Function at 0x1800072b0
Capabilities:
Accept command line arguments
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
xor ecx, ecx
call fcn.18008616c
mov ecx, eax
call fcn.180082d64
call fcn.180082d38
and eax, 0x80000003
jge 0x1800072ea
dec eax
or eax, 0xfffffffc
inc eax
xor edi, edi
mov ebx, edi
test eax, eax
jne 0x18000741f
cmp dword [0x180107ce0], 0xdbf12718
jne 0x18000740b
mov eax, edi
xchg dword [rdi], eax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDesktopW]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov dword [rsp + 0x20], edi
lea r9, [0x18011fb80]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsNLSDefinedString]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToUnicodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DeleteMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18011fbb0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InsertMenuW]
mov rdx, qword [rbp + 0x6f]
call fcn.180001fb0
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret
cmp eax, 1
jne 0x1800074f7
mov r8d, 0x4253
nop
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180007430
mov ecx, 0x1a9a
sub ecx, r8d
mov edx, 0x9465
sub edx, ecx
add r8d, 0xffff5566
sub ecx, edx
add ecx, 0x1551
mov eax, 0x777b
add eax, ecx
cmp eax, 0xffffa8f3
jne 0x1800074eb
cmp ecx, 0xffff3178
jne 0x1800074eb
cmp r8d, 0xffff97ba
jne 0x1800074eb
cmp edx, 0xbc1f
jne 0x1800074eb
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov qword [rbp + 0x7f], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x210
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x210
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x59], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x6f]
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x59]
call fcn.1800110f0
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1800077c7
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x132
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x132
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rdi
mov ecx, 0x10
call fcn.18007cf48
mov qword [rax + 8], rdi
mov qword [rbp - 0x31], rax
lea rcx, [rbp - 0x31]
mov qword [rax], rcx
mov word [rbp - 1], bx
mov qword [rbp + 5], rdi
mov qword [rbp + 0xd], rdi
xor eax, eax
mov word [rbp + 2], ax
mov byte [rbp + 4], al
mov word [rbp + 5], ax
mov byte [rbp + 7], al
mov word [rbp + 8], ax
mov byte [rbp + 0xa], al
mov word [rbp + 0xb], ax
mov byte [rbp + 0xd], al
mov word [rbp + 0xe], ax
mov byte [rbp + 0x10], al
mov word [rbp + 0x11], ax
mov byte [rbp + 0x13], al
mov dword [rbp - 0x35], edi
mov dword [rbp - 5], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x59], xmm0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call fcn.1800141c0
mov rbx, qword [rbp - 0x41]
lea rcx, [rbp - 0x31]
call fcn.180016a10
mov rcx, qword [rbp - 0x31]
mov qword [rbp - 0x31], rdi
mov edx, 0x10
call fcn.18007ce5c
mov qword [rbp + 0x77], rbx
cmp dword [0x180107ce0], 0x3214bb04
jne 0x1800076f3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenJobObjectW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
mov dword [rbp + 0x67], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x24a
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x24a
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rdi
mov ecx, 0x10
call fcn.18007cf48
mov qword [rax + 8], rdi
mov qword [rbp - 0x31], rax
lea rcx, [rbp - 0x31]
mov qword [rax], rcx
mov word [rbp - 1], 0
mov qword [rbp + 5], rdi
mov qword [rbp + 0xd], rdi
xor eax, eax
mov word [rbp + 2], ax
mov byte [rbp + 4], al
mov word [rbp + 5], ax
mov byte [rbp + 7], al
mov word [rbp + 8], ax
mov byte [rbp + 0xa], al
mov word [rbp + 0xb], ax
mov byte [rbp + 0xd], al
mov word [rbp + 0xe], ax
mov byte [rbp + 0x10], al
mov word [rbp + 0x11], ax
mov byte [rbp + 0x13], al
mov dword [rbp - 0x35], edi
mov dword [rbp - 5], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x59], xmm0
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x67]
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call fcn.180013ff0
mov rbx, qword [rbp - 0x41]
lea rcx, [rbp - 0x31]
call fcn.180016a10
mov rcx, qword [rbp - 0x31]
mov qword [rbp - 0x31], rdi
jmp 0x180007acd
cmp eax, 3
jne 0x180007ad7
mov dword [rbp + 0x67], edi
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rax, 0x20b
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x2f], 0x20b
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rdi
mov ecx, 0x10
call fcn.18007cf48
mov qword [rax + 8], rdi
mov qword [rbp - 0x31], rax
lea rcx, [rbp - 0x31]
mov qword [rax], rcx
mov word [rbp - 1], bx
mov qword [rbp + 5], rdi
mov qword [rbp + 0xd], rdi
xor eax, eax
mov word [rbp + 2], ax
mov byte [rbp + 4], al
mov word [rbp + 5], ax
mov byte [rbp + 7], al
mov word [rbp + 8], ax
mov byte [rbp + 0xa], al
mov word [rbp + 0xb], ax
mov byte [rbp + 0xd], al
mov word [rbp + 0xe], ax
mov byte [rbp + 0x10], al
mov word [rbp + 0x11], ax
mov byte [rbp + 0x13], al
mov dword [rbp - 0x35], edi
mov dword [rbp - 5], edi
movaps xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 0x59], xmm0
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x67]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call fcn.180016160
mov rbx, qword [rbp - 0x41]
lea rcx, [rbp - 0x31]
call fcn.180016a10
mov rcx, qword [rbp - 0x31]
mov qword [rbp - 0x31], rdi
mov edx, 0x10
call fcn.18007ce5c
mov qword [rbp + 0x37], rbx
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov dword [rbp + 0x7f], 0x400
mov qword [rbp + 0x27], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x15b
mov qword [rbp - 0x59], rax
mov dword [rbp - 0x51], 0x15b
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x59], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x59]
call fcn.180011390
mov qword [rbp + 0x17], rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x2a4
mov qword [rbp - 0x59], rax
mov dword [rbp - 0x51], 0x2a4
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x59], xmm0
lea rdx, [rbp + 0x37]
lea rcx, [rbp - 0x59]
call fcn.180010580
mov rbx, rax
cmp dword [0x180107ce0], 0xc0987431
jne 0x1800079fc
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleDisplayMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18011fbe8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x67]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [rbp + 0x67], 0x8000
mov dword [rbp + 0x77], edi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
add rax, 0x1f9
mov qword [rbp - 0x59], rax
mov dword [rbp - 0x51], 0x1f9
xor eax, eax
mov word [rbp - 0x49], ax
mov byte [rbp - 0x47], al
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.18007cf48
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], 0
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x59], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call fcn.180013e20
nop
lea rcx, [rbp - 0x41]
call fcn.180016a10
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18007ce5c
mov rax, rbx
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret