Function at 0x140006410
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x14000bc09], 0
jne 0x1400064a8
lea rcx, str.advapi32
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b628], rax
test rax, rax
je 0x1400066d1
lea rdx, str.RegCloseKey
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b628]
lea rdx, str.RegEnumKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b628]
lea rdx, [0x1400089e0]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b628]
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp byte [0x14000b651], 0
je 0x140006538
lea rcx, str.combase
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b620], rax
test rax, rax
je 0x140006538
lea rdx, str.RoGetActivationFactory
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b620]
lea rdx, str.RoInitialize
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b620]
lea rdx, str.RoUninitialize
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b620]
lea rdx, str.WindowsCreateStringReference
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rcx, str.kernelbase
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b618], rax
test rax, rax
je 0x1400066f6
lea rdx, str.QuirkIsEnabled
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rcx, str.ntdll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b630], rax
test rax, rax
je 0x14000671b
lea rdx, str.EtwEventSetInformation
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b630]
lea rdx, str.RtlGetSystemTimePrecise
mov qword [0x14000b5f8], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp byte [0x14000b653], 0
jne 0x14000666f
lea rcx, str.user32
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b610], rax
test rax, rax
je 0x140006740
lea rdx, str.EnumWindows
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b610]
lea rdx, str.GetKeyboardLayout
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b610]
lea rdx, str.GetWindow
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b610]
lea rdx, str.GetWindowThreadProcessId
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b610]
lea rdx, str.IsWindowVisible
jmp 0x1400066a5
cmp byte [0x14000bc08], 0
je 0x1400066cb
lea rcx, str.minuser
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b610], rax
test rax, rax
je 0x140006765
lea rdx, str.GetKeyboardLayout
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b610]
lea rdx, str.MapVirtualKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
add rsp, 0x28
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x43
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006790
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x5e
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006790
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x64
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006790
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x6e
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006790
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x79
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006790
int3