Function at 0x140009598
Capabilities:
Accept command line arguments
Check os version
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1b0
mov rax, qword [0x14004ffa8]
xor rax, rsp
mov qword [rbp + 0xa0], rax
or ebx, 0xffffffff
mov ecx, ebx
call qword [sym.imp.IMM32.dll_ImmDisableTextFrameService]
mov ecx, ebx
call qword [sym.imp.IMM32.dll_ImmDisableIME]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea r15d, [r9 + 1]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov rax, qword [0x140050b98]
lea rdx, [0x140008860]
xor r14d, r14d
test rax, rax
je 0x140009614
cmp rax, rdx
je 0x140009614
lea ecx, [r15 + 6]
int 0x29
mov qword [0x140050b98], rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x4000
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp qword [0x14004f140], r14
jne 0x14000979a
cmp byte [0x140050b28], r14b
mov edi, r14d
jne 0x140009723
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140009685
mov eax, dword [rbp - 0x7c]
cmp eax, 6
setb cl
mov byte [0x140050ae4], cl
ja 0x14000967a
jne 0x14000967d
cmp dword [rbp - 0x78], r15d
jbe 0x14000967d
mov edi, r15d
test cl, cl
jne 0x14000971c
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x1400096b3
test edi, edi
je 0x140009715
lea rcx, str.api_ms_win_eventing_provider_l1_1_0.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140009715
lea rdx, str.EventWrite
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140050b10], rax
test rax, rax
je 0x140009715
lea rdx, [0x14003ccb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14004f048], rax
test rax, rax
je 0x140009707
lea rdx, [0x14003ccc0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140050ab0], rax
test rax, rax
jne 0x14000971c
lea rax, [0x140006220]
mov qword [0x14004f048], rax
mov byte [0x140050ae4], r15b
mov byte [0x140050b28], r15b
cmp byte [0x140050ae4], r14b
lea rdx, [0x14004f140]
jne 0x140009756
mov rax, qword [0x14004f048]
lea rcx, [0x14003d2a0]
mov r9, rdx
mov r8, rdx
lea rdx, [0x1400060f0]
call qword [case.0x140024a15.0]
jmp 0x14000979a
mov qword [rsp + 0x38], rdx
lea rax, [0x14003d2a0]
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], r14
mov r9d, r15d
mov qword [rsp + 0x20], rcx
mov r8, rax
lea rcx, [0x140005f80]
mov qword [0x14004f140], rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r14
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
test byte [0x140050ac0], r15b
je 0x1400097b6
lea r8, [0x14003d480]
lea rdx, [0x14003d460]
call fcn.140006400
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x140009a27
lea ecx, [rax + 0x43]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x140009a27
lea ecx, [rax + 0x10]
call fcn.140035c78
mov rbx, rax
test rax, rax
je 0x14000980a
lea r8, str.D4445657_0FBC_11dc_A692_00037AF63586
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
jmp 0x14000980d
mov rbx, r14
test rbx, rbx
je 0x140009a27
cmp dword [rbx], 0xb7
je 0x1400099fa
mov dword [rsp + 0x40], r14d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, str.kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140009869
lea rdx, str.RegisterApplicationRestart
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009869
xor edx, edx
mov rcx, rdi
call qword [case.0x140024a15.0]
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x40]
mov rdx, rdi
call fcn.140008d0c
cmp al, r15b
jne 0x1400099ec
mov ecx, 0x250
call fcn.140035c78
test rax, rax
je 0x140009898
mov rcx, rax
call fcn.14002423c
jmp 0x14000989b
mov rax, r14
lea rcx, [0x140050cd8]
mov qword [0x140050b30], rax
mov qword [rsp + 0x40], r14
call fcn.14000d764
lea rcx, [fcn.140009450]
mov qword [0x140050d68], rcx
test eax, eax
js 0x1400099c9
lea rcx, [rsp + 0x40]
call fcn.14000939c
test eax, eax
js 0x1400098fb
mov r8, qword [rsp + 0x40]
lea rdx, [0x140050cd8]
call fcn.140024474
movzx ecx, byte [0x140050adc]
test eax, eax
cmovns ecx, r15d
mov byte [0x140050adc], cl
lea rax, [0x140050b20]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140009270]
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140050b38], rax
call fcn.14001c168
cmp qword [0x140050b38], r14
je 0x140009977
mov edi, r14d
mov ecx, dword [0x140050b20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x140009966
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, r15d
cmp edi, 0xf0
jl 0x140009938
cmp qword [0x140050b38], r14
je 0x140009977
cmp edi, 0xf0
jl 0x140009980
cmp byte [0x140050adc], r14b
je 0x1400099c4
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x30]
call sub.msvcrt.dll_memset
jmp 0x1400099ad
cmp eax, 0xffffffff
je 0x1400099c4
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140009992
call fcn.140009450
lea rcx, [0x140050cd8]
call fcn.14000d9a8
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400099ec
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024a15.0]
test rsi, rsi
je 0x1400099fa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009a1f
cmp dword [rbx], 0xb7
je 0x140009a15
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], r14
mov rcx, rbx
call fcn.140035cb4
test byte [0x140050ac0], r15b
je 0x140009a43
lea r8, [0x14003d480]
lea rdx, [0x14003d3d8]
call fcn.140006400
cmp byte [0x140050b28], r14b
je 0x140009ac5
mov rcx, qword [0x14004f140]
test rcx, rcx
je 0x140009ac5
cmp byte [0x140050ae4], r14b
jne 0x140009a70
mov rax, qword [0x140050ab0]
call qword [case.0x140024a15.0]
jmp 0x140009abe
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
movzx eax, word [0x14004f16a]
mov dword [0x14004f160], r14d
mov byte [0x14004f168], r14b
mov qword [0x14004f148], r14
test ax, ax
je 0x140009abe
mov rcx, qword [0x14004f170]
movzx eax, ax
sub eax, r15d
cdq
and edx, 0x1f
add eax, edx
xor edx, edx
sar eax, 5
add eax, r15d
movsxd r8, eax
shl r8, 2
call sub.msvcrt.dll_memset
mov qword [0x14004f140], r14
xor eax, eax
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1400362c0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret