Function at 0x62249750
Capabilities:
Accept command line arguments
Check for peb beingdebugged flag
Get process heap flags
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x4a8
mov dword [ebp - 0x444], 0
call dword [sym.imp.kernel32.dll_GetCommandLineW]
lea edx, [ebp - 0x448]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.shell32.dll_CommandLineToArgvW]
mov ebx, dword [ebp - 0x448]
sub esp, 8
mov esi, eax
test ebx, ebx
jle 0x622499a0
mov edx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
xor eax, eax
xor edi, edi
mov ebx, eax
mov dword [ebp - 0x44c], edx
nop
mov dword [esp + 0x1c], 0
add ebx, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [esi + edi*4]
add edi, 1
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x44c]
mov dword [esp], 0xfde9
call eax
sub esp, 0x20
add ebx, eax
cmp edi, dword [ebp - 0x448]
jl 0x622497b0
mov eax, ebx
add eax, 4
mov dword [ebp - 0x454], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x458], eax
call eax
mov ecx, eax
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x448]
sub esp, 0xc
lea edi, [ecx + eax*4 + 4]
test eax, eax
jle 0x622498c7
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
xor ebx, ebx
mov dword [ebp - 0x44c], eax
lea esi, [esi]
nop
mov eax, dword [ebp - 0x450]
mov dword [eax + ebx*4], edi
mov eax, dword [ebp - 0x454]
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [esi + ebx*4]
add ebx, 1
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x44c]
mov dword [esp], 0xfde9
call eax
add edi, eax
mov eax, dword [ebp - 0x448]
sub esp, 0x20
cmp ebx, eax
jl 0x62249868
mov edx, dword [ebp - 0x450]
lea ebx, [ebp - 0x428]
mov dword [edx + eax*4], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_LocalFree]
sub esp, 4
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
sub esp, 0xc
test byte [0x62258078], 8
jne 0x62249960
mov dword [esp], ebx
call fcn.622539a0
mov esi, eax
test eax, eax
jne 0x622499b4
mov ecx, dword [ebp - 0x450]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, 0xffffffff
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov esi, dword [ebp - 0x448]
mov eax, ebx
call fcn.62246c90
mov dword [esp + 0xc], str._s_argc_i_n
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._CorExeMain
mov dword [esp + 4], 0x62258078
mov dword [esp], 3
call fcn.62246f10
jmp 0x6224990b
mov dword [ebp - 0x454], 4
mov eax, 4
jmp 0x62249814
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov dword [esp], 0
mov dword [ebp - 0x480], eax
call eax
push ecx
mov edi, eax
mov dword [esp + 4], eax
lea eax, [ebp - 0x438]
mov dword [esp], eax
call fcn.622421e0
test eax, eax
jns 0x62249e6e
test byte [0x62258078], 2
jne 0x62249e41
lea eax, [ebp - 0x220]
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x434]
mov dword [ebp - 0x45c], eax
mov edi, dword [ebp - 0x44c]
mov eax, dword [sym.imp.ucrtbase.dll_wcscpy]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [ebp - 0x478], eax
call eax
mov dword [esp + 4], 0x6225bdb0
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebp - 0x45c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.622445e0
test eax, eax
js 0x62249c83
mov edx, dword [ebp - 0x42c]
test edx, edx
je 0x62249c83
movzx eax, word [edx]
test ax, ax
je 0x62249c83
mov dword [ebp - 0x454], 0
lea ecx, [edx + 2]
cmp ax, 0x3b
jne 0x62249a83
add dword [ebp - 0x454], 1
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x62249a76
mov eax, dword [sym.imp.ucrtbase.dll_wcslen]
mov dword [esp], edx
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x47c], eax
call eax
mov edx, dword [ebp - 0x460]
cmp word [edx + eax*2 - 2], 0x3b
je 0x62249ab9
add dword [ebp - 0x454], 1
mov edi, dword [ebp - 0x44c]
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcsrchr]
mov dword [esp + 4], 0
sub eax, edi
mov dword [ebp - 0x468], eax
sar eax, 1
mov edi, eax
mov eax, dword [ebp - 0x454]
mov ecx, dword fs:[0x18]
lea eax, [eax*4 + 4]
mov dword [ebp - 0x470], ecx
mov dword [esp + 8], eax
mov dword [ebp - 0x46c], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x458]
call eax
sub esp, 0xc
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x438]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x42c]
mov dword [esp + 4], 0x6225bdac
