Function at 0x1000429e4
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create thread
Print debug messages
Register raw input devices
Set current directory
Terminate process

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x720
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x10009f140]
xor rax, rsp
mov qword [rsp + 0x710], rax
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebp, 1
lea r12d, [rbp + 1]
xor r13d, r13d
cmp rax, r13
je 0x100042b72
mov qword [0x1000ab080], rax
mov qword [0x1000ab078], r13
mov byte [0x1000aafd5], r13b
cmp qword [0x1000ab0a8], r13
jne 0x100042b72
lea rcx, [0x100020aa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1000ab0a8], rax
cmp rax, r13
je 0x100042b31
lea rdx, [0x100020ab8]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1000ab088], rax
lea rdx, [0x100020ac8]
mov rcx, qword [0x1000ab0a8]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1000ab098], rax
cmp qword [0x1000ab088], r13
jne 0x100042abe
cmp rax, r13
je 0x100042b31
mov dword [rsp + 0x100], 0x114
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, r13d
je 0x100042b31
cmp dword [rsp + 0x104], 6
jb 0x100042b31
cmp dword [rsp + 0x108], r13d
jne 0x100042b31
cmp dword [rsp + 0x110], r12d
jne 0x100042b31
cmp dword [rsp + 0x10c], 0x147c
jae 0x100042b31
mov rax, qword [0x1000ab088]
mov qword [0x1000ab090], rax
mov qword [0x1000ab088], r13
mov rax, qword [0x1000ab098]
mov qword [0x1000ab0a0], rax
mov qword [0x1000ab098], r13
mov dword [rsp + 0x40], r13d
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetProcessDefaultLayout]
mov dl, byte [rsp + 0x40]
and dl, bpl
mov byte [0x1000a85b5], dl
mov edx, 0xbb8
mov dword [0x1000ab138], edx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [0x1000ab130], rax
mov qword [0x1000a8648], r13
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov rdi, rax
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
lea edi, [rcx + 0x18]
mov rax, r12
mul rdi
cmovo rax, r14
mov rcx, rax
call fcn.10008f138
mov rsi, rax
cmp rax, r13
jne 0x100042bb4
xor al, al
jmp 0x100043b7f
lea r8, [0x10001a330]
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_wcscpy_s
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov r8, rax
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscat_s
lea r8, [0x10001a350]
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscat_s
mov r8, rsi
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
mov rcx, rsi
call sub.msvcrt.dll_free
cmp rdi, r13
jne 0x100042c15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x100042c88
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov rcx, rax
call fcn.100061128
mov rdi, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rsi, r13
je 0x100042c7f
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, r13d
je 0x100042c6d
mov edx, 0xa
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [rsp + 0x60], r13d
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r8, rax
mov r15d, 5
mov eax, dword [rsp + 0x60]
cmp eax, ebp
jle 0x100042cf2
add r8, 8
dec eax
mov r9d, eax
mov al, byte [0x1000aacb8]
xor edx, edx
lea rdi, [0x10001a368]
mov rsi, qword [r8]
mov rcx, r15
repe cmpsw word [rsi], word [rdi]
je 0x100042cda
sbb edx, edx
sbb edx, r14d
movzx eax, al
cmp edx, r13d
cmove eax, ebp
mov byte [0x1000aacb8], al
add r8, 8
sub r9, rbp
jne 0x100042cc1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov sil, r13b
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [0x10001aab0]
mov r8d, ebp
xor edx, edx
lea rcx, [0x10001aa90]
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, r13d
jl 0x100042e44
mov edi, 0x104
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x100]
xor r8d, r8d
xor edx, edx
lea rcx, [0x10001a150]
call sub.SHELL32.dll_SHGetFolderPathEx
cmp eax, r13d
jl 0x100042e44
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xa8]
mov r11, rax
mov rdx, rdi
lea rcx, [rsp + 0x100]
cmp word [rcx], r13w
je 0x100042d92
add rcx, r12
sub rdx, rbp
jne 0x100042d84
cmp rdx, r13
je 0x100042e44
mov rcx, rdi
sub rcx, rdx
sub rdi, rcx
lea rax, [rsp + rcx*2 + 0x100]
mov r8d, r13d
je 0x100042de2
lea rdx, [rdi + rcx + 0x7ffffefb]
sub r11, rax
cmp rdx, r13
je 0x100042ddd
movzx ecx, word [r11 + rax]
cmp cx, r13w
je 0x100042ddd
mov word [rax], cx
add rax, r12
sub rdi, rbp
sub rdx, rbp
cmp rdi, r13
jne 0x100042dbc
cmp rdi, r13
jne 0x100042deb
sub rax, r12
mov r8d, 0x8007007a
mov word [rax], r13w
cmp r8d, r13d
jl 0x100042e44
lea rcx, [rsp + 0x100]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [0x1000aac58], rax
cmp rax, r13
je 0x100042e44
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, r13d
je 0x100042e44
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov rdx, qword [0x1000aac58]
call qword [rax + 0x30]
cmp eax, r13d
jl 0x100042e44
movzx esi, sil
cmp dword [rsp + 0x40], r13d
cmovne esi, ebp
mov rcx, qword [rsp + 0x48]
cmp rcx, r13
je 0x100042e54
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp sil, r13b
jne 0x100042e62
mov ecx, r15d
call fcn.100041e3c
int3
mov ecx, 8
call fcn.10008f098
cmp rax, r13
je 0x100042e7d
mov qword [rax], r13
mov qword [0x1000aac90], rax
jmp 0x100042e84
mov qword [0x1000aac90], r13
lea rcx, [0x10004299c]
call qword [sym.imp.msvcrt.dll_int____cdecl___unsigned_long_long_unsigned___int64_____cdecl__set_new_handler_int____cdecl___unsigned_long_long_unsigned___int64___]
mov ecx, ebp
call qword [sym.imp.msvcrt.dll_int___cdecl__set_new_mode_int_]
mov qword [0x1000aac80], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov rcx, rax
call fcn.100061128
mov qword [0x1000aac50], rax
mov r8d, 0x200
lea rdx, [rsp + 0x310]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [rax - 1]
movsxd rdx, ecx
cmp ecx, eax
ja 0x100042f00
lea rdx, [rsp + rdx*2 + 0x310]
cmp word [rdx], 0x2f
je 0x100042ef7
cmp word [rdx], 0x5c
je 0x100042ef7
dec ecx
sub rdx, r12
cmp ecx, eax
jbe 0x100042ee0
jmp 0x100042f00
mov word [rsp + rcx*2 + 0x310], r13w
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [0x10001a378]
lea rcx, [0x1000ab530]
call fcn.10005fb00
mov esi, 0x18
mov rcx, rsi
call fcn.10008f098
lea r14d, [rsi - 8]
cmp rax, r13
je 0x100042f48
mov dword [rax], r13d
mov dword [rax + 4], r13d
mov dword [rax + 8], r14d
mov qword [rax + 0x10], r13
jmp 0x100042f4b
mov rax, r13
mov qword [0x1000aac40], rax
mov rcx, rax
call fcn.1000602cc
lea r9, [0x10001a390]
lea r15, [0x10001a210]
mov r8, r15
mov edx, 0x469
mov ecx, r14d
call fcn.100061370
mov rdx, qword [0x1000aac50]
mov qword [rsp + 0x20], rdx
lea r9, [0x10001a3c0]
mov r8, r15
mov edx, 0x472
mov ecx, r14d
call fcn.100061370
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rsp + 0x310]
mov qword [rsp + 0x20], rdx
lea r9, [0x10001a400]
mov r8, r15
mov edx, 0x476
mov ecx, r14d
call fcn.100061370
lea r9, [0x10001a438]
mov r8, r15
mov edx, 0x47a
mov ecx, r14d
call fcn.100061370
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x94], r13d
mov dword [rsp + 0x90], ebp
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x80]
lea rcx, [0x1000aac48]
call sub.gdiplus.dll_GdiplusStartup
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.100047cb4
mov ecx, 0x2868
call fcn.10008f098
mov qword [rsp + 0x48], rax
cmp rax, r13
je 0x10004304d
xor edx, edx
mov rcx, rax
call fcn.1000677ec
jmp 0x100043050
mov rax, r13
mov qword [0x1000aac98], rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.10005db10
nop
lea r9, [0x10001a460]
mov r8b, byte [0x1000aace3]
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1000aac98]
call fcn.100067a14
cmp al, r13b
sete dil
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
cmp dil, r13b
je 0x10004311f
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov edx, 0x37c
lea rcx, [rsp + 0xe0]
call fcn.10005dc30
nop
mov rdi, qword [rax + 0x10]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.10005df6c
nop
mov rcx, qword [rsp + 0xf0]
call sub.msvcrt.dll_free
mov byte [rsp + 0x30], bpl
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r9d, 0xfffe
mov r8d, ebp
xor edx, edx
mov ecx, 0x385
call fcn.100062dc8
xor ecx, ecx
call fcn.100041e3c
nop
call fcn.100044158
cmp al, r13b
jne 0x100043148
lea r9, [0x10001a470]
mov r8, r15
mov edx, 0x4ae
mov ecx, r14d
call fcn.100061370
xor ecx, ecx
call fcn.100041e3c
int3
mov edi, 0xc
cmp byte [0x1000aacb8], r13b
je 0x1000431e8
lea r9, [0x10001a4a0]
mov r8, r15
mov edx, 0x4bb
mov ecx, r14d
call fcn.100061370
xor ecx, ecx
call fcn.100062c7c
cmp byte [0x1000aacb8], r13b
je 0x1000431e8
lea r9, [0x10001a4d0]
mov r8, r15
mov edx, 0x4c4
mov ecx, r14d
call fcn.100061370
mov word [rsp + 0x48], di
mov word [rsp + 0x4a], bp
mov dword [rsp + 0x4c], r13d
mov rax, qword [0x1000aac60]
mov qword [rsp + 0x50], rax
mov r8d, r14d
mov edx, ebp
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
cmp eax, r13d
jne 0x1000431e8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea r9, [0x10001a530]
mov r8, r15
mov edx, 0x4cf
mov ecx, r14d
call fcn.100061370
lea r9, [0x10001a570]
mov r8, r15
mov edx, 0x4d5
mov ecx, r14d
call fcn.100061370
lea rdx, [0x1000416ec]
mov ecx, r12d
call fcn.10004cef0
lea rdx, [0x100041754]
mov ecx, 4
call fcn.10004cef0
lea rdx, [0x10004178c]
mov ecx, 5
call fcn.10004cef0
lea rdx, [0x100041720]
mov ecx, 3
call fcn.10004cef0
lea rdx, [0x1000417c0]
mov ecx, 6
call fcn.10004cef0
lea rdx, [0x1000417f4]
mov ecx, 7
call fcn.10004cef0
lea rdx, [0x100041828]
mov ecx, 8
call fcn.10004cef0
lea rdx, [0x100041860]
mov ecx, 9
call fcn.10004cef0
lea rdx, [0x100041898]
mov ecx, 0xa
call fcn.10004cef0
lea rdx, [0x1000418d0]
mov ecx, 0xb
call fcn.10004cef0
lea rdx, [0x100041904]
mov ecx, ebp
call fcn.10004cef0
lea rdx, [0x1000419e0]
mov ecx, 0xd
call fcn.10004cef0
lea rdx, [0x10004194c]
mov ecx, edi
call fcn.10004cef0
lea rdx, [0x100041a14]
mov ecx, 0xe
call fcn.10004cef0
lea rdx, [0x100041a48]
mov ecx, 0xf
call fcn.10004cef0
lea rdx, [0x100041aa8]
mov ecx, r14d
call fcn.10004cef0
lea rdx, [0x100041ae4]
mov ecx, 0x11
call fcn.10004cef0
lea rdx, [0x100041b18]
mov ecx, 0x12
call fcn.10004cef0
lea rdx, [0x100041b4c]
mov ecx, 0x13
call fcn.10004cef0
lea rdx, [0x100036274]
mov ecx, 0x14
call fcn.10004cef0
lea rdx, [0x100041b80]
mov ecx, 0x15
call fcn.10004cef0
lea rdx, [0x100041bb4]
mov ecx, 0x16
call fcn.10004cef0
lea rdx, [0x100041650]
mov ecx, 0x17
call fcn.10004cef0
lea rdx, [0x100041684]
mov ecx, esi
call fcn.10004cef0
lea rdx, [0x100041be8]
mov ecx, 0x19
call fcn.10004cef0
lea rdx, [0x100041c1c]
mov ecx, 0x1a
call fcn.10004cef0
lea rdx, [0x100041c50]
mov ecx, 0x1b
call fcn.10004cef0
lea rdx, [0x100041c84]
mov ecx, 0x1c
call fcn.10004cef0
lea rdx, [0x100041cb8]
mov ecx, 0x1d
call fcn.10004cef0
lea rdx, [0x100041cf0]
mov ecx, 0x1e
call fcn.10004cef0
lea rdx, [0x100041d60]
mov ecx, 0x1f
call fcn.10004cef0
lea rdx, [0x100041d98]
mov edi, 0x20
mov ecx, edi
call fcn.10004cef0
lea rdx, [0x100041dd0]
lea ecx, [rdi + 1]
call fcn.10004cef0
lea rdx, [0x100041e08]
lea ecx, [rdi + 2]
call fcn.10004cef0
lea rdx, [0x1000416b8]
lea ecx, [rdi + 5]
call fcn.10004cef0
lea rdx, [0x100041d28]
lea ecx, [rdi + 3]
call fcn.10004cef0
lea r9, [0x10001a5a0]
mov r8, r15
mov edx, 0x500
mov ecx, r14d
call fcn.100061370
lea rdx, [0x1000546b4]
lea rcx, [0x10001eed0]
call fcn.100040648
lea rdx, [0x10004ce48]
lea rcx, [0x100015b78]
call fcn.100040648
lea rdx, [0x10003f710]
lea rcx, [0x100002f58]
call fcn.100040648
mov r8, rsi
xor edx, edx
lea rcx, [0x1000a8598]
call sub.msvcrt.dll_memset
mov byte [0x1000aac3c], bpl
lea rdx, [0x10004b9a8]
lea rcx, [0x10001c2c8]
call fcn.100040648
lea rdx, [0x100055c34]
lea rcx, [0x10001ef50]
call fcn.100040648
lea rdx, [0x100055c74]
lea rcx, [0x10001f090]
call fcn.100040648
lea rdx, [0x100055e24]
lea rcx, [0x10001f110]
call fcn.100040648
lea r9, [0x10001a5d0]
mov r8, r15
mov edx, 0x50b
mov ecx, r14d
call fcn.100061370
call fcn.1000544b8
cmp al, r13b
jne 0x100043544
lea r9, [0x10001a610]
mov r8, r15
mov edx, 0x50e
mov ecx, r14d
call fcn.100061370
xor ecx, ecx
call fcn.100041e3c
int3
lea rax, [fcn.1000426c0]
mov qword [0x1000ab0b8], rax
lea r9, [0x10001a658]
mov r8, r15
mov edx, 0x518
mov ecx, r14d
call fcn.100061370
mov ecx, 0x80
call fcn.10008f098
cmp rax, r13
je 0x100043582
mov rcx, rax
call fcn.10004eb00
jmp 0x100043585
mov rax, r13
mov qword [0x1000aad60], rax
mov rcx, rax
call fcn.1000602cc
mov rcx, qword [0x1000aad60]
call fcn.10004ebc0
cmp al, r13b
jne 0x1000435c4
lea r9, [0x10001a6a0]
mov r8, r15
mov edx, 0x51c
mov ecx, r14d
call fcn.100061370
xor ecx, ecx
call fcn.100041e3c
int3
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rax, qword [0x1000aac68]
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x7c], r13b
mov dword [rsp + 0x78], edi
mov byte [rsp + 0x7d], r13b
mov rcx, qword [0x1000aac80]
mov rax, qword [rcx]
lea r8, [rsp + 0x74]
lea rdx, [rsp + 0x70]
call qword [rax + 0x18]
cmp byte [0x1000aac3d], r13b
je 0x100043623
mov eax, dword [rsp + 0x70]
add eax, eax
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x74]
add eax, eax
mov dword [rsp + 0x74], eax
lea r9, [0x10001a6f0]
mov r8, r15
mov edx, 0x533
mov ecx, r14d
call fcn.100061370
mov ecx, 0xd8
call fcn.10008f098
cmp rax, r13
je 0x100043653
mov rcx, rax
call fcn.10003e920
jmp 0x100043656
mov rax, r13
mov qword [0x1000aac30], rax
mov rcx, rax
call fcn.1000602cc
lea rdx, [rsp + 0x68]
mov rcx, qword [0x1000aac30]
call fcn.10003c750
cmp al, r13b
jne 0x10004369a
lea r9, [0x10001a730]
mov r8, r15
mov edx, 0x537
mov ecx, r14d
call fcn.100061370
xor ecx, ecx
call fcn.100041e3c
int3
lea r9, [0x10001a778]
mov r8, r15
mov edx, 0x53e
mov ecx, r14d
call fcn.100061370
mov ecx, 0x38
call fcn.10008f098
cmp rax, r13
je 0x1000436eb
mov dword [rax + 0x20], r13d
mov dword [rax + 0x24], r13d
mov dword [rax + 0x28], r14d
mov qword [rax + 0x30], r13
mov qword [rax + 0x10], r13
mov dword [rax + 0x1c], r13d
mov dword [rax + 0x18], r12d
mov ecx, 0x64
mov dword [rax + 8], ecx
mov dword [rax], ecx
mov dword [rax + 4], ecx
jmp 0x1000436ee
mov rax, r13
mov qword [0x1000aac28], rax
mov rcx, rax
call fcn.1000602cc
mov rcx, qword [0x1000aac28]
call fcn.10003bbbc
cmp al, r13b
jne 0x10004372d
lea r9, [0x10001a7a0]
mov r8, r15
mov edx, 0x542
mov ecx, r14d
call fcn.100061370
xor ecx, ecx
call fcn.100041e3c
int3
lea r9, [0x10001a7e0]
mov r8, r15
mov edx, 0x54a
mov ecx, r14d
call fcn.100061370
mov ecx, 0x90
call fcn.10008f098
cmp rax, r13
je 0x100043771
xor r9d, r9d
mov r8b, byte [0x1000aacb8]
mov rdx, qword [0x1000aac60]
mov rcx, rax
call fcn.100068cc0
mov rdi, rax
jmp 0x100043774
mov rdi, r13
mov qword [0x1000aac78], rdi
cmp qword [rdi + 8], r13
je 0x100043789
mov rcx, rdi
call fcn.100068f04
mov byte [rdi + 0x14], bpl
lea rax, [rdi + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rdi
lea r8, [0x100068e9c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], rax
lea r9, [0x10001a828]
mov r8, r15
mov edx, 0x551
mov ecx, r14d
call fcn.100061370
mov ecx, 0x50
call fcn.10008f098
mov rdi, rax
cmp rax, r13
je 0x10004384e
mov esi, 0x40
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rdi], rax
mov r12d, 0x200
mov rcx, r12
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rdi + 8], rax
mov dword [rdi + 0x10], r13d
mov dword [rdi + 0x14], r14d
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rdi + 0x18], rax
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rdi + 0x20], rax
mov dword [rdi + 0x28], r13d
mov dword [rdi + 0x2c], r14d
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rdi + 0x30], rax
mov rcx, r12
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rdi + 0x38], rax
mov dword [rdi + 0x40], r13d
mov dword [rdi + 0x44], r14d
jmp 0x100043851
mov rdi, r13
mov qword [0x1000aac20], rdi
mov rcx, rdi
call fcn.1000602cc
lea r9, [0x10001a850]
mov r8, r15
mov edx, 0x55c
mov ecx, r14d
call fcn.100061370
lea rdx, [0x10001a870]
mov rcx, qword [0x1000aac40]
call fcn.100041158
cmp rax, r13
je 0x1000439b8
lea r8, [rsp + 0x40]
lea rdx, [0x10001a890]
mov rcx, rax
call fcn.10005f37c
mov r12, rax
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x20], ecx
lea r9, [0x10001a8a0]
mov r8, r15
mov edx, 0x567
mov ecx, r14d
call fcn.100061370
mov ebp, r13d
cmp dword [rsp + 0x40], r13d
jbe 0x1000439a9
mov rsi, r12
mov rcx, qword [rsi]
call fcn.10005fa38
mov rdi, rax
mov qword [rsp + 0x20], rax
lea r9, [0x10001a8c0]
mov r8, r15
mov edx, 0x56c
mov ecx, r14d
call fcn.100061370
mov rcx, rdi
call qword [sym.imp.GDI32.dll_AddFontResourceW]
cmp eax, r13d
jne 0x100043935
mov qword [rsp + 0x20], rdi
lea r9, [0x10001a8e8]
mov r8, r15
mov edx, 0x584
mov ecx, r14d
call fcn.100061370
mov rcx, rdi
call sub.msvcrt.dll_free
jmp 0x100043999
mov eax, dword [0x1000a6d40]
inc eax
mov dword [0x1000a6d40], eax
mov ecx, dword [0x1000a6d44]
cmp eax, ecx
jbe 0x10004398c
add ecx, dword [0x1000a6d48]
mov dword [0x1000a6d44], ecx
mov edx, ecx
shl rdx, 3
mov rcx, qword [0x1000a6d50]
call qword [sym.imp.msvcrt.dll_realloc]
mov rdx, rax
cmp rax, r13
jne 0x10004397d
xor ecx, ecx
call fcn.1000602cc
jmp 0x100043999
mov qword [0x1000a6d50], rax
mov eax, dword [0x1000a6d40]
jmp 0x100043993
mov rdx, qword [0x1000a6d50]
dec eax
mov qword [rdx + rax*8], rdi
inc ebp
add rsi, 8
cmp ebp, dword [rsp + 0x40]
jb 0x1000438da
mov rcx, r12
call sub.msvcrt.dll_free
mov ebp, 1
jmp 0x1000439cf
lea r9, [0x10001a918]
mov r8, r15
mov edx, 0x592
mov ecx, r14d
call fcn.100061370
lea r9, [0x10001a940]
mov r8, r15
mov edx, 0x597
mov ecx, r14d
call fcn.100061370
xor edx, edx
mov rcx, qword [0x1000aac60]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
lea rdx, [0x100018328]
mov rcx, qword [0x1000aac40]
call fcn.100041158
mov rdi, rax
mov byte [0x1000aac74], bpl
lea r9, [0x10001a990]
mov r8, r15
mov edx, 0x59f
mov ecx, r14d
call fcn.100061370
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x60]
cmp al, r13b
jne 0x100043a55
lea r9, [0x10001aa00]
mov r8, r15
mov edx, 0x5a2
mov ecx, r14d
call fcn.100061370
xor ecx, ecx
call fcn.100041e3c
int3
mov byte [0x1000aac74], r13b
cmp rdi, r13
je 0x100043a7e
or r8d, 0xffffffff
lea rdx, [0x10001aa48]
mov rcx, rdi
call fcn.10005f6a0
cmp eax, r13d
setg byte [0x1000aac72]
call fcn.1000424d4
mov qword [0x1000aac88], r13
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
cmp rax, r13
je 0x100043abf
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
mov rdi, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov qword [0x1000aac88], rax
mov byte [0x1000a0562], r13b
lea rcx, [0x1000aac48]
call qword [rsp + 0x98]
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r13d
je 0x100043b53
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r13d
je 0x100043b5d
mov rdx, qword [0x1000aac88]
cmp rdx, r13
je 0x100043b35
lea r8, [rsp + 0xb0]
mov rcx, qword [0x1000aac60]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
cmp eax, r13d
jne 0x100043ad4
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100043ad4
call fcn.100043c34
jmp 0x100043ad4
mov rcx, qword [0x1000aac48]
call qword [rsp + 0xa0]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x90]
xor ecx, ecx
call fcn.100041e3c
int3
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.10008f560
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret