Function at 0x14001e400
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x468]
sub rsp, 0x568
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rbp + 0x450], rax
xor r15d, r15d
mov qword [rbp + 0x448], 7
mov rax, r8
mov qword [rbp + 0x430], r15
mov qword [rbp + 0x440], r15
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x14001e450
mov qword [rsp + 0x580], rbx
lea rcx, [rbp + 0x430]
mov rdx, rax
mov qword [rsp + 0x598], rdi
call fcn.14001a700
mov edx, 0x4b
lea rcx, [rbp + 0x410]
call fcn.1400144e0
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x430]
call fcn.14001ece0
cmp rax, 0xffffffffffffffff
je 0x14001e53b
xorps xmm0, xmm0
lea rcx, [rbp + 0x2f8]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2f8], xmm0
movdqu xmmword [rbp + 0x308], xmm1
movdqu xmmword [rbp + 0x318], xmm0
call fcn.140024000
mov rcx, qword [rbp + 0x310]
test rcx, rcx
je 0x14001e527
mov rdx, qword [rbp + 0x320]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x14001e510
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb77
call fcn.140027b1c
xorps xmm0, xmm0
mov qword [rbp + 0x320], r15
movdqu xmmword [rbp + 0x310], xmm0
lea rcx, [rbp + 0x2f8]
call fcn.14001ec70
mov edi, r15d
jmp 0x14001e86d
mov dword [rbp + 0x2f0], r15d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp + 0x2f0]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, 0x4c
lea rcx, [rbp + 0x350]
mov rdi, rax
call fcn.1400144e0
mov ebx, r15d
cmp dword [rbp + 0x2f0], r15d
jle 0x14001e62d
nop dword [rax]
mov rdx, qword [rdi]
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x328], r15
mov qword [rbp + 0x338], r15
mov qword [rbp + 0x340], 7
inc r8
cmp word [rdx + r8*2], r15w
jne 0x14001e5a3
lea rcx, [rbp + 0x328]
call fcn.14001a700
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x328]
call fcn.14001ece0
test rax, rax
je 0x14001e93f
mov rdx, qword [rbp + 0x340]
cmp rdx, 8
jb 0x14001e61b
mov rcx, qword [rbp + 0x328]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e616
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb83
call fcn.140027b1c
inc ebx
add rdi, 8
cmp ebx, dword [rbp + 0x2f0]
jl 0x14001e580
xor eax, eax
lea rcx, [rbp + 0x2f8]
xor edx, edx
mov dword [rbp + 0x384], eax
mov dword [rbp + 0x3ac], eax
mov word [rbp + 0x3be], ax
mov dword [rbp + 0x3c9], eax
mov word [rbp + 0x3cd], ax
mov byte [rbp + 0x3cf], al
mov word [rbp + 0x405], ax
mov byte [rbp + 0x407], al
mov dword [rbp + 0x40c], eax
call fcn.1400144e0
cmp qword [rbp + 0x310], 8
lea rax, [rbp + 0x2f8]
xorps xmm0, xmm0
mov dword [rbp + 0x380], r15d
cmovae rax, qword [rbp + 0x2f8]
xor ecx, ecx
mov qword [rbp + 0x3a0], rcx
test rax, rax
mov qword [rbp + 0x3a4], rcx
lea rcx, [0x14006250c]
cmove rax, rcx
mov qword [rbp + 0x388], r15
movups xmmword [rbp + 0x390], xmm0
xor r9d, r9d
mov qword [rbp + 0x378], rax
lea rax, vtable.ServiceManager.0
mov qword [rbp + 0x3b0], r15
xor r8d, r8d
mov dword [rbp + 0x390], 0x110
xor ecx, ecx
mov dword [rbp + 0x394], 2
lea edx, [r9 + 1]
mov qword [rbp + 0x398], 0x185
mov dword [rbp + 0x3a0], r15d
mov dword [rbp + 0x3a8], r15d
mov dword [rbp + 0x3b8], r15d
mov word [rbp + 0x3bc], r15w
mov qword [rbp + 0x370], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xorps xmm0, xmm0
mov byte [rbp + 0x3c8], r15b
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3d0], xmm0
movdqa xmmword [rbp + 0x3e0], xmm1
movdqa xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x3c0], rax
mov dword [rbp + 0x400], r15d
mov byte [rbp + 0x404], r15b
mov dword [rbp + 0x408], r15d
call fcn.140021340
mov rdx, qword [rbp + 0x310]
cmp rdx, 8
jb 0x14001e7b9
mov rcx, qword [rbp + 0x2f8]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e7b4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb7d
call fcn.140027b1c
lea rax, [rbp + 0x370]
mov qword [rbp + 0x308], r15
mov qword [0x14006e870], rax
lea rcx, [rbp + 0x2f8]
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x2f8], rax
lea rax, [0x140020f90]
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x310], r15
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
lea rcx, [rbp + 0x3c8]
mov edi, r15d
call fcn.14001eba0
mov rdx, qword [rbp + 0x368]
cmp rdx, 8
jb 0x14001e853
mov rcx, qword [rbp + 0x350]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e84e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb71
call fcn.140027b1c
mov qword [rbp + 0x360], r15
mov qword [rbp + 0x368], 7
mov word [rbp + 0x350], r15w
mov rdx, qword [rbp + 0x428]
cmp rdx, 8
jb 0x14001e8b3
mov rcx, qword [rbp + 0x410]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e8ae
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb71
call fcn.140027b1c
mov rdx, qword [rbp + 0x448]
mov qword [rbp + 0x420], r15
mov qword [rbp + 0x428], 7
mov word [rbp + 0x410], r15w
cmp rdx, 8
jb 0x14001e913
mov rcx, qword [rbp + 0x430]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e90e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb71
call fcn.140027b1c
mov rbx, qword [rsp + 0x580]
mov eax, edi
mov rdi, qword [rsp + 0x598]
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.140027ad0
add rsp, 0x568
pop r15
pop rbp
ret
mov r8, qword [rbp + 0x338]
lea rcx, [rbp + 0x328]
mov rax, qword [rbp + 0x360]
cmp r8, rax
cmovb rax, r8
cmp qword [rbp + 0x340], 8
cmovae rcx, qword [rbp + 0x328]
sub r8, rax
mov qword [rbp + 0x338], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.140029d40
cmp qword [rbp + 0x340], 8
lea rcx, [rbp + 0x328]
lea r8, [rbp + 0x348]
cmovae rcx, qword [rbp + 0x328]
lea rdx, [0x1400624e8]
call fcn.14001eee0
cmp eax, 1
jne 0x14001eb21
mov qword [rsp + 0x588], rsi
lea edx, [rax + 0x21]
mov esi, dword [rbp + 0x348]
lea rcx, [rbp + 0x2f8]
mov qword [rsp + 0x560], r14
lea edi, [rax + 1]
call fcn.1400144e0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
nop word [rax + rax]
mov rbx, r15
nop dword [rax]
nop word [rax + rax]
cmp qword [rbp + 0x310], 8
lea r8, [rbp + 0x2f8]
mov rdx, rbx
cmovae r8, qword [rbp + 0x2f8]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x14001eaa9
lea rdx, [rbp + 0x2f4]
mov dword [rbp + 0x2f4], r15d
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rbp + 0x2f4], esi
jne 0x14001ea00
xor eax, eax
lea rcx, [rsp + 0x34]
xor edx, edx
mov dword [rsp + 0x24], eax
mov r8d, 0x3bc
call fcn.14002a3f0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x3d0
mov ecx, 2
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], 1
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
cmp eax, 1
jne 0x14001ea96
mov edi, r15d
jmp 0x14001ea00
cmp edi, 2
jne 0x14001ea00
mov edi, 1
jmp 0x14001ea00
test edi, edi
je 0x14001eacd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r14d
cmp eax, 0x2bf20
ja 0x14001eacd
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001e9f0
mov rdx, qword [rbp + 0x310]
mov r14, qword [rsp + 0x560]
mov rsi, qword [rsp + 0x588]
cmp rdx, 8
jb 0x14001eb26
mov rcx, qword [rbp + 0x2f8]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001eb1a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb89
call fcn.140027b1c
jmp 0x14001eb26
mov edi, 3
mov rdx, qword [rbp + 0x340]
cmp rdx, 8
jb 0x14001e80d
mov rcx, qword [rbp + 0x328]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001eb67
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb8f
call fcn.140027b1c
jmp 0x14001e80d
call fcn.14002e468
int3
call fcn.14002e468
int3
call fcn.14002e468
int3
call fcn.14002e468
int3
call fcn.14002e468
int3
call fcn.14002e468
int3