Function at 0x140048f44
Capabilities:
Accept command line arguments
Resolve path using msvcrt
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r14d, r14d
mov rsi, rdx
mov qword [0x1401fa998], r14
lea rdx, [0x1401fa990]
mov qword [0x1401fa990], r14
mov rdi, rcx
mov qword [0x1401fa9a0], r14
mov r9, qword [rcx + 0xf38]
mov rcx, rsi
call fcn.1400488d8
mov ebx, dword [rdi + 0x154]
mov r8b, 1
shr ebx, 5
mov rdx, rsi
mov rcx, rdi
and bl, 1
call fcn.140049370
cmp byte [0x1401fa4b8], r14b
jne 0x140048fdb
test bl, bl
jne 0x140048fca
cmp byte [0x1401faa78], r14b
je 0x140048fca
mov esi, 0x20
test byte [rdi + 0x154], sil
jne 0x1400a0baa
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp byte [0x1401fac71], r14b
je 0x140048fab
jmp 0x1400a0b6a
cmp byte [0x1401fcad0], r14b
jne 0x140048fab
lea r8, str.INCREMENTAL:NO
mov edx, 0x106a
mov rcx, rsi
call fcn.140124b74
mov cl, 1
call fcn.140005b0c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000510c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x1401fcad3], r14b
jne 0x1400a0bbc
cmp byte [0x1401fcad2], r14b
je 0x1400a0bc8
mov edx, 0x17bc
xor ecx, ecx
call fcn.1400eb834
mov cl, 1
call fcn.140005b0c
xor ecx, ecx
mov byte [0x1401fadc8], r14b
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov ecx, 0x30
call qword [sym.imp.tbbmalloc.dll_scalable_malloc]
mov rbx, rax
test rax, rax
je 0x1400a0d74
mov rcx, qword [0x1401fa558]
or r15, 0xffffffffffffffff
mov rdi, r15
mov rax, qword [rcx]
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x1400a0c06
add rdi, 3
lea rcx, [rdi + rdi]
call qword [sym.imp.tbbmalloc.dll_scalable_malloc]
mov rbp, rax
test rax, rax
je 0x1400a0d74
mov r9, qword [0x1401fa558]
lea r8, [0x1401a1388]
mov rdx, rdi
mov rcx, rax
mov r9, qword [r9]
call fcn.140005090
mov qword [rbx], rbp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8d, 0x22
mov rcx, rax
movzx edx, word [rax]
cmp dx, r8w
jne 0x1400a0c6c
movzx esi, r8w
add rcx, 2
movzx edx, word [rcx]
cmp dx, si
jne 0x1400a0c65
cmp dx, r8w
mov qword [rbx + 0x20], r14
lea rax, [rcx + 2]
cmovne rax, rcx
add rax, 2
mov qword [rbx + 8], rax
lea rax, str._INFERASANLIBS
mov qword [rbx + 0x10], rax
lea rax, str._nologo
mov qword [rbx + 0x18], rax
cmp byte [0x1401fcad2], r14b
je 0x1400a0cc6
call fcn.14000775c
lea rdx, [0x1401cb028]
mov ecx, 0x2347
call fcn.14000761c
mov rcx, rbx
call fcn.1401320c4
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r15
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call fcn.140005adc
cmp byte [0x1401fa4b8], r14b
je 0x1400a0d02
mov rcx, qword [0x1401fa4f0]
test rcx, rcx
je 0x1400a0d02
call fcn.1400ba5e4
call fcn.140005c4c
call fcn.140042888
mov rcx, rax
call fcn.140005f1c
lea rcx, [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__get_wpgmptr]
test eax, eax
je 0x1400a0d2b
xor ecx, ecx
call fcn.14005e418
int3
mov rdi, qword [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov rdx, rdi
mov r8, rbx
call fcn.1400052dc
cmp byte [rsp + 0x60], r14b
jne 0x1400a0d57
mov r8, rdi
mov edx, 0x486
xor ecx, ecx
call fcn.14005e3e8
int3
mov rcx, rbx
call qword [sym.imp.tbbmalloc.dll_scalable_free]
mov rcx, rbp
call qword [sym.imp.tbbmalloc.dll_scalable_free]
mov ecx, dword [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x44e
xor ecx, ecx
call fcn.14005e3e8
int3