Function at 0x14003ab3c
Capabilities:
Accept command line arguments
Get common file path
Get hostname
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x1400e5430]
xor rax, rsp
mov qword [rbp + 0x460], rax
xor r15d, r15d
mov r14, r8
mov rdi, rdx
cmp word [0x1400e9280], r15w
mov rsi, rcx
lea rbx, [0x1400b7344]
je 0x14003abcd
lea rcx, str.Application:
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str.Application:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [0x1400e9280]
mov rcx, rdi
call fcn.14003d56c
mov rcx, rbx
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
cmp word [0x1400e9490], r15w
je 0x14003ac20
lea rcx, str.Version:
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str.Version:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [0x1400e9490]
mov rcx, rdi
call fcn.14003d56c
mov rcx, rbx
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x30], shutdown
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x14003ac81
lea rcx, str.Computer:
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str.Computer:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.14003d56c
mov rcx, rbx
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rcx, [rsp + 0x50]
mov edx, 0x400
mov r8d, 1
call fcn.14002cd54
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
call qword [rax]
lea rcx, [rsp + 0x38]
call fcn.14003a8cc
cmp qword [rsp + 0x70], r15
je 0x14003ad20
lea rcx, [rbp - 0x68]
xor r8d, r8d
xor edx, edx
call fcn.140032f70
lea rcx, str.IP_Address:
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str.IP_Address:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rbx
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x40]
mov dword [rsp + 0x30], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14003ad81
lea rcx, str.User:
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str.User:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rbp + 0x40]
mov rcx, rdi
call fcn.14003d56c
mov rcx, rbx
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rbp - 0x40]
mov r8d, 0x40
mov rcx, rsi
call fcn.14003aa5c
lea rcx, str.Date:
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str.Date:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.14003d56c
lea r12, str._________________________________________r_n
cmp qword [rsi + 0x18], r15
je 0x14003ae12
lea rcx, str._r_n_r_nError_Reason:_r_n
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nError_Reason:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.14003a21c
mov rax, qword [0x1400e5100]
cmp qword [rax + 8], r15
je 0x14003ae6c
lea rcx, str._r_n_r_nUser_Message:_r_n
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nUser_Message:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rdx, qword [0x1400e5100]
mov rcx, rdi
add rdx, 0x10
call fcn.14003d56c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003ae7d
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14003a284
cmp qword [rsp + 0x70], r15
je 0x14003aee8
lea rcx, [rbp - 0x68]
xor r8d, r8d
xor edx, edx
call fcn.140032f70
lea rcx, str._r_n_r_nSystem_Error:_r_n
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nSystem_Error:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003aef9
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14003a338
cmp qword [rsp + 0x70], r15
je 0x14003af64
lea rcx, [rbp - 0x68]
xor r8d, r8d
xor edx, edx
call fcn.140032f70
lea rcx, str._r_n_r_nCOM_Error:_r_n
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nCOM_Error:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x20]
cmp qword [rsi + 0x18], r15
je 0x14003afaf
lea rcx, str._r_n_r_nRegisters:_r_n
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nRegisters:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.14003a1c0
lea rcx, str._r_n_r_nCPU:_r_n
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nCPU:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, rdi
call fcn.14003a51c
lea rcx, str._r_n_r_nOperating_System:_r_n
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nOperating_System:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, rdi
call fcn.14003a570
lea rcx, str._r_n_r_nMemory_Usage:_r_n
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nMemory_Usage:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, rdi
call fcn.14003a5cc
mov rcx, rbx
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
cmp qword [rsi + 0x18], r15
je 0x14003b0b7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str.Interrupted_Thread
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov r8d, eax
mov rdx, rdi
call fcn.14003820c
test r14, r14
je 0x14003b0ca
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140038d2c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, str.Command_Line:_r_n
mov rbx, rax
call fcn.140081770
mov rcx, qword [rdi + 8]
mov r9, qword [rcx]
lea rdx, str.Command_Line:_r_n
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rdx, rbx
mov rcx, rdi
call fcn.14003d56c
lea rdx, [rbp + 0x250]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14003b177
lea rcx, str._r_n_r_nCurrent_Directory:_r_n
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nCurrent_Directory:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rbp + 0x250]
mov rcx, rdi
call fcn.14003d56c
lea rcx, str._r_n_r_nEnvironment_Variables:_r_n
call fcn.140081770
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nEnvironment_Variables:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call fcn.140081770
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, rdi
call fcn.14003a628
test r14, r14
je 0x14003b1cc
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140039410
lea rax, [0x1400b4f60]
mov qword [rsp + 0x50], rax
lea rax, [0x1400b4f78]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
movsxd rcx, dword [rax + 4]
lea rax, [0x1400b4fa0]
mov qword [rsp + rcx + 0x58], rax
mov rax, qword [rsp + 0x58]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x40]
mov dword [rsp + rcx + 0x54], edx
mov rcx, qword [rbp - 0x78]
call fcn.14007efdc
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.14007e1c0
add rsp, 0x570
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret