Function at 0x10000fb10
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov r12, r8
call fcn.10000e6bc
xor r15d, r15d
lea rax, [0x100001cf8]
lea rbx, [0x10003e138]
lea r14d, [r15 + 1]
mov qword [0x10003e148], r15
mov qword [0x10003e138], r15
mov byte [0x10003e151], r15b
mov word [0x10003e152], r15w
mov dword [0x10003e154], r15d
mov byte [0x10003e150], r14b
mov qword [0x10003e158], rax
mov qword [0x10003d610], rbx
lea rdi, [0x10003e158]
mov r8, qword [rdi]
lea rax, [rbx + 8]
lea rcx, [0x10000e7c8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], r15
mov r9d, r14d
mov rdx, rbx
mov qword [rsp + 0x28], r15
add rdi, 8
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x10000fb8c
lea rax, [rsp + 0x80]
mov qword [rsp + 0x80], r15
mov rbp, r15
mov qword [rsp + 0xf0], rax
call fcn.10002734c
cmp eax, r15d
mov esi, eax
jl 0x10000fc0d
mov ebp, 0x795c4bd4
mov esi, r15d
cmp esi, r15d
jge 0x10000fc8b
mov rdi, qword [0x10003d610]
lea rbx, [0x10003d610]
cmp rdi, rbx
je 0x10000fc4a
test byte [rdi + 0x1c], r14b
je 0x10000fc4a
mov rcx, qword [rdi + 0x10]
lea r8, [0x100007ae0]
mov edx, 0xa
mov r9d, esi
call fcn.10001550c
mov rdi, qword [0x10003d610]
cmp rbp, r15
je 0x10000fc5b
call fcn.100027428
mov rdi, qword [0x10003d610]
cmp rdi, rbx
je 0x10000fc84
jmp 0x10000fc78
mov rcx, qword [rdi + 8]
cmp rcx, r15
je 0x10000fc75
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rdi + 8], r15
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x10000fc62
mov qword [0x10003d610], rbx
mov eax, esi
jmp 0x100010556
call fcn.10001258c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [0x100008160]
mov rdx, rax
call fcn.10001288c
mov bl, r15b
mov dword [rsp + 0x48], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp eax, r15d
jne 0x10000fccd
call fcn.1000251f0
jmp 0x10000fcd8
cmp dword [rsp + 0x48], r15d
mov eax, r15d
setne bl
cmp eax, r15d
jl 0x10000fcee
cmp bl, r15b
je 0x10000fcee
lea rcx, [0x100008180]
call fcn.10001288c
lea rax, [rsp + 0x90]
lea rcx, [rsp + 0x68]
mov rdx, r12
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0xb8], rax
call fcn.10000fa00
cmp eax, r15d
mov esi, eax
jge 0x10000fe1c
lea rdx, [0x1000081d8]
mov r8, r12
mov ecx, eax
call fcn.1000128bc
mov rcx, qword [rsp + 0x68]
cmp rcx, r15
je 0x10000fd44
call qword [sym.imp.msvcrt.dll_free]
cmp byte [0x10003e2d0], r15b
je 0x10000fdd9
lea rcx, [0x1000083b0]
call fcn.10001288c
lea rcx, [0x1000082d4]
call fcn.10001288c
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x10003e348]
mov rbx, r15
cmp rax, r15
je 0x10000fd9f
sub rax, r14
mov qword [0x10003e348], rax
jne 0x10000fd9f
mov rbx, qword [0x10003e350]
mov qword [0x10003e350], r15
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, r15
je 0x10000fdd9
mov eax, dword [rbx + 8]
cmp eax, r14d
jne 0x10000fdbf
mov dword [rbx + 8], r15d
jmp 0x10000fdce
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
cmp eax, r15d
jg 0x10000fdd9
mov rax, qword [rbx]
mov edx, r14d
mov rcx, rbx
call qword [rax]
cmp rbp, r15
je 0x10000fde3
call fcn.100027428
mov rdi, qword [0x10003d610]
lea rbx, [0x10003d610]
cmp rdi, rbx
je 0x10000fc84
jmp 0x10000fe12
mov rcx, qword [rdi + 8]
cmp rcx, r15
je 0x10000fe0f
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rdi + 8], r15
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x10000fdfc
jmp 0x10000fc7d
mov rdi, qword [rsp + 0x68]
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x88], r15
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x40], r15
call fcn.10002620c
cmp eax, r15d
mov esi, eax
jge 0x10000ff7a
mov rbx, qword [rsp + 0x40]
lea rdx, [0x100008208]
mov ecx, eax
mov r8, rbx
call fcn.1000128bc
cmp rbx, r15
je 0x10000fe84
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x10000fe94
mov rax, qword [rcx]
call qword [rax + 8]
cmp rdi, r15
je 0x10000fea2
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
cmp byte [0x10003e2d0], r15b
je 0x10000ff37
lea rcx, [0x1000083b0]
call fcn.10001288c
lea rcx, [0x1000082d4]
call fcn.10001288c
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x10003e348]
