Function at 0x100006dcc
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
xor r13d, r13d
mov qword [0x10000b7f0], r13
lea rax, [0x10000b800]
mov qword [0x10000b7e0], rax
lea r14d, [r13 + 1]
mov byte [0x10000b7f8], r14b
mov byte [0x10000b7f9], r13b
mov word [0x10000b7fa], r13w
mov dword [0x10000b7fc], r13d
mov qword [0x10000b810], r13
mov qword [0x10000b800], r13
mov byte [0x10000b818], r14b
mov byte [0x10000b819], r13b
mov word [0x10000b81a], r13w
mov dword [0x10000b81c], r13d
lea rax, [0x100001700]
mov qword [0x10000b820], rax
lea rax, [0x100001710]
mov qword [0x10000b828], rax
lea rbx, [0x10000b7e0]
mov qword [0x10000b190], rbx
lea rdi, [0x10000b820]
mov r8, qword [rdi]
add rdi, 8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r13
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov rdx, rbx
lea rcx, [0x1000064a0]
call sub.ntdll.dll_EtwRegisterTraceGuidsW
mov rbx, qword [rbx]
cmp rbx, r13
jne 0x100006e83
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbp, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, r14d
movsxd rbx, eax
mov r15d, 2
mov rax, r15
mul rbx
lea r12, [r15 - 3]
cmovo rax, r12
mov rcx, rax
call qword [sym.imp.wbemcomn.dll_public:_static_void____ptr64___cdecl_CWin32DefaultArena::WbemMemAlloc_unsigned_long_long_unsigned___int64__]
mov rsi, rax
cmp rax, r13
jne 0x100006f57
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
lea rbx, [0x10000b190]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x100006f4d
test byte [rcx + 0x1c], r14b
je 0x100006f4d
cmp byte [rcx + 0x19], r15b
jb 0x100006f4d
lea edx, [r15 + 0x13]
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.100002318
call fcn.10000654c
jmp 0x1000077ec
mov edi, r13d
cmp rbx, r13
je 0x100006f68
cmp rbx, 0x7fffffff
jbe 0x100006f6d
mov edi, 0x80070057
cmp edi, r13d
jl 0x10000779f
mov rcx, rax
mov edi, r13d
cmp rbx, r13
je 0x100006faf
mov edx, 0x7ffffffe
sub rdx, rbx
sub rbp, rax
lea rax, [rbx + rdx]
cmp rax, r13
je 0x100006faa
movzx eax, word [rcx + rbp]
cmp ax, r13w
je 0x100006faa
mov word [rcx], ax
add rcx, r15
sub rbx, r14
jne 0x100006f8c
cmp rbx, r13
jne 0x100006fb7
sub rcx, r15
mov edi, 0x8007007a
mov word [rcx], r13w
cmp edi, r13d
jl 0x10000779f
mov rbx, rsi
mov ebp, 0x19
lea edx, [rbp + 7]
cmp word [rsi], r13w
je 0x100007044
lea edi, [rbp + 0x66]
movzx ecx, word [rbx]
cmp cx, di
ja 0x100006fed
lea eax, [rcx - 0x61]
cmp ax, bp
ja 0x100007038
sub cx, dx
jmp 0x100007038
mov word [rsp + 0xc0], cx
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r8, [rsp + 0xc0]
mov edx, 0x200
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov cx, word [rsp + 0xc8]
cmp eax, r13d
cmove cx, word [rsp + 0xc0]
mov edx, 0x20
mov word [rbx], cx
add rbx, r15
cmp word [rbx], r13w
jne 0x100006fd8
mov rcx, qword [0x10000b850]
mov rax, qword [rcx]
call qword [rax]
mov edi, eax
cmp eax, r13d
jge 0x1000070aa
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
lea rbx, [0x10000b190]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x1000070a0
test byte [rcx + 0x1c], r14b
je 0x1000070a0
cmp byte [rcx + 0x19], r15b
jb 0x1000070a0
mov edx, 0x17
mov r9d, edi
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
call fcn.10000654c
jmp 0x1000077ec
lea rdx, [0x100001df0]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsstr]
mov ecx, r13d
cmp rax, r13
setne cl
cmp ecx, r13d
jne 0x100007651
lea rdx, [0x100001e08]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsstr]
mov ecx, r13d
cmp rax, r13
setne cl
cmp ecx, r13d
jne 0x100007651
lea rdx, [0x100001e20]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsstr]
mov ecx, r13d
cmp rax, r13
setne cl
cmp ecx, r13d
jne 0x100007514
lea rdx, [0x100001e40]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsstr]
mov ecx, r13d
cmp rax, r13
setne cl
cmp ecx, r13d
jne 0x100007514
lea rdx, [0x100001e60]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsstr]
mov ecx, r13d
cmp rax, r13
setne cl
cmp ecx, r13d
jne 0x10000716b
cmp dword [0x10000b958], r13d
jne 0x10000716b
lea rcx, [0x100001e78]
call qword [sym.imp.msvcrt.dll_printf]
jmp 0x100007798
mov rcx, qword [0x10000b850]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov esi, eax
cmp eax, r13d
jge 0x1000071d2
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
lea rbx, [0x10000b190]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x1000071c8
test byte [rcx + 0x1c], r14b
je 0x1000071c8
cmp byte [rcx + 0x19], r15b
jb 0x1000071c8
mov edx, 0x1e
mov r9d, esi
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
call fcn.10000654c
jmp 0x1000077ec
mov rbx, qword [0x10000b128]
lea rdi, [0x10000b128]
cmp rbx, rdi
je 0x10000732b
mov ecx, 0x28
call qword [sym.imp.wbemcomn.dll_public:_static_void____ptr64___cdecl_CWin32DefaultArena::WbemMemAlloc_unsigned_long_long_unsigned___int64__]
mov rbp, rax
mov qword [rsp + 0xd0], rax
cmp rax, r13
je 0x100007245
mov rax, qword [rbx + 0x18]
lea rcx, [0x100001e98]
mov qword [rbp], rcx
lea rcx, [0x100001ec0]
mov qword [rbp + 8], rcx
mov dword [rbp + 0x10], r13d
lea r8, [rbp + 0x18]
mov qword [r8], r13
mov qword [rbp + 0x20], rax
lock add dword [rax + 8], r14d
lea rdx, [0x1000015e8]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.wbemcomn.dll_public:_long_int___cdecl_CUnkInternal::InternalQueryInterface_struct__GUID_const____ptr64__void____ptr64____ptr64____ptr64]
jmp 0x100007248
mov rbp, r13
cmp rbp, r13
je 0x1000072db
lea rax, [rbx + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8d, 0x15
mov rdx, rbp
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov ebp, eax
cmp eax, r13d
jl 0x100007288
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1000071e9
jmp 0x10000732b
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
lea rbx, [0x10000b190]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x1000072d1
test byte [rcx + 0x1c], r14b
je 0x1000072d1
cmp byte [rcx + 0x19], r15b
jb 0x1000072d1
mov edx, 0x20
mov r9d, ebp
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
call fcn.10000654c
jmp 0x1000077ec
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
lea rbx, [0x10000b190]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x100007321
test byte [rcx + 0x1c], r14b
je 0x100007321
cmp byte [rcx + 0x19], r15b
jb 0x100007321
mov edx, 0x1f
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.100002318
call fcn.10000654c
jmp 0x1000077ec
lea rbx, [0x10000b190]
cmp dword [0x10000b958], r13d
je 0x1000073c5
mov rax, qword [0x10000b960]
mov qword [rsp + 0x58], rax
lea rax, [0x10000691c]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rcx, [rsp + 0x58]
call qword [sym.imp.API_MS_WIN_Service_Core_L1_1_0.dll_StartServiceCtrlDispatcherW]
cmp eax, r13d
jne 0x1000073c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x1000073bb
test byte [rcx + 0x1c], r14b
je 0x1000073bb
cmp byte [rcx + 0x19], r15b
jb 0x1000073bb
mov edx, 0xf
mov r9d, esi
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
mov esi, r13d
jmp 0x1000073d6
mov esi, r14d
jmp 0x1000073d6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x10000b138], eax
call fcn.10000680c
mov rbp, qword [0x10000b128]
cmp rbp, rdi
je 0x100007445
mov ecx, dword [rbp + 0x30]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov r12d, eax
cmp eax, r13d
jge 0x100007438
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
or edx, 0xffffffff
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x100007435
test byte [rcx + 0x1c], r14b
je 0x100007435
cmp byte [rcx + 0x19], r15b
jb 0x100007435
mov edx, 0x22
mov r9d, r12d
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
mov esi, r12d
mov rbp, qword [rbp]
cmp rbp, rdi
jne 0x1000073e2
or r12, 0xffffffffffffffff
cmp esi, r13d
jge 0x100007495
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, esi
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x10000748b
test byte [rcx + 0x1c], r14b
je 0x10000748b
cmp byte [rcx + 0x19], r15b
jb 0x10000748b
mov edx, 0x23
mov r9d, esi
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
call fcn.10000654c
jmp 0x1000077ec
lea r9, [0x100006dbc]
xor edx, edx
xor ecx, ecx
mov r8d, 0x3e8
call qword [sym.imp.USER32.dll_SetTimer]
call fcn.10000680c
call fcn.1000063f0
mov edi, eax
cmp eax, r13d
jge 0x100007798
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x100007798
test byte [rcx + 0x1c], r14b
je 0x100007798
cmp byte [rcx + 0x19], r15b
jb 0x100007798
mov edx, 0x24
mov r9d, edi
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
jmp 0x100007798
mov rcx, qword [0x10000b850]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edi, eax
lea rbx, [0x10000b190]
cmp eax, r13d
jge 0x100007571
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x100007571
test byte [rcx + 0x1c], r14b
je 0x100007571
cmp byte [rcx + 0x19], r15b
jb 0x100007571
mov edx, 0x1b
mov r9d, edi
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
mov rsi, qword [0x10000b128]
lea rdi, [0x10000b128]
cmp rsi, rdi
je 0x1000075e1
lea rcx, [rsi - 8]
mov edx, r14d
call fcn.100005e7c
mov ebp, eax
cmp eax, r13d
jge 0x1000075d9
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x1000075d9
test byte [rcx + 0x1c], r14b
je 0x1000075d9
cmp byte [rcx + 0x19], r15b
jb 0x1000075d9
mov edx, 0x1c
mov r9d, ebp
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
mov rsi, qword [rsi]
cmp rsi, rdi
jne 0x100007584
cmp dword [0x10000b958], r13d
je 0x100007798
call fcn.100006c80
mov edi, eax
cmp eax, r13d
jge 0x100007798
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x100007798
test byte [rcx + 0x1c], r14b
je 0x100007798
cmp byte [rcx + 0x19], r15b
jb 0x100007798
mov edx, 0x1d
mov r9d, edi
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
jmp 0x100007798
mov rcx, qword [0x10000b850]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov edi, eax
cmp eax, r13d
jge 0x1000076b8
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
lea rbx, [0x10000b190]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x1000076ae
test byte [rcx + 0x1c], r14b
je 0x1000076ae
cmp byte [rcx + 0x19], r15b
jb 0x1000076ae
mov edx, 0x18
mov r9d, edi
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
call fcn.10000654c
jmp 0x1000077ec
mov rbx, qword [0x10000b128]
lea rdi, [0x10000b128]
cmp rbx, rdi
je 0x100007738
lea rcx, [rbx - 8]
mov edx, r14d
call fcn.1000057f4
mov esi, eax
cmp eax, r13d
jl 0x1000076e8
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1000076cb
jmp 0x100007738
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
lea rbx, [0x10000b190]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x10000772e
test byte [rcx + 0x1c], r14b
je 0x10000772e
cmp byte [rcx + 0x19], r15b
jb 0x10000772e
mov edx, ebp
mov r9d, esi
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
call fcn.10000654c
jmp 0x1000077ec
cmp dword [0x10000b958], r13d
je 0x100007798
call fcn.100006b00
cmp eax, r13d
jne 0x100007798
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
lea rbx, [0x10000b190]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x100007791
test byte [rcx + 0x1c], r14b
je 0x100007791
cmp byte [rcx + 0x19], r15b
jb 0x100007791
mov edx, 0x1a
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.100002318
call fcn.10000654c
jmp 0x1000077ec
call fcn.10000654c
jmp 0x1000077ec
call qword [sym.imp.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_]
mov rcx, rax
mov edx, edi
call qword [sym.imp.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64]
lea rbx, [0x10000b190]
mov rcx, qword [0x10000b190]
cmp rcx, rbx
je 0x1000077e7
test byte [rcx + 0x1c], r14b
je 0x1000077e7
cmp byte [rcx + 0x19], r15b
jb 0x1000077e7
mov edx, 0x16
mov r9d, edi
lea r8, [0x1000016b8]
mov rcx, qword [rcx + 0x10]
call fcn.10000387c
call fcn.10000654c
xor eax, eax
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret