Function at 0x140001c90
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xcc8
xor r9d, r9d
mov word [rcx], r9w
movzx eax, word [rdx]
mov r15, rcx
mov rsi, r8
test ax, ax
je 0x140001da1
lea rcx, [rsp + 0x40]
lea rdi, [rdx + 2]
xor edx, edx
mov qword [rsp + 0x28], rcx
jmp 0x140001cf0
test rdx, rdx
je 0x140001d80
mov word [rdx], ax
add rdx, 2
movzx eax, word [rdi]
add rdi, 2
test ax, ax
je 0x140001da1
cmp ax, 0x25
jne 0x140001cd0
test rdx, rdx
je 0x140001db0
xor ecx, ecx
lea r14, [rsp + 0x4c0]
mov word [rdx], cx
lea rdx, str.TEMP
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140001fbb
lea rdx, str.PROGRAM
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140001fcf
lea rdx, [0x14000c0c2]
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140001ee0
lea rdx, str.TIME
mov rcx, r14
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140001dc9
xor eax, eax
add rsp, 0xcc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rsi, rsi
je 0x140001d64
mov word [r15], ax
movzx eax, word [rdi]
sub rsi, 1
add r15, 2
add rdi, 2
test ax, ax
jne 0x140001cf0
xor eax, eax
mov word [r15], ax
mov eax, 1
jmp 0x140001d66
xor r8d, r8d
lea rdx, [rsp + 0x4c0]
mov word [rsp + 0x4c0], r8w
jmp 0x140001ce0
lea rcx, [rsp + 0x38]
lea rbx, [rsp + 0xc0]
mov rbp, rsi
mov r14, r15
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r9, qword [rsp + 0x38]
mov edx, 0x400
mov rcx, rbx
lea r8, str._lld
call fcn.1400017e0
movzx eax, word [r15]
test ax, ax
je 0x140001e1f
nop dword [rax]
add r14, 2
sub rbp, 1
cmp word [r14], 0
jne 0x140001e10
movzx r13d, byte [rsp + 0xc0]
xor ecx, ecx
mov r9, rbx
add rbp, rbx
test r13b, r13b
je 0x140001eb4
nop dword [rax]
mov rax, rbp
mov rbx, r14
sub rax, r9
test cx, cx
je 0x140001e5e
nop word cs:[rax + rax]
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140001e50
mov qword [rsp + 0x20], r9
test rax, rax
je 0x1400099aa
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov rdx, qword [rsp + 0x28]
mov r8d, 2
mov byte [rsp + 0x40], r13b
lea rcx, [rbx + rax*2]
mov byte [rsp + 0x41], 0
call sub.msvcrt.dll_mbstowcs
mov r9, qword [rsp + 0x20]
movzx r13d, byte [r9 + 1]
add r9, 1
test r13b, r13b
je 0x140001eb0
movzx ecx, word [r14]
jmp 0x140001e38
movzx eax, word [r15]
test ax, ax
je 0x140001ecf
nop dword [rax]
add r15, 2
sub rsi, 1
cmp word [r15], 0
jne 0x140001ec0
xor edx, edx
jmp 0x140001ce0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x28]
mov rbp, rsi
mov r14, r15
mov r9d, eax
lea r8, [0x14000c0ca]
mov edx, pe_nt_image_headers64
call fcn.1400017e0
movzx eax, word [r15]
test ax, ax
je 0x140001f1f
nop
add r14, 2
sub rbp, 1
cmp word [r14], 0
jne 0x140001f10
mov rdx, qword [rsp + 0x28]
movzx r13d, byte [rsp + 0x40]
xor ecx, ecx
mov r12, rdx
add rbp, rdx
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x20], rdx
test r13b, r13b
je 0x140001eb4
nop dword [rax + rax]
mov rax, rbp
mov rbx, r14
sub rax, r12
test cx, cx
je 0x140001f6e
nop
add rbx, 2
sub rax, 1
cmp word [rbx], 0
jne 0x140001f60
test rax, rax
je 0x1400099aa
mov rcx, rbx
add r12, 1
call sub.msvcrt.dll_wcslen
mov rdx, qword [rsp + 0x20]
mov r8d, 2
mov byte [rsp + 0xc0], r13b
lea rcx, [rbx + rax*2]
mov byte [rsp + 0xc1], 0
call sub.msvcrt.dll_mbstowcs
movzx r13d, byte [r12]
test r13b, r13b
je 0x140001eb0
movzx ecx, word [r14]
jmp 0x140001f50
mov rdx, r15
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
movzx eax, word [r15]
jmp 0x140001eb4
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x34]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp word [r15], 0
mov rdx, rsi
mov rcx, qword [rax]
mov rax, r15
je 0x140002006
nop dword [rax + rax]
add rax, 2
sub rdx, 1
cmp word [rax], 0
jne 0x140001ff8
movzx r8d, word [rcx]
test r8w, r8w
je 0x140002043
test rdx, rdx
jne 0x140002029
jmp 0x140002051
test rdx, rdx
je 0x1400099aa
add rcx, 2
mov word [rax], r8w
add rax, 2
sub rdx, 1
movzx r8d, word [rcx]
test r8w, r8w
jne 0x140002020
xor edx, edx
mov word [rax], dx
movzx eax, word [r15]
jmp 0x140001eb4
jmp 0x1400099aa
call sub.msvcrt.dll_abort
nop