Function at 0x140001010
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, qword [r8]
mov rbx, r9
mov r15, r8
mov r9, rdx
mov r8d, ecx
mov r14, rdx
mov ebp, ecx
mov rdx, r12
lea rcx, [rsp + 0x20]
mov esi, 2
call fcn.14000c0b0
test eax, eax
je 0x140001054
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x20]
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x60], rdi
lea rdx, str.cnmspdBbDiC:v
call fcn.14000bed0
test eax, eax
jne 0x140001106
nop dword [rax]
movzx edx, byte [rsp + 0x70]
cmp dl, 0x44
je 0x1400010e0
cmp dl, 0x63
je 0x1400010db
cmp dl, 0x6e
je 0x1400010d4
cmp dl, 0x76
je 0x1400010cf
mov r8, qword [rsp + 0x28]
mov rcx, r15
call fcn.140002090
mov edi, eax
test eax, eax
je 0x1400010e3
mov r9, qword [r15 + 8]
lea rdx, str._s:__s_r_n
mov r8, qword [r14]
mov rcx, qword [0x14001cba8]
call fcn.14000b100
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
or dword [rbx], 8
jmp 0x1400010e3
dec esi
or dword [rbx], 2
jmp 0x1400010e3
or dword [rbx], 1
jmp 0x1400010e3
or dword [rbx], 4
mov rcx, qword [rsp + 0x20]
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x70]
lea rdx, str.cnmspdBbDiC:v
call fcn.14000bed0
test eax, eax
je 0x140001080
mov r8d, dword [r15 + 0x30]
lea edx, [rsi + 1]
cmp r8d, 1
cmovne edx, esi
cmp eax, 0x1117e
jne 0x1400012cd
mov ecx, dword [rbx]
lea eax, [rcx - 1]
test ecx, eax
je 0x14000114a
mov r8, qword [r14]
lea rdx, str._s:_only_one_of__c__n__v__D_may_be_specified_r_n
mov rcx, qword [0x14001cba8]
call fcn.14000b100
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test cl, 8
je 0x14000115c
test r8d, r8d
jne 0x14000115c
mov dword [r15 + 0x30], 3
mov rax, qword [rsp + 0x20]
movsxd rsi, dword [rax + 0x18]
sub ebp, esi
cmp ebp, edx
jne 0x1400012cd
test byte [rbx], 2
mov rdi, 0xffffffffffffffff
jne 0x1400011ca
mov rdx, qword [r14 + rsi*8]
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x140001182
cmp rax, 0x1fff
jbe 0x1400011b5
mov r8, qword [r14]
lea rdx, str._s:_filename_too_long_r_n
mov rcx, qword [0x14001cba8]
call fcn.14000b100
mov ecx, 5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, r12
call fcn.140009130
mov rcx, qword [rsp + 0x88]
inc esi
mov qword [rcx], rax
movsxd rax, esi
mov rdx, qword [r14 + rax*8]
lea rbx, [r14 + rax*8]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400011e0
cmp rax, 0xff
jbe 0x140001219
mov r8, qword [r14]
lea rdx, str._s:_username_too_long_____d__r_n
mov rcx, qword [0x14001cba8]
mov r9d, 0xff
call fcn.14000b100
mov ecx, 5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, r12
call fcn.140009130
mov rcx, qword [rsp + 0x80]
mov edx, 0x3a
mov qword [rcx], rax
mov rcx, rax
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x140001264
movsx r9d, byte [rax]
lea rdx, str._s:_username_contains_illegal_character__c_r_n
mov r8, qword [r14]
mov rcx, qword [0x14001cba8]
call fcn.14000b100
mov ecx, 6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp dword [r15 + 0x30], 1
jne 0x1400012b6
mov rdx, qword [rbx + 8]
nop
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140001270
cmp rdi, 0xff
jbe 0x1400012aa
mov r8, qword [r14]
lea rdx, str._s:_password_too_long_____d__r_n
mov rcx, qword [0x14001cba8]
mov r9d, pe_nt_image_headers64
call fcn.14000b100
mov ecx, 5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, r12
call fcn.140009130
mov qword [r15 + 0x20], rax
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
call fcn.140001b00
int3