Function at 0x140002070
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push rdi
sub rsp, 0x140
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rsp + 0x150], rsi
mov rax, qword [0x14000b0f8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x1400020ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WinMain
lea rcx, str._s:_CommandLineToArgvW_error_0x_lx._n
call entry0
lea eax, [rsi + 2]
jmp 0x1400026e8
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.140001660
nop
mov eax, dword [rsp + 0x30]
add eax, 0xfffffffe
cmp eax, 1
ja 0x1400026c8
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x1400021a5
xor edi, edi
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
xor r8d, r8d
lea rdx, [0x140006ee8]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_unsigned_long_long_unsigned___int64____cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const____ptr64__unsigned_long_long_unsigned___int64__const___ptr64]
mov rcx, qword [sym.imp.MSVCP90.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
cmp qword [rcx], rax
jne 0x14000222b
mov ecx, 0x3f1
call fcn.140001420
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
cmp byte [rsp + 0x38], dil
jne 0x14000219b
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x40]
mov eax, 2
jmp 0x1400026e8
cmp eax, 3
jne 0x140002227
mov rdx, qword [rsi + 0x10]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov r11, qword [rsi + 8]
lea rsi, str.__file
mov rdi, r11
mov ecx, 7
repe cmpsw word [rsi], word [rdi]
jne 0x1400021db
mov edi, 1
jmp 0x14000222b
lea rsi, str.__url
mov rdi, r11
mov ecx, 6
repe cmpsw word [rsi], word [rdi]
jne 0x1400021f3
xor edi, edi
jmp 0x14000222b
mov ecx, 0x3f1
call fcn.140001420
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
cmp byte [rsp + 0x38], 0
jne 0x14000221d
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x40]
mov eax, 2
jmp 0x1400026e8
mov edi, dword [rsp + 0x30]
call sub.vmtools.dll_VmCheck_IsVirtualWorld
test al, al
jne 0x1400024f4
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
test edi, edi
je 0x1400022b3
cmp edi, 1
jne 0x140002300
mov rax, qword [sym.imp.MSVCP90.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
mov rdi, qword [rax]
mov edx, 0x2e
mov r8, rdi
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_unsigned_long_long_unsigned___int64____cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::rfind_wchar_t__unsigned_long_long_unsigned___int64__const___ptr64]
mov r8, rax
mov r9, rdi
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140002300
mov edx, 0x3a
xor r8d, r8d
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_unsigned_long_long_unsigned___int64____cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t__unsigned_long_long_unsigned___int64__const___ptr64]
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
cmp qword [rsp + 0xf8], 0
jne 0x140002371
lea r8, [rsp + 0xe8]
cmp qword [rsp + 0x100], 8
cmovae r8, qword [rsp + 0xe8]
lea rdx, str.WinMain
lea rcx, str._s:_Couldnt_determine_file_type_for___s_._n
call entry0
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
cmp byte [rsp + 0x38], 0
jne 0x140002367
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x40]
mov eax, 2
jmp 0x1400026e8
lea rcx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 8
cmovae rcx, qword [rsp + 0xe8]
mov r8d, 1
or rdx, 0xffffffffffffffff
call sub.vmtools.dll_Unicode_AllocWithLength
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400023f3
lea rdx, str.WinMain
lea rcx, str._s:_Failed_to_encode_file_type_as_UTF8._n
call entry0
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
cmp byte [rsp + 0x38], dil
jne 0x1400023e9
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x40]
mov eax, 2
jmp 0x1400026e8
lea rax, [sub.vmtools.dll_Unicode_Free]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x108]
call fcn.140001660
nop
mov rcx, rdi
call fcn.140002810
test al, al
jne 0x140002489
lea rdx, str.WinMain
lea rcx, str._s:_Failed_to_restore_handler_for_file_type._n
call entry0
nop
cmp byte [rsp + 0x108], 0
jne 0x140002451
mov rcx, qword [rsp + 0x118]
call qword [rsp + 0x110]
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
cmp byte [rsp + 0x38], 0
jne 0x14000247f
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x40]
mov eax, 2
jmp 0x1400026e8
lea r8, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae r8, qword [rsp + 0xc0]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp byte [rsp + 0x108], 0
jne 0x1400024e1
mov rcx, qword [rsp + 0x118]
call qword [rsp + 0x110]
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x1400026a5
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
cmp edi, 1
jne 0x14000262b
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x60]
call fcn.1400018f0
nop
mov rdx, rax
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
cmp qword [rsp + 0xf8], 0
jne 0x140002645
lea rcx, [rsp + 0xb8]
call fcn.1400012c0
test al, al
je 0x1400025c3
lea rcx, [rsp + 0x108]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0xb8]
call fcn.140001ca0
test al, al
je 0x1400025b5
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x60]
call fcn.1400018f0
nop
mov rdx, rax
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x108]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
cmp qword [rsp + 0xf8], 0
jne 0x140002645
lea rdx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae rdx, qword [rsp + 0xc0]
mov ecx, 0x3ee
call fcn.140001420
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
cmp byte [rsp + 0x38], 0
jne 0x140002621
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x40]
mov eax, 2
jmp 0x1400026e8
test edi, edi
jne 0x140002645
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64]
lea rcx, [rsp + 0xe0]
call fcn.140001a80
test al, al
jne 0x140002696
mov ecx, 0x3ec
call fcn.140001420
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
cmp byte [rsp + 0x38], 0
jne 0x14000268f
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x40]
mov eax, 2
jmp 0x1400026e8
lea rcx, [rsp + 0xe0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
cmp byte [rsp + 0x38], 0
jne 0x1400026c4
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x40]
xor eax, eax
jmp 0x1400026e8
mov ecx, 0x3f1
call fcn.140001420
nop
cmp byte [rsp + 0x38], 0
jne 0x1400026e3
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x40]
mov eax, 2
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400047a0
mov rsi, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret