Function at 0x140001010
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
lea r15d, [r9 + 1]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r12, rax
mov edx, 0x20000
lea r9d, [r15 + 5]
mov r8d, 0x200000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
call fcn.140008ac0
xor r14d, r14d
cmp eax, r14d
je 0x140009b2f
mov byte [rsp + 0x50], r14b
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [0x1400263e0], rax
mov qword [0x1400263f0], rbx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
call fcn.140007830
mov r13d, r14d
cmp al, r14b
cmovne r13d, r15d
mov dword [rsp + 0xa0], r14d
xor edx, edx
lea r8d, [rdx + 0x2c]
lea rcx, [rsp + 0xa4]
call fcn.140001ef0
movdqu xmm5, xmmword [0x14001ed78]
movdqu xmmword [rsp + 0xa0], xmm5
mov dword [rsp + 0xb8], r15d
lea rax, [0x14001ed88]
mov qword [rsp + 0xc0], rax
mov edi, 0x80
mov rcx, rdi
call fcn.140002220
mov rbx, rax
cmp rax, r14
je 0x140009b37
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.140001ef0
jmp 0x140001128
cmp rbx, r14
je 0x140009b3f
lea rcx, [rbx + 0x30]
lea rdx, [rsp + 0xa0]
mov r8d, 0x30
call fcn.1400029f0
mov qword [rbx + 0x60], r14
mov qword [rbx + 0x68], r14
mov byte [rbx + 0x70], r14b
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], r14
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x28], r14
mov qword [0x140024078], rbx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, str.EhTray.exe_is_starting
mov r8d, 0x6000002
mov edx, r15d
mov rcx, rbx
call fcn.1400029a0
mov byte [0x1400263f9], r15b
mov edi, r14d
mov dword [rsp + 0x58], r14d
mov ebx, r15d
mov dword [rsp + 0x54], ebx
lea rsi, [0x140000000]
lea rcx, [rsp + 0x50]
call fcn.140006e60
cmp al, r14b
je 0x140009b47
mov al, byte [rsp + 0x50]
cmp al, r14b
jne 0x140009cda
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, str.EhTray.exe_initialization_is_complete.
mov r8d, 0x6000009
mov edx, r15d
mov rcx, qword [0x140024078]
call fcn.1400029a0
mov ecx, dword [0x140025ea0]
cmp ecx, 0xfffffffe
jle 0x140001233
mov r8b, r15b
or edx, 0xffffffff
call fcn.140001f98
or r8, 0xffffffffffffffff
or rdx, r8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call fcn.140005530
mov sil, r14b
mov byte [rsp + 0x51], r14b
mov r12d, 2
cmp sil, r14b
jne 0x140009cda
mov ebx, r14d
mov edi, r14d
mov r10, qword [section..data]
cmp r10, r14
je 0x140001275
mov edi, dword [r10 + 4]
cmp edi, r14d
jle 0x140009bd9
mov rax, qword [section..data]
mov dword [rsp + 0x20], r12d
mov r9d, 0x4ff
or r8d, 0xffffffff
mov rdx, qword [rax + 8]
mov ecx, edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
mov ebx, eax
jmp 0x1400012a4
cmp ebx, edi
jne 0x140001423
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r14d
jne 0x1400013cc
jmp 0x140001256
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400012ac
cmp dword [rsp + 0x78], 0x12
je 0x140009be5
mov ebx, r14d
mov dword [rsp + 0x5c], ebx
cmp ebx, r15d
jge 0x1400013b1
movsxd rax, ebx
lea rcx, [0x140000000]
mov rdi, qword [rcx + rax*8 + 0x24020]
cmp qword [rdi + 0x220], r14
jne 0x140009bf2
mov al, r14b
cmp al, r14b
jne 0x140009c37
add ebx, r15d
mov dword [rsp + 0x5c], ebx
jmp 0x1400013de
mov cl, r14b
mov byte [rsp + 0x52], cl
mov eax, r14d
mov dword [rsp + 0x60], eax
cmp ebx, r14d
jl 0x140001458
mov r10, qword [section..data]
cmp ebx, dword [r10 + 4]
jge 0x140001458
movsxd rcx, ebx
mov rax, qword [r10 + 0x10]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x60], eax
mov cl, r15b
mov byte [rsp + 0x52], cl
cmp cl, r14b
je 0x1400012cd
cmp eax, r14d
je 0x140005974
sub eax, r15d
jne 0x140005398
mov r8b, r15b
lea rdx, str.EnableLaunchErrors
mov rcx, qword [0x140024010]
call fcn.1400014f4
mov byte [0x140024018], al
mov r8b, r15b
lea rdx, str.EnableSPADLaunchErrors
mov rcx, qword [0x140024010]
call fcn.1400014f4
mov byte [0x14002401a], al
mov edx, r15d
mov r10, qword [section..data]
mov rcx, r10
call fcn.1400015ac
cmp rax, r14
je 0x1400012cd
mov rcx, r10
call fcn.1400015ac
mov r9, rax
mov dword [rsp + 0x20], r15d
mov r8d, 4
mov rcx, qword [0x140024010]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x1400012cd
sub eax, r15d
je 0x140009c6d
sub eax, r15d
jne 0x140009c3c
call fcn.140005530
mov rcx, qword [0x1400240a8]
cmp rcx, r14
je 0x1400053d0
cmp dword [0x140024120], r14d
je 0x140005a87
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x1400053d0
xor edx, edx
mov rcx, qword [0x140024058]
call fcn.1400052f4
jmp 0x1400012cd
mov bl, byte [0x140024130]
mov r8b, r15b
lea rdx, str.EnableNotifications
mov rcx, qword [0x140024138]
call fcn.1400014f4
mov r11b, al
mov byte [0x140024130], al
xor edx, edx
mov r10, qword [section..data]
mov rcx, r10
call fcn.1400015ac
cmp rax, r14
je 0x1400059d7
mov rcx, r10
call fcn.1400015ac
mov r9, rax
mov dword [rsp + 0x20], r15d
lea r8d, [rdx + 4]
mov rcx, qword [0x140024138]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov r11b, byte [0x140024130]
cmp bl, r11b
je 0x1400012cd
jmp 0x140009cbc
mov r8d, 0xa
lea rdx, str.EhtrayExitDelay
mov rcx, qword [0x140024010]
call fcn.140005af0
cmp eax, r15d
jl 0x140009c65
mov ecx, 0x1e13380
cmp eax, ecx
cmovg eax, ecx
cdqe
imul rax, rax, 0xffffffffff676980
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, qword [0x1400240a8]
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
nop
jmp 0x1400053d0
or eax, 0xffffffff
jmp 0x140009ce2
mov rbx, r14
jmp 0x140001128
mov rbx, r14
jmp 0x140001173
mov al, byte [rsp + 0x50]
cmp al, r14b
jne 0x1400011df
mov eax, edi
lea rsi, [rsi + rax*8 + 0x1f8c0]
cmp ebx, dword [rsi]
jb 0x140009b85
mov ebx, r14d
mov dword [rsp + 0x54], ebx
lea eax, [rdi + 1]
cmp eax, 4
cmovb edi, eax
mov dword [rsp + 0x58], edi
lea rcx, [0x140000000]
lea rsi, [rcx + rdi*8 + 0x1f8c0]
mov eax, dword [rsi + 4]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea r9, str.EhTray.exe_initialization_failed.__Sleeping_before_retry.
mov r8d, 0x6000008
mov edx, r15d
mov rcx, qword [0x140024078]
call fcn.1400029a0
mov ecx, dword [rsi + 4]
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, r15d
mov dword [rsp + 0x54], ebx
lea rsi, [0x140000000]
jmp 0x1400011c8
call qword [sym.imp.USER32.dll_WaitMessage]
nop
jmp 0x1400012a4
mov sil, r15b
mov byte [rsp + 0x51], r15b
jmp 0x1400012cd
cmp qword [rdi + 0x230], r14
jne 0x140009c0a
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov qword [rdi + 0x230], rax
mov rdx, qword [rdi + 0x230]
cmp rdx, r14
je 0x14000140e
lea r8, [rsp + 0x70]
mov rcx, qword [rdi + 0x220]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
cmp eax, r14d
setne al
jmp 0x140001405
jmp 0x1400012ac
sub eax, r15d
jne 0x1400012cd
call fcn.1400054a0
cmp eax, r14d
jne 0x1400012cd
mov rcx, qword [0x140024058]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x1400012cd
mov eax, r15d
jmp 0x140005ab3
mov edx, r12d
mov r10, qword [section..data]
mov rcx, r10
call fcn.1400015ac
mov rbx, rax
cmp rax, r14
je 0x140009ca5
mov rcx, r10
call fcn.14000fcd0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
or edx, 0xffffffff
or ecx, edx
call fcn.140001f98
mov edx, 0x802f
mov rcx, qword [0x140024058]
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x1400012cd
mov rcx, qword [0x140024060]
cmp rcx, r14
je 0x1400012cd
mov dl, r11b
call fcn.140005fa8
nop
jmp 0x1400012cd
call fcn.14000dda8
mov eax, r13d
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400012d0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret