Function at 0x1400024d0
Capabilities:
Accept command line arguments
Check mutex on windows
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, 4
nop
call fcn.1400010ef
sub rbx, 1
jne 0x1400024e0
mov ebx, 3
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
mov ecx, eax
test eax, eax
jne 0x140002510
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x140002568
dec eax
cmp eax, 1
jbe 0x140002562
cmp ecx, 3
jne 0x140002524
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140002568
cmp ecx, 4
je 0x140002552
cmp ecx, 5
jne 0x140002536
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x140002568
cmp ecx, 6
je 0x14000255a
cmp ecx, 7
jne 0x140002548
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x140002568
cmp ecx, 8
je 0x14000255a
cmp ecx, 9
jne 0x140002568
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x140002568
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x140002568
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rbx, 1
jne 0x1400024f0
mov edi, 5
mov ebx, edi
call fcn.1400010ef
sub rbx, 1
jne 0x140002575
mov ebx, 3
nop word [rax + rax]
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
mov ecx, eax
test eax, eax
jne 0x1400025b0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x140002607
dec eax
cmp eax, 1
jbe 0x140002601
cmp ecx, 3
jne 0x1400025c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140002607
cmp ecx, 4
je 0x1400025f1
cmp ecx, edi
jne 0x1400025d5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x140002607
cmp ecx, 6
je 0x1400025f9
cmp ecx, 7
jne 0x1400025e7
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x140002607
cmp ecx, 8
je 0x1400025f9
cmp ecx, 9
jne 0x140002607
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x140002607
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x140002607
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rbx, 1
jne 0x140002590
mov ebx, 8
call fcn.1400010ef
sub rbx, 1
jne 0x140002612
mov ebx, 3
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
mov ecx, eax
test eax, eax
jne 0x140002642
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x140002699
dec eax
cmp eax, 1
jbe 0x140002693
cmp ecx, 3
jne 0x140002656
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140002699
cmp ecx, 4
je 0x140002683
cmp ecx, edi
jne 0x140002667
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x140002699
cmp ecx, 6
je 0x14000268b
cmp ecx, 7
jne 0x140002679
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x140002699
cmp ecx, 8
je 0x14000268b
cmp ecx, 9
jne 0x140002699
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x140002699
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x140002699
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rbx, 1
jne 0x140002622
nop
lea r8, str.Global_smbsvc_mutex
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je 0x1400026c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140002801
mov ebx, 8
nop dword [rax]
call fcn.1400010ef
sub rbx, 1
jne 0x1400026d0
mov ebx, 3
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
mov ecx, eax
test eax, eax
jne 0x140002700
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x140002757
dec eax
cmp eax, 1
jbe 0x140002751
cmp ecx, 3
jne 0x140002714
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140002757
cmp ecx, 4
je 0x140002741
cmp ecx, edi
jne 0x140002725
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x140002757
cmp ecx, 6
je 0x140002749
cmp ecx, 7
jne 0x140002737
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x140002757
cmp ecx, 8
je 0x140002749
cmp ecx, 9
jne 0x140002757
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x140002757
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x140002757
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rbx, 1
jne 0x1400026e0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 8
nop dword [rax]
call fcn.1400010ef
sub rbx, 1
jne 0x140002770
mov ebx, 3
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
test eax, eax
jne 0x14000279e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x1400027f6
lea ecx, [rax - 1]
cmp ecx, 1
jbe 0x1400027f0
cmp eax, 3
jne 0x1400027b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400027f6
cmp eax, 4
je 0x1400027e0
cmp eax, edi
jne 0x1400027c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1400027f6
cmp eax, 6
je 0x1400027e8
cmp eax, 7
jne 0x1400027d6
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x1400027f6
cmp eax, 8
je 0x1400027e8
cmp eax, 9
jne 0x1400027f6
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x1400027f6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x1400027f6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rbx, 1
jne 0x140002780
jmp 0x1400026a0
call fcn.140006070
cmp eax, 0x228
jne 0x1400028cc
call fcn.140005fb0
test al, al
je 0x1400028d9
nop
call fcn.1400010ef
sub rdi, 1
jne 0x140002820
lea ebx, [rdi + 2]
nop
mov edx, 9
xor ecx, ecx
call fcn.140001000
mov dword [0x14005ce10], eax
mov ecx, eax
test eax, eax
jne 0x140002850
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x1400028a8
dec eax
cmp eax, 1
jbe 0x1400028a2
cmp ecx, 3
jne 0x140002864
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400028a8
cmp ecx, 4
je 0x140002892
cmp ecx, 5
jne 0x140002876
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1400028a8
cmp ecx, 6
je 0x14000289a
cmp ecx, 7
jne 0x140002888
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x1400028a8
cmp ecx, 8
je 0x14000289a
cmp ecx, 9
jne 0x1400028a8
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x1400028a8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x1400028a8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub rbx, 1
jne 0x140002830
xor r9d, r9d
lea r8, str.admin
lea rdx, str.admin
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140006070
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
call fcn.14000f500
int3