Function at 0x14000f3f0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1b0
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rsi, r8
mov qword [rsp + 0x68], r8
xor edi, edi
mov dword [rsp + 0x24], edi
mov qword [rsp + 0x78], rdi
lea rcx, [rsp + 0x78]
call fcn.14002b980
nop
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
lea r8d, [rdi + 0x1e]
lea rdx, str.Sophos_ML_Engine_Validator_Log
lea rcx, [rsp + 0x48]
call fcn.140012760
nop
lea rcx, [rsp + 0x48]
call fcn.1400203b0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000f4ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f4a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd6e
call fcn.140047430
nop
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0xa0]
call fcn.14006d3c0
lea rcx, [rsp + 0xa0]
call fcn.1400106e0
nop
lea rcx, [rsp + 0x28]
call fcn.14001f780
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14000f4ea
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140016970
lea rdx, [0x1400b1ffc]
mov rcx, rax
call fcn.140014060
lea rdx, str.wWinMain
mov rcx, rax
call fcn.140014060
lea rdx, [0x1400b1fd0]
mov rcx, rax
call fcn.140013dc0
lea rdx, str.Command_line:
mov rcx, rax
call fcn.140013dc0
mov rdx, rsi
mov rcx, rax
call fcn.140013dc0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000f585
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f57f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd74
call fcn.140047430
nop
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], di
mov dword [rsp + 0x24], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rsp + 0x128]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000f5f1
mov rax, qword [rsp + 0xf8]
mov r8, qword [rax]
test r8, r8
je 0x14000f5f1
mov rax, qword [rsp + 0xd8]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0x120]
cmovb r8, qword [rsp + 0x120]
sub r8, rdx
sar r8, 1
jmp 0x14000f634
test cl, 4
jne 0x14000f62a
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000f62a
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x108]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x14000f634
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14000f644
lea rcx, [rsp + 0x28]
call fcn.140012760
nop
mov ebx, 1
mov dword [rsp + 0x24], ebx
lea edx, [rbx + 0x27]
lea rcx, [rsp + 0x28]
call fcn.14001fc60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000f69e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f698
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd7a
call fcn.140047430
nop
lea rcx, [rsp + 0xa0]
call fcn.14000e3f0
nop
jmp 0x14000f6b9
call fcn.14000eac0
test al, al
jne 0x14000f8bb
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0xa0]
call fcn.14006d3c0
lea rcx, [rsp + 0xa0]
call fcn.1400106e0
nop
lea rcx, [rsp + 0x28]
call fcn.14001f780
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14000f702
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140016970
lea rdx, [0x1400b1ffc]
mov rcx, rax
call fcn.140014060
lea rdx, str.wWinMain
mov rcx, rax
call fcn.140014060
lea rdx, [0x1400b1fd0]
mov rcx, rax
call fcn.140013dc0
lea rdx, str.Startup_failed.
mov rcx, rax
call fcn.140013dc0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000f792
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f78c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd80
call fcn.140047430
nop
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], di
or ebx, 8
mov dword [rsp + 0x24], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rsp + 0x128]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000f7fd
mov rax, qword [rsp + 0xf8]
mov r8, qword [rax]
test r8, r8
je 0x14000f7fd
mov rax, qword [rsp + 0xd8]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0x120]
cmovb r8, qword [rsp + 0x120]
sub r8, rdx
sar r8, 1
jmp 0x14000f840
test cl, 4
jne 0x14000f836
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000f836
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x108]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x14000f840
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14000f850
lea rcx, [rsp + 0x28]
call fcn.140012760
nop
mov edx, 0x28
lea rcx, [rsp + 0x28]
call fcn.14001fc60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000f8a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f89d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd86
call fcn.140047430
nop
lea rcx, [rsp + 0xa0]
call fcn.14000e3f0
nop
mov eax, 1
jmp 0x14000fd49
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x78], 1
je 0x14000fad4
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0xa0]
call fcn.14006d3c0
lea rcx, [rsp + 0xa0]
call fcn.1400106e0
nop
lea rcx, [rsp + 0x28]
call fcn.14001f780
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14000f91b
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140016970
lea rdx, [0x1400b1ffc]
mov rcx, rax
call fcn.140014060
lea rdx, str.wWinMain
mov rcx, rax
call fcn.140014060
lea rdx, [0x1400b1fd0]
mov rcx, rax
call fcn.140013dc0
lea rdx, str.Bad_command_line.
mov rcx, rax
call fcn.140013dc0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000f9ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f9a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd8c
call fcn.140047430
nop
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], di
or ebx, 0x20
mov dword [rsp + 0x24], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rsp + 0x128]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000fa16
mov rax, qword [rsp + 0xf8]
mov r8, qword [rax]
test r8, r8
je 0x14000fa16
mov rax, qword [rsp + 0xd8]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0x120]
cmovb r8, qword [rsp + 0x120]
sub r8, rdx
sar r8, 1
jmp 0x14000fa59
test cl, 4
jne 0x14000fa4f
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000fa4f
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x108]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x14000fa59
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14000fa69
lea rcx, [rsp + 0x28]
call fcn.140012760
nop
mov edx, 0x28
lea rcx, [rsp + 0x28]
call fcn.14001fc60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000fabc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fab6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd92
call fcn.140047430
nop
lea rcx, [rsp + 0xa0]
call fcn.14000e3f0
nop
mov eax, 2
jmp 0x14000fd49
mov rdx, qword [rax]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000fae0
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], di
lea rcx, [rsp + 0x80]
call fcn.140012760
or ebx, 0xc0
lea rcx, [rsp + 0x80]
call fcn.1400144c0
movzx esi, al
mov byte [rsp + 0x20], al
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0xa0]
call fcn.14006d3c0
lea rcx, [rsp + 0xa0]
call fcn.1400106e0
nop
lea rcx, [rsp + 0x28]
call fcn.14001f780
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14000fb72
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140016970
lea rdx, [0x1400b1ffc]
mov rcx, rax
call fcn.140014060
lea rdx, str.wWinMain
mov rcx, rax
call fcn.140014060
lea rdx, [0x1400b1fd0]
mov rcx, rax
call fcn.140013dc0
lea rdx, str.Validation
mov rcx, rax
call fcn.140013dc0
lea rcx, str.succeeded
lea rdx, str.failed
test sil, sil
cmovne rdx, rcx
mov rcx, rax
call fcn.140013dc0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000fc1f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd98
call fcn.140047430
nop
mov qword [rsp + 0x28], rdi
movdqa xmm0, xmmword [0x1400b4e30]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], di
bts ebx, 9
mov dword [rsp + 0x24], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rsp + 0x128]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000fc8b
mov rax, qword [rsp + 0xf8]
mov r8, qword [rax]
test r8, r8
je 0x14000fc8b
mov rax, qword [rsp + 0xd8]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0x120]
cmovb r8, qword [rsp + 0x120]
sub r8, rdx
sar r8, 1
jmp 0x14000fcce
test cl, 4
jne 0x14000fcc4
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000fcc4
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x108]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x14000fcce
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14000fcde
lea rcx, [rsp + 0x28]
call fcn.140012760
nop
mov edx, 0x28
lea rcx, [rsp + 0x28]
call fcn.14001fc60
nop
lea rcx, [rsp + 0x28]
call fcn.14000d1a0
nop
lea rcx, [rsp + 0xa0]
call fcn.14000e3f0
nop
jmp 0x14000fd10
call fcn.14004a264
lea rcx, [rax + 0x405f7e00]
call fcn.1400214d0
mov ebx, 3
test sil, sil
cmovne ebx, edi
lea rcx, [rsp + 0x80]
call fcn.14000d1a0
mov eax, ebx
jmp 0x14000fd49
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140047410
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140076d80
nop
call fcn.140076d80
int3
call fcn.140076d80
nop
call fcn.140076d80
int3
call fcn.140076d80
nop
call fcn.140076d80
int3
call fcn.140076d80
nop
call fcn.140076d80
int3