Function at 0x140001310
Capabilities:
Accept command line arguments
Delete registry value
Enumerate files on windows
Get geographical location
Identify system language via api
Log keystrokes via polling
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push r13
lea rbp, [rsp - 0xb00]
sub rsp, 0xc00
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ebx, ebx
lea rdx, [rbp + 0xb28]
mov rcx, rax
mov dword [rbp + 0xb28], ebx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rbp + 0xb28], 2
mov r13, rax
mov qword [rbp - 0x50], rax
jne 0x1400013fd
mov rcx, qword [rax + 8]
lea rdx, str._lsp
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x14000137e
call fcn.1400043b0
test al, al
sete bl
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [rbp + 0xb28], 2
jne 0x1400013fd
mov rcx, qword [r13 + 8]
lea rdx, str._tls12
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400013af
call fcn.140004430
test al, al
sete bl
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [rbp + 0xb28], 2
jne 0x1400013fd
mov rcx, qword [r13 + 8]
lea rdx, str._ngen
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400013d6
xor edx, edx
mov cl, 1
call fcn.140003d60
cmp dword [rbp + 0xb28], 2
jne 0x1400013fd
mov rcx, qword [r13 + 8]
lea rdx, str._unngen
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400013fd
xor edx, edx
xor ecx, ecx
call fcn.140003d60
mov qword [rsp + 0xbf8], rsi
mov qword [rsp + 0xbf0], rdi
mov qword [rsp + 0xbe0], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, SafeArrayAllocDescriptor
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rdx, str.SoftwareLogos4
lea rcx, [0x140008010]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rbp + 0x4c0]
mov r8d, 0x208
call fcn.1400045b0
mov r8d, 0x104
lea rdx, [rbp + 0x4c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400014ba
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, rax
lea rax, [rbp + 0x4c0]
cmp rdi, rax
je 0x1400014ba
lea rdx, str.logos.exe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400014ba
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov r8, rdi
lea rdx, str.Software_s
lea rcx, [0x140008010]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x68]
mov dword [rbp - 0x80], ebx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x140008010]
mov rcx, 0xffffffff80000001
mov edi, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400015d7
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0xb38]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xb20]
lea rax, [rbp + 0xb30]
mov dword [rbp + 0xb30], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NgenStatus
mov dword [rbp + 0xb20], ebx
mov dword [rbp + 0xb38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000154d
cmp dword [rbp + 0xb20], 4
cmove edi, dword [rbp + 0xb30]
mov dword [rbp - 0x80], edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 1
jne 0x1400015d7
movzx edx, dil
xor ecx, ecx
call fcn.140003d60
lea rax, [rbp + 0xb30]
mov dword [rbp + 0xb20], ebx
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x140008010]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400015d7
mov rcx, qword [rbp + 0xb30]
lea rax, [rbp + 0xb20]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 3]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NgenStatus
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0xb30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [rbp + 0xb20], 0x1fe
mov r8d, 0x3fc
lea rcx, [rbp + 0x6d0]
movzx edi, bx
call fcn.1400045b0
lea rax, [rbp + 0xb38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140008010]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 0x409
test eax, eax
jne 0x140001696
mov rcx, qword [rbp + 0xb38]
lea rax, [rbp + 0xb20]
mov qword [rsp + 0x28], rax
lea rdx, str.UserInterfaceLanguage
lea rax, [rbp + 0x6d0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001689
lea r9d, [rax + 2]
mov edx, 0x20000001
lea r8, [rbp + 0xb30]
lea rcx, [rbp + 0x6d0]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
mov edi, esi
cmovne di, word [rbp + 0xb30]
mov rcx, qword [rbp + 0xb38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [0x140008218], di
test di, di
jne 0x1400016b2
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
mov word [0x140008218], ax
cmp di, word [0x140008004]
mov qword [rsp + 0xbe8], r12
mov qword [rsp + 0xbd8], r15
je 0x140001806
mov eax, 0x3ff
lea rcx, [rbp + 0xb0]
movzx r12d, di
xor edx, edx
mov r8d, 0x208
and r12w, ax
movzx r14d, bx
call fcn.1400045b0
mov r8d, 0x104
lea rdx, [rbp + 0xb0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140001809
lea rcx, [rbp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140001809
lea r8, [0x140005cd0]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
je 0x140001809
lea rdx, [rbp + 0x6d0]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140001809
nop dword [rax + rax]
mov r9d, 2
lea r8, [rbp + 0xb20]
mov edx, 0x20000001
lea rcx, [rbp + 0x6fc]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
je 0x1400017bc
mov ecx, dword [rbp + 0xb20]
movzx eax, di
cmp ecx, eax
je 0x1400017b7
movzx eax, cx
mov edx, 0x3ff
and ax, dx
cmp ax, r12w
jne 0x1400017bc
movzx r14d, cx
jmp 0x1400017bc
test cx, cx
jne 0x1400017ef
lea rdx, [rbp + 0x6d0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140001770
test r14w, r14w
je 0x1400017fa
movzx eax, r14w
mov ecx, 0x3ff
and ax, cx
cmp ax, 0xa
jne 0x1400017f4
mov edi, 0xc0a
jmp 0x1400017fd
movzx edi, cx
jmp 0x1400017fd
movzx edi, r14w
jmp 0x1400017fd
movzx edi, si
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx esi, di
mov r8d, 0x104
mov word [0x140008004], si
lea rdx, [0x140008430]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [0x140008430]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rsi, [0x140008220]
mov rdx, rdi
mov rcx, rsi
lea r8d, [rax - 3]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rax, [rbp - 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140008010]
mov rcx, 0xffffffff80000001
xor dil, dil
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001919
mov rcx, qword [rbp - 0x48]
lea rdx, [0x140005420]
xor eax, eax
mov dword [rbp + 0xb20], 0x40
mov qword [rbp - 0x10], rax
xor r9d, r9d
mov qword [rbp - 8], rax
xor r8d, r8d
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0xb20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000190a
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..CloseSplashScreenEvent
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dil, 1
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
jne 0x14000193d
mov rdx, rsi
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..CloseSplashScreenEvent
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14d, 1
lea r9, [rbp + 0x2c0]
mov edx, r14d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x70], rax
test rax, rax
je 0x1400024a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400024a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [sym.imp.USER32.dll_DefWindowProcW]
lea edx, [r14 + 0x64]
mov qword [rbp - 8], rcx
xorps xmm0, xmm0
xorps xmm1, xmm1
mov qword [0x140008428], rax
mov rcx, rax
mov qword [rbp - 0x10], rbx
mov qword [rbp], rbx
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x20], xmm1
mov qword [rbp + 0x30], rbx
mov qword [rbp + 8], rax
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp + 0x10], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 0x18], rax
lea rcx, [rbp - 0x10]
lea rax, str.LDLS4.SplashWindow
mov qword [rbp + 0x30], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
jne 0x1400019ff
lea ecx, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x140001a1c
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8d, dword [rbp + 0xb28]
xor r9b, r9b
mov edx, r14d
cmp r8d, r14d
jle 0x140001a4c
lea rcx, [r13 + 8]
mov rax, qword [rcx]
cmp word [rax], 0x2f
je 0x140001a48
inc edx
add rcx, 8
cmp edx, r8d
jl 0x140001a32
jmp 0x140001a4c
movzx r9d, r14b
mov qword [rbp - 0x58], rbx
mov r13d, 7
cmp r8d, r14d
jle 0x140001c03
test r9b, r9b
jne 0x140001c03
lea r8, [rbp - 0x58]
xor edx, edx
lea rcx, [0x140005ee8]
call qword [sym.imp.OLEAUT32.dll_SafeArrayAllocDescriptor]
test eax, eax
jne 0x140001bfc
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140001bfc
mov qword [rbp + 0xb20], rbx
lea r8, [rbp + 0xb20]
mov rax, qword [rcx]
lea rdx, [0x1400053f0]
call qword [rax]
mov esi, r14d
cmp dword [rbp + 0xb28], r14d
jle 0x140001b66
mov rdi, qword [rbp - 0x50]
lea r15d, [r13 + 1]
add rdi, 8
lea rcx, [rbp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rdi]
mov word [rbp + 0x78], r15w
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x68], rbx
mov qword [rbp + 0x80], rax
lea rax, [rbp + 0x78]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], r14
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0xb20]
lea rdx, [rbp - 0x38]
mov qword [rsp + 0x40], rbx
lea r8, [0x140005400]
mov qword [rsp + 0x38], rbx
mov r9d, 0x400
mov qword [rsp + 0x30], rdx
lea rdx, [rbp - 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdx
mov edx, 4
mov word [rsp + 0x20], r14w
call qword [rax + 0x30]
lea rcx, [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
inc esi
lea rdi, [rdi + 8]
cmp esi, dword [rbp + 0xb28]
jl 0x140001ac6
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
xor eax, eax
lea rcx, [rbp - 0x10]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], rax
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0xb20]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x40], rbx
lea r8, [0x140005400]
mov qword [rsp + 0x38], rbx
mov r9d, 0x400
mov qword [rsp + 0x30], rdx
lea rdx, [rbp + 0x90]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdx
mov edx, 3
mov word [rsp + 0x20], r14w
call qword [rax + 0x30]
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0xb20]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140002486
mov r8d, dword [rbp + 0xb28]
cmp r8d, 2
jne 0x140001c7f
mov rcx, qword [rbp - 0x50]
lea rdx, str._register
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140001c7f
call fcn.140003ab0
test al, al
je 0x140001c35
mov esi, 0xcc
mov r13d, ebx
jmp 0x140001c3d
mov esi, 0xcd
mov r13d, r14d
mov ecx, 0xc9
call fcn.140003a20
mov ecx, esi
mov rdi, rax
call fcn.140003a20
mov r9d, 0x40
mov r8, rdi
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140002486
movups xmm0, xmmword [str.LogosBibleSoftware.]
xor edx, edx
mov r8d, 0x1e0
movups xmm1, xmmword [0x140005558]
lea rcx, [rbp + 0xd8]
movaps xmmword [rbp + 0xb0], xmm0
movsd xmm0, qword [0x140005568]
movsd qword [rbp + 0xd0], xmm0
movaps xmmword [rbp + 0xc0], xmm1
call fcn.1400045b0
lea rdx, str.logos
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
lea rcx, str.Logos4
cmove rsi, rcx
lea rcx, [rbp + 0xb0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.SHELL32.dll_SetCurrentProcessExplicitAppUserModelID]
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.USER32.dll_MonitorFromPoint]
lea r8, [0x140008010]
mov qword [rbp - 0x40], rax
lea rdx, str._sLastWindowPlacement
mov r15, rax
lea rcx, [rbp + 0xb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp - 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xb0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001ec8
mov rcx, qword [rbp - 0x78]
lea rax, [rbp + 0xb30]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xb20]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Left
mov dword [rsp + 0x74], ebx
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x7c], ebx
mov dword [rbp + 0xb20], ebx
mov dword [rbp + 0xb30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001db6
cmp dword [rbp + 0xb20], 4
mov edi, r14d
je 0x140001db8
mov edi, ebx
mov rcx, qword [rbp - 0x78]
lea rax, [rbp + 0xb30]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xb20]
lea rax, [rsp + 0x74]
xor r8d, r8d
lea rdx, [0x140005648]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001df9
cmp dword [rbp + 0xb20], 4
mov eax, r14d
je 0x140001dfb
mov eax, ebx
mov rcx, qword [rbp - 0x78]
lea r9, [rbp + 0xb20]
add edi, eax
lea rdx, str.Width
lea rax, [rbp + 0xb30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001e3e
cmp dword [rbp + 0xb20], 4
mov eax, r14d
je 0x140001e40
mov eax, ebx
mov rcx, qword [rbp - 0x78]
lea r9, [rbp + 0xb20]
add edi, eax
lea rdx, str.Height
lea rax, [rbp + 0xb30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001e83
cmp dword [rbp + 0xb20], 4
mov eax, r14d
je 0x140001e85
mov eax, ebx
add eax, edi
cmp eax, 4
jne 0x140001ebe
mov ecx, dword [rsp + 0x70]
mov edx, dword [rsp + 0x74]
mov dword [rbp - 0x70], ecx
add ecx, dword [rsp + 0x78]
mov dword [rbp - 0x68], ecx
mov ecx, dword [rsp + 0x7c]
add ecx, edx
mov dword [rbp - 0x6c], edx
mov dword [rbp - 0x64], ecx
lea edx, [rax - 2]
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_MonitorFromRect]
mov r15, rax
mov qword [rbp - 0x40], rax
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov edx, 0x58
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x5a
mov rcx, rdi
mov esi, eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rdi
xor ecx, ecx
mov r14d, eax
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rcx, str.shcore.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140001f4b
lea rdx, str.GetDpiForMonitor
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001f4b
lea r9, [rsp + 0x60]
xor edx, edx
lea r8, [rbp + 0xb38]
mov rcx, r15
call rax
test eax, eax
js 0x140001f4b
mov esi, dword [rbp + 0xb38]
mov r14d, dword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, r14d
mov ecx, esi
call fcn.140002720
mov r12, rax
test rax, rax
jne 0x140001f70
lea ecx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xc9
call fcn.140003a20
mov rcx, qword [0x140008428]
lea rdx, str.LDLS4.SplashWindow
mov qword [rsp + 0x58], rbx
mov r9d, 0x80000000
mov qword [rsp + 0x50], rcx
mov r8, rax
mov qword [rsp + 0x48], rbx
xor ecx, ecx
mov qword [rsp + 0x40], rbx
mov rdi, rax
mov dword [rsp + 0x38], ebx
mov r15, rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExW]
test rax, rax
je 0x140002011
mov rcx, qword [0x140008428]
lea rdx, str.LDLS4.SplashWindow
mov qword [rsp + 0x58], rbx
mov r9d, 0x90000000
mov qword [rsp + 0x50], rcx
mov r8, rdi
mov qword [rsp + 0x48], rbx
mov ecx, 0x80000
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r15, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15, r15
jne 0x14000202a
lea ecx, [r15 + 5]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r8, [rbp - 0x10]
mov edx, SafeArrayAllocDescriptor
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
jne 0x14000204a
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [rbp - 0xc]
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov rdi, rbx
mov dword [rsp + 0x60], eax
mov eax, dword [rbp - 8]
mov dword [rsp + 0x64], eax
xor eax, eax
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x38], 0x28
mov qword [rsp + 0x68], rbx
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x1400020c0
mov eax, dword [rbp - 0x1c]
sub eax, dword [rbp - 0x24]
sub eax, dword [rsp + 0x60]
cdq
sub eax, edx
sar eax, 1
add eax, dword [rbp - 0x24]
mov dword [rsp + 0x68], eax
mov eax, dword [rbp - 0x18]
sub eax, dword [rbp - 0x20]
sub eax, dword [rsp + 0x64]
cdq
sub eax, edx
sar eax, 1
add eax, dword [rbp - 0x20]
mov dword [rsp + 0x6c], eax
mov rdi, qword [rsp + 0x68]
xor ecx, ecx
mov qword [rbp + 0x68], rdi
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r14, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, rax
mov rdx, r12
mov rsi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 2
lea r9, [rsp + 0x60]
mov rdi, rax
mov dword [rbp + 0xb38], ebx
lea rax, [rbp + 0xb38]
mov word [rbp + 0xb3a], 0x1ff
mov qword [rsp + 0x38], rax
lea r8, [rbp + 0x68]
lea rax, [rbp + 0x60]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rcx, r15
mov qword [rsp + 0x20], rsi
mov qword [rbp + 0x60], rbx
call qword [sym.imp.USER32.dll_UpdateLayeredWindow]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rsp + 0x40], rbx
lea rdx, str.SoftwareLogos4Logging
test ax, ax
mov rcx, 0xffffffff80000001
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
sets sil
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x2001f
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000238f
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0xb38]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xb30]
lea rax, [rbp + 0xb20]
mov dword [rbp + 0xb30], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Enabled
mov dword [rbp + 0xb38], 4
mov dword [rbp + 0xb20], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000221a
cmp dword [rbp + 0xb30], 4
jne 0x14000221a
cmp dword [rbp + 0xb20], 1
jne 0x14000221a
mov dil, 1
jmp 0x14000221d
xor dil, dil
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0xb38]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xb30]
lea rax, [rbp + 0xb20]
mov dword [rbp + 0xb30], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AutoEnabled
mov dword [rbp + 0xb38], 4
mov dword [rbp + 0xb20], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002281
cmp dword [rbp + 0xb30], 4
jne 0x140002281
cmp dword [rbp + 0xb20], 1
jne 0x140002281
mov al, 1
jmp 0x140002283
xor al, al
test sil, sil
je 0x140002320
test dil, dil
jne 0x140002384
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0xb20]
mov dword [rsp + 0x28], 4
lea rdx, str.Enabled
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0xb30], 4
mov dword [rbp + 0xb38], 4
mov dword [rbp + 0xb20], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rbp + 0xb38]
lea rdx, str.AutoEnabled
mov r9d, dword [rbp + 0xb30]
xor r8d, r8d
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xb20]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0xb20], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140002384
test dil, dil
je 0x140002384
test al, al
je 0x140002384
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0xb20]
mov dword [rsp + 0x28], 4
lea rdx, str.Enabled
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0xb30], 4
mov dword [rbp + 0xb38], 4
mov dword [rbp + 0xb20], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
lea rdx, str.AutoEnabled
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r15
call fcn.140002a00
test al, al
jne 0x140002486
cmp dword [rbp - 0x80], 2
jne 0x14000244f
xor edx, edx
lea rcx, [rbp - 0x10]
lea r8d, [rdx + 0x64]
call fcn.1400045b0
lea rax, [rbp + 0xb30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140008010]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002446
mov rcx, qword [rbp + 0xb30]
lea rax, [rbp + 0xb20]
mov qword [rsp + 0x28], rax
lea rdx, str.NgenVersion
lea rax, [rbp - 0x10]
mov dword [rbp + 0xb20], 0x64
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0xb30]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140002446
lea rdx, [0x140005530]
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14000244f
xor edx, edx
mov cl, 1
call fcn.140003d60
call fcn.1400034d0
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp rdi, 0xffffffffffffffff
je 0x140002486
mov rax, qword [rbp + 0x70]
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
mov r13d, ebx
mov qword [rbp - 0x68], rdi
call section..text
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_ExitProcess]