Function at 0x1800295fc
Capabilities:
Accept command line arguments
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1a0
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor r14d, r14d
mov rdi, rcx
mov sil, r14b
mov qword [rbp - 0x58], r14
mov r13d, r14d
call fcn.18002adb4
test eax, eax
jne 0x180029e37
lea r12d, [r14 + 4]
mov ecx, r12d
call fcn.18002aa18
lea ecx, [r14 + 0x20]
test eax, eax
je 0x1800296af
mov dword [rsp + 0x60], ecx
lea r8, [rsp + 0x60]
mov ecx, 0x10002
mov word [rbp + 0x50], r14w
lea rdx, [rbp + 0x50]
call qword [sym.imp.SspiCli.dll_GetUserNameExW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
test rax, rax
lea r8, [0x180070708]
cmovne r8, rax
cmp dword [0x180096970], r14d
je 0x1800296af
lea r9, [rbp + 0x50]
mov edx, 0x7d5
mov ecx, r12d
call fcn.18002ab28
mov ecx, dword [rdi]
cmp ecx, 5
jne 0x1800296cd
mov r13, qword [rdi + 0x20]
mov sil, 1
test r13, r13
je 0x1800296cd
mov dword [rdi], 1
mov ecx, 1
mov dword [rbp + 0x30], ecx
mov dword [rbp + 0x34], 9
sub ecx, 1
je 0x180029706
sub ecx, 1
je 0x18002970f
sub ecx, 1
je 0x18002970f
cmp ecx, 1
je 0x1800296f5
mov eax, 0x57
jmp 0x180029e37
movups xmm0, xmmword [rdi + 8]
mov eax, dword [rdi + 0x18]
mov dword [rbp + 0x48], eax
movdqu xmmword [rbp + 0x38], xmm0
jmp 0x180029717
movups xmm0, xmmword [rdi + 0x10]
movdqu xmmword [rbp + 0x40], xmm0
mov rax, qword [rdi + 8]
mov qword [rbp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x48], r14
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x38]
call sub.msvcrt.dll_memset
mov r9, qword [0x1800968d0]
lea rcx, [0x18005e3f8]
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea edx, [r8 + 1]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x180029e37
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.180001bbc
mov ebx, dword [rsp + 0x60]
test ebx, ebx
jne 0x180029dca
cmp qword [rbp - 0x68], r14
jne 0x180029b8b
test sil, sil
je 0x1800297b9
mov ebx, 0x57
jmp 0x180029dca
mov rax, qword [0x1800962a0]
xor edx, edx
xor ecx, ecx
call qword [0x18006e698]
mov ecx, dword [rsp + 0x50]
mov r15d, eax
test ecx, ecx
je 0x1800297eb
mov rax, qword [0x1800962a0]
xor edx, edx
lea ecx, [rdx + 3]
call qword [0x18006e698]
mov ecx, dword [rsp + 0x50]
mov esi, r14d
mov r13d, 0xbc2
test ecx, ecx
je 0x180029934
mov r8, qword [rsp + 0x58]
mov eax, esi
imul r14, rax, 0x38
test byte [r14 + r8 + 0x30], 0x10
je 0x180029921
xor r12d, r12d
cmp dword [0x180096970], r12d
je 0x180029838
mov r9, qword [r14 + r8 + 0x10]
lea ecx, [r12 + 4]
mov r8, qword [r14 + r8 + 8]
mov edx, 0xbe3
call fcn.18002ab28
mov rcx, qword [rsp + 0x58]
lea rdx, str.PackageCode
mov rax, qword [0x180096298]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [r14 + rcx + 0x18]
call qword [0x18006e698]
mov ebx, eax
test eax, eax
je 0x180029872
cmp eax, 0x64a
je 0x180029872
cmp eax, 0x645
jne 0x1800298e1
jmp 0x18002989c
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov rax, qword [0x1800962b0]
mov edx, 0xffff
mov rcx, qword [r14 + rcx + 0x18]
lea r8d, [r9 + 2]
call qword [0x18006e698]
mov ebx, eax
cmp eax, r13d
jne 0x1800298a1
mov ebx, r12d
jmp 0x1800298e1
cmp eax, 0x659
je 0x1800298af
cmp eax, 0x66c
jne 0x1800298e1
mov rax, qword [rsp + 0x58]
xor r8d, r8d
mov r9, qword [rsp + 0x48]
mov dword [rsp + 0x28], 1
mov rcx, qword [r14 + rax]
lea edx, [r8 + 3]
mov qword [rsp + 0x20], rcx
lea rcx, [0x18005e3f8]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov rbx, rax
mov r9, qword [rsp + 0x58]
mov r8d, 1
mov rcx, qword [rsp + 0x48]
mov edx, ebx
mov rax, qword [r14 + r9]
mov qword [rsp + 0x28], rax
mov rax, qword [r14 + r9 + 0x10]
mov r9, qword [r14 + r9 + 8]
mov qword [rsp + 0x20], rax
call fcn.180029e68
xor r14d, r14d
test ebx, ebx
jne 0x180029aa8
mov ecx, dword [rsp + 0x50]
jmp 0x180029924
xor r14d, r14d
inc esi
cmp esi, ecx
jb 0x1800297fc
mov r12d, 4
mov r9, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [0x18005e3f8]
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
lea edx, [r8 + 2]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov ebx, eax
test eax, eax
jne 0x180029aa8
mov eax, dword [rbp - 0x60]
and al, 2
neg al
sbb ecx, ecx
and ecx, 2
add ecx, 3
cmp dword [rdi], 1
mov eax, ecx
jne 0x180029990
test byte [rbp - 0x60], 1
je 0x180029990
bts eax, 7
mov ecx, eax
xor edx, edx
mov rax, qword [0x1800962a0]
call qword [0x18006e698]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1800299e4
cmp dword [0x180096970], r14d
je 0x1800299cd
mov r9, qword [rbp - 0x80]
mov edx, 0x7d2
mov r8, qword [rsp + 0x78]
mov ecx, r12d
call fcn.18002ab28
mov rcx, qword [rbp - 0x70]
mov rax, qword [0x1800962d0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [0x18006e698]
jmp 0x180029a1d
cmp dword [0x180096970], r14d
je 0x180029a03
mov r9, qword [rbp - 0x80]
mov edx, 0x7d1
mov r8, qword [rsp + 0x78]
mov ecx, r12d
call fcn.18002ab28
mov rcx, qword [rbp - 0x78]
xor r9d, r9d
mov rax, qword [0x1800962b0]
xor edx, edx
lea r8d, [r9 + 5]
call qword [0x18006e698]
mov ebx, eax
cmp eax, 0x669
je 0x180029a32
cmp eax, r13d
je 0x180029a32
cmp eax, 0x644
jne 0x180029a35
mov ebx, r14d
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov r9, qword [rsp + 0x78]
mov edx, ebx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.180029e68
mov rax, qword [0x1800962a0]
xor edx, edx
mov ecx, r15d
call qword [0x18006e698]
test ebx, ebx
je 0x180029b45
test byte [rbp - 0x60], r12b
jne 0x180029dca
mov rax, qword [rsp + 0x70]
lea rcx, [0x18005e3f8]
mov r9, qword [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
lea edx, [r8 + 3]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
test esi, esi
je 0x180029dca
mov rdi, r14
mov rax, qword [rsp + 0x58]
xor r8d, r8d
mov r9, qword [rsp + 0x48]
mov byte [rsp + 0x40], r14b
mov rcx, qword [rax + rdi]
lea edx, [r8 + 2]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
lea rcx, [0x18005e3f8]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
test eax, eax
jne 0x180029b32
cmp byte [rsp + 0x40], r14b
je 0x180029b32
mov rcx, qword [rsp + 0x58]
lea r8d, [rax + 5]
mov rax, qword [0x1800962b0]
xor r9d, r9d
xor edx, edx
mov rcx, qword [rcx + rdi + 0x18]
call qword [0x18006e698]
mov r8, qword [rsp + 0x58]
lea rcx, [rbp - 0x58]
mov edx, ebx
mov r9, qword [r8 + rdi + 0x10]
mov r8, qword [r8 + rdi + 8]
call fcn.18002b07c
add rdi, 0x38
sub rsi, 1
jne 0x180029ab3
jmp 0x180029dca
test esi, esi
je 0x180029dca
mov rdi, r14
mov rax, qword [rsp + 0x58]
xor r8d, r8d
mov r9, qword [rsp + 0x48]
mov dword [rsp + 0x28], r14d
mov rcx, qword [rax + rdi]
lea edx, [r8 + 3]
mov qword [rsp + 0x20], rcx
lea rcx, [0x18005e3f8]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
lea rdi, [rdi + 0x38]
