Function at 0x140009cf0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x88
movzx r13d, byte [0x140170441]
mov rax, qword [0x140170450]
movsxd r12, ecx
or r13b, byte [0x140170440]
mov qword [rsp + 0xd8], rax
mov byte [rsp + 0xc8], r13b
jne 0x140009e96
xor al, al
cmp qword [0x14016f9b0], 0
mov ebx, 1
movzx esi, al
cmovne esi, ebx
cmp qword [0x14016f9b8], 0
je 0x140009d52
or sil, 2
test sil, sil
je 0x14000aec9
xor r12d, r12d
mov edi, r12d
mov ecx, dword [0x14016e50c]
mov r9, rbx
xor r8d, r8d
mov edx, 0x417
call qword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x140009d8c
lea ecx, [rax + 0xa]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x32
jl 0x140009d61
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
nop word [rax + rax]
mov rcx, qword [0x140170410]
lea rdx, [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0xc8], 0x103
jne 0x140009ddb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1f4
ja 0x140009df4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009da0
mov rcx, qword [0x140170410]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140170410], r12
call fcn.14000b540
cmp qword [0x14016f9b0], r12
je 0x140009e24
test bl, sil
jne 0x140009e3d
lea rcx, str.___9
call fcn.1400dd2e0
xor edx, edx
xor ecx, ecx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140170400], rax
jmp 0x140009e3d
test bl, sil
je 0x140009e3d
mov rcx, qword [0x140170400]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140170400], r12
cmp qword [0x14016f9b8], r12
je 0x140009e74
test sil, 2
jne 0x140009e8e
lea rcx, [0x14012de58]
call fcn.1400dd2e0
xor edx, edx
xor ecx, ecx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test bpl, bpl
mov qword [0x140170408], rax
jmp 0x14000ae95
test sil, 2
je 0x140009e8e
mov rcx, qword [0x140170408]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140170408], r12
test bpl, bpl
jmp 0x14000ae95
mov rdi, qword [0x140170430]
test rdi, rdi
jne 0x14000a026
mov ecx, 0x1800
call fcn.1401094b8
mov qword [0x140170430], rax
test rax, rax
je 0x14000a012
mov ecx, 0x3000
call fcn.1401094b8
mov qword [0x140170438], rax
test rax, rax
je 0x14000a012
mov ecx, 0x20000
call fcn.1401094b8
mov qword [0x140170418], rax
test rax, rax
je 0x14000a012
mov ecx, 0x40000
call fcn.1401094b8
mov rbp, rax
mov qword [0x140170420], rax
test rax, rax
je 0x14000a012
movsxd rcx, dword [0x14017044c]
add rcx, rcx
call fcn.1401084ac
mov rbx, rax
mov qword [0x140170428], rax
test rax, rax
je 0x14000a012
mov rdi, qword [0x140170430]
xor edx, edx
mov r8d, 0x1800
mov rcx, rdi
call fcn.14010ec60
mov rsi, qword [0x140170438]
xor edx, edx
mov rcx, rsi
mov r8d, 0x3000
call fcn.14010ec60
mov byte [rdi + 0x1a4], 3
mov byte [rdi + 0xf3c], 1
mov byte [rdi + 0xf54], 2
mov byte [rdi + 0x1bc], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov byte [rdi + 0xf6c], 4
mov byte [rdi + 0xf84], 8
mov byte [rdi + 0x18c], gethostbyname
mov byte [rdi + 0xf0c], 0x10
mov byte [rdi + 0xf24], 0x20
mov byte [rdi + 0x894], 0x40
mov byte [rdi + 0x8ac], 0x80
mov byte [rsi + 0x2c4], 1
mov byte [rsi + 0x1ac4], 2
mov byte [rsi + 0x54c], 4
mov byte [rsi + 0x1d4c], 8
mov byte [rsi + 0x3fc], 0x10
mov byte [rsi + 0x1d1c], 0x20
mov byte [rsi + 0x2094], 0x40
mov byte [rsi + 0x20ac], 0x80
lea rax, [0x140169c0c]
mov qword [rdi + 0xd98], rax
lea rax, str._a_a_v
mov qword [rdi + 0x1e0], rax
lea rax, [0x140169bfc]
mov qword [rdi + 0xd80], rax
jmp 0x14000a03b
add rsp, 0x88
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.14000b540
mov rsi, qword [0x140170438]
mov rbp, qword [0x140170420]
mov rbx, qword [0x140170428]
mov qword [rsp + 0xc0], r14
lea rax, [rdi + 0xd]
mov ecx, 0x40
mov qword [rsp + 0x80], r15
mov r9d, 0x7fff
nop word [rax + rax]
and byte [rax + 3], 8
and byte [rax + 0x1b], 8
and byte [rax + 0x33], 8
and byte [rax + 0x4b], 8
mov word [rax - 3], r9w
mov word [rax], 0
mov byte [rax + 2], 0
mov byte [rax + 0xa], 0
mov word [rax + 0x15], r9w
mov word [rax + 0x18], 0
mov byte [rax + 0x1a], 0
mov byte [rax + 0x22], 0
mov word [rax + 0x2d], r9w
mov word [rax + 0x30], 0
mov byte [rax + 0x32], 0
mov byte [rax + 0x3a], 0
mov word [rax + 0x45], r9w
mov word [rax + 0x48], 0
mov byte [rax + 0x4a], 0
mov byte [rax + 0x52], 0
add rax, 0x60
dec rcx
jne 0x14000a060
lea rax, [rsi + 0xd]
mov ecx, pe_nt_image_headers64
nop dword [rax]
and byte [rax + 3], 8
and byte [rax + 0x1b], 8
and byte [rax + 0x33], 8
and byte [rax + 0x4b], 8
mov word [rax - 3], r9w
mov word [rax], 0
mov byte [rax + 2], 0
mov byte [rax + 0xa], 0
mov word [rax + 0x15], r9w
mov word [rax + 0x18], 0
mov byte [rax + 0x1a], 0
mov byte [rax + 0x22], 0
mov word [rax + 0x2d], r9w
mov word [rax + 0x30], 0
mov byte [rax + 0x32], 0
mov byte [rax + 0x3a], 0
mov word [rax + 0x45], r9w
mov word [rax + 0x48], 0
mov byte [rax + 0x4a], 0
mov byte [rax + 0x52], 0
add rax, 0x60
dec rcx
jne 0x14000a0d0
lea rdx, [0x1401727a8]
lea edi, [rcx + 0xd]
mov r8d, 0x1fe
movzx ecx, word [rdx]
lea eax, [rcx - 1]
cmp ax, r8w
ja 0x14000a15c
movzx eax, cx
lea rcx, [rax + rax*2]
mov byte [rsi + rcx*8 + 0x17], 1
add rdx, 0x10
dec rdi
jne 0x14000a144
mov rdi, qword [0x140170418]
movzx eax, r9w
mov ecx, 0x10000
rep stosw word [rdi], ax
movzx eax, r9w
mov rdi, rbp
mov ecx, 0x20000
rep stosw word [rdi], ax
xor eax, eax
cmp dword [0x14017044c], eax
jle 0x14000a1b2
nop word [rax + rax]
mov word [rbx], r9w
inc eax
add rbx, 2
cmp eax, dword [0x14017044c]
jl 0x14000a1a0
mov rax, qword [0x140169c40]
movzx ecx, word [rax]
mov eax, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1401094b8
xor r15d, r15d
xor r14d, r14d
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0x30], rax
test r12d, r12d
jle 0x14000a9f8
mov rbx, qword [0x140170430]
mov rsi, qword [0x140170438]
mov r13, rax
add r13, 6
mov ecx, 0x1ff
mov r8d, 0x8000
mov qword [rsp + 0x40], r13
nop dword [rax + rax]
mov rax, qword [rsp + 0xd8]
mov rdi, qword [rax + r14*8]
movzx eax, byte [rdi + 0x12]
test al, al
je 0x14000a47b
cmp al, 4
jae 0x14000a47b
cmp byte [0x14016f9ea], 0
je 0x14000a272
mov rcx, rdi
call fcn.1400060e0
mov rbx, qword [0x140170430]
mov rsi, qword [0x140170438]
test al, al
je 0x14000a47b
mov ecx, 0x1ff
mov r8d, 0x8000
cmp word [rdi + 6], 0
je 0x14000a2c9
cmp byte [rdi + 0x19], 0
sete al
test al, al
jne 0x14000a47b
movzx edx, byte [rdi + 0x10]
test dl, dl
jne 0x14000a29b
cmp word [rdi + 8], 0
je 0x14000a47b
cmp dl, 0xff
ja 0x14000a47b
movzx eax, word [rdi + 8]
cmp ax, cx
ja 0x14000a47b
test dl, dl
jne 0x14000a2ea
movzx eax, ax
lea rcx, [rax + rax*2]
lea rbp, [rsi + rcx*8]
mov byte [rbp + 0x17], 1
jmp 0x14000a3ce
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x14000a47b
cmp byte [rax + 0x28], 0
jne 0x14000a288
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14000a2d6
jmp 0x14000a47b
movzx eax, dl
lea rcx, [rax + rax*2]
lea rbp, [rbx + rcx*8]
movzx ecx, dl
sub ecx, 0x10
je 0x14000a390
dec ecx
je 0x14000a350
dec ecx
jne 0x14000a3ce
mov byte [rbx + 0xf6e], 1
mov byte [rbx + 0xf86], 1
mov byte [rsi + 0x54e], 1
mov byte [rsi + 0x1d4e], 1
cmp byte [rdi + 0x16], cl
je 0x14000a3ce
mov byte [rbx + 0xf6f], 1
mov byte [rbx + 0xf87], 1
mov byte [rsi + 0x54f], 1
mov byte [rsi + 0x1d4f], 1
jmp 0x14000a3ce
mov byte [rbx + 0xf3e], 1
mov byte [rbx + 0xf56], 1
mov byte [rsi + 0x2c6], 1
mov byte [rsi + 0x1ac6], 1
cmp byte [rdi + 0x16], 0
je 0x14000a3ce
mov byte [rbx + 0xf3f], 1
mov byte [rbx + 0xf57], 1
mov byte [rsi + 0x2c7], 1
mov byte [rsi + 0x1ac7], 1
jmp 0x14000a3ce
mov byte [rbx + 0xf0e], 1
mov byte [rbx + 0xf26], 1
mov byte [rsi + 0x3fe], 1
mov byte [rsi + 0x1d1e], 1
cmp byte [rdi + 0x16], 0
je 0x14000a3ce
mov byte [rbx + 0xf0f], 1
mov byte [rbx + 0xf27], 1
mov byte [rsi + 0x3ff], 1
mov byte [rsi + 0x1d1f], 1
mov byte [rbp + 0xe], 1
cmp byte [rdi + 0x16], 0
movzx r12d, word [rdi + 4]
je 0x14000a3e5
mov byte [rbp + 0xf], 1
or r12w, r8w
movzx ecx, byte [rdi + 0x11]
test cl, cl
jne 0x14000a3f8
cmp word [rdi + 0xa], 0
jne 0x14000a3f8
xor al, al
jmp 0x14000a3fa
mov al, 1
cmp byte [rbp + 0xc], 0
je 0x14000a551
cmp byte [rdi + 0xf], 0
jne 0x14000a551
test al, al
jne 0x14000a559
test byte [rdi + 0x13], 2
jne 0x14000a42c
movzx edx, word [rdi + 8]
movzx ecx, byte [rdi + 0x10]
xor r8d, r8d
call fcn.140009a80
cmp byte [rdi + 0xf], 0
jne 0x14000a43c
test byte [rdi + 0x13], 2
je 0x14000a43c
or byte [rbp + 0x10], 1
movzx eax, word [rdi + 6]
test ax, ax
cmovne r12w, ax
inc r15d
add r13, 0xc
mov word [r13 - 8], r12w
movzx eax, byte [rdi + 0x10]
mov byte [r13 - 0xc], al
movzx eax, word [rdi + 8]
mov word [r13 - 0xa], ax
mov eax, dword [rdi]
mov dword [r13 - 0x12], eax
movzx eax, byte [rdi + 0xe]
mov byte [r13 - 0xe], al
movzx eax, byte [rdi + 0x15]
mov byte [r13 - 0xd], al
inc r14
mov ecx, 0x1ff
mov r8d, 0x8000
cmp r14, qword [rsp + 0xd0]
jl 0x14000a220
test r15d, r15d
je 0x14000a9ef
mov rcx, qword [rsp + 0x30]
movsxd rdi, r15d
lea r9, [0x1400098e0]
mov rdx, rdi
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x38], rdi
call fcn.140109580
test r15d, r15d
jle 0x14000a9ef
mov rbx, qword [0x140170418]
mov r15, qword [0x140170420]
mov r12, qword [0x140170428]
mov r8, qword [rsp + 0x40]
mov edx, 0x7ff9
add rbx, 0x14a
lea rdi, [r15 + 0x270]
mov r9d, 8
mov r10d, 0xc0
mov qword [rsp + 0x48], rbx
lea ecx, [rdx + 6]
nop dword [rax]
movzx ebp, word [r8 + 4]
movzx eax, bp
and bp, cx
shr ax, 0xf
and al, 1
mov word [rsp + 0xd0], ax
cmp bp, dx
ja 0x14000a6f4
movzx eax, byte [r8]
test al, al
je 0x14000a683
movzx eax, al
lea rcx, [rax + rax*2]
mov rax, qword [0x140170430]
jmp 0x14000a693
test al, al
je 0x14000a42c
test cl, cl
je 0x14000a62f
movzx eax, cl
lea rdx, [rax + rax*2]
cmp byte [rbx + rdx*8 + 0xc], 0
je 0x14000a615
lea eax, [rcx - 0x10]
cmp al, 2
ja 0x14000a607
movzx ecx, cl
sub ecx, 0x10
je 0x14000a5e2
dec ecx
je 0x14000a5ba
dec ecx
jne 0x14000a66e
mov byte [rbx + 0x1bd], 2
mov byte [rbx + 0xf6d], 2
mov byte [rbx + 0xf85], 2
mov byte [rsi + 0x54d], 2
mov byte [rsi + 0x1d4d], 2
jmp 0x14000a66e
mov byte [rbx + 0x1a5], 2
mov byte [rbx + 0xf3d], 2
mov byte [rbx + 0xf55], 2
mov byte [rsi + 0x2c5], 2
mov byte [rsi + 0x1ac5], 2
jmp 0x14000a66e
mov byte [rbx + 0x18d], 2
mov byte [rbx + 0xf0d], 2
mov byte [rbx + 0xf25], 2
mov byte [rsi + 0x3fd], 2
mov byte [rsi + 0x1d1d], 2
jmp 0x14000a66e
movzx eax, cl
lea rcx, [rax + rax*2]
mov byte [rbx + rcx*8 + 0xd], 1
jmp 0x14000a66e
mov byte [rbx + rdx*8 + 0xd], 1
test byte [rdi + 0x13], 1
je 0x14000a66e
movzx eax, byte [rdi + 0x11]
lea rcx, [rax + rax*2]
or byte [rbx + rcx*8 + 0x10], 1
jmp 0x14000a66e
movzx eax, word [rdi + 0xa]
lea rcx, [rax + rax*2]
cmp byte [rsi + rcx*8 + 0xc], 0
je 0x14000a649
lea rcx, [rax + rax*2]
mov byte [rsi + rcx*8 + 0xd], 1
jmp 0x14000a66e
mov byte [rsi + rcx*8 + 0xd], 1
test byte [rdi + 0x13], 1
je 0x14000a661
movzx eax, word [rdi + 0xa]
lea rcx, [rax + rax*2]
or byte [rsi + rcx*8 + 0x10], 1
movzx eax, word [rdi + 0xa]
lea rcx, [rax + rax*2]
mov byte [rsi + rcx*8 + 0x17], 1
movzx eax, word [rbp + 0xa]
mov word [rdi + 0xc], ax
movzx eax, word [rdi + 4]
mov word [rbp + 0xa], ax
jmp 0x14000a47b
movzx eax, word [r8 + 2]
lea rcx, [rax + rax*2]
mov rax, qword [0x140170438]
lea rdx, [rax + rcx*8]
mov r10d, 0x7fff
add rdx, 0xa
cmp word [rdx], r10w
je 0x14000a6d5
mov r9, qword [rsp + 0xd8]
nop
movzx eax, word [rdx]
mov rcx, qword [r9 + rax*8]
cmp byte [rcx + 0x11], 0
jne 0x14000a6c4
cmp word [rcx + 0xa], 0
je 0x14000a6cf
cmp word [rcx + 0xc], r10w
lea rdx, [rcx + 0xc]
jne 0x14000a6b0
mov r9d, 8
mov rcx, qword [rsp + 0xd8]
movzx eax, bp
mov r10d, 0xc0
mov rcx, qword [rcx + rax*8]
movzx eax, word [rdx]
mov word [rcx + 0xc], ax
mov word [rdx], bp
movzx ecx, byte [r8 - 2]
mov edx, dword [r8 - 6]
mov r14d, edx
test cl, cl
je 0x14000a72b
test cl, 0xc0
mov eax, 0
cmovne eax, r9d
test cl, 0xc
je 0x14000a718
or eax, 1
test cl, 0x30
je 0x14000a720
or eax, 4
test cl, 3
je 0x14000a728
or eax, 2
or r14d, eax
xor al, al
cmp byte [r8 - 1], al
jne 0x14000a756
test dl, 8
movzx eax, al
cmovne eax, r10d
test dl, 1
je 0x14000a744
or al, 0xc
test dl, 2
je 0x14000a74b
or al, 3
test dl, 4
je 0x14000a752
or al, 0x30
or al, cl
not al
xor r9d, r9d
xor esi, esi
movzx r13d, al
xor r10d, r10d
mov r11, rdi
test r9d, r13d
jne case.0x14000a902.19
test r9b, 0xc0
mov eax, 0
mov ecx, 8
cmovne eax, ecx
test r9b, 0xc
je 0x14000a788
or eax, 1
test r9b, 0x30
je 0x14000a791
or eax, 4
test r9b, 3
je 0x14000a79a
or eax, 2
and eax, r14d
cmp r14d, eax
jne case.0x14000a902.19
cmp byte [r8 - 2], 0
je 0x14000a7bf
movzx ecx, byte [r8 - 2]
mov eax, ecx
and eax, r9d
cmp ecx, eax
jne case.0x14000a902.19
movzx eax, byte [r8]
test al, al
jne 0x14000a857
movzx eax, word [r8 + 2]
mov ecx, 0x7fff
add eax, r10d
movsxd rdi, eax
movzx edx, word [r15 + rdi*2]
cmp dx, cx
jne 0x14000a7f4
movzx eax, word [r8 + 4]
mov word [r15 + rdi*2], ax
jmp 0x14000a998
movzx eax, dx
shr ax, 0xf
and al, 1
cmp byte [rsp + 0xd0], 0
je 0x14000a81d
test al, al
jne 0x14000a838
movzx eax, word [r8 + 4]
and rdx, rcx
mov word [r12 + rdx*2], ax
jmp 0x14000a998
test al, al
je 0x14000a838
movzx eax, bp
mov word [r12 + rax*2], dx
movzx eax, word [r8 + 4]
mov word [r15 + rdi*2], ax
jmp 0x14000a998
and rdx, rcx
movzx ecx, bp
movzx eax, word [r12 + rdx*2]
mov word [r12 + rcx*2], ax
movzx eax, word [r8 + 4]
mov word [r15 + rdi*2], ax
jmp case.0x14000a902.19
mov rcx, qword [0x140170418]
movzx eax, al
add eax, esi
movsxd rdi, eax
mov eax, 0x7fff
movzx edx, word [rcx + rdi*2]
cmp dx, ax
je 0x14000a8cc
movzx eax, dx
shr ax, 0xf
and al, 1
cmp byte [rsp + 0xd0], 0
je 0x14000a8a2
test al, al
jne 0x14000a8b0
movzx eax, word [r8 + 4]
mov ecx, 0x7fff
and rdx, rcx
mov word [r12 + rdx*2], ax
jmp 0x14000a998
test al, al
je 0x14000a8b0
movzx eax, bp
mov word [r12 + rax*2], dx
jmp 0x14000a8cc
mov eax, 0x7fff
movzx ecx, bp
and rdx, rax
movzx eax, word [r12 + rdx*2]
mov word [r12 + rcx*2], ax
mov rcx, qword [0x140170418]
movzx eax, word [r8 + 4]
mov word [rcx + rdi*2], ax
movzx eax, byte [r8]
add eax, 0xfffffff0
cmp eax, 0x95
ja case.0x14000a902.19
lea rdx, sym.MZ_b_4ix__UH3tlIju_n3bu_bRSDz8e8_6O__LTLn_u_28Wnitpw
cdqe
movzx eax, byte [rdx + rax + 0xaef8]
mov ecx, dword [rdx + rax*4 + 0xaedc]
add rcx, rdx
jmp rcx
movzx eax, word [r8 + 4]
mov word [rbx - 2], ax
movzx eax, word [r8 + 4]
mov word [r11 - 0x200], ax
cmp byte [r8], 0xa4
je case.0x14000a902.19
movzx eax, word [r8 + 4]
mov word [rbx], ax
movzx eax, word [r8 + 4]
mov word [r11], ax
jmp case.0x14000a902.19
movzx eax, word [r8 + 4]
mov word [rbx - 0xa], ax
movzx eax, word [r8 + 4]
mov word [r11 - 0x21c], ax
cmp byte [r8], 0xa0
je case.0x14000a902.19
movzx eax, word [r8 + 4]
mov word [rbx - 8], ax
movzx eax, word [r8 + 4]
mov word [r11 - 4], ax
jmp case.0x14000a902.19
movzx eax, word [r8 + 4]
mov word [rbx - 6], ax
movzx eax, word [r8 + 4]
mov word [r11 - 0x236], ax
cmp byte [r8], 0xa2
je case.0x14000a902.19
movzx eax, word [r8 + 4]
mov word [rbx - 4], ax
movzx eax, word [r8 + 4]
mov word [r11 - 0x36], ax
mov ecx, 0x7fff
add r10d, 0x200
inc r9d
add esi, 0x100
add rbx, 0x200
add r11, 0x400
cmp r10d, 0x1fe00
jle 0x14000a765
mov rbx, qword [rsp + 0x48]
add r8, 0xc
dec qword [rsp + 0x38]
lea rdi, [r15 + 0x270]
mov edx, 0x7ff9
mov r9d, 8
mov r10d, 0xc0
jne 0x14000a510
movzx r13d, byte [rsp + 0xc8]
mov rcx, qword [rsp + 0x30]
call fcn.140109878
mov rdx, qword [0x140170430]
mov r15, qword [rsp + 0x80]
cmp byte [rdx + 0x18e], 0
mov r14, qword [rsp + 0xc0]
mov r9d, 0x7fff
je 0x14000aa99
movzx r8d, word [rdx + 0x18a]
cmp r8w, r9w
je 0x14000aa99
lea rax, [rdx + 0xf0a]
movzx ecx, word [rax]
cmp cx, r9w
je 0x14000aa65
mov rdi, qword [0x140170450]
nop dword [rax]
movzx eax, cx
mov rax, qword [rdi + rax*8]
movzx ecx, word [rax + 0xc]
add rax, 0xc
cmp cx, r9w
jne 0x14000aa50
mov word [rax], r8w
lea rax, [rdx + 0xf22]
movzx ecx, word [rax]
cmp cx, r9w
je 0x14000aa95
mov rdi, qword [0x140170450]
movzx eax, cx
mov rax, qword [rdi + rax*8]
movzx ecx, word [rax + 0xc]
add rax, 0xc
cmp cx, r9w
jne 0x14000aa80
mov word [rax], r8w
cmp byte [rdx + 0x1a6], 0
je 0x14000ab19
movzx r8d, word [rdx + reloc.OLEAUT32.dll_OleCreatePictureIndirect]
cmp r8w, r9w
je 0x14000ab19
lea rax, [rdx + 0xf3a]
movzx ecx, word [rax]
cmp cx, r9w
je 0x14000aae5
mov rdi, qword [0x140170450]
nop word [rax + rax]
movzx eax, cx
mov rax, qword [rdi + rax*8]
movzx ecx, word [rax + 0xc]
add rax, 0xc
cmp cx, r9w
jne 0x14000aad0
mov word [rax], r8w
lea rax, [rdx + 0xf52]
movzx ecx, word [rax]
cmp cx, r9w
je 0x14000ab15
mov rdi, qword [0x140170450]
movzx eax, cx
mov rax, qword [rdi + rax*8]
movzx ecx, word [rax + 0xc]
add rax, 0xc
cmp cx, r9w
jne 0x14000ab00
mov word [rax], r8w
cmp byte [rdx + 0x1be], 0
je 0x14000ab99
movzx r8d, word [rdx + 0x1ba]
cmp r8w, r9w
je 0x14000ab99
lea rax, [rdx + 0xf6a]
movzx ecx, word [rax]
cmp cx, r9w
je 0x14000ab65
mov rdi, qword [0x140170450]
nop word [rax + rax]
movzx eax, cx
mov rax, qword [rdi + rax*8]
movzx ecx, word [rax + 0xc]
add rax, 0xc
cmp cx, r9w
jne 0x14000ab50
mov word [rax], r8w
lea rax, [rdx + 0xf82]
movzx ecx, word [rax]
cmp cx, r9w
je 0x14000ab95
mov rdx, qword [0x140170450]
movzx eax, cx
mov rax, qword [rdx + rax*8]
movzx ecx, word [rax + 0xc]
add rax, 0xc
cmp cx, r9w
jne 0x14000ab80
mov word [rax], r8w
xor al, al
cmp qword [0x14016f9b0], 0
mov ebx, 1
movzx esi, al
cmovne esi, ebx
cmp qword [0x14016f9b8], 0
je 0x14000abbc
or sil, 2
cmp r13b, sil
je 0x14000aec9
xor r12d, r12d
test sil, sil
jne 0x14000ac13
lea rax, [0x14016e50c]
lea r8, [0x14000b190]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov edx, 0x2000
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140170410], rax
test rax, rax
je 0x14000aca2
lea edx, [r12 + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edi, r12d
movzx ebp, r13b
nop word [rax + rax]
mov ecx, dword [0x14016e50c]
mov r9, rbx
mov r8, rbp
mov edx, 0x417
call qword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x14000ac4b
