Function at 0x140001130
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Resume thread
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xff0]
mov eax, 0x10f0
call fcn.14000a210
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xfe0], rax
mov r14, rdx
mov ebx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x1000
mov rdi, rax
call fcn.140004010
lea r8d, [rsi + 0x68]
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140004010
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
cmp ebx, 1
jg 0x140001231
lea rcx, str.jailbreak64___Launches_other_applications_and_hooks_function_calls_n
call fcn.140001858
lea rcx, str.____________to_allow_for_the_export_of_non_exportable_certificates._n
call fcn.140001858
lea rcx, str._c__2014_iSEC_Partners_n
call fcn.140001858
lea rcx, str.____________________________________________________________________n
call fcn.140001858
lea rcx, str.Usage:_n
call fcn.140001858
lea rcx, str._jailbreak64__program___options__n_n
call fcn.140001858
lea rcx, str.Example:_n_n
call fcn.140001858
lea rcx, str.jailbreak64_c:windows_system32mmc.exe_c:windows_system32certmgr.msc__32_n
call fcn.140001858
lea rcx, str.___Launches_the_Certificate_Manager_and_allows_it_to_export_non_exportable_n
call fcn.140001858
lea rcx, str.___certificates._n
call fcn.140001858
or rax, 0xffffffffffffffff
jmp 0x140001565
xor r9d, r9d
mov qword [rsp + 0x30], rsi
lea rcx, str.jailbreak.log
lea r8d, [r9 + 3]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x1130], r15
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, qword [r14 + 8]
mov rcx, rdi
mov r15, rax
mov rdx, rbx
call fcn.140001644
mov r14, rax
test rax, rax
jne 0x14000129c
lea rcx, str.Could_not_find_first_argument___S__in_command_line___S__n
mov r8, rdi
mov rdx, rbx
call fcn.140001858
or rax, 0xffffffffffffffff
jmp 0x14000155d
movzx ecx, word [rax - 2]
mov qword [rsp + 0x1120], r12
cmp cx, 0x22
je 0x1400012b4
cmp cx, 0x27
jne 0x1400012b8
lea r14, [rax - 2]
or rdi, 0xffffffffffffffff
mov rbx, rdi
nop
inc rbx
cmp word [r14 + rbx*2], si
jne 0x1400012c0
mov rcx, rbx
mov edx, 2
add rcx, 1
cmovb rcx, rdi
call fcn.140001600
mov r12, rax
test rax, rax
jne 0x1400012fa
lea rcx, str.Failed_to_allocate_memory_n
call fcn.140001858
mov eax, edi
jmp 0x140001555
lea rdx, [rbx + 1]
mov r8, r14
mov rcx, rax
call fcn.140001000
cmp r15, 0xffffffffffffffff
je 0x140001406
mov dword [rsp + 0x6c], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, str._r_n__d_:__S_r_n
mov r9d, eax
lea rax, str.jailbreak64
lea rcx, [rbp - 0x20]
mov edx, 0x800
mov qword [rsp + 0x20], rax
call fcn.1400010a0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rcx, [rbp - 0x20]
mov rax, rdi
nop dword [rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140001360
lea r8d, [rax + rax]
lea r9, [rsp + 0x6c]
lea rdx, [rbp - 0x20]
mov rcx, r15
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400013ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_write_to_jailbreak.log_no_logging_will_be_performed.___d__n
mov edx, eax
call fcn.140001858
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, rdi
jmp 0x140001406
mov dword [rsp + 0x68], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, str.__d_:_Launching_new_process___s_r_n
lea rcx, [rbp - 0x20]
mov edx, 0x800
mov r9d, eax
mov qword [rsp + 0x20], r12
call fcn.1400010a0
lea rcx, [rbp - 0x20]
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x1400013e0
lea r8d, [rax + rax]
lea r9, [rsp + 0x68]
lea rdx, [rbp - 0x20]
mov rcx, r15
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000146f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProces_failed_with_error_code___d_n
mov edx, eax
call fcn.140001858
lea rcx, str.Command_line___S_n
mov rdx, r12
call fcn.140001858
mov eax, edi
jmp 0x140001555
cmp r15, 0xffffffffffffffff
je 0x1400014d6
mov dword [rsp + 0x68], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, str.__d_:_Injecting_hook_library_to_process__d_r_n
mov r9d, eax
mov eax, dword [rsp + 0x60]
lea rcx, [rbp - 0x20]
mov edx, 0x800
mov dword [rsp + 0x20], eax
call fcn.1400010a0
lea rcx, [rbp - 0x20]
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x1400014b0
lea r8d, [rax + rax]
lea r9, [rsp + 0x68]
lea rdx, [rbp - 0x20]
mov rcx, r15
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x60]
lea rax, str.jailbreakhook64.dll
mov dword [rsp + 0x30], esi
lea r9, str.jailbreakhook32.dll
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.EasyHook64.dll_RhInjectLibrary]
test eax, eax
je 0x140001515
lea rcx, str.RhInjectLibrary_failed_with_error_code___d_n
mov edx, eax
call fcn.140001858
mov esi, edi
lea rcx, [0x140014860]
call fcn.140001858
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r12
call fcn.1400015c0
mov rcx, qword [rsp + 0x50]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp r15, 0xffffffffffffffff
je 0x140001553
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov r12, qword [rsp + 0x1120]
mov r15, qword [rsp + 0x1130]
mov rcx, qword [rbp + 0xfe0]
xor rcx, rsp
call fcn.1400015a0
add rsp, 0x10f0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret