Function at 0x140006de0
Capabilities:
Accept command line arguments
Check mutex on windows
Delete directory
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x14006e538]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rcx
mov ebx, r9d
lea rcx, str.Shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140006e32
lea rdx, str.SetProcessDpiAwareness
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006e32
mov ecx, 2
call rax
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xb0], r15
call sub.MAGNIFICATION.dll_MagInitialize
test eax, eax
je 0x140007284
call fcn.1400040a0
mov qword [rax], rdi
call fcn.1400040a0
mov dword [rax + 8], ebx
call fcn.1400040a0
mov rcx, rax
call fcn.14000d540
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r14
mov r8, 0xffffffffffffffff
mov qword [rbp + 7], r14
inc r8
cmp byte [rax + r8], r14b
jne 0x140006ea3
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.140002110
mov r15, qword [rbp + 7]
lea rdi, [rbp - 0x11]
mov rsi, qword [rbp - 0x11]
cmp r15, 0x10
mov rax, qword [rbp - 1]
cmovae rdi, rsi
cmp rax, 0x10
jb 0x140006f41
lea r14, [rax + rdi]
mov edx, 0x64
lea r8, [r14 - 0xf]
mov rcx, rdi
sub r8, rdi
call fcn.1400252e0
mov rbx, rax
test rax, rax
je 0x140006f3e
movabs r12, 0x6f636574656c6564
movabs r13, 0x656c69666769666e
nop word [rax + rax]
cmp qword [rbx], r12
jne 0x140006f1f
cmp qword [rbx + 8], r13
je 0x140007026
inc rbx
lea r8, [r14 - 0xf]
sub r8, rbx
mov rcx, rbx
mov edx, 0x64
call fcn.1400252e0
mov rbx, rax
test rax, rax
jne 0x140006f10
xor r14d, r14d
mov rbx, 0xffffffffffffffff
cmp r15, 0x10
jb 0x140006f7f
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140006f77
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000744c
mov rcx, rsi
call fcn.14002321c
cmp rbx, 0xffffffffffffffff
je 0x1400072c5
lea rdx, str.APPDATA
lea rcx, [rbp - 0x11]
call fcn.14001fd20
mov r14, qword [rbp - 1]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, r14
cmp rax, 0x1a
jb 0x140007452
cmp qword [rbp + 7], 0x10
lea r12, [rbp - 0x11]
mov ebx, 0xf
lea r15, [r14 + 0x1a]
cmovae r12, qword [rbp - 0x11]
lea rsi, [rbp - 0x31]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov edi, ebx
movabs rax, 0x8000000000000000
lea ecx, [rbx + 7]
movups xmmword [rbp - 0x31], xmm0
movdqu xmmword [rbp - 0x21], xmm1
cmp r15, rbx
jbe 0x140007069
mov rdi, r15
or rdi, rbx
cmp rdi, r13
jbe 0x140007031
mov rdi, r13
add rax, 0x27
mov rcx, rax
call fcn.1400231e0
test rax, rax
je 0x140007458
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140007065
sub rbx, rdi
xor r14d, r14d
jmp 0x140006f48
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140007054
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140007440
jmp 0x140007007
test rcx, rcx
je 0x140007063
call fcn.1400231e0
mov rsi, rax
jmp 0x140007065
xor esi, esi
mov qword [rbp - 0x31], rsi
mov r8, r14
mov qword [rbp - 0x21], r15
mov rdx, r12
mov qword [rbp - 0x19], rdi
mov rcx, rsi
call fcn.140025480
movups xmm0, xmmword [str.DarkModeAnyAppCONFIG.ini]
lea rcx, [rbp - 0x31]
movups xmmword [rsi + r14], xmm0
movsd xmm1, qword [0x140054230]
movsd qword [rsi + r14 + 0x10], xmm1
movzx eax, word [0x140054238]
mov word [rsi + r14 + 0x18], ax
mov byte [rsi + r15], 0
cmp qword [rbp - 0x19], 0x10
cmovae rcx, qword [rbp - 0x31]
call fcn.14002a394
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x1400070fa
mov rcx, qword [rbp - 0x31]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400070f5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007458
call fcn.14002321c
mov rsi, qword [rbp - 1]
mov rax, r13
sub rax, rsi
cmp rax, rbx
jb 0x14000745e
cmp qword [rbp + 7], 0x10
lea r15, [rbp - 0x11]
lea r14, [rsi + 0xf]
xorps xmm0, xmm0
cmovae r15, qword [rbp - 0x11]
lea rdi, [rbp - 0x31]
xorps xmm1, xmm1
movups xmmword [rbp - 0x31], xmm0
movdqu xmmword [rbp - 0x21], xmm1
cmp r14, rbx
jbe 0x1400071b1
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x140007173
movabs rax, 0x8000000000000000
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.1400231e0
test rax, rax
je 0x140007464
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400071ad
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000719c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140007446
jmp 0x140007154
test rcx, rcx
je 0x1400071ab
call fcn.1400231e0
mov rdi, rax
jmp 0x1400071ad
xor edi, edi
mov qword [rbp - 0x31], rdi
mov r8, rsi
mov qword [rbp - 0x21], r14
mov rdx, r15
mov qword [rbp - 0x19], rbx
mov rcx, rdi
call fcn.140025480
movsd xmm0, qword [str.DarkModeAnyApp]
lea rcx, [rbp - 0x31]
movsd qword [rdi + rsi], xmm0
mov eax, dword [0x140054248]
mov dword [rdi + rsi + 8], eax
movzx eax, word [0x14005424c]
mov word [rdi + rsi + 0xc], ax
movzx eax, byte [0x14005424e]
mov byte [rdi + rsi + 0xe], al
mov byte [rdi + r14], 0
cmp qword [rbp - 0x19], 0x10
cmovae rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x140007249
mov rcx, qword [rbp - 0x31]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007244
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007464
call fcn.14002321c
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140007284
mov rcx, qword [rbp - 0x11]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000727f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000743a
call fcn.14002321c
xor eax, eax
mov r15, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400237f0
add rsp, 0xc0
pop rdi
pop rbx
pop rbp
ret
movzx eax, word [0x140054268]
lea r8, [rbp + 0xf]
movups xmm0, xmmword [str.com_topiary_darkmodeanyapp]
mov edx, 1
mov word [rbp + 0x27], ax
movsd xmm1, qword [0x140054260]
xor ecx, ecx
movzx eax, byte [0x14005426a]
mov byte [rbp + 0x29], al
movups xmmword [rbp + 0xf], xmm0
movsd qword [rbp + 0x1f], xmm1
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140007418
mov qword [rsp + 0x30], r14
lea rcx, str..pipeDarkModeAnyAppPipe
mov dword [rsp + 0x28], r14d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400073e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_opening_named_pipe:
mov ebx, eax
lea rcx, [0x140071170]
call fcn.140001e60
mov rcx, rax
mov edx, ebx
call fcn.140003ba0
mov rdi, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov rcx, qword [rdx + rax + 0x40]
mov rbx, qword [rcx + 8]
mov rcx, rbx
mov qword [rbp - 0x29], rbx
mov rdx, qword [rbx]
call qword [rdx + 8]
lea rcx, [rbp - 0x31]
call fcn.1400029d0
mov dl, 0xa
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x40]
movzx esi, al
test rbx, rbx
je 0x1400073c9
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
test rax, rax
je 0x1400073c9
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, sil
mov rcx, rdi
call fcn.140006c20
mov rcx, rdi
call fcn.140006a00
mov eax, 1
jmp 0x140007286
lea r9, [rbp - 0x39]
mov qword [rsp + 0x20], r14
mov r8d, 0xb
lea rdx, str.ShowConfig
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400073dd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007284
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.1400040a0
mov dword [rax + 0x48], ebx
call fcn.1400040a0
mov rcx, rax
call fcn.14000f5b0
jmp 0x140007286
call fcn.140029c74
int3
call fcn.140005710
int3
call fcn.140005710
int3
call fcn.140029c74
int3
call fcn.140005750
int3
call fcn.140029c74
int3
call fcn.140005750
int3
call fcn.140029c74
int3