbp + 1]
cmp eax, ecx
cmove ebp, ecx
mov ecx, 4
lea rdx, str.__Service_added_from_command_line:_0x_x._r_n
jmp 0x14002c9cd
mov ecx, 2
lea rdx, str.__Specified_service_is_not_valid:_0x_x._r_n
mov r8d, r15d
call fcn.140018ed8
test ebp, ebp
je 0x14002ca9c
mov rcx, rbx
call fcn.1400299cc
jmp 0x14002ca9c
lea rdx, str._ServiceExtra
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14002ca9c
mov rcx, qword [rsi]
mov edx, 0x3a
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x14002ca9c
lea rdx, [rax + 2]
lea rcx, [rdi + 0x40]
call fcn.14001d218
jmp 0x14002ca9c
mov rcx, qword [rsi]
mov edx, 0x3a
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x14002ca9c
add r12, 2
mov rcx, rdi
mov rdx, r12
call fcn.14002d38c
lea rcx, [rdi + 0x20]
mov rdx, r12
call fcn.14001d218
mov rcx, qword [rsi]
lea rdx, str._DownloadService
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14002ca88
mov eax, 1
mov dword [rdi + 0x6c], eax
mov r8, r12
lea rdx, str.__Command_line_specified_default_service_is:__S._r_n
mov ecx, 3
call fcn.140018ed8
mov ecx, dword [rsp + 0x80]
inc ecx
add rsi, 8
jmp 0x14002c7fa
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret