Function at 0x1400060f8
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x14000a655], 0
jne 0x140006190
lea rcx, str.advapi32
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000a628], rax
test rax, rax
je 0x1400063b9
lea rdx, str.RegCloseKey
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a628]
lea rdx, str.RegEnumKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a628]
lea rdx, [0x140007a30]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a628]
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp byte [0x14000a651], 0
je 0x140006220
lea rcx, str.combase
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000a620], rax
test rax, rax
je 0x140006220
lea rdx, str.RoGetActivationFactory
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a620]
lea rdx, str.RoInitialize
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a620]
lea rdx, str.RoUninitialize
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a620]
lea rdx, str.WindowsCreateStringReference
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rcx, str.kernelbase
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000a618], rax
test rax, rax
je 0x1400063de
lea rdx, str.QuirkIsEnabled
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rcx, str.ntdll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000a630], rax
test rax, rax
je 0x140006403
lea rdx, str.EtwEventSetInformation
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a630]
lea rdx, str.RtlGetSystemTimePrecise
mov qword [0x14000a5f8], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp byte [0x14000a653], 0
jne 0x140006357
lea rcx, str.user32
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000a610], rax
test rax, rax
je 0x140006428
lea rdx, str.EnumWindows
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a610]
lea rdx, str.GetKeyboardLayout
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a610]
lea rdx, str.GetWindow
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a610]
lea rdx, str.GetWindowThreadProcessId
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a610]
lea rdx, str.IsWindowVisible
jmp 0x14000638d
cmp byte [0x14000a654], 0
je 0x1400063b3
lea rcx, str.minuser
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000a610], rax
test rax, rax
je 0x14000644d
lea rdx, str.GetKeyboardLayout
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000a610]
lea rdx, str.MapVirtualKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
add rsp, 0x28
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x43
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006478
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x5e
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006478
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x64
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006478
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x6e
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006478
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x79
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006478
int3