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_wcstok_s]
mov dword [ebp - 0x474], eax
call eax
mov dword [ebp - 0x488], esi
mov dword [ebp - 0x460], 0
mov ecx, eax
lea eax, [edi + 2]
mov dword [ebp - 0x484], eax
mov esi, ecx
jmp 0x62249c1c
mov dword [esp], esi
mov eax, dword [ebp - 0x47c]
call eax
add eax, dword [ebp - 0x484]
mov dword [esp + 4], 0
add eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x470]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x458]
call eax
mov ecx, dword [ebp - 0x464]
mov edi, eax
mov eax, dword [ebp - 0x460]
sub esp, 0xc
mov dword [ecx + eax*4], edi
mov ecx, dword [ebp - 0x468]
mov dword [esp], edi
lea edx, [ecx + 2]
mov ecx, dword [ebp - 0x44c]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x48c], edx
call sub.ucrtbase.dll_memcpy
mov edx, dword [ebp - 0x48c]
mov dword [esp + 4], esi
mov ecx, dword [ebp - 0x478]
add edx, edi
mov dword [esp], edx
call ecx
lea ecx, [ebp - 0x438]
mov dword [esp], 0
mov dword [esp + 8], ecx
mov ecx, dword [ebp - 0x474]
mov dword [esp + 4], 0x6225bdac
call ecx
add dword [ebp - 0x460], 1
mov esi, eax
mov ecx, dword [ebp - 0x454]
cmp dword [ebp - 0x460], ecx
jne 0x62249b6c
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x464]
mov esi, dword [ebp - 0x488]
mov dword [ecx + eax - 4], 0
xor eax, eax
lock cmpxchg dword [section..bss], ecx
test eax, eax
je 0x62249c83
test byte [0x62258078], 2
je 0x62249c83
mov dword [esp + 0xc], str.private_path_was_already_set_n
mov dword [esp + 8], str._CorExeMain
mov dword [esp + 4], 0x62258078
mov dword [esp], 1
call fcn.62246f10
mov eax, dword [ebp - 0x45c]
or edi, 0xffffffff
mov dword [esp], eax
call fcn.622446a0
lea eax, [ebp - 0x43c]
mov dword [esp], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call fcn.62251c20
test eax, eax
jns 0x62249d22
mov ecx, dword [ebp - 0x450]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
cmp dword [ebp - 0x444], 0
je 0x62249d19
call dword [0x6226d01c]
call dword [0x6226d028]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_ExitProcess]
lea eax, [ebp - 0x438]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x43c]
mov dword [esp], eax
call fcn.62250700
test eax, eax
jns 0x62249d52
or edi, 0xffffffff
mov eax, dword [ebp - 0x43c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push eax
jmp 0x62249cda
mov edx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x438]
lea ecx, [ebp - 0x444]
call fcn.62247b90
test eax, eax
js 0x62249d3e
mov dword [esp], 0
mov edi, dword [0x6226d054]
mov eax, dword [ebp - 0x480]
call eax
push edx
lea edx, [ebp - 0x440]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], eax
call edi
test eax, eax
je 0x62249df6
lea edx, [ebp - 0x440]
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [0x6226d08c]
mov esi, eax
test eax, eax
je 0x62249df6
mov dword [esp], eax
call dword [0x6226d078]
mov eax, dword [ebp - 0x450]
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x448]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x444]
mov dword [esp], eax
call dword [0x6226d050]
mov edi, eax
jmp 0x62249d41
test byte [0x62258078], 2
je 0x62249d3e
mov esi, dword [ebp - 0x440]
mov eax, ebx
call fcn.62246c90
mov dword [esp + 0xc], str.couldnt_load__s__status_d_n
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._CorExeMain
mov dword [esp + 4], 0x62258078
mov dword [esp], 1
call fcn.62246f10
jmp 0x62249d3e
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.failed_to_read_CLR_headers__hr_lx_n
mov dword [esp + 8], str.FixupVTable
mov dword [esp + 4], 0x62258078
mov dword [esp], 1
call fcn.62246f10
jmp 0x622499f2
lea eax, [ebp - 0x220]
mov dword [ebp - 0x44c], eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x434]
mov dword [ebp - 0x45c], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x438]
mov dword [esp], eax
call fcn.62242280
xor ecx, ecx
cmp dword [ebp - 0x220], 0
je 0x62249ed4
mov eax, edi
mov edi, esi
mov esi, ecx
mov edx, dword [ebp - 0x434]
mov dword [ebp - 0x454], eax
lea edx, [edx + esi*8]
add esi, 1
call fcn.622472b0
cmp esi, dword [ebp - 0x220]
mov eax, dword [ebp - 0x454]
jb 0x62249ead
mov esi, edi
mov eax, dword [ebp - 0x438]
mov dword [esp], eax
call fcn.62242000
jmp 0x62249a0a