lea ecx, [rax + 0xa]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x32
jl 0x14000ac20
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
test r13b, r13b
je 0x14000ad2e
mov r9d, 0x417
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, r9d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14000ad50
cmp qword [rsp + 0x60], 0
je 0x14000adfc
movzx edi, bl
call fcn.14000b510
test al, al
jne 0x14000adfc
xor r13b, r13b
jmp 0x14000ac56
mov rcx, qword [0x140170430]
test rcx, rcx
je 0x14000acba
call fcn.140109878
mov qword [0x140170430], r12
mov rcx, qword [0x140170438]
test rcx, rcx
je 0x14000acd2
call fcn.140109878
mov qword [0x140170438], r12
mov rcx, qword [0x140170418]
test rcx, rcx
je 0x14000acea
call fcn.140109878
mov qword [0x140170418], r12
mov rcx, qword [0x140170420]
test rcx, rcx
je 0x14000ad02
call fcn.140109878
mov qword [0x140170420], r12
mov rcx, qword [0x140170428]
test rcx, rcx
je 0x14000aec9
call fcn.140108f48
mov qword [0x140170428], r12
add rsp, 0x88
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [0x140170410]
lea rdx, [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0xc8], 0x103
jne 0x14000ad70
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x1f4
ja 0x14000adfc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000ac56
mov rcx, qword [0x140170410]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140170430]
mov qword [0x140170410], r12
test rcx, rcx
je 0x14000ad9c
call fcn.140109878
mov qword [0x140170430], r12
mov rcx, qword [0x140170438]
test rcx, rcx
je 0x14000adb4
call fcn.140109878
mov qword [0x140170438], r12
mov rcx, qword [0x140170418]
test rcx, rcx
je 0x14000adcc
call fcn.140109878
mov qword [0x140170418], r12
mov rcx, qword [0x140170420]
test rcx, rcx
je 0x14000ade4
call fcn.140109878
mov qword [0x140170420], r12
mov rcx, qword [0x140170428]
test rcx, rcx
je 0x14000adfc
call fcn.140108f48
mov qword [0x140170428], r12
cmp qword [0x14016f9b0], 0
je 0x14000ae2d
test bl, sil
jne 0x14000ae46
lea rcx, str.___9
call fcn.1400dd2e0
xor edx, edx
xor ecx, ecx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140170400], rax
jmp 0x14000ae46
test bl, sil
je 0x14000ae46
mov rcx, qword [0x140170400]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140170400], r12
cmp qword [0x14016f9b8], 0
je 0x14000ae78
test sil, 2
jne 0x14000ae92
lea rcx, [0x14012de58]
call fcn.1400dd2e0
xor edx, edx
xor ecx, ecx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140170408], rax
jmp 0x14000ae92
test sil, 2
je 0x14000ae92
mov rcx, qword [0x140170408]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140170408], r12
test dil, dil
je 0x14000aec9
lea rcx, str._r__434_z
mov dword [0x140169afc], r12d
call fcn.1400dd2e0
xor r8d, r8d
mov edx, 0x10000
xorpd xmm3, xmm3
mov rcx, rax
mov qword [rsp + 0x20], r12
call fcn.1400ec710
mov dword [0x140169afc], ebx
add rsp, 0x88
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret