Function at 0x1400321c8
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
xor r12d, r12d
mov r13, rax
cmp dword [0x14005a77c], r12d
jne 0x140032516
lea eax, [r12 + 1]
mov dword [0x14005a77c], eax
test r13, r13
je 0x140032516
and dword [rsp + 0x68], r12d
lea rdx, [rsp + 0x68]
mov rcx, r13
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140032516
and dword [rsp + 0x70], r12d
cmp dword [rsp + 0x68], r12d
jle 0x140032507
mov rsi, rax
mov rcx, qword [rsi]
lea rdx, str._RunOnce:
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x1400322ae
lea rdx, str._prefetch
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x1400324ea
lea rdx, str._prefetch:1
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x1400324ea
and dword [rdi + 0x68], 0
jmp 0x140032516
mov rcx, qword [rsi]
lea rdx, str._NoService
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x1400322a5
mov rcx, qword [rsi]
lea rdx, str._DefaultService
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x14003247c
mov rcx, qword [rsi]
lea rdx, str._DownloadService
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x14003247c
mov rcx, qword [rsi]
lea rdx, str._ServiceInfo
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
mov rcx, qword [rsi]
test rax, rax
je 0x140032438
mov edx, 0x3a
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x1400324ea
lea r15, [rax + 2]
mov rcx, r15
call fcn.14001ab20
test eax, eax
je 0x1400324ea
mov rdx, r12
mov rcx, rdi
xor ebp, ebp
call fcn.14002ff90
mov rbx, rax
test rax, rax
jne 0x14003238f
mov ecx, 0x140
call fcn.140001460
test rax, rax
je 0x140032388
mov rcx, rax
call fcn.14002dcac
mov rbx, rax
jmp 0x14003238a
xor ebx, ebx
mov ebp, 1
and dword [rdi + 0x68], 0
test rbx, rbx
je 0x1400324ea
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14002f880
mov r15d, eax
test eax, eax
js 0x140032402
xor edx, edx
mov rcx, rbx
call fcn.140031f10
test eax, eax
je 0x140032402
mov rdx, rbx
mov rcx, rdi
call fcn.14002e28c
mov r15d, eax
test eax, eax
js 0x1400323dd
xor ebp, ebp
mov rcx, rdi
call fcn.140032fb4
jmp 0x1400323f4
test ebp, ebp
jne 0x1400323f4
mov rdx, rbx
mov rcx, rdi
call fcn.140032534
lea ecx, [rbp + 1]
cmp eax, ecx
cmove ebp, ecx
mov ecx, 4
lea rdx, str.__Service_added_from_command_line:_0x_x._r_n
jmp 0x14003240e
mov ecx, 2
lea rdx, str.__Specified_service_is_not_valid:_0x_x._r_n
mov r8d, r15d
call fcn.140019b1c
test ebp, ebp
je 0x1400324ea
mov rcx, rbx
call fcn.14002dde0
mov edx, 0x140
mov rcx, rbx
call fcn.140001818
jmp 0x1400324ea
lea rdx, str._ServiceExtra
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x1400324ea
mov rcx, qword [rsi]
mov edx, 0x3a
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x1400324ea
lea rdx, [rax + 2]
lea rcx, [rdi + 0x40]
call fcn.14001e0f8
jmp 0x1400324ea
mov rcx, qword [rsi]
mov edx, 0x3a
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x1400324ea
add r12, 2
mov rcx, rdi
mov rdx, r12
call fcn.140032e18
lea rcx, [rdi + 0x20]
mov rdx, r12
call fcn.14001e0f8
mov rcx, qword [rsi]
lea rdx, str._DownloadService
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x1400324d6
mov eax, 1
mov dword [rdi + 0x6c], eax
mov r8, r12
lea rdx, str.__Command_line_specified_default_service_is:__S._r_n
mov ecx, 3
call fcn.140019b1c
mov eax, dword [rsp + 0x70]
add rsi, 8
inc eax
mov dword [rsp + 0x70], eax
cmp eax, dword [rsp + 0x68]
jl 0x14003224c
mov rax, qword [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret