Function at 0x100001648
Capabilities:
Accept command line arguments
Get token membership
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x100004110]
xor rax, rsp
mov qword [rsp + 0xb8], rax
xor ebx, ebx
mov qword [r11 - 0x60], rbx
mov dword [rsp + 0x6c], ebx
xor r9d, r9d
xor r8d, r8d
lea edi, [rbx + 1]
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov esi, ebx
lea rcx, [rsp + 0x98]
call fcn.100001b20
cmp eax, ebx
je 0x10000178b
mov eax, dword [0x1000046f0]
add eax, edi
mov dword [0x1000046f0], eax
cmp eax, edi
jne 0x1000016fb
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [0x100004790], rax
cmp rax, rbx
je 0x100001702
mov dword [0x100004788], edi
xor ecx, ecx
call fcn.100001ce0
mov ecx, dword [0x1000046f4]
cmp eax, ebx
cmovne ecx, edi
mov dword [0x1000046f4], ecx
mov rax, qword [0x100004790]
jmp 0x100001702
mov rax, qword [0x100004790]
cmp esi, ebx
je 0x100001732
cmp dword [0x1000046f4], ebx
jne 0x100001732
mov r8, qword [0x1000046f8]
cmp r8, rbx
je 0x10000172c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [0x1000046f8], rbx
mov dword [0x100004788], ebx
lea rax, [rsp + 0x98]
lock cmpxchg qword [0x100004708], rbx
lea rcx, [rsp + 0x98]
cmp rax, rcx
je 0x10000178b
mov rcx, qword [rsp + 0xa8]
cmp rcx, rbx
jne 0x10000177e
mov rcx, qword [rax + 8]
mov qword [rcx + 0x10], rax
mov rax, qword [rax + 8]
lea rcx, [rsp + 0x98]
cmp rax, rcx
jne 0x10000175d
mov rcx, qword [rsp + 0xa8]
mov qword [rcx + 8], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [rsp + 0xb0], bl
mov byte [rsp + 0xb1], bl
mov byte [rsp + 0xb2], bl
mov byte [rsp + 0xb3], bl
mov byte [rsp + 0xb4], bl
mov byte [rsp + 0xb5], 5
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x64], eax
cmp eax, ebx
je 0x100001829
lea r8, [rsp + 0x64]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x64]
mov dword [rsp + 0x64], ecx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x64]
cmp eax, ebx
jne 0x10000183a
mov dword [rsp + 0x60], 5
jmp 0x10000195b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp rax, rbx
jne 0x100001852
mov dword [rsp + 0x60], 0x57
jmp 0x10000195b
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
cmp dword [rsp + 0x68], 2
jge 0x100001877
mov dword [rsp + 0x60], 0x57
jmp 0x10000195b
cmp dword [rsp + 0x68], 3
jge 0x10000188b
mov dword [rsp + 0x60], 0x57
jmp 0x10000195b
lea r8, [rsp + 0x78]
lea rdx, [0x1000012a0]
mov rcx, qword [rax + 8]
call qword [sym.imp.msvcrt.dll_swscanf]
cmp eax, edi
je 0x1000018b2
mov dword [rsp + 0x60], 0x57
jmp 0x10000195b
cmp dword [rsp + 0x68], 4
jl 0x1000018dd
lea r8, [rsp + 0x6c]
lea rdx, [0x1000012a0]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.msvcrt.dll_swscanf]
cmp eax, edi
je 0x1000018dd
mov dword [rsp + 0x60], 0x57
jmp 0x10000195b
mov r13d, dword [rsp + 0x6c]
mov r14, qword [rsi + 0x10]
mov r15, qword [rsp + 0x78]
mov esi, ebx
lea rcx, [0x100001270]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
cmp rax, rbx
jne 0x10000190c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x100001936
lea rdx, [0x100001288]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
jne 0x10000192b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x100001936
mov r8d, r13d
mov rdx, r14
mov rcx, r15
call rax
cmp r12, rbx
je 0x100001944
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rsp + 0x60], esi
jmp 0x10000195b
cmp dword [0x1000046f4], ebx
je 0x100001a66
lea rcx, [rsp + 0x80]
call fcn.100001b20
cmp eax, ebx
je 0x100001a66
sub dword [0x1000046f0], edi
jne 0x100001a0d
cmp dword [0x100004700], ebx
je 0x1000019df
call fcn.100001de8
mov r8, qword [0x100004738]
cmp r8, rbx
je 0x1000019b7
xor edx, edx
mov rcx, qword [0x100004790]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [0x100004738], rbx
mov r8, qword [0x100004768]
cmp r8, rbx
je 0x1000019d9
xor edx, edx
mov rcx, qword [0x100004790]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [0x100004768], rbx
mov dword [0x100004700], ebx
mov r8, qword [0x1000046f8]
cmp r8, rbx
je 0x100001a01
xor edx, edx
mov rcx, qword [0x100004790]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [0x1000046f8], rbx
mov dword [0x100004788], ebx
mov dword [0x1000046f4], ebx
lea rax, [rsp + 0x80]
lock cmpxchg qword [0x100004708], rbx
lea rcx, [rsp + 0x80]
cmp rax, rcx
je 0x100001a66
mov rcx, qword [rsp + 0x90]
cmp rcx, rbx
jne 0x100001a59
mov rcx, qword [rax + 8]
mov qword [rcx + 0x10], rax
mov rax, qword [rax + 8]
lea rcx, [rsp + 0x80]
cmp rax, rcx
jne 0x100001a38
mov rcx, qword [rsp + 0x90]
mov qword [rcx + 8], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ExitProcess]