mov rbx, r15
cmp rax, r15
je 0x10000fefd
sub rax, r14
mov qword [0x10003e348], rax
jne 0x10000fefd
mov rbx, qword [0x10003e350]
mov qword [0x10003e350], r15
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, r15
je 0x10000ff37
mov eax, dword [rbx + 8]
cmp eax, r14d
jne 0x10000ff1d
mov dword [rbx + 8], r15d
jmp 0x10000ff2c
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
cmp eax, r15d
jg 0x10000ff37
mov rax, qword [rbx]
mov edx, r14d
mov rcx, rbx
call qword [rax]
cmp rbp, r15
je 0x10000ff41
call fcn.100027428
mov rdi, qword [0x10003d610]
lea rbx, [0x10003d610]
cmp rdi, rbx
je 0x10000fc84
jmp 0x10000ff70
mov rcx, qword [rdi + 8]
cmp rcx, r15
je 0x10000ff6d
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rdi + 8], r15
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x10000ff5a
jmp 0x10000fc7d
mov r13, qword [0x10003e160]
mov rbx, qword [rsp + 0x50]
lea rax, [rsp + 0x78]
lea rcx, [rsp + 0x58]
xor edx, edx
mov qword [0x10003e160], rbx
mov qword [rsp + 0x78], r15
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x58], r15
call fcn.100024060
cmp eax, r15d
mov esi, eax
jge 0x1000100d6
mov rcx, qword [rsp + 0x58]
cmp rcx, r15
je 0x10000ffcb
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x40]
mov qword [0x10003e160], r13
cmp rcx, r15
je 0x10000ffe2
call qword [sym.imp.msvcrt.dll_free]
cmp rbx, r15
je 0x10000fff0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
cmp rdi, r15
je 0x10000fffe
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
cmp byte [0x10003e2d0], r15b
je 0x100010093
lea rcx, [0x1000083b0]
call fcn.10001288c
lea rcx, [0x1000082d4]
call fcn.10001288c
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x10003e348]
mov rbx, r15
cmp rax, r15
je 0x100010059
sub rax, r14
mov qword [0x10003e348], rax
jne 0x100010059
mov rbx, qword [0x10003e350]
mov qword [0x10003e350], r15
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, r15
je 0x100010093
mov eax, dword [rbx + 8]
cmp eax, r14d
jne 0x100010079
mov dword [rbx + 8], r15d
jmp 0x100010088
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
cmp eax, r15d
jg 0x100010093
mov rax, qword [rbx]
mov edx, r14d
mov rcx, rbx
call qword [rax]
cmp rbp, r15
je 0x10001009d
call fcn.100027428
mov rdi, qword [0x10003d610]
lea rbx, [0x10003d610]
cmp rdi, rbx
je 0x10000fc84
jmp 0x1000100cc
mov rcx, qword [rdi + 8]
cmp rcx, r15
je 0x1000100c9
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rdi + 8], r15
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x1000100b6
jmp 0x10000fc7d
mov rsi, qword [rsp + 0x58]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], r15
mov rdx, rsi
call fcn.100015958
cmp eax, r15d
mov r12d, eax
jge 0x100010218
cmp rsi, r15
je 0x100010107
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x40]
mov qword [0x10003e160], r13
cmp rcx, r15
je 0x10001011e
call qword [sym.imp.msvcrt.dll_free]
cmp rbx, r15
je 0x10001012c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
cmp rdi, r15
je 0x10001013a
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
cmp byte [0x10003e2d0], r15b
je 0x1000101cf
lea rcx, [0x1000083b0]
call fcn.10001288c
lea rcx, [0x1000082d4]
call fcn.10001288c
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x10003e348]
mov rbx, r15
cmp rax, r15
je 0x100010195
sub rax, r14
mov qword [0x10003e348], rax
jne 0x100010195
mov rbx, qword [0x10003e350]
mov qword [0x10003e350], r15
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, r15
je 0x1000101cf
mov eax, dword [rbx + 8]
cmp eax, r14d
jne 0x1000101b5
mov dword [rbx + 8], r15d
jmp 0x1000101c4
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
cmp eax, r15d
jg 0x1000101cf
mov rax, qword [rbx]
mov edx, r14d
mov rcx, rbx
call qword [rax]
cmp rbp, r15
je 0x1000101d9
call fcn.100027428
mov rdi, qword [0x10003d610]
lea rbx, [0x10003d610]
cmp rdi, rbx
je 0x100010210
jmp 0x100010204
mov rcx, qword [rdi + 8]
cmp rcx, r15
je 0x100010201
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rdi + 8], r15
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x1000101ee
mov qword [0x10003d610], rbx
mov eax, r12d
jmp 0x100010556
mov rdx, qword [rsp + 0x70]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x98], r15
mov qword [rsp + 0x110], rax
mov rax, rdx
movzx r10d, dx
shr rax, 0x10
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x60], r15
movzx ecx, ax
mov rax, rdx
shr rdx, 0x30
mov r8d, edx
shr rax, 0x20
mov dword [rsp + 0x20], ecx
lea rdx, [0x100008230]
lea rcx, [rsp + 0x60]
movzx r9d, ax
call fcn.100027324
cmp eax, r15d
mov r12d, eax
jge 0x1000103a9
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x100010290
call qword [sym.imp.msvcrt.dll_free]
cmp rsi, r15
je 0x10001029e
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x40]
mov qword [0x10003e160], r13
cmp rcx, r15
je 0x1000102b5
call qword [sym.imp.msvcrt.dll_free]
cmp rbx, r15
je 0x1000102c3
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
cmp rdi, r15
je 0x1000102d1
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
cmp byte [0x10003e2d0], r15b
je 0x100010366
lea rcx, [0x1000083b0]
call fcn.10001288c
lea rcx, [0x1000082d4]
call fcn.10001288c
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x10003e348]
mov rbx, r15
cmp rax, r15
je 0x10001032c
sub rax, r14
mov qword [0x10003e348], rax
jne 0x10001032c
mov rbx, qword [0x10003e350]
mov qword [0x10003e350], r15
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, r15
je 0x100010366
mov eax, dword [rbx + 8]
cmp eax, r14d
jne 0x10001034c
mov dword [rbx + 8], r15d
jmp 0x10001035b
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
cmp eax, r15d
jg 0x100010366
mov rax, qword [rbx]
mov edx, r14d
mov rcx, rbx
call qword [rax]
cmp rbp, r15
je 0x100010370
call fcn.100027428
mov rdi, qword [0x10003d610]
lea rbx, [0x10003d610]
cmp rdi, rbx
je 0x100010210
jmp 0x10001039f
mov rcx, qword [rdi + 8]
cmp rcx, r15
je 0x10001039c
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rdi + 8], r15
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x100010389
jmp 0x100010209
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov r12, qword [rsp + 0x60]
lea rdx, [rsp + 0xe0]
movaps xmm5, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0xe0], xmm5
mov rcx, r12
call fcn.1000123e4
call fcn.10000f388
cmp eax, r15d
mov r14d, eax
jge 0x1000103f8
lea rdx, [0x100008280]
mov ecx, eax
call fcn.1000128bc
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x120]
lea rcx, [0x1000082a0]
movaps xmm5, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x120], xmm5
call fcn.1000123e4
cmp r12, r15
je 0x100010439
mov rcx, r12
call qword [sym.imp.msvcrt.dll_free]
cmp rsi, r15
je 0x100010447
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x40]
mov qword [0x10003e160], r13
cmp rcx, r15
je 0x10001045e
call qword [sym.imp.msvcrt.dll_free]
cmp rbx, r15
je 0x10001046c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
cmp rdi, r15
je 0x10001047a
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
cmp byte [0x10003e2d0], r15b
je 0x100010512
lea rcx, [0x1000083b0]
call fcn.10001288c
lea rcx, [0x1000082d4]
call fcn.10001288c
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x10003e348]
mov rbx, r15
cmp rax, r15
je 0x1000104d6
sub rax, 1
mov qword [0x10003e348], rax
jne 0x1000104d6
mov rbx, qword [0x10003e350]
mov qword [0x10003e350], r15
lea rcx, [0x10003e2f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, r15
je 0x100010512
mov eax, dword [rbx + 8]
cmp eax, 1
jne 0x1000104f6
mov dword [rbx + 8], r15d
jmp 0x100010505
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
cmp eax, r15d
jg 0x100010512
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
cmp rbp, r15
je 0x10001051c
call fcn.100027428
mov rdi, qword [0x10003d610]
lea rbx, [0x10003d610]
cmp rdi, rbx
je 0x100010553
jmp 0x100010547
mov rcx, qword [rdi + 8]
cmp rcx, r15
je 0x100010544
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rdi + 8], r15
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x100010531
mov qword [0x10003d610], rbx
mov eax, r14d
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret