Function at 0x10000eec0
Capabilities:
Accept command line arguments
Print debug messages
Set registry value

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov rdi, rcx
xor r14d, r14d
mov dword [rax + 0x10], r14d
movabs rsi, 0x4000000000010000
cmp dword [0x1000408f4], r14d
jne 0x100014786
mov r13d, r14d
lea rcx, str.Microsoft.Windows.StickyNotes
call qword [sym.imp.SHELL32.dll_SetCurrentProcessExplicitAppUserModelID]
mov ebp, 0x80004005
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x180]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r12, rax
mov dword [rdi + 0xe8], r14d
mov ebx, 1
or r15d, 0xffffffff
cmp dword [rsp + 0x180], ebx
jg 0x1000147d5
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 0x1f6
mov edx, ebx
lea rcx, [0x1000400d8]
call fcn.100007bb0
cmp eax, r14d
je 0x10001493c
mov r8, qword [rdi + 0xc0]
mov r12d, 1
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0xb0], eax
cmp qword [rdi + 0xb8], r14
je 0x10000efb3
cmp eax, 0xb7
je 0x10001499b
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov r9b, r12b
mov r8b, r12b
lea rdx, [0x100000000]
mov ecx, 8
call sub.DUI70.dll_InitProcessPriv
mov dword [rsp + 0x88], r12d
mov qword [rsp + 0x90], r14
mov dword [rsp + 0x98], r14d
mov dword [rsp + 0x9c], r14d
lea rcx, [rdi + 0xf8]
xor r8d, r8d
lea rdx, [rsp + 0x88]
call sub.gdiplus.dll_GdiplusStartup
cmp byte [rdi + 0x308], r14b
je 0x100014aad
call sub.ntdll.dll_WinSqmIsOptedIn
cmp eax, r14d
je 0x100014aad
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [0x100040a60]
call sub.ntdll.dll_WinSqmStartSession
mov qword [rdi + 0x728], rax
jmp 0x10000f03e
mov ecx, 0x20
call fcn.1000023a0
cmp rax, r14
je 0x100014ab9
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov dword [rax + 0x18], r15d
mov dword [rax + 0x1c], r14d
jmp 0x10000f066
mov qword [rdi], rax
cmp rax, r14
je 0x10000f0b9
mov qword [rsp + 0x40], r14
lea r9, [rsp + 0x40]
mov edx, 0xc08
mov r8d, 0x17
mov rcx, qword [0x1000400c8]
call sub.SHLWAPI.dll_Ordinal_628
mov ebx, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, r14
je 0x10000f0b0
mov rcx, qword [rdi]
call fcn.10000cb9c
mov ebx, eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp ebx, r14d
jne 0x100014ac1
mov rcx, rdi
call fcn.10000f950
mov rcx, rdi
call fcn.10000c718
mov rcx, rdi
call fcn.10000c804
lea rsi, [rdi + 8]
mov rcx, rsi
call fcn.10000ca88
movabs rdx, 0x2000000000010000
cmp eax, r14d
je 0x100014ae1
mov ecx, 0x50
call fcn.1000023a0
mov rbx, rax
mov qword [rsp + 0xf0], rax
cmp rax, r14
je 0x100014b45
mov ebp, 7
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xb8], r14
mov word [rsp + 0xa8], r14w
xor r8d, r8d
lea rdx, [0x100032018]
lea rcx, [rsp + 0xa0]
call fcn.10000a000
nop
mov dword [rsp + 0x188], r12d
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x30], r14
mov word [rbx + 0x20], r14w
mov qword [rbx], rsi
mov dword [rbx + 0x40], 5
mov dword [rbx + 0x44], 0x12c
mov dword [rbx + 0x48], r14d
mov dword [rbx + 0x4c], r12d
mov ecx, 0x90
call fcn.1000023a0
mov qword [rsp + 0xf8], rax
cmp rax, r14
je 0x100014b3d
lea rdx, [rsp + 0xa0]
mov rcx, rax
call fcn.10000f800
jmp 0x10000f19f
mov qword [rbx + 8], rax
jmp 0x10000f1a5
mov qword [rdi + 0x58], rbx
test byte [rsp + 0x188], r12b
je 0x10000f1c2
cmp qword [rsp + 0xc0], 8
jae 0x100014b4d
mov ecx, 0x18
call fcn.1000023a0
mov r11, rax
cmp rax, r14
je 0x100014b60
lea rax, [0x100031990]
mov qword [r11], rax
mov qword [r11 + 0x10], rdi
jmp 0x10000f1e8
mov qword [rdi + 0x720], r11
mov rax, qword [rdi + 0x58]
cmp rax, r14
je 0x100014b68
cmp r11, r14
je 0x100014b68
mov qword [rax + 0x10], r11
mov rax, qword [rax + 8]
mov qword [r11 + 8], rax
mov rdx, qword [rdi + 0x58]
mov r8d, dword [rdx + 0x40]
imul r8d, r8d, 0x3e8
xor r9d, r9d
lea rcx, [0x100027900]
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
movabs rbp, 0x4000000000010000
jmp 0x10000f23c
mov rcx, rdi
call fcn.10000df7c
cmp eax, r14d
jl 0x100014be9
cmp byte [rdi + 0xf1], r14b
jne 0x100014bfb
call fcn.10000c208
call fcn.10000c360
mov rcx, rdi
call fcn.10000f5bc
cmp eax, r14d
je 0x10000f329
mov rcx, rdi
call fcn.10000c680
cmp al, r14b
jne 0x100014c09
mov rcx, rdi
call fcn.10000f348
cmp eax, r14d
je 0x10000f329
lea rcx, [0x100040120]
mov rax, qword [0x100040120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 0x70]
call fcn.100004270
mov rbx, qword [rdi + 0x68]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xe8]
call fcn.1000031f0
mov rdx, rax
mov rcx, rbx
call fcn.1000036a0
cmp eax, r15d
je 0x10000f303
movsxd rcx, eax
cmp rcx, qword [rbx + 0x20]
jae 0x100014f3b
shl rcx, 4
add rcx, qword [rbx + 0x18]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_SetFocus]
mov r13d, r12d
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
cmp ecx, r14d
jg 0x10000f329
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, r13d
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov al, byte [0x1000408f8]
cmp al, 4
jae 0x100014799
cmp al, r14b
jne 0x10000ef03
test qword [0x1000408e0], rsi
je 0x10000ef03
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rsi
cmp rax, rcx
jne 0x10000ef03
lea rdx, [0x100032d50]
mov rcx, qword [0x1000400f0]
call fcn.1000180a0
nop
jmp 0x10000ef03
lea rsi, [rax + 8]
mov rdx, qword [rsi]
mov eax, 0x2d
cmp ax, word [rdx]
je 0x1000147f4
mov eax, 0x2f
cmp ax, word [rdx]
jne 0x100014882
add rdx, 2
lea rcx, [rsp + 0x198]
call fcn.100002f84
nop
lea rdx, str.OpenNote
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
jne 0x100014836
mov dword [rdi + 0xe8], 2
lea eax, [rbx + 1]
cmp eax, dword [rsp + 0x180]
jl 0x100014896
lea rdx, [0x100033518]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r14d
jne 0x10001485d
mov ebp, r14d
mov dword [rdi + 0xe8], 1
mov rdx, qword [rsp + 0x198]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x100014882
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
inc ebx
add rsi, 8
cmp ebx, dword [rsp + 0x180]
jge 0x10001490f
jmp 0x1000147d9
lea rcx, [rdi + 0x84]
mov word [rcx], r14w
movsxd rax, ebx
mov r8, qword [r12 + rax*8 + 8]
mov edx, 0x15
mov ebp, r14d
sub r8, rcx
lea rax, [rdx + 0x7fffffe9]
cmp rax, r14
je 0x1000148d8
movzx eax, word [r8 + rcx]
cmp ax, r14w
je 0x1000148d8
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000148b4
cmp rdx, r14
jne 0x1000148e6
sub rcx, 2
mov ebp, 0x8007007a
mov word [rcx], r14w
mov rdx, qword [rsp + 0x198]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x10001490f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp ebp, r14d
jne 0x10001492d
mov dword [rdi + 0x80], 1
movabs rsi, 0x4000000000010000
jmp 0x10000ef4f
movabs rsi, 0x4000000000010000
jmp 0x10000ef4f
cmp dword [0x1000408f4], r14d
je 0x10000ef74
mov al, byte [0x1000408f8]
cmp al, 4
jae 0x10001495c
cmp al, r14b
jne 0x10000ef74
test qword [0x1000408e0], rsi
je 0x10000ef74
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rsi
cmp rax, rcx
jne 0x10000ef74
mov r8d, ebx
lea rdx, [0x1000331a0]
mov rcx, qword [0x1000400f0]
call fcn.1000180bc
nop
jmp 0x10000ef74
cmp dword [0x1000408f4], r14d
je 0x1000149e1
mov al, byte [0x1000408f8]
cmp al, 4
jae 0x1000149b3
cmp al, r14b
jne 0x1000149e1
test qword [0x1000408e0], rsi
je 0x1000149e1
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rsi
cmp rax, rcx
jne 0x1000149e1
lea rdx, [0x100032d70]
mov rcx, qword [0x1000400f0]
call fcn.1000180a0
mov rdx, qword [0x1000400d8]
lea rcx, str.Sticky_Notes_Top_Window
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
cmp rax, r14
je 0x10000f329
mov dword [rsp + 0x100], 0x2c
xor edx, edx
lea r8d, [rdx + 0x28]
lea rcx, [rsp + 0x104]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x100]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [rsp + 0x108], 2
jne 0x100014a48
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [rdi + 0x80], r14d
je 0x10000f329
movsxd rax, dword [rdi + 0xe8]
cmp eax, r14d
je 0x10000f329
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xd0], 0x2a
lea rax, [rdi + 0x84]
mov qword [rsp + 0xd8], rax
lea r9, [rsp + 0xc8]
xor r8d, r8d
lea edx, [r8 + 0x4a]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10000f329
mov byte [rdi + 0x308], r14b
jmp 0x10000f03e
mov rax, r14
jmp 0x10000f066
mov rbx, qword [rdi]
cmp rbx, r14
je 0x100014ad9
mov rcx, rbx
call fcn.10000b524
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [rdi], r14
jmp 0x10000f0b9
cmp dword [0x1000408f4], r14d
je 0x10000f0f0
mov al, byte [0x1000408f8]
cmp al, 2
jae 0x100014b01
cmp al, r14b
jne 0x10000f0f0
test qword [0x1000408e0], rdx
je 0x10000f0f0
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x10000f0f0
lea rdx, [0x100033010]
mov rcx, qword [0x1000400f0]
call fcn.1000180a0
nop
jmp 0x10000f0f0
mov rax, r14
jmp 0x10000f19f
mov rbx, r14
jmp 0x10000f1a5
mov rcx, qword [rsp + 0xa8]
call sub.msvcrt.dll_free
nop
jmp 0x10000f1c2
mov r11, r14
jmp 0x10000f1e8
cmp dword [0x1000408f4], r14d
je 0x100014bda
mov al, byte [0x1000408f8]
cmp al, 2
jae 0x100014b80
cmp al, r14b
jne 0x100014bcb
movabs rbp, 0x4000000000010000
test qword [0x1000408e0], rbp
je 0x10000f23c
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rbp
cmp rax, rcx
jne 0x10000f23c
mov r8d, 0x80004005
lea rdx, [0x100032ce0]
mov rcx, qword [0x1000400f0]
call fcn.100019be4
jmp 0x10000f23c
movabs rbp, 0x4000000000010000
jmp 0x10000f23c
movabs rbp, 0x4000000000010000
jmp 0x10000f23c
mov edx, 0x205
mov rcx, rdi
call fcn.10001df38
jmp 0x10000f329
mov rcx, rdi
call fcn.10001d710
nop
jmp 0x10000f25a
mov rsi, qword [rdi]
mov rax, qword [rdi + 0x70]
mov dword [rsp + 0x78], r14d
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call fcn.1000075d0
xor edx, edx
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call fcn.1000081c8
mov r9, qword [rbx + 0x178]
cmp r9, r14
je 0x100014c51
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.100007304
nop
lea rbx, [0x100040120]
mov rcx, rbx
mov rax, qword [0x100040120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
mov rcx, rbx
mov rax, qword [0x100040120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x100]
lea rcx, [rsp + 0x30]
call fcn.100002f84
nop
mov rcx, rbx
mov rax, qword [0x100040120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov ebx, 0x20d
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.100007bb0
cmp eax, r14d
jne 0x100014d0e
cmp dword [0x1000408f4], r14d
je 0x100014d0e
mov al, byte [0x1000408f8]
cmp al, 4
jae 0x100014cdd
cmp al, r14b
jne 0x100014d0e
test qword [0x1000408e0], rbp
je 0x100014d0e
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rbp
cmp rax, rcx
jne 0x100014d0e
mov r8d, ebx
lea rdx, [0x1000331a0]
mov rcx, qword [0x1000400f0]
call fcn.1000180bc
mov rbx, qword [rsp + 0x58]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.100004f64
mov r9, qword [rdi + 0xe0]
lea r8, [rdi + 0x100]
lea rdx, str._s_s
lea rcx, [rsp + 0x38]
call fcn.100004080
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.10002303c
mov r8d, eax
cmp eax, r14d
jge 0x100014daf
cmp dword [0x1000408f4], r14d
je 0x100014daf
mov al, byte [0x1000408f8]
cmp al, 2
jae 0x100014d77
cmp al, r14b
jne 0x100014daf
movabs rdx, 0x2000000000010000
test qword [0x1000408e0], rdx
je 0x100014daf
mov rcx, qword [0x1000408e8]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100014daf
lea rdx, [0x100033140]
mov rcx, qword [0x1000400f0]
call fcn.100019be4
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionAppletsStickyNotes
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x100014e3a
mov rsi, qword [rsp + 0x50]
mov dword [rsp + 0x190], r14d
mov ecx, 4
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, ecx
xor r8d, r8d
lea rdx, str.Upgrade
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r14d
jne 0x100014e2b
lea rcx, str.Error_setting_upgrade_key
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp rsi, r14
je 0x100014e3a
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x100014e58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x100014e7b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x100014e9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x100014ec4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rbx, qword [rsp + 0x68]
cmp rbx, r14
je 0x100014f1e
mov rcx, rbx
call fcn.100022f40
mov rcx, qword [rbx + 0x10]
cmp rcx, r14
je 0x100014ee5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x100014ef4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
cmp eax, r14d
jg 0x100014f14
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x70]
cmp rcx, r14
je 0x10000f286
mov dl, r12b
call qword [sym.imp.DUI70.dll_public:_long_int___cdecl_DirectUI::Element::Destroy_bool____ptr64]
nop
jmp 0x10000f286
mov ecx, 0x80070057
call fcn.100018078
int3