sub rsi, 1
jne 0x180029b50
jmp 0x180029dca
xor edx, edx
lea rcx, [rbp - 0x40]
lea r8d, [rdx + 0x70]
call sub.msvcrt.dll_memset
xor edx, edx
mov qword [rsp + 0x60], r14
mov r8d, 0x800
lea rcx, [0x18007ba00]
mov rsi, r14
mov r15, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
test rax, rax
je 0x180029bdc
lea rdx, str.ShellExecuteExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x180029bec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x180029cd6
mov rsi, qword [rbp - 0x68]
mov edx, 0x22
cmp dx, word [rsi]
jne 0x180029c12
lea rcx, [rsi + 2]
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
test rax, rax
je 0x180029c3a
add rsi, 2
jmp 0x180029c23
mov edx, 0x20
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
test rdi, rdi
je 0x180029c3a
mov word [rdi], r14w
mov eax, 0x20
add rdi, 2
cmp ax, word [rdi]
je 0x180029c31
mov edx, 0x5c
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r14, rax
test rax, rax
je 0x180029c71
mov rcx, rsi
call fcn.180029ef8
mov r15, rax
xor eax, eax
test r15, r15
je 0x180029d89
sub r14, rsi
sar r14, 1
mov word [r15 + r14*2], ax
xor r14d, r14d
mov dword [rbp - 0x40], 0x70
cmp dword [0x180096970], r14d
mov dword [rbp - 0x3c], 0x40
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], r15
mov dword [rbp - 0x10], 1
mov qword [rbp + 0x28], r14
je 0x180029cbb
mov r8, rsi
lea ecx, [r14 + 4]
mov edx, 0x7d4
call fcn.18002ab28
mov rax, qword [rsp + 0x60]
lea rcx, [rbp - 0x40]
call qword [0x18006e698]
test eax, eax
jne 0x180029cd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
je 0x180029ced
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x180029db1
cmp qword [rbp + 0x28], r14
je 0x180029db1
mov ebx, r14d
call fcn.180001a50
test eax, eax
je 0x180029d96
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x60], rax
mov rax, qword [0x180096288]
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x20], 0x1cff
or r9d, 0xffffffff
lea ecx, [r8 + 1]
call qword [0x18006e698]
mov ebx, eax
cmp eax, 1
jne 0x180029d96
mov dword [rsp + 0x20], eax
lea rcx, [rbp + 0x50]
mov rax, qword [0x180096278]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [0x18006e698]
test eax, eax
je 0x180029d18
mov rax, qword [0x180096290]
lea rcx, [rbp + 0x50]
call qword [0x18006e698]
mov rax, qword [0x1800962b8]
lea rcx, [rbp + 0x50]
call qword [0x18006e698]
jmp 0x180029d18
mov ebx, 0xe
xor r14d, r14d
jmp 0x180029cd6
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x180029da9
mov ebx, r14d
jmp 0x180029db1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r9, qword [rbp - 0x80]
lea rcx, [rbp - 0x58]
mov r8, qword [rsp + 0x78]
mov edx, ebx
mov qword [rsp + 0x20], rsi
call fcn.18002b45c
cmp qword [rsp + 0x48], r14
je 0x180029df8
test ebx, ebx
lea rax, [rsp + 0x48]
mov r9d, r14d
mov qword [rsp + 0x20], rax
sete r9b
lea rcx, [0x18005e3f8]
xor r8d, r8d
lea edx, [r8 + 4]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
lea rcx, [rsp + 0x70]
jmp 0x180029e0e
dec eax
imul rcx, rax, 0x38
mov dword [rsp + 0x50], eax
add rcx, qword [rsp + 0x58]
call fcn.18002a68c
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x180029dff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x180029e35
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.180017170
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
jmp 0x1800295fc