Function at 0x140006910
Capabilities:
Check mutex on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3b8
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [0x1400e5fa8], rax
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x1400e5fb0], rax
call fcn.140008610
lea rsi, [0x1400e3a40]
mov qword [0x1400e5fa0], rsi
call fcn.140061580
call fcn.140061030
call fcn.140060800
call fcn.14005bb90
call fcn.14005a78c
call fcn.14005a35c
call fcn.140057028
call fcn.140054fa0
call fcn.140054810
call fcn.1400370b0
call fcn.1400365a8
lea rbx, [0x1400e6010]
mov rdx, rbx
lea rcx, [0x1400e5d00]
call fcn.140061120
call fcn.1400086c4
call fcn.1400367e8
call fcn.1400368e0
call fcn.1400366d4
mov qword [0x1400e5f28], rax
call fcn.14005bfd4
mov dword [rsp + 0x20], 0x200
lea r9, [0x1400e5ff0]
lea r8, [0x1400e20c0]
mov edx, 7
mov ecx, 0x40
call fcn.14005a1a0
mov dword [rsp + 0x20], 0x200
lea r9, [0x1400e5fe8]
xor r8d, r8d
mov edx, 0x15
mov ecx, 8
call fcn.14005a1a0
lea rcx, [0x1400e5e80]
call sub.KERNEL32.dll_InitializeCriticalSection
lea rdx, str.__0_9___
mov rcx, 0xffffffffffffffff
call fcn.140036b60
mov qword [0x1400e5eb8], rax
call fcn.1400366d4
mov qword [0x1400e5eb0], rax
call fcn.1400366d4
mov qword [0x1400e5ea8], rax
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.140061290
mov rdi, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rdi
call fcn.14005b110
lea rcx, str._rooConfig.json
call fcn.140061430
call fcn.1400613d0
call fcn.140061290
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x58], rbx
call fcn.140061090
lea r14, [rsp + 0xc0]
mov rdx, qword [rsp + 0xc0]
mov rcx, r14
call fcn.140061120
lea rcx, [rsp + 0x58]
mov rdx, qword [rsp + 0x58]
call fcn.140061120
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.1400613d0
mov rdi, qword [0x1400e5ff0]
call fcn.140061290
mov rdx, rax
mov rcx, rdi
call fcn.140059f5c
mov rdi, rax
call fcn.140061220
test rdi, rdi
je 0x140007270
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0xc0]
call fcn.1400613b0
mov rcx, qword [rsp + 0x58]
call fcn.1400613b0
call fcn.140061220
call sub.KERNEL32.dll_CreateTimerQueue
mov qword [0x1400e5ec0], rax
mov edx, 1
lea r12, str.config_program_kitShutdown_enable
mov rcx, r12
call fcn.140003650
test rax, rax
je 0x140007ad0
call fcn.1400366d4
mov qword [0x1400e5f88], rax
mov dword [rsp + 0x20], 0x200
lea r9, [0x1400e6008]
lea r8, [0x1400e2160]
mov edx, 7
mov ecx, 0x36
call fcn.14005a1a0
call fcn.140061090
mov edx, 1
lea rsi, str._.config.program.kitShutdown.periodicCheck
mov rcx, rsi
call fcn.140003650
test rax, rax
jne 0x140007b00
mov edx, 1
mov rcx, r12
call fcn.140003650
test rax, rax
je 0x140007b50
mov dword [rsp + 0x20], 0x200
lea r9, [0x1400e5ff8]
lea r8, [0x1400e2100]
mov edx, 7
mov ecx, 0x30
call fcn.14005a1a0
call fcn.1400366d4
mov qword [0x1400e5f20], rax
call fcn.140061090
mov edx, 1
mov rcx, rsi
call fcn.140003650
test rax, rax
jne 0x140007b80
mov edx, 1
lea rcx, str._.config.program.kitShutdown.periodicClear
call fcn.140003650
test rax, rax
jne 0x140007bd0
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x48
lea rsi, str.rooconfig.pbi
mov rdx, rsi
lea r15, [0x1400e3160]
mov rcx, r15
call fcn.140001990
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.140061290
mov rdi, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rdi
call fcn.14005b110
call fcn.140061290
mov rcx, rax
call fcn.14005b264
call fcn.140061220
call fcn.1400612c0
lea rdi, str.___WIN
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140003e60
call fcn.1400611d0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
lea rbp, [0x1400e3986]
mov rcx, rbp
call fcn.140061190
test eax, eax
je 0x140007c30
call fcn.1400612c0
call fcn.1400612c0
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140003e60
call fcn.1400611d0
lea rcx, [0x1400e3208]
call fcn.140061430
call fcn.140061290
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x57
mov rdx, rsi
call fcn.140001990
call fcn.140061220
call fcn.1400612c0
lea rdi, str.STRART
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.1400611d0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
mov rcx, rbp
call fcn.140061190
test eax, eax
je 0x140007cb0
call fcn.1400612c0
call fcn.1400612c0
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.1400611d0
lea rcx, [0x1400e3208]
call fcn.140061430
call fcn.140061290
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x58
mov rdx, rsi
call fcn.140001990
call fcn.140061220
call fcn.1400612c0
lea rdi, str.___VER
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.140061290
mov r13, rax
call fcn.1400611d0
mov edx, eax
mov rcx, r13
call fcn.140004280
call fcn.1400611d0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
mov rcx, rbp
call fcn.140061190
test eax, eax
je 0x140007d30
call fcn.1400612c0
call fcn.1400612c0
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.140061290
mov rdi, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rdi
call fcn.140004280
call fcn.1400611d0
lea rcx, [0x1400e3208]
call fcn.140061430
call fcn.140061290
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x5a
mov rdx, rsi
call fcn.140001990
call fcn.140061220
call fcn.1400612c0
lea r13, str.Hardware_ID
mov rcx, r13
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
movsxd rcx, eax
call fcn.1400613f0
call fcn.140061090
mov ecx, 0x14
mov rdi, qword [rsp + 0x48]
xor eax, eax
rep stosq qword [rdi], rax
xor eax, eax
mov word [rdi], ax
lea rcx, [rsp + 0xf0]
call sub.ADVAPI32.dll_GetCurrentHwProfileW
call fcn.1400612c0
lea rcx, [rsp + 0xf4]
mov edx, 0x27
call fcn.1400615b0
call fcn.140061290
call fcn.1400611d0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
mov rcx, rbp
call fcn.140061190
test eax, eax
je 0x140007df0
call fcn.1400612c0
call fcn.1400612c0
mov rcx, r13
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
movsxd rcx, eax
call fcn.1400613f0
call fcn.140061090
lea rdi, [rsp + 0x300]
mov ecx, 0x14
xor eax, eax
rep stosq qword [rdi], rax
xor r9d, r9d
mov word [rdi], r9w
lea rcx, [rsp + 0x300]
call sub.ADVAPI32.dll_GetCurrentHwProfileW
call fcn.1400612c0
lea rcx, [rsp + 0x304]
mov edx, 0x27
call fcn.1400615b0
call fcn.140061290
call fcn.1400611d0
lea rcx, [0x1400e3208]
call fcn.140061430
call fcn.140061290
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x5e
mov rdx, rsi
call fcn.140001990
call fcn.140061220
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x5f
mov rdx, rsi
mov rcx, r15
call fcn.140001990
xor edx, edx
lea rcx, str._.config.program.rooOutput.debugOutput.includeDebugInfo
call fcn.140003650
test al, al
setne byte [0x1400e5da9]
xor edx, edx
lea rcx, str._.config.program.rooOutput.debugOutput.includeCheckPoints
call fcn.140003650
test al, al
setne byte [0x1400e5da8]
lea rcx, str.config_servers_ftp_
call fcn.140005180
lea rcx, str.config_servers_email_
call fcn.140005180
mov dword [rsp + 0x20], 0x200
lea r9, [0x1400e5fc8]
lea r8, [0x1400e2030]
mov edx, 7
mov ecx, InitCommonControls
call fcn.14005a1a0
mov dword [rsp + 0x20], 0x200
lea r9, [0x1400e5fc0]
lea r8, [0x1400e2020]
mov edx, 7
mov ecx, 0x18
call fcn.14005a1a0
mov dword [rsp + 0x20], 0x200
lea r9, [0x1400e5fe0]
lea r8, [0x1400e20a0]
mov edx, 7
mov ecx, InitCommonControls
call fcn.14005a1a0
mov dword [rsp + 0x20], 0x200
lea r9, [0x1400e5fd8]
lea r8, [0x1400e2040]
mov edx, 7
mov ecx, 0x70
call fcn.14005a1a0
call fcn.140061090
lea rcx, [0x1400e5d80]
call sub.KERNEL32.dll_InitializeCriticalSection
mov dword [rsp + 0x20], 0x200
lea r9, [0x1400e5fd0]
xor r8d, r8d
mov edx, 7
mov ecx, 0x18
call fcn.14005a1a0
mov dword [rsp + 0x20], 0x200
lea r9, [0x1400e6000]
xor r8d, r8d
mov edx, 0x15
mov ecx, 8
call fcn.14005a1a0
lea r8, str.roo.kill
mov edx, 1
xor ecx, ecx
call sub.KERNEL32.dll_CreateMutexW
mov rcx, rax
mov qword [0x1400e5ef0], rax
test rax, rax
jne 0x140007f00
call sub.KERNEL32.dll_CloseHandle
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x34
lea rdx, [0x1400e3210]
lea rcx, str.ERROR:_Program_already_running
call fcn.140001990
call fcn.140061090
mov qword [rsp + 0x60], 0
mov edx, 1
mov rcx, r12
call fcn.140003650
test rax, rax
jne 0x140008020
mov ecx, 1
call fcn.140005a80
mov ecx, 1
call fcn.1400048f0
call fcn.140036558
call fcn.1400370a0
call fcn.140054a50
call fcn.140054f94
call fcn.140056fd0
call fcn.14005b248
call fcn.14005bb80
call fcn.14005fa6c
call fcn.140061020
mov rcx, qword [0x1400e5fb0]
call sub.KERNEL32.dll_HeapDestroy
movsxd rcx, dword [0x1400e5fb8]
call sub.KERNEL32.dll_ExitProcess
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call fcn.140061190
test eax, eax
je 0x1400073c8
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call fcn.140061190
test eax, eax
je 0x140007510
xor edx, edx
xor ecx, ecx
call fcn.14005713c
mov rsi, rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x1400076bd
mov rcx, qword [0x1400e5ea8]
mov rax, qword [0x1400ca570]
call qword [rax]
call fcn.1400612c0
mov rcx, qword [rsp + 0xc0]
call fcn.140061430
call fcn.1400613d0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
mov rsi, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rsi
call fcn.140061320
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
mov qword [rax + 0x10], 0
mov rcx, qword [0x1400e5ea8]
mov rax, qword [0x1400ca580]
call qword [rax]
call fcn.1400612c0
mov rcx, qword [rsp + 0x58]
call fcn.140061430
call fcn.1400613d0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
mov rsi, rax
call fcn.1400611d0
lea rcx, [rsi + 8]
mov edx, eax
call fcn.140061320
jmp 0x140006b2d
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0xc0]
call fcn.1400023f0
call fcn.1400611d0
mov edx, eax
mov rcx, r14
call fcn.140061320
mov rcx, qword [rsp + 0xc0]
call fcn.14005af58
test rax, rax
js 0x140007478
mov rcx, qword [0x1400e5ff0]
call fcn.140059de4
nop dword [rax + rax]
mov rcx, qword [0x1400e5ff0]
call fcn.140059e20
test rax, rax
je 0x140007288
mov rax, qword [0x1400e5ff0]
mov rax, qword [rax]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rsp + 0xc0]
call fcn.140061190
test eax, eax
je 0x140007418
mov rax, qword [0x1400e5ff0]
mov rax, qword [rax]
lea rdi, [rsp + 0xf0]
mov qword [rsp + 0x48], rdi
cmp qword [rax + 0x20], 0
jne 0x140006b2d
jmp 0x140007288
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0xc0]
call fcn.14005ae48
call fcn.140061290
mov rcx, rax
call fcn.14005af58
mov rdi, rax
call fcn.140061220
test rdi, rdi
js 0x140007407
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0xc0]
call fcn.14005ae48
call fcn.140061290
mov rdi, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rdi
call fcn.1400023f0
call fcn.1400611d0
mov edx, eax
mov rcx, r14
call fcn.140061320
jmp 0x140007407
mov rcx, qword [rsp + 0xc0]
call fcn.14005af58
test rax, rax
jle 0x140007648
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x1a0], rax
call fcn.140061090
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0xf0]
mov rcx, rax
call fcn.140061120
lea rcx, [rsp + 0x1a0]
mov rdx, qword [rsp + 0x1a0]
call fcn.140061120
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x300], rax
call fcn.140061090
lea rcx, [rsp + 0x250]
mov rdx, qword [rsp + 0x250]
call fcn.140061120
lea rcx, [rsp + 0x300]
mov rdx, qword [rsp + 0x300]
call fcn.140061120
mov rdx, qword [rsp + 0x250]
mov rcx, 0xffffffffffffffff
call fcn.14005b900
mov rdi, rax
test rax, rax
jne 0x140007a00
mov rcx, qword [rsp + 0x250]
call fcn.1400613b0
mov rcx, qword [rsp + 0x300]
call fcn.1400613b0
mov rcx, rdi
call fcn.140060c20
mov r8, rax
xor r9d, r9d
mov rdx, rdi
xor ecx, ecx
call fcn.1400571b0
mov rsi, rax
mov rcx, rdi
call fcn.140060df0
mov rcx, qword [rsp + 0xf0]
call fcn.1400613b0
mov rcx, qword [rsp + 0x1a0]
call fcn.1400613b0
jmp 0x1400072b9
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0xc0]
call fcn.14005b110
call fcn.140061290
mov rcx, rax
call fcn.14005af58
mov rsi, rax
call fcn.140061220
cmp rsi, 0xfffffffffffffffe
je 0x140007a88
xor r8d, r8d
mov rdx, qword [rsp + 0xc0]
xor ecx, ecx
call fcn.1400572c8
lea rsi, [rsp + 0xf0]
mov qword [rsp + 0x48], rsi
test rax, rax
jne 0x1400072c2
mov rdx, rbx
mov rcx, r14
call fcn.1400614a0
call fcn.1400612c0
mov rcx, qword [rsp + 0xc0]
call fcn.140061430
call fcn.1400613d0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
mov rsi, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rsi
call fcn.140061320
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
mov qword [rax + 0x10], 0
call fcn.140056918
mov rsi, rax
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
mov dword [rax + 0x20], esi
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.1400568f4
call fcn.1400613d0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
mov rsi, rax
call fcn.1400611d0
lea rcx, [rsi + 0x18]
mov edx, eax
call fcn.140061320
call fcn.140056934
mov rsi, rax
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
mov dword [rax + 0x24], esi
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
lea rcx, [rax + 0x30]
lea rsi, str.init
mov rdx, rsi
call fcn.1400614a0
call fcn.1400612c0
call fcn.1400612c0
lea rcx, str.JSON_ERROR
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
mov rcx, qword [rax + 0x18]
call fcn.140061430
call fcn.140061290
mov rcx, rax
mov qword [rsp + 0x20], rsi
lea r9, str.json
mov r8d, 0x1a8
lea rdi, str.jsondata.pbi
mov rdx, rdi
call fcn.140001990
call fcn.140061220
call fcn.1400612c0
call fcn.1400612c0
lea rcx, str.File
call fcn.140061430
mov rcx, qword [rsp + 0xc0]
call fcn.140061430
call fcn.140061290
mov rcx, rax
mov qword [rsp + 0x20], rsi
lea r9, str.json
mov r8d, 0x1a9
mov rdx, rdi
call fcn.140001990
call fcn.140061220
call fcn.1400612c0
call fcn.1400612c0
lea rcx, str.at_line
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
movsxd rbp, dword [rax + 0x20]
call fcn.1400611d0
mov edx, eax
mov rcx, rbp
call fcn.140058b90
call fcn.1400611d0
lea rcx, [0x1400e3a30]
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
xor ecx, ecx
call fcn.140058b90
call fcn.140061250
mov rdx, rax
mov rcx, qword [0x1400e5ff0]
call fcn.14005a014
movsxd rbp, dword [rax + 0x24]
call fcn.1400611d0
mov edx, eax
mov rcx, rbp
call fcn.140058b90
call fcn.1400611d0
call fcn.140061290
mov rcx, rax
mov qword [rsp + 0x20], rsi
lea r9, str.json
mov r8d, 0x1aa
mov rdx, rdi
call fcn.140001990
call fcn.140061220
jmp 0x140006b2d
mov rcx, rax
call fcn.14005bbc0
mov r12, rax
mov rcx, rax
call fcn.140060c40
mov rbp, rax
test rax, rax
jne 0x140007a30
mov rcx, rdi
call fcn.14005ba90
mov rdi, rbp
jmp 0x1400075e9
mov r8, r12
mov rdx, rax
mov rcx, rdi
call fcn.14005bc20
test rax, rax
je 0x140007a1b
mov r8d, 4
mov rdx, rsi
mov rcx, rbp
call fcn.140061050
test rax, rax
je 0x140007a1b
lea rdx, [rbp + 4]
mov r9d, 1
lea r8, [r12 - 4]
mov rcx, qword [rsp + 0x300]
call section..text
mov rsi, rax
mov rcx, rbp
call fcn.140060df0
mov rbp, rsi
jmp 0x140007a1b
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov edx, eax
mov rcx, qword [rsp + 0xc0]
call fcn.14005ae48
call fcn.140061290
mov rcx, rax
call fcn.14005b280
mov rsi, rax
call fcn.140061220
test rsi, rsi
je 0x14000768a
jmp 0x1400072a0
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x1b
lea rdx, str.ThreadKitMOD.pbi
lea rcx, str.__no_reThraed
call fcn.140001990
jmp 0x140006b72
mov edx, 0x493e0
lea rcx, str._.config.program.kitShutdown.periodMS
call fcn.140003430
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [fcn.140005a80]
mov rdx, qword [0x1400e5ec0]
lea rcx, [0x1400e5ed0]
call sub.KERNEL32.dll_CreateTimerQueueTimer
jmp 0x140006bc5
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x14
lea rdx, str.MemoryKitMOD.pbi
lea rcx, str._no_reMem
call fcn.140001990
jmp 0x140006bdb
mov edx, 0x493e0
lea rcx, str._.config.program.kitShutdown.periodMS
call fcn.140003430
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [fcn.1400048f0]
mov rdx, qword [0x1400e5ec0]
lea rcx, [0x1400e5ed8]
call sub.KERNEL32.dll_CreateTimerQueueTimer
jmp 0x140006c27
mov edx, 0x1d4c0
lea rcx, str._.config.program.kitShutdown.Memory.periodMS
call fcn.140003430
mov rsi, rax
mov edx, 0x493e0
lea rcx, str._.config.program.kitShutdown.Memory.ageMS
call fcn.140003430
mov r9, rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r8, [0x140001360]
mov rdx, qword [0x1400e5ec0]
lea rcx, [0x1400e5ee8]
call sub.KERNEL32.dll_CreateTimerQueueTimer
jmp 0x140006c41
call fcn.1400612c0
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140003e60
call fcn.1400611d0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
lea rcx, [0x1400e3982]
call fcn.140061190
test eax, eax
jne 0x140006d0d
call fcn.1400612c0
call fcn.1400612c0
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140003e60
call fcn.1400611d0
jmp 0x140006d46
call fcn.1400612c0
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.1400611d0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
lea rcx, [0x1400e3982]
call fcn.140061190
test eax, eax
jne 0x140006db9
call fcn.1400612c0
call fcn.1400612c0
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.1400611d0
jmp 0x140006df2
call fcn.1400612c0
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.140061290
mov r13, rax
call fcn.1400611d0
mov edx, eax
mov rcx, r13
call fcn.140004280
call fcn.1400611d0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
lea rcx, [0x1400e3982]
call fcn.140061190
test eax, eax
jne 0x140006e86
call fcn.1400612c0
call fcn.1400612c0
mov rcx, rdi
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.140061290
mov rdi, rax
call fcn.1400611d0
mov edx, eax
mov rcx, rdi
call fcn.140004280
call fcn.1400611d0
jmp 0x140006ee0
call fcn.1400612c0
mov rcx, r13
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
movsxd rcx, eax
call fcn.1400613f0
call fcn.140061090
lea rdi, [rsp + 0x1a0]
mov ecx, 0x14
xor eax, eax
rep stosq qword [rdi], rax
xor r11d, r11d
mov word [rdi], r11w
lea rcx, [rsp + 0x1a0]
call sub.ADVAPI32.dll_GetCurrentHwProfileW
call fcn.1400612c0
lea rcx, [rsp + 0x1a4]
mov edx, 0x27
call fcn.1400615b0
call fcn.140061290
call fcn.1400611d0
call fcn.1400613d0
call fcn.140061250
mov rdx, rax
lea rcx, [0x1400e3982]
call fcn.140061190
test eax, eax
jne 0x140006f96
call fcn.1400612c0
call fcn.1400612c0
mov rcx, r13
call fcn.140061430
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
movsxd rcx, eax
call fcn.1400613f0
call fcn.140061090
lea rdi, [rsp + 0x250]
mov ecx, 0x14
xor eax, eax
rep stosq qword [rdi], rax
xor r10d, r10d
mov word [rdi], r10w
lea rcx, [rsp + 0x250]
call sub.ADVAPI32.dll_GetCurrentHwProfileW
call fcn.1400612c0
lea rcx, [rsp + 0x254]
mov edx, 0x27
call fcn.1400615b0
call fcn.140061290
call fcn.1400611d0
jmp 0x140007017
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x1400e5ef0]
cmp rax, 0xb7
je 0x1400071ae
lea r9, str.rooShutdownSignal
mov r8d, 1
mov edx, 1
xor ecx, ecx
call sub.KERNEL32.dll_CreateEventW
mov qword [0x1400e5ee0], rax
mov ecx, 0x3e8
call fcn.140036b24
lea rcx, str.rooMonitor.exe
call fcn.1400067d0
test rax, rax
je 0x140007f80
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x3e
lea rsi, [0x1400e3210]
mov rdx, rsi
lea rcx, str.Monitor_killed
call fcn.140001990
jmp 0x140007fa8
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
mov r8d, 0x40
lea rsi, [0x1400e3210]
mov rdx, rsi
lea rcx, str.Monitor_not_killed
call fcn.140001990
lea rcx, str.ROOhtaccess.exe
call fcn.1400067d0
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e6010]
test rax, rax
jne 0x140008000
mov r8d, 0x46
mov rdx, rsi
lea rcx, str.htaccess_not_killed
call fcn.140001990
mov rcx, qword [0x1400e5ef0]
call sub.KERNEL32.dll_ReleaseMutex
mov rcx, qword [0x1400e5ef0]
call sub.KERNEL32.dll_CloseHandle
jmp 0x1400071d8
mov r8d, 0x44
mov rdx, rsi
lea rcx, str.htaccess_killed
call fcn.140001990
jmp 0x140007fda
mov edx, 1
lea rcx, str.config_program_kitShutdown_queryAtEnd
call fcn.140003650
test rax, rax
je 0x1400071fc
mov edx, 0x12c
lea rcx, str.config_program_MsgBoxTimeoutSeconds
call fcn.140003430
mov rdi, rax
xor ecx, ecx
call fcn.140005a80
test rax, rax
jle 0x1400084b0
call sub.KERNEL32.dll_CreateTimerQueue
mov rsi, rax
lea rbp, [0x140006640]
imul rax, rdi, 0x3e8
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call sub.KERNEL32.dll_CreateTimerQueueTimer
lea r13, str.Stop
lea r12, str.Wait
jmp 0x140008109
mov rdx, qword [0x1400e5f10]
mov rcx, rbx
call fcn.140061190
cmp eax, 1
mov eax, 3
sbb eax, 0xffffffff
jmp 0x140008277
mov ecx, 0x1f4
call fcn.140036b24
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0x493e0
mov qword [rsp + 0x20], 0x493e0
mov r9d, 1
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call sub.KERNEL32.dll_CreateTimerQueueTimer
xor ecx, ecx
call fcn.140005a80
test rax, rax
jle 0x140008498
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400612c0
call fcn.1400611d0
mov ecx, eax
call fcn.140054748
call fcn.140061290
mov r15, rax
call fcn.1400611d0
mov r8d, eax
mov edx, 1
mov rcx, r15
call fcn.14005ae54
lea rcx, str._finishing
call fcn.140061430
call fcn.140061290
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r12
lea rax, str.There_are_active_threads__possibly_still_doing_important_work._r_nDo_you_want_to_wait_or_stop_the_threads_
mov qword [rsp + 0x88], rax
call fcn.140061090
lea rcx, [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
call fcn.140061120
lea rcx, [rsp + 0x88]
mov rdx, qword [rsp + 0x88]
call fcn.140061120
lea rcx, [rsp + 0x80]
mov rdx, qword [rsp + 0x80]
call fcn.140061120
lea rcx, [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
call fcn.140061120
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x70]
call fcn.140061120
call sub.COMCTL32.dll_InitCommonControls
call fcn.1400612c0
mov rcx, qword [rsp + 0x80]
call fcn.140061430
call fcn.1400611d0
mov edx, eax
lea rcx, [0x1400e5f00]
call fcn.140061320
call fcn.1400612c0
mov rcx, qword [rsp + 0x78]
call fcn.140061430
call fcn.1400611d0
mov edx, eax
lea rcx, [0x1400e5f08]
call fcn.140061320
call fcn.1400612c0
mov rcx, qword [rsp + 0x70]
call fcn.140061430
call fcn.1400611d0
mov edx, eax
lea rcx, [0x1400e5f10]
call fcn.140061320
mov rdx, qword [0x1400e5f08]
mov rcx, rbx
call fcn.140061190
mov edx, eax
xor eax, eax
test edx, edx
je 0x1400080b0
mov dword [0x1400e5f1c], eax
call sub.KERNEL32.dll_GetCurrentThreadId
mov r15, rax
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov r8, rax
mov r9, r15
lea rdx, [0x1400014f0]
mov ecx, 5
call sub.USER32.dll_SetWindowsHookExW
mov dword [0x1400e5f18], eax
movsxd r9, dword [0x1400e5f1c]
or r9, 0x11024
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x88]
xor ecx, ecx
call sub.USER32.dll_MessageBoxW
mov r15, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400613b0
mov rcx, qword [rsp + 0x80]
call fcn.1400613b0
mov rcx, qword [rsp + 0x78]
call fcn.1400613b0
mov rcx, qword [rsp + 0x70]
call fcn.1400613b0
mov rcx, qword [rsp + 0x88]
call fcn.1400613b0
call fcn.140061220
cmp r15b, 7
jne 0x140008498
call fcn.140061090
call fcn.140061090
call fcn.140061090
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0xc0], 1
mov eax, 0x4e
mov word [rsp + 0xc8], ax
xor edx, edx
mov word [rsp + 0xca], dx
mov dword [rsp + 0xcc], 0
mov dword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov r8d, 0x28
mov rdx, r14
mov ecx, 1
call sub.USER32.dll_SendInput
mov ecx, 0x19
call fcn.140036b24
call fcn.140061090
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x90], 1
mov ecx, 0x4e
mov word [rsp + 0x98], cx
xor r8d, r8d
mov word [rsp + 0x9a], r8w
mov dword [rsp + 0x9c], 2
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
lea rdx, [rsp + 0x90]
mov r8d, 0x28
mov ecx, 1
call sub.USER32.dll_SendInput
mov ecx, 0x19
call fcn.140036b24
mov rdx, qword [rsp + 0x60]
xor r8d, r8d
mov rcx, rsi
call sub.KERNEL32.dll_DeleteTimerQueueTimer
mov ecx, 1
call fcn.140005a80
test rax, rax
jg 0x1400080d0
jmp 0x1400080da
mov rdx, qword [rsp + 0x60]
lea r8, [0x140006640]
mov rcx, rsi
call sub.KERNEL32.dll_DeleteTimerQueueTimer
nop dword [rax]
xor ecx, ecx
call fcn.1400048f0
test rax, rax
jle 0x140007210
mov ecx, 0x3e8
call fcn.140036b24
mov ecx, 1
call fcn.1400048f0
jmp 0x1400084b0