Function at 0x10000239c
Capabilities:
Accept command line arguments
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x10000b170]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.ole32.dll_CoInitialize]
xor ebp, ebp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], 8
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 6
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea r12, [0x10000b890]
lea r11, [0x10000b180]
lea rdx, [0x10000b1b0]
mov rcx, r12
mov r8, rbx
mov qword [0x10000b958], r11
mov qword [0x10000b9e0], r12
mov dword [0x10000b890], 0xf8
mov dword [0x10000b940], 0x301
call fcn.100003c00
lea r14d, [rbp + 1]
cmp eax, ebp
jl 0x100002478
movdqu xmm0, xmmword [0x100001750]
mov dword [0x10000b980], r14d
movdqu xmmword [0x10000b9e8], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x88]
mov dword [0x10000b988], eax
mov eax, dword [0x1000017f8]
mov esi, ebp
mov dword [rcx], eax
movzx eax, word [0x1000017fc]
mov word [rcx + 4], ax
mov rcx, rdi
call fcn.100002324
mov r15d, 0xb0
jmp 0x1000024f5
lea rdx, [0x100001800]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebp
je 0x100002602
lea rdx, [0x100001818]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebp
je 0x100002560
lea rdx, [rsp + 0x88]
mov rcx, rbx
call fcn.100002324
mov rbx, rax
cmp rax, rbp
jne 0x1000024b9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x10000b990], rax
cmp rax, rbp
je 0x100002549
lea rax, [rsp + 0x50]
lea r8, [0x100002274]
mov r9, r12
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, rbp
je 0x100002549
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x10000b8b0]
cmp rbx, rbp
je 0x1000026ad
mov edi, ebp
jmp 0x10000269b
xor r9d, r9d
mov r8d, r14d
mov rcx, r12
lea edx, [r9 + 0x64]
call fcn.1000060a8
mov rbx, qword [0x10000b8b0]
cmp rbx, rbp
je 0x100002742
cmp qword [rbx], rbp
je 0x1000025f1
mov rax, qword [rbx + 0x30]
cmp rax, rbp
je 0x100002597
call rax
cmp rax, rbp
jne 0x1000025cf
mov ecx, r14d
call qword [rbx + 8]
cmp eax, ebp
mov esi, eax
jl 0x100002704
mov eax, dword [0x10000b890]
cmp eax, 0xf8
jne 0x1000025d5
call qword [rbx + 0x38]
mov rcx, qword [rbx]
mov r8d, r14d
mov rdx, rax
call fcn.1000037ac
cmp eax, ebp
mov esi, eax
jl 0x100002704
mov eax, dword [0x10000b890]
cmp eax, r15d
jne 0x1000025e0
add rbx, 0x38
jmp 0x1000025e4
add rbx, 0x48
cmp qword [rbx], rbp
jne 0x100002587
cmp esi, ebp
jl 0x100002704
xor edx, edx
mov rcx, r12
call fcn.1000035fc
mov esi, eax
jmp 0x100002704
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
lea edx, [r9 + 0x64]
call fcn.1000060a8
xor r8d, r8d
mov edx, r14d
mov rcx, r12
call fcn.100003aa8
jmp 0x1000025fb
cmp edi, ebp
jne 0x1000026ad
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x50], rbp
cmp rax, rbp
jne 0x10000263e
mov edi, ebp
jmp 0x100002688
mov rcx, qword [rbx + 0x18]
lea r8, [rsp + 0x50]
lea rdx, [0x1000014b0]
call rax
cmp eax, ebp
mov edi, eax
jl 0x100002678
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rbx]
lea rax, [rbx + 0x28]
mov r9d, r14d
mov r8d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov edi, eax
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x100002688
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp dword [0x10000b890], r15d
jne 0x100002697
add rbx, 0x38
jmp 0x10000269b
add rbx, 0x48
cmp qword [rbx], rbp
jne 0x100002624
jmp 0x1000026ad
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, ebp
jne 0x1000026a2
mov rbx, qword [0x10000b8b0]
cmp rbx, rbp
je 0x1000026f9
mov eax, ebp
jmp 0x1000026f4
cmp eax, ebp
jne 0x1000026f9
mov ecx, dword [rbx + 0x28]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
cmp dword [0x10000b890], r15d
jne 0x1000026f0
add rbx, 0x38
jmp 0x1000026f4
add rbx, 0x48
cmp qword [rbx], rbp
jne 0x1000026d4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [0x10000b8b0]
cmp rbx, rbp
je 0x100002742
jmp 0x10000273d
mov rcx, qword [rbx + 0x20]
cmp rcx, rbp
je 0x100002721
mov rax, qword [rcx]
call qword [rax + 0x10]
xor ecx, ecx
mov qword [rbx + 0x20], rbp
call qword [rbx + 0x40]
cmp dword [0x10000b890], r15d
jne 0x100002739
add rbx, 0x38
jmp 0x10000273d
add rbx, 0x48
cmp qword [rbx], rbp
jne 0x100002712
xor edx, edx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x58], rbp
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
mov ebx, 0x28
lea rdx, [rsp + 0x58]
lea rcx, [0x10000b8c8]
mov r8, rbx
call sub.msvcrt.dll_memcmp
cmp eax, ebp
je 0x100002781
lea rcx, [0x10000b8c8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rdx, [rsp + 0x58]
lea rcx, [0x10000b8f0]
mov r8, rbx
call sub.msvcrt.dll_memcmp
cmp eax, ebp
je 0x1000027a6
lea rcx, [0x10000b8f0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rdx, [rsp + 0x58]
lea rcx, [0x10000b918]
mov r8, rbx
call sub.msvcrt.dll_memcmp
cmp eax, ebp
je 0x1000027cb
lea rcx, [0x10000b918]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rdi, qword [0x10000b978]
cmp rdi, rbp
je 0x1000027f1
mov rcx, qword [rdi + 8]
call qword [rdi]
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call sub.msvcrt.dll_free
mov rdi, rbx
cmp rbx, rbp
jne 0x1000027d7
mov rcx, qword [0x10000b8c0]
cmp rcx, rbp
je 0x10000284a
cmp byte [0x10000b950], bpl
je 0x10000284a
mov rax, qword [0x10000b968]
cmp rax, rbp
je 0x100002844
mov edi, ebp
mov rbx, rbp
cmp qword [rbx + rax], rbp
je 0x10000282e
mov rcx, qword [rbx + rax]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov rax, qword [0x10000b968]
add edi, r14d
add rbx, 8
cmp edi, dword [0x10000b960]
jbe 0x100002817
mov rcx, qword [0x10000b8c0]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.100007a20
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret