Function at 0x140004480
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rbx
push rdi
push r12
lea rbp, [rsp - 0x638]
sub rsp, 0x738
mov rax, qword [0x1400391d8]
xor rax, rsp
mov qword [rbp + 0x620], rax
mov ecx, 0xffffffff
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x140004519
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, 0xffffffffffffffff
je 0x140004519
mov edx, 0x4000
mov rcx, rax
call fcn.140018268
cmp eax, 0xffffffff
je 0x140004519
lea rdx, [0x140035a3c]
mov ecx, eax
call fcn.14001871c
test rax, rax
je 0x140004519
mov rbx, qword [rax]
mov ecx, 1
call fcn.140018850
mov ecx, 1
mov qword [rax], rbx
call fcn.140018850
xor r9d, r9d
mov rcx, rax
xor edx, edx
lea r8d, [r9 + 4]
call fcn.140018a08
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r12, rax
test rax, rax
jne 0x140004539
mov eax, 0x1b63
jmp 0x14000480d
xor edx, edx
mov qword [rsp + 0x760], rsi
xorps xmm0, xmm0
mov edi, edx
mov esi, edx
mov qword [rsp + 0x48], rdx
movdqu xmmword [rsp + 0x38], xmm0
mov rcx, qword [rsp + 0x40]
cmp dword [rsp + 0x30], edx
jle 0x1400045a1
mov rbx, r12
cmp rcx, rdi
je 0x140004579
mov rax, qword [rbx]
mov qword [rcx], rax
add rcx, 8
mov qword [rsp + 0x40], rcx
jmp 0x140004593
mov rdx, rcx
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.140004830
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
inc esi
add rbx, 8
cmp esi, dword [rsp + 0x30]
jl 0x140004563
xor edx, edx
mov rsi, qword [rsp + 0x38]
sub rcx, rsi
sar rcx, 3
cmp ecx, 3
je 0x1400045bc
mov ebx, 0x1b62
jmp 0x1400047c2
mov rax, qword [rsi + 8]
mov qword [rsp + 0x768], r13
mov r13, qword [rsi]
mov qword [rsp + 0x778], r14
mov r14, qword [rsi + 0x10]
mov qword [rsp + 0x60], rax
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x730], r15
nop dword [rax + rax]
cmp word [r14 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400045f0
cmp word [r14 + rax*2 - 2], 0x5c
jne 0x14000460c
mov word [r14 + rax*2 - 2], dx
lea rcx, [rsp + 0x70]
call fcn.140001960
mov rdx, r13
lea rcx, str.ImportCertificate
call fcn.14000c10c
test eax, eax
lea rcx, str.DeleteCertificate
mov rdx, r13
mov ebx, eax
sete r15b
call fcn.14000c10c
test eax, eax
sete al
test ebx, ebx
je 0x1400046b6
test al, al
jne 0x1400046b6
lea rax, vtable.CBrowserCertInstallerArray.0
lea r14, vtable.CMozilla.0
mov qword [rsp + 0x70], rax
lea rcx, [rbp + 0x4f0]
mov qword [rbp + 0x2d8], r14
call fcn.140002980
lea r15, vtable.IBrowserCertificate.0
mov qword [rbp - 0x68], r14
lea rcx, [rbp + 0x1b0]
mov qword [rbp + 0x2d8], r15
call fcn.140002980
mov rcx, qword [rsp + 0x78]
lea rax, vtable.CArray_class_IBrowserCertificate____ptr64__class_IBrowserCertificate__const___ptr64_const____ptr64_.0
mov qword [rbp - 0x68], r15
mov qword [rsp + 0x70], rax
test rcx, rcx
je 0x1400046ac
call fcn.140005fc4
mov ebx, 0x1b62
jmp 0x1400047aa
mov rcx, qword [rsp + 0x60]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.140011424
xor r13d, r13d
mov ebx, eax
mov qword [rsp + 0x38], r13
lea rax, str.ESET_SSL_Filter_CA
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
test r15b, r15b
je 0x1400046f9
lea rcx, [rsp + 0x38]
call fcn.140001fb0
test al, al
je 0x14000471c
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], r14
mov r8d, ebx
lea rcx, [rsp + 0x70]
movzx edx, r15b
call fcn.140001cd0
test al, al
je 0x14000471c
mov al, 1
jmp 0x14000471e
xor al, al
mov rcx, qword [rsp + 0x38]
test al, al
mov ebx, 0x1b65
cmovne ebx, r13d
test rcx, rcx
je 0x140004738
call fcn.14000c28c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140004747
call fcn.14000c28c
lea rax, vtable.CBrowserCertInstallerArray.0
lea r14, vtable.CMozilla.0
mov qword [rsp + 0x70], rax
lea rcx, [rbp + 0x4f0]
mov qword [rbp + 0x2d8], r14
call fcn.140002980
lea r15, vtable.IBrowserCertificate.0
mov qword [rbp - 0x68], r14
lea rcx, [rbp + 0x1b0]
mov qword [rbp + 0x2d8], r15
call fcn.140002980
mov rcx, qword [rsp + 0x78]
lea rax, vtable.CArray_class_IBrowserCertificate____ptr64__class_IBrowserCertificate__const___ptr64_const____ptr64_.0
mov qword [rbp - 0x68], r15
mov qword [rsp + 0x70], rax
test rcx, rcx
je 0x1400047aa
call fcn.140005fc4
mov r14, qword [rsp + 0x778]
mov r13, qword [rsp + 0x768]
mov r15, qword [rsp + 0x730]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x140004803
sub rdi, rsi
mov rax, rsi
and rdi, 0xfffffffffffffff8
cmp rdi, 0x1000
jb 0x1400047f8
mov rsi, qword [rsi - 8]
add rdi, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004829
mov rdx, rdi
mov rcx, rsi
call fcn.140005fc4
mov rsi, qword [rsp + 0x760]
mov eax, ebx
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.140005fa0
add rsp, 0x738
pop r12
pop rdi
pop rbx
pop rbp
ret
call fcn.14000becc
int3