Function at 0x14002bf50
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Enumerate processes
Query or enumerate registry value
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x328]
sub rsp, 0x400
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
xor edi, edi
mov qword [0x14022a9d8], rcx
mov esi, edi
mov qword [0x140235e10], rcx
mov r12d, r9d
mov r14, r8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14002bfb6
lea rcx, [0x140028328]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor edx, edx
mov dword [rbp - 0x50], 0x114
mov r8d, 0x110
lea rcx, [rbp - 0x4c]
call fcn.14012d4b0
mov r8d, 2
lea rcx, [0x14022aa20]
mov rdx, rcx
lea rax, [rbp - 0x50]
lea r15d, [r8 + 0x7e]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, r15
movups xmmword [rdx + 0x60], xmm0
add rdx, r15
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x14002bfe6
movups xmm0, xmmword [rax]
mov eax, dword [rax + 0x10]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
call fcn.140115f88
movzx ecx, word [0x14022aa28]
mov eax, 0xff
and cx, ax
movzx eax, word [0x14022aa24]
shl ax, 8
or cx, ax
mov word [0x1401f11c0], cx
call fcn.140113da0
lea rax, [fcn.1400297d8]
mov qword [0x14023e690], rax
lea rax, [0x140059470]
mov qword [0x14023e698], rax
call fcn.140113c58
lea rax, [fcn.140123e6c]
mov qword [0x140235dc0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rax + rbx]
call fcn.140138a98
mov r13d, 0x600
cmp word [0x1401f11c0], r13w
jb 0x14002c0c4
call fcn.140045c68
lea rcx, [rsp + 0x70]
call fcn.140114c40
test r14, r14
je 0x14002c10b
cmp byte [r14], dil
je 0x14002c10b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdx, eax
lea rcx, [rsp + 0x70]
lea ebx, [rax + 1]
call fcn.140114fb4
or r9d, 0xffffffff
mov dword [rsp + 0x28], ebx
mov r8, r14
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rsp + 0x40]
call fcn.140114c40
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.140115190
lea rcx, [rsp + 0x40]
call fcn.14011513c
test al, al
je 0x14002c14f
or r8, 0xffffffffffffffff
lea rdx, [0x1401759d0]
lea rcx, [rsp + 0x40]
call fcn.140115190
lea rcx, [rsp + 0x40]
call fcn.140054ee8
mov rcx, rax
call fcn.1400275a0
call fcn.140027c04
cmp word [0x1401f11c0], r13w
mov qword [0x14022a9d0], rax
jb 0x14002c17f
mov rcx, rax
call fcn.140045bb0
call fcn.1401168b4
mov byte [0x14022aa19], al
mov r14d, 6
test al, al
je 0x14002c1a4
lea rdx, str.Liberation_Mono
lea rcx, [0x1401f11d0]
jmp 0x14002c1f1
cmp dword [0x14022aa24], r14d
jb 0x14002c1f6
xor r9d, r9d
mov dword [rsp + 0x34], edi
lea r8, [rsp + 0x34]
xor edx, edx
mov ecx, 0x1048
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x14002c1e3
cmp dword [rsp + 0x34], edi
je 0x14002c1e3
lea rdx, str.Consolas
lea rcx, [0x1401f11d0]
call fcn.14000129c
lea rdx, str.Segoe_UI
lea rcx, str.Tahoma
call fcn.14000129c
call fcn.140116698
mov byte [0x14022aa1a], al
mov r13d, 0x3f
test al, al
je 0x14002c307
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
mov ebx, eax
test eax, eax
je 0x14002c307
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionConsoleTrueTypeFont
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002c307
mov r8d, ebx
lea rdx, [0x140175bf0]
lea rcx, [rbp + 0x270]
call fcn.14000c80c
mov r8, r15
lea rcx, [rbp + 0x1f0]
xor edx, edx
call fcn.14012d4b0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x270]
lea rax, [rbp + 0x1f0]
mov dword [rsp + 0x34], 0x7e
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002c2fc
cmp word [rbp + 0x1f0], di
je 0x14002c2fc
mov edx, r13d
lea rcx, [rbp + 0x1f0]
call fcn.14012cc40
test rax, rax
jne 0x14002c2fc
cmp word [rbp + 0x1f0], 0x2a
lea rax, [rbp + 0x1f0]
lea rdx, [rbp + 0x1f2]
cmovne rdx, rax
lea r8d, [r13 - 0x1f]
lea rcx, [0x1401f1250]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140029fdc
mov ecx, 0x18
call fcn.140113d08
mov rbx, rax
test rax, rax
je 0x14002c330
call fcn.140113da0
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
jmp 0x14002c333
mov rbx, rdi
mov ecx, 0x140
mov qword [0x14022ab88], rbx
call fcn.140113d08
test rax, rax
je 0x14002c353
mov rcx, rax
call fcn.14004f478
jmp 0x14002c356
mov rax, rdi
mov ecx, 0x12fa0
mov qword [0x14022ab90], rax
call fcn.140113d08
test rax, rax
je 0x14002c376
mov rcx, rax
call fcn.14007f780
jmp 0x14002c379
mov rax, rdi
mov ecx, 0x7cb0
mov qword [0x14022ab58], rax
call fcn.140113d08
test rax, rax
je 0x14002c399
mov rcx, rax
call fcn.14000cc28
jmp 0x14002c39c
mov rax, rdi
mov qword [0x14022a9e0], rax
call fcn.14006302c
mov ebx, 0x1e
lea rcx, [0x14022abb8]
mov edx, ebx
mov r8b, 1
call fcn.14002892c
mov r8b, 1
lea rcx, [0x14022ab98]
mov edx, ebx
call fcn.14002892c
call fcn.140116ec4
mov qword [0x140235e08], rax
call fcn.140003b04
call fcn.1401217cc
mov rcx, qword [0x14022a9d0]
mov qword [rcx + 0x70], rax
lea rcx, [rsp + 0x60]
mov rax, qword [0x14022ab58]
mov dword [rax + 0x11b34], edi
mov rax, qword [0x14022ab58]
mov dword [rax + 0x11b38], edi
call fcn.140114c40
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x30], dil
mov r15b, dil
mov dword [rsp + 0x38], edi
call fcn.140054ee8
mov rcx, qword [0x14022a9e0]
lea r8, [rsp + 0x38]
add rcx, 0x4d8
mov rdx, rax
call fcn.14003cb8c
test al, al
jne 0x14002c452
mov edi, dword [rsp + 0x38]
jmp 0x14002d024
mov rcx, qword [0x14022a9e0]
add rcx, 0x9f0
call fcn.14003c3a0
mov cl, al
call fcn.140027784
test eax, eax
jns 0x14002c47a
mov edi, ILGetSize
jmp 0x14002d024
mov rcx, qword [0x14022a9e0]
add rcx, 0x9f0
call fcn.14003c3a0
test al, al
je 0x14002c4ac
mov rcx, qword [0x14022a9e0]
add rcx, 0xa00
call fcn.14003c3a0
test al, al
jne 0x14002d024
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x894], dil
je 0x14002c4de
add rcx, 0x888
call fcn.14003cb68
mov rcx, qword [0x14022ab58]
mov rdx, rax
call fcn.140086db8
mov rcx, qword [0x14022a9e0]
add rcx, 0x8b8
call fcn.14003c3a0
mov rcx, qword [0x14022a9e0]
test al, al
je 0x14002c4fc
call fcn.140021710
jmp 0x14002c526
cmp byte [rcx + 0x8d4], dil
je 0x14002c526
add rcx, 0x8c8
call fcn.14003cb68
mov rcx, qword [0x14022a9e0]
mov rdx, rax
mov r9b, 1
xor r8d, r8d
call fcn.1400213f8
call fcn.14002a810
mov rcx, qword [0x14022a9e0]
xor edx, edx
call fcn.1400262c4
mov rcx, qword [0x14022a9e0]
add rcx, 0xa30
mov byte [rsp + 0x31], dil
call fcn.14003c3a0
test al, al
je 0x14002c571
mov rax, qword [0x14022ab58]
mov byte [rax + 0x11b2c], 1
mov rcx, qword [0x14022ab50]
call fcn.1400765a8
jmp 0x14002c585
mov rcx, qword [0x14022ab50]
lea rdx, [rsp + 0x31]
xor r8d, r8d
call fcn.140078010
mov rcx, qword [0x14022a9e0]
add rcx, 0x800
call fcn.14011513c
test al, al
jne 0x14002c634
mov rax, qword [0x14022a9e0]
cmp dword [rax + 0x814], 0xffffffff
jne 0x14002c634
lea rcx, [rbp - 0x80]
call fcn.1401170c0
mov rcx, qword [0x14022a9e0]
add rcx, 0x800
call fcn.140054ee8
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.1401188b8
test rax, rax
je 0x14002c62b
lea rcx, [rbp - 0x80]
call fcn.140054ee8
mov rcx, rax
call fcn.1400f97fc
test al, al
je 0x14002c62b
mov rcx, qword [0x14022a9e0]
add rcx, 0x7f0
call fcn.140114fa4
lea rcx, [rbp - 0x80]
call fcn.140054ee8
mov rcx, rax
call fcn.1400f9d58
lea rcx, [rbp - 0x80]
call fcn.1401170e4
jmp 0x14002cf79
lea rcx, [rbp - 0x80]
call fcn.1401170e4
mov rcx, qword [0x14022a9e0]
add rcx, 0x800
call fcn.140114d88
test al, al
je 0x14002c69f
mov rcx, qword [0x14022a9e0]
cmp dword [rcx + 0x814], 0xffffffff
sete bl
add rcx, 0x800
call fcn.140054ee8
mov rcx, rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x30]
mov r8b, bl
mov qword [rsp + 0x20], rax
mov rax, qword [0x14022a9e0]
mov dl, byte [rax + 0x810]
call fcn.140029b0c
test eax, eax
je 0x14002c69a
mov edi, eax
jmp 0x14002d024
mov r15b, byte [rsp + 0x30]
mov rcx, qword [0x14022a9e0]
add rcx, 0xa30
call fcn.14003c3a0
mov rcx, qword [0x14022ab58]
test al, al
jne 0x14002c6c6
cmp byte [rcx + 0x11b2c], dil
je 0x14002c6cc
mov r14d, 0x16
mov al, byte [rcx + 0x11b2d]
mov rcx, qword [0x14022a9e0]
neg al
mov eax, edi
sbb ebx, ebx
and ebx, 0x40
cmp byte [rsp + 0x31], dil
setne al
add rcx, 0x800
or ebx, eax
or ebx, r14d
call fcn.140054ee8
mov rcx, qword [0x14022ab58]
mov r8, rax
mov edx, ebx
call fcn.140087100
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x8a4], dil
je 0x14002c73e
add rcx, 0x898
call fcn.14003cb68
mov rcx, qword [0x14022ab50]
mov rdx, rax
call fcn.14007b248
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x924], dil
je 0x14002c770
add rcx, 0x918
call fcn.14003cb68
mov rcx, qword [0x14022ab50]
mov rdx, rax
add rcx, 0x116a0
call fcn.1400fc604
mov rcx, qword [0x14022a9e0]
add rcx, 0x928
call fcn.14003cb68
test rax, rax
je 0x14002c7ee
mov rax, qword [0x14022ab50]
mov byte [rax + 0x11468], 1
mov rax, qword [0x14022ab50]
mov byte [rax + 0x11469], 1
mov rax, qword [0x14022ab50]
mov rcx, qword [rax + 0x11470]
test rcx, rcx
je 0x14002c7c3
call fcn.140113e18
mov rax, qword [0x14022ab50]
mov qword [rax + 0x11470], rdi
mov rcx, qword [0x14022a9e0]
add rcx, 0x928
call fcn.14003cb68
mov rcx, rax
xor edx, edx
call fcn.1401145e0
mov rcx, qword [0x14022ab50]
mov qword [rcx + 0x11470], rax
mov rcx, qword [0x14022a9e0]
test rcx, rcx
je 0x14002c813
mov r9b, 1
lea rdx, str.SettingsLoaded
mov r8b, r9b
call fcn.1400157d0
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x15b0], dil
je 0x14002c85c
add rcx, 0xa00
call fcn.14003c3a0
test al, al
je 0x14002c855
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.1400730d0
mov dl, 1
mov cl, dl
call fcn.14002abd8
test al, al
mov ecx, 0xa
cmove esi, ecx
lea rcx, [rsp + 0x50]
call fcn.140073100
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x8e4], dil
je 0x14002c8bb
add rcx, 0x8d8
call fcn.14003cb68
mov rcx, qword [0x14022a9e0]
mov r9b, 1
mov r8b, r9b
mov rdx, rax
call fcn.1400213f8
test al, al
jne 0x14002c895
test esi, esi
jne 0x14002c8b4
mov esi, 0xb
jmp 0x14002c8b4
mov rcx, qword [0x14022ab50]
xor r8d, r8d
xor edx, edx
call fcn.14007c870
test eax, eax
jne 0x14002c8b4
test esi, esi
mov eax, 0xc
cmove esi, eax
mov rcx, qword [0x14022a9e0]
add rcx, 0x9e0
call fcn.14003c3a0
test al, al
je 0x14002c943
mov rax, qword [0x14022ab50]
mov byte [rax + 0xa60], 1
mov rax, qword [0x14022ab50]
mov byte [rax + 0xa61], 1
mov rcx, qword [0x14022a9e0]
add rcx, 0xa00
call fcn.14003c3a0
test al, al
je 0x14002c943
mov rax, qword [0x14022a9e0]
mov rcx, qword [rax + 0x3e80]
test rcx, rcx
je 0x14002c935
mov r8b, 1
mov dl, r8b
call fcn.140042de8
mov rcx, qword [0x14022a9e0]
mov r8b, 1
mov dl, r8b
mov rcx, qword [rcx + 0x3e80]
call fcn.140043db8
mov rax, qword [0x14022ab58]
mov byte [rax + 0x11b31], 1
mov rcx, qword [0x14022a9e0]
add rcx, 0xa00
call fcn.14003c3a0
test al, al
jne 0x14002d003
mov rcx, qword [0x14022a9e0]
add rcx, 0x938
call fcn.14003cb68
test rax, rax
je 0x14002c998
mov rcx, qword [0x14022a9e0]
add rcx, 0x938
call fcn.14003cb68
mov rcx, qword [0x14022a9e0]
mov rdx, rax
call fcn.1400217c0
mov rcx, qword [0x14022a9e0]
mov rax, qword [rcx + 0x3e58]
test rax, rax
je 0x14002c9b9
cmp qword [rax + 0x230], 0xffffffffffffffff
je 0x14002ceff
call fcn.14000fce4
test al, al
je 0x14002ceff
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x884], dil
je 0x14002c9f7
add rcx, 0x878
call fcn.14003cb58
mov rcx, qword [0x14022ab58]
mov edx, eax
call fcn.140086c18
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x8b4], dil
jne 0x14002ca2e
cmp r12d, 3
jne 0x14002ca19
mov rax, qword [0x14022ab50]
mov dword [rax + 0x111f0], 0x520
jmp 0x14002ca47
cmp r12d, 2
je 0x14002ca25
cmp r12d, 7
jne 0x14002ca4e
mov byte [rcx + 0x3ea0], 1
jmp 0x14002ca47
add rcx, 0x8a8
call fcn.14003cb58
mov rcx, qword [0x14022ab50]
mov dword [rcx + 0x111f0], eax
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0xa1c], dil
je 0x14002ca77
add rcx, 0xa10
call fcn.14003c3a0
mov rcx, qword [0x14022ab50]
mov byte [rcx + 0x11216], al
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0xa2c], dil
je 0x14002ca99
add rcx, 0xa20
call fcn.14003c3a0
mov rcx, qword [0x14022ab50]
mov byte [rcx + 0x11480], al
mov rcx, qword [0x14022ab58]
call fcn.140083db0
test al, al
jne 0x14002cad6
mov rcx, qword [0x14022a9e0]
xor r8d, r8d
add rcx, 0x4d8
xor edx, edx
call fcn.14003c6d0
mov rcx, rax
lea rdx, str.conman.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x14002cae9
mov rcx, qword [0x14022a9e0]
add rcx, 0x4d8
call fcn.14003f4e8
test r15b, r15b
je 0x14002cb1f
lea rcx, [rsp + 0x60]
call fcn.14011513c
test al, al
jne 0x14002cb1f
lea rcx, [rsp + 0x60]
call fcn.140054ee8
cmp word [rax], r13w
jne 0x14002cb10
add rax, 2
mov rcx, qword [0x14022ab50]
mov rdx, rax
call fcn.140075864
mov rcx, qword [0x14022a9e0]
add rcx, 0x260
call fcn.140038758
mov rax, qword [0x14022a9d0]
mov rdx, qword [rax + 0x70]
test rdx, rdx
je 0x14002cb55
mov rcx, qword [0x14022a9e0]
add rcx, 0x260
call fcn.140039714
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x978], dil
je 0x14002cc45
cmp byte [rcx + 0x98c], dil
je 0x14002cba0
add rcx, 0x980
call fcn.14003cb68
mov rcx, qword [0x14022a9e0]
mov r8, rax
add rcx, 0x260
mov edx, 0x58
call fcn.14003abd0
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x99c], dil
je 0x14002cbd7
add rcx, 0x990
call fcn.14003cb68
mov rcx, qword [0x14022a9e0]
mov r8, rax
add rcx, 0x260
mov edx, 0x59
call fcn.14003abd0
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x9ac], dil
je 0x14002cc0e
add rcx, 0x9a0
call fcn.14003cb68
mov rcx, qword [0x14022a9e0]
mov r8, rax
add rcx, 0x260
mov edx, 0x57
call fcn.14003abd0
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x9bc], dil
je 0x14002cc45
add rcx, 0x9b0
call fcn.14003cb68
mov rcx, qword [0x14022a9e0]
mov r8, rax
add rcx, 0x260
mov edx, 0x48
call fcn.14003abd0
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x954], dil
je 0x14002cc8b
add rcx, 0x948
call fcn.14003cb58
mov rcx, qword [0x14022a9e0]
mov edx, eax
add rcx, 0x260
xor r9d, r9d
or r8d, 0xffffffff
call fcn.1400393dc
mov rax, qword [0x14022ab50]
mov byte [rax + 0x10fec], 1
mov rcx, qword [0x14022a9e0]
mov rax, qword [0x14022ab50]
cmp byte [rax + 0x111f4], dil
je 0x14002cca7
add rcx, 0x260
call fcn.140031234
mov rcx, qword [0x14022ab58]
call fcn.140083dd4
test al, al
je 0x14002ce9a
mov rcx, qword [0x14022a9e0]
xor edx, edx
call fcn.1400262c4
test al, al
jne 0x14002ce9a
mov rcx, qword [0x14022a9e0]
test rcx, rcx
je 0x14002ccef
mov r9b, 1
lea rdx, str.Checking_for_existing_instance
mov r8b, r9b
call fcn.1400157d0
xor r9d, r9d
lea r8, str.VirtualConsoleClass
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
jne 0x14002cdf0
mov rax, qword [0x14022ab58]
cmp dword [rax + 0x11b38], edi
jne 0x14002cdf0
mov rcx, qword [0x14022a9e0]
lea rdx, str.TH32CS_SNAPPROCESS
mov r9b, 1
mov r14b, dil
mov r8b, r9b
call fcn.1400157d0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14002cdf0
xor edx, edx
mov dword [rbp - 0x50], 0x238
mov r8d, 0x234
lea rcx, [rbp - 0x4c]
call fcn.14012d4b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rbp - 0x50]
mov rcx, rbx
mov r15d, eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14002cdd7
cmp dword [rbp - 0x48], r15d
je 0x14002cdc6
lea rcx, [rbp - 0x24]
call fcn.140118eac
mov rsi, rax
test rax, rax
je 0x14002cdc6
lea rdx, str.ConEmu.exe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14002cdd4
lea rdx, [0x140180978]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14002cdd4
lea rdx, [rbp - 0x50]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
jmp 0x14002cd83
mov r14b, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
je 0x14002cdf0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14022a9e0]
lea rdx, str.isFirstInstance
mov r9b, 1
mov r8b, r9b
call fcn.1400157d0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
jmp 0x14002ce6a
mov rcx, qword [0x14022a9e0]
test rcx, rcx
je 0x14002ce38
mov r9b, 1
lea rdx, str.Waiting_for_RunSingleInstance
mov r8b, r9b
call fcn.1400157d0
mov rcx, qword [0x14022a9e0]
xor r8d, r8d
xor edx, edx
call fcn.1400208c4
test eax, eax
jg 0x14002cf27
js 0x14002cf09
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x2710
ja 0x14002ce7c
mov rcx, qword [0x14022a9e0]
xor edx, edx
call fcn.1400262c4
test al, al
je 0x14002ce13
mov rcx, qword [0x14022a9e0]
test rcx, rcx
je 0x14002cebf
mov r9b, 1
lea rdx, str.Existing_instance_was_terminated__continue_as_first_instance
mov r8b, r9b
call fcn.1400157d0
mov rcx, qword [0x14022a9e0]
test rcx, rcx
je 0x14002cebf
mov r9b, 1
lea rdx, str.gpConEmu__Init
mov r8b, r9b
call fcn.1400157d0
mov rcx, qword [0x14022a9e0]
call fcn.1400133b8
test eax, eax
je 0x14002ceff
call fcn.1400273a0
test eax, eax
je 0x14002ceff
mov rcx, qword [0x14022a9e0]
test rcx, rcx
je 0x14002cef6
mov r9b, 1
lea rdx, str.gpConEmu__CreateMainWindow
mov r8b, r9b
call fcn.1400157d0
mov rcx, qword [0x14022a9e0]
call fcn.1400111a8
test eax, eax
jne 0x14002cf45
mov edi, 0x64
jmp 0x14002d024
mov rcx, qword [0x14022a9e0]
lea rdx, str.Reusing_running_instance_is_not_allowed_here
mov r9b, 1
mov r8b, r9b
call fcn.1400157d0
jmp 0x14002ce7c
mov rcx, qword [0x14022a9e0]
lea rdx, str.Passed_to_first_instance__exiting
mov r9b, 1
mov r8b, r9b
call fcn.1400157d0
jmp 0x14002d024
mov rcx, qword [0x14022a9e0]
xor edx, edx
call fcn.14001d6e8
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call fcn.1400296fc
mov rax, qword [0x14022a9e0]
mov esi, dword [rax + 0x7c0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, str.MessageLoop_terminated
xor edx, edx
call fcn.14002a444
mov rcx, qword [0x14022ab90]
call fcn.1400549d0
call qword [sym.imp.ole32.dll_OleUninitialize]
lea rcx, [0x14022a9e0]
call fcn.140026a34
lea rcx, [0x14022ab58]
call fcn.14000456c
lea rcx, [0x14022ab90]
call fcn.140026ab4
lea rcx, [0x14022ab88]
call fcn.140026b44
lea rcx, [0x14022de60]
call fcn.140026a6c
lea rcx, [0x14022b158]
call fcn.140026afc
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, str.Gui_terminated
xor edx, edx
call fcn.14002a444
call fcn.140113d40
call fcn.14011a408
test al, al
je 0x14002d022
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, esi
lea rcx, [rsp + 0x60]
call fcn.140114ca4
lea rcx, [rsp + 0x40]
call fcn.140114ca4
lea rcx, [rsp + 0x70]
call fcn.140114ca4
mov eax, edi
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret