Function at 0x1400bddb0
Capabilities:
Accept command line arguments
Query service status

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r13
sub rsp, 0x320
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x310], rax
xor r13d, r13d
mov r12d, edx
cmp dword [0x1401f33bc], r13d
jne 0x1400bdefa
mov qword [0x1401f37e0], rcx
call fcn.1400b17c0
call fcn.1400d25f0
call fcn.140156a40
call fcn.14000a4b0
call fcn.1400b5b20
call fcn.140194a00
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
lea rdx, str.ole_initialize:__08x_n
mov ecx, 0xffffff00
mov r8d, eax
mov edi, eax
call fcn.1400b1ca0
lea rcx, [rsp + 0x100]
call fcn.1401617b0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x100]
mov rdx, rax
call fcn.140162580
mov rcx, qword [rsp + 0x108]
xor r8d, r8d
xor edx, edx
call fcn.140006630
lea rcx, [rsp + 0x100]
mov qword [0x1401f37a0], rax
call fcn.140001150
mov r9, qword [0x1401f37a0]
mov ecx, dword [r9]
bt ecx, 0xd
jae 0x1400bdeb2
mov r8d, dword [r9 + 4]
mov rax, qword [r9 + 0x80]
mov r9, qword [r9 + 0x78]
mov edx, ecx
and r8d, 0x40000
and ecx, 8
and edx, 0x1000000
mov qword [rsp + 0x20], rax
call fcn.1400df820
jmp 0x1400be555
bt ecx, 0x11
jae 0x1400bdecc
call fcn.140005520
test eax, eax
je 0x1400be555
xor eax, eax
jmp 0x1400be616
bt ecx, 0xe
jae 0x1400bdefe
call fcn.1400ca260
test eax, eax
jne 0x1400bdefe
xor ecx, ecx
call fcn.1400bd240
test eax, eax
jne 0x1400be555
mov ebx, 1
mov dword [0x1401f3798], ebx
jmp 0x1400be555
mov edi, dword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x34], 0x42ff
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.14000ca70
mov rcx, qword [0x1401f37a0]
cmp qword [rcx + 0x68], r13
je 0x1400bdf44
mov rcx, qword [rcx + 0x68]
call fcn.14000ca60
mov r8d, dword [0x1401e2cc0]
test r8d, r8d
jle 0x1400bdf92
mov ecx, dword [0x1401e90c0]
mov eax, 0x2aaaaaab
imul ecx, r8d
imul ecx
mov eax, 0x2aaaaaab
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x1401e90c4]
mov dword [0x1401e90c0], edx
imul ecx, r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [0x1401e90c4], edx
cmp byte [0x1401f35bd], r13b
je 0x1400bdfc3
call fcn.1400ca260
test eax, eax
jne 0x1400bdfc3
xor ecx, ecx
call fcn.1400bd240
test eax, eax
jne 0x1400be555
mov ebx, 1
mov dword [0x1401f3798], ebx
jmp 0x1400be555
mov eax, dword [0x1401f3720]
cmp byte [0x1401f35bc], r13b
mov ebx, 1
cmovne eax, ebx
cmp byte [0x1401f35a7], r13b
mov dword [0x1401f3720], eax
jne 0x1400bdff4
mov rax, qword [0x1401f37a0]
bt dword [rax], 0x18
jae 0x1400bdffb
xor ecx, ecx
call fcn.1400b2190
cmp byte [0x1401f35a6], r13b
je 0x1400be00b
mov ecx, ebx
call fcn.1400b2060
call fcn.1400b1cd0
lea rdx, str.load_localization_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
mov r11, qword [0x1401f37a0]
mov ecx, dword [0x1401f33fc]
mov eax, dword [r11 + 0xa4]
cmp eax, 0xffffffff
cmovne ecx, eax
call fcn.1400ba3a0
mov r11, qword [0x1401f37a0]
test byte [r11], 8
je 0x1400be05b
mov ecx, ebx
call fcn.1400b2060
mov r11, qword [0x1401f37a0]
bt dword [r11 + 4], 0x12
jae 0x1400be06b
mov dword [0x1401f3720], ebx
jmp 0x1400be081
mov eax, dword [0x1401f3720]
bt dword [r11 + 8], 0x12
cmovb eax, r13d
mov dword [0x1401f3720], eax
lea rdx, str.ole_initialize:__08x_n
mov r8d, edi
mov ecx, 0xffffff00
call fcn.1400b1ca0
mov r11, qword [0x1401f37a0]
bt dword [r11], 0xc
jae 0x1400be0af
call fcn.1400115e0
mov r11, qword [0x1401f37a0]
cmp dword [r11 + 0xb0], 4
jne 0x1400be223
call fcn.1400ca260
test eax, eax
jne 0x1400be223
lea r8d, [rax + 4]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x350], rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, r13
test rax, rax
mov rsi, rax
mov rdi, r13
je 0x1400be172
lea rcx, [rsp + 0x100]
call fcn.1400da800
lea rdx, [rsp + 0x100]
mov r8d, 4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
je 0x1400be172
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x68]
mov r9d, 0x24
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400be172
mov r8d, dword [rsp + 0x84]
test r8d, r8d
je 0x1400be161
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
jmp 0x1400be172
mov rax, qword [0x1401f37a0]
mov dword [rax + 0xb0], 5
mov rax, qword [0x1401f37a0]
cmp dword [rax + 0xb0], 4
jne 0x1400be1e3
lea rcx, [fcn.140194a00]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x340], rbp
call fcn.1400da390
test rax, rax
mov rbp, rax
je 0x1400be1ca
mov rcx, rax
call fcn.1400da360
test eax, eax
je 0x1400be1c0
mov rcx, qword [0x1401f37a0]
mov dword [rcx + 0xb0], 5
mov rcx, rbp
call fcn.1400d7f50
jmp 0x1400be1db
mov rax, qword [0x1401f37a0]
mov dword [rax + 0xb0], 5
mov rbp, qword [rsp + 0x340]
test rdi, rdi
je 0x1400be1ff
mov edx, 0xea60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400be20d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1400be21b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x350]
call fcn.1400bd880
call fcn.1400bc090
test eax, eax
jne 0x1400be555
mov rax, qword [0x1401f37a0]
cmp dword [rax + 0xc4], r13d
je 0x1400be27f
call fcn.1400d0650
call fcn.1400c9d10
lea rdx, str.load_everything_icon_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
call fcn.1400bb570
mov r11, qword [0x1401f37a0]
mov edx, dword [r11 + 0xc4]
xor ecx, ecx
call fcn.140150db0
jmp 0x1400be555
lea rdx, str.create_mutex_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
cmp byte [0x1401f33e1], r13b
jne 0x1400be2b6
mov ecx, r12d
call fcn.1400bd6c0
test eax, eax
jne 0x1400be2b6
lea rcx, str.mutex_exists_n
call fcn.1400b1c70
jmp 0x1400be555
mov rax, qword [0x1401f37a0]
mov ecx, dword [rax]
test cl, 4
je 0x1400be2ed
test cl, 0x40
jne 0x1400be2ed
bt ecx, 0x10
jb 0x1400be2ed
bt ecx, 0x1b
jb 0x1400be2ed
bt dword [rax + 4], 0x1a
jb 0x1400be2ed
bt dword [rax + 8], 0x1a
jb 0x1400be2ed
cmp qword [rax + 0x70], r13
je 0x1400be555
call fcn.1400d0650
call fcn.1400c9d10
lea rdx, str.load_everything_icon_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
call fcn.1400bb570
lea rdx, str.bookmarks_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
call fcn.140004250
lea rdx, str.filters_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
call fcn.1400b9e20
lea rdx, str.search_history_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
call fcn.1400d7a70
lea rdx, str.set_hook_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [0x1400bd620]
mov r9d, eax
xor r8d, r8d
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
lea rdx, str.create_tray_n
mov ecx, 0xffffff00
mov rbx, rax
call fcn.1400b1ca0
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x90], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
movzx ecx, word [rsp + 0xd0]
test byte [rsp + 0xcc], 1
cmove cx, r12w
mov word [rsp + 0xd0], cx
movzx ecx, cx
call fcn.1400e4230
lea rdx, str.enter_main_loop_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
nop
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400be53c
cmp dword [0x1401f3720], r13d
je 0x1400be438
mov rax, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
lea rdx, str.MSG:__p__04x__p__p_n
mov ecx, 0xff00ff00
mov qword [rsp + 0x20], rax
call fcn.1400b1ca0
cmp dword [rsp + 0x40], 0x12
je 0x1400be54c
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400be54c
lea rcx, [rsp + 0x38]
call fcn.1400f9b30
test eax, eax
jne 0x1400be3e0
lea rcx, [rsp + 0x38]
call fcn.14013bde0
test eax, eax
jne 0x1400be3e0
lea rcx, [rsp + 0x38]
call fcn.14010ac00
test eax, eax
jne 0x1400be3e0
lea rcx, [rsp + 0x38]
call fcn.14011afb0
test eax, eax
jne 0x1400be3e0
lea rcx, [rsp + 0x38]
call fcn.14014e410
test eax, eax
jne 0x1400be3e0
cmp dword [rsp + 0x40], 0x100
jne 0x1400be521
cmp qword [rsp + 0x48], 0x41
jne 0x1400be521
call fcn.1400d05e0
cmp eax, 1
jne 0x1400be521
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x100]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.Edit
lea rcx, [rsp + 0x100]
call fcn.140167380
test eax, eax
jne 0x1400be521
mov rcx, qword [rsp + 0x38]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400be3e0
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400be3e0
call fcn.1400eb1e0
call qword [sym.imp.USER32.dll_WaitMessage]
jmp 0x1400be3e0
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea rdx, str.shutdown_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
call fcn.14011e3a0
call fcn.1400ed800
call fcn.1400e23a0
mov rcx, qword [0x1401f3790]
test rcx, rcx
je 0x1400be58e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401f3790], r13
cmp byte [0x1401f3788], r13b
je 0x1400be59c
call fcn.1400bd020
lea rdx, str.kill_n
mov ecx, 0xffffff00
call fcn.1400b1ca0
call fcn.1400d7a10
call fcn.1400b97a0
call fcn.140003f30
mov rcx, qword [0x1401f37a0]
call fcn.140005c80
mov rcx, qword [0x1401f37e8]
test rcx, rcx
je 0x1400be5da
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [0x1401f37f0]
test rcx, rcx
je 0x1400be5ec
call qword [sym.imp.GDI32.dll_DeleteObject]
call qword [sym.imp.ole32.dll_OleUninitialize]
call fcn.1400bac70
call fcn.1400b5b30
call fcn.14000d380
call fcn.140156b40
call fcn.1400c7a70
call fcn.1400b1fe0
mov eax, dword [0x1401f3798]
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1401931f0
mov rbx, qword [rsp + 0x358]
add rsp, 0x320
pop r13
pop r12
pop rdi
ret