Function at 0x1400cee50
Capabilities:
Accept command line arguments
Query service status

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r13
sub rsp, 0x320
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x310], rax
xor r13d, r13d
mov r12d, edx
cmp dword [0x14020dd3c], r13d
jne 0x1400cef9a
mov qword [0x14020e210], rcx
call fcn.1400b3b00
call fcn.1400e3850
call fcn.14016bd60
call fcn.14000a600
call fcn.1400bd530
call fcn.1400b5040
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
lea rdx, str.ole_initialize:__08x_n
mov ecx, 0xffffff00
mov r8d, eax
mov edi, eax
call fcn.1400b3fe0
lea rcx, [rsp + 0x100]
call fcn.140177280
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x100]
mov rdx, rax
call fcn.140178050
mov rcx, qword [rsp + 0x108]
xor r8d, r8d
xor edx, edx
call fcn.140006780
lea rcx, [rsp + 0x100]
mov qword [0x14020e1d0], rax
call fcn.14017d580
mov r9, qword [0x14020e1d0]
mov ecx, dword [r9]
bt ecx, 0xd
jae 0x1400cef52
mov r8d, dword [r9 + 4]
mov rax, qword [r9 + 0x80]
mov r9, qword [r9 + 0x78]
mov edx, ecx
and r8d, 0x40000
and ecx, 8
and edx, 0x1000000
mov qword [rsp + 0x20], rax
call fcn.1400f0a50
jmp 0x1400cf5f5
bt ecx, 0x11
jae 0x1400cef6c
call fcn.140005670
test eax, eax
je 0x1400cf5f5
xor eax, eax
jmp 0x1400cf6c5
bt ecx, 0xe
jae 0x1400cef9e
call fcn.1400db310
test eax, eax
jne 0x1400cef9e
xor ecx, ecx
call fcn.1400ce2e0
test eax, eax
jne 0x1400cf5f5
mov ebx, 1
mov dword [0x14020e1c8], ebx
jmp 0x1400cf5f5
mov edi, dword [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x34], 0x42ff
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.14000cc10
mov rcx, qword [0x14020e1d0]
cmp qword [rcx + 0x68], r13
je 0x1400cefe4
mov rcx, qword [rcx + 0x68]
call fcn.14000cc00
mov r8d, dword [0x1401fccc0]
test r8d, r8d
jle 0x1400cf032
mov ecx, dword [0x140203a50]
mov eax, 0x2aaaaaab
imul ecx, r8d
imul ecx
mov eax, 0x2aaaaaab
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x140203a54]
mov dword [0x140203a50], edx
imul ecx, r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [0x140203a54], edx
cmp byte [0x14020df3c], r13b
je 0x1400cf063
call fcn.1400db310
test eax, eax
jne 0x1400cf063
xor ecx, ecx
call fcn.1400ce2e0
test eax, eax
jne 0x1400cf5f5
mov ebx, 1
mov dword [0x14020e1c8], ebx
jmp 0x1400cf5f5
mov eax, dword [0x14020e118]
cmp byte [0x14020df3b], r13b
mov ebx, 1
cmovne eax, ebx
cmp byte [0x14020df3a], r13b
mov dword [0x14020e118], eax
jne 0x1400cf094
mov rax, qword [0x14020e1d0]
bt dword [rax], 0x18
jae 0x1400cf09b
xor ecx, ecx
call fcn.1400b44d0
cmp byte [0x14020df39], r13b
je 0x1400cf0ab
mov ecx, ebx
call fcn.1400b43a0
call fcn.1400b4010
lea rdx, str.load_localization_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
mov r11, qword [0x14020e1d0]
mov ecx, dword [0x14020dd7c]
mov eax, dword [r11 + 0xa4]
cmp eax, 0xffffffff
cmovne ecx, eax
call fcn.1400cb440
mov r11, qword [0x14020e1d0]
test byte [r11], 8
je 0x1400cf0fb
mov ecx, ebx
call fcn.1400b43a0
mov r11, qword [0x14020e1d0]
bt dword [r11 + 4], 0x12
jae 0x1400cf10b
mov dword [0x14020e118], ebx
jmp 0x1400cf121
mov eax, dword [0x14020e118]
bt dword [r11 + 8], 0x12
cmovb eax, r13d
mov dword [0x14020e118], eax
lea rdx, str.ole_initialize:__08x_n
mov r8d, edi
mov ecx, 0xffffff00
call fcn.1400b3fe0
mov r11, qword [0x14020e1d0]
bt dword [r11], 0xc
jae 0x1400cf14f
call fcn.140011800
mov r11, qword [0x14020e1d0]
cmp dword [r11 + 0xb0], 4
jne 0x1400cf2c3
call fcn.1400db310
test eax, eax
jne 0x1400cf2c3
lea r8d, [rax + 4]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x350], rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, r13
test rax, rax
mov rsi, rax
mov rdi, r13
je 0x1400cf212
lea rcx, [rsp + 0x100]
call fcn.1400eba30
lea rdx, [rsp + 0x100]
mov r8d, 4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
je 0x1400cf212
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x68]
mov r9d, 0x24
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400cf212
mov r8d, dword [rsp + 0x84]
test r8d, r8d
je 0x1400cf201
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
jmp 0x1400cf212
mov rax, qword [0x14020e1d0]
mov dword [rax + 0xb0], 5
mov rax, qword [0x14020e1d0]
cmp dword [rax + 0xb0], 4
jne 0x1400cf283
lea rcx, [fcn.1400b5040]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x340], rbp
call fcn.1400eb5c0
test rax, rax
mov rbp, rax
je 0x1400cf26a
mov rcx, rax
call fcn.1400eb590
test eax, eax
je 0x1400cf260
mov rcx, qword [0x14020e1d0]
mov dword [rcx + 0xb0], 5
mov rcx, rbp
call fcn.1400e9180
jmp 0x1400cf27b
mov rax, qword [0x14020e1d0]
mov dword [rax + 0xb0], 5
mov rbp, qword [rsp + 0x340]
test rdi, rdi
je 0x1400cf29f
mov edx, 0xea60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400cf2ad
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1400cf2bb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x350]
call fcn.1400ce920
call fcn.1400cd130
test eax, eax
jne 0x1400cf5f5
mov rax, qword [0x14020e1d0]
cmp dword [rax + 0xc4], r13d
je 0x1400cf31f
call fcn.1400e18b0
call fcn.1400dadc0
lea rdx, str.load_everything_icon_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
call fcn.1400cc610
mov r11, qword [0x14020e1d0]
mov edx, dword [r11 + 0xc4]
xor ecx, ecx
call fcn.1401660e0
jmp 0x1400cf5f5
lea rdx, str.create_mutex_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
cmp byte [0x14020dd61], r13b
jne 0x1400cf356
mov ecx, r12d
call fcn.1400ce760
test eax, eax
jne 0x1400cf356
lea rcx, str.mutex_exists_n
call fcn.1400b3fb0
jmp 0x1400cf5f5
mov rax, qword [0x14020e1d0]
mov ecx, dword [rax]
test cl, 4
je 0x1400cf38d
test cl, 0x40
jne 0x1400cf38d
bt ecx, 0x10
jb 0x1400cf38d
bt ecx, 0x1b
jb 0x1400cf38d
bt dword [rax + 4], 0x1a
jb 0x1400cf38d
bt dword [rax + 8], 0x1a
jb 0x1400cf38d
cmp qword [rax + 0x70], r13
je 0x1400cf5f5
call fcn.1400e18b0
call fcn.1400dadc0
lea rdx, str.load_everything_icon_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
call fcn.1400cc610
lea rdx, str.bookmarks_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
call fcn.1400043a0
lea rdx, str.filters_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
call fcn.1400c18c0
lea rdx, str.search_history_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
call fcn.1400e8ca0
lea rdx, str.set_hook_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [0x1400ce6c0]
mov r9d, eax
xor r8d, r8d
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
lea rdx, str.create_tray_n
mov ecx, 0xffffff00
mov rbx, rax
call fcn.1400b3fe0
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x90], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
movzx ecx, word [rsp + 0xd0]
test byte [rsp + 0xcc], 1
cmove cx, r12w
mov word [rsp + 0xd0], cx
movzx ecx, cx
call fcn.1400f5ae0
lea rdx, str.enter_main_loop_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
nop
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400cf5dc
cmp dword [0x14020e118], r13d
je 0x1400cf4d8
mov rax, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
lea rdx, str.MSG:__p__04x__p__p_n
mov ecx, 0xff00ff00
mov qword [rsp + 0x20], rax
call fcn.1400b3fe0
cmp dword [rsp + 0x40], 0x12
je 0x1400cf5ec
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400cf5ec
lea rcx, [rsp + 0x38]
call fcn.14010b7a0
test eax, eax
jne 0x1400cf480
lea rcx, [rsp + 0x38]
call fcn.140150020
test eax, eax
jne 0x1400cf480
lea rcx, [rsp + 0x38]
call fcn.14011c830
test eax, eax
jne 0x1400cf480
lea rcx, [rsp + 0x38]
call fcn.14012cbe0
test eax, eax
jne 0x1400cf480
lea rcx, [rsp + 0x38]
call fcn.140163740
test eax, eax
jne 0x1400cf480
cmp dword [rsp + 0x40], 0x100
jne 0x1400cf5c1
cmp qword [rsp + 0x48], 0x41
jne 0x1400cf5c1
call fcn.1400e1840
cmp eax, 1
jne 0x1400cf5c1
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x100]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, str.Edit
lea rcx, [rsp + 0x100]
call fcn.14017d130
test eax, eax
jne 0x1400cf5c1
mov rcx, qword [rsp + 0x38]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400cf480
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400cf480
call fcn.1400fca90
call qword [sym.imp.USER32.dll_WaitMessage]
jmp 0x1400cf480
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea rdx, str.shutdown_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
call fcn.14012ffd0
call fcn.1400ff0b0
call fcn.1400bb5f0
call fcn.1400c8830
call fcn.1400cae60
call fcn.1400f35d0
mov rcx, qword [0x14020e1c0]
test rcx, rcx
je 0x1400cf63d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14020e1c0], r13
cmp byte [0x14020e1b8], r13b
je 0x1400cf64b
call fcn.1400ce0c0
lea rdx, str.kill_n
mov ecx, 0xffffff00
call fcn.1400b3fe0
call fcn.1400e8c40
call fcn.1400c1240
call fcn.140004080
mov rcx, qword [0x14020e1d0]
call fcn.140005dd0
mov rcx, qword [0x14020e218]
test rcx, rcx
je 0x1400cf689
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [0x14020e220]
test rcx, rcx
je 0x1400cf69b
call qword [sym.imp.GDI32.dll_DeleteObject]
call qword [sym.imp.ole32.dll_OleUninitialize]
call fcn.1400cbd10
call fcn.1400bd540
call fcn.14000d5a0
call fcn.14016be60
call fcn.1400d8b30
call fcn.1400b4320
mov eax, dword [0x14020e1c8]
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1401a8fb0
mov rbx, qword [rsp + 0x358]
add rsp, 0x320
pop r13
pop r12
pop rdi
ret