Function at 0x140004bf0
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows
Get file attributes
Get session user name
Set current directory

Disassembly:
push rbp
push rsi
push rdi
push r14
lea rbp, [rsp - 0x1618]
mov eax, 0x1718
call fcn.14001afa0
sub rsp, rax
mov rax, qword [0x14002b010]
xor rax, rsp
mov qword [rbp + 0x1600], rax
xor r14d, r14d
lea rcx, [rbp - 0x20]
mov rdi, r8
mov qword [rbp - 0x20], r14
lea r8, str.SoftwareOpenShell
mov dword [rbp - 0x18], r14d
mov r9d, 0x20119
mov qword [rbp - 0x10], r14
mov rdx, 0xffffffff80000001
call fcn.140004140
cmp eax, 2
jne 0x140004cc2
lea r8, str.SoftwareOpenShellClassicExplorer
lea rdx, str.SoftwareIvoSoftClassicExplorer
call fcn.140002eb0
lea r8, str.SoftwareOpenShellClassicIE
lea rdx, str.SoftwareIvoSoftClassicIE
call fcn.140002eb0
lea r8, str.SoftwareOpenShellOpenShell
lea rdx, str.SoftwareIvoSoftClassicShell
call fcn.140002eb0
lea r8, str.SoftwareOpenShellStartMenu
lea rdx, str.SoftwareIvoSoftClassicStartMenu
call fcn.140002eb0
lea rdx, str._APPDATA_OpenShell
lea rcx, str._APPDATA_ClassicShell
call fcn.140002f90
lea rdx, str._LOCALAPPDATA_OpenShell
lea rcx, str._LOCALAPPDATA_ClassicShell
call fcn.140002f90
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140004cd1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, rdi
mov qword [rsp + 0x1740], rbx
lea rdx, str.StartMenu:_start__s
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
lea rdx, str._startup
mov rcx, rdi
call fcn.140009dec
mov rsi, 0xffffffffffffffff
test rax, rax
jne 0x140004f10
lea rdx, str._autorun
mov rcx, rdi
call fcn.140009dec
test rax, rax
je 0x140004d35
mov eax, 0x602
cmp word [0x14002ddf2], ax
jb 0x140004f10
lea rdx, str._autorun
mov rcx, rdi
call fcn.140009dec
test rax, rax
je 0x140004eca
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_WaitDllInitThread_void_]
call fcn.140004750
test al, al
je 0x140004e9d
mov edx, 0xbb9
lea rcx, [rbp - 0x28]
call qword [sym.imp.StartMenuDLL.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_DllLoadStringEx_int_]
mov edx, 0xdf7
lea rcx, [rbp - 0x30]
mov rbx, qword [rax]
call qword [sym.imp.StartMenuDLL.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_DllLoadStringEx_int_]
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
mov rdx, qword [rax]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp - 0x30]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004db2
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x28]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004dd2
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
movaps xmm0, xmmword [str._windir_System32StartMenuHelper64.dll]
lea rcx, [rbp + 0x130]
movaps xmm1, xmmword [0x140026540]
xor edx, edx
movaps xmmword [rbp + 0xe0], xmm0
mov r8d, 0x1b8
movaps xmm0, xmmword [0x140026550]
movaps xmmword [rbp + 0x100], xmm0
movaps xmm0, xmmword [0x140026570]
movaps xmmword [rbp + 0xf0], xmm1
movaps xmm1, xmmword [0x140026560]
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x110], xmm1
call fcn.14000a0b0
mov edx, 0x104
lea rcx, [rbp + 0xe0]
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004e9d
mov r8d, 0x104
lea rdx, [rbp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea r9, str._upgrade
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0xe0]
mov qword [rsp + 0x20], r14
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, str.AutoStart
call qword [sym.imp.StartMenuDLL.dll_bool___cdecl_DllGetSettingBool_wchar_t_const____ptr64_]
test al, al
je 0x140004f27
lea rcx, str.AutoStartDelay
call qword [sym.imp.StartMenuDLL.dll_int___cdecl_DllGetSettingInt_wchar_t_const____ptr64_]
test eax, eax
jle 0x140004eca
lfence
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._upgrade
mov rcx, rdi
call fcn.140009dec
test rax, rax
je 0x140004f40
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_WaitDllInitThread_void_]
call fcn.140004750
test al, al
je 0x1400058a4
lea rdx, str._silent
mov rcx, rdi
call fcn.140009dec
test rax, rax
setne cl
call fcn.140004800
jmp 0x1400058a6
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_WaitDllInitThread_void_]
lea rcx, str.AutoStart
call qword [sym.imp.StartMenuDLL.dll_bool___cdecl_DllGetSettingBool_wchar_t_const____ptr64_]
test al, al
jne 0x140004eae
lea rdx, str.StartMenu:_quit___no_AutoStart
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
jmp 0x1400058a4
lea rdx, str._cmd
mov rcx, rdi
call fcn.140009dec
mov rbx, rax
test rax, rax
je 0x140004ff7
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_WaitDllInitThread_void_]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [rbx + 0xa]
mov r8d, 0x64
lea rdx, [rbp + 0x2f0]
call fcn.1400064e0
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.StartMenuDLL.dll_bool___cdecl_DllExecuteNamedCommand_wchar_t_const____ptr64_]
test al, al
je 0x140004fec
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x80]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140004fec
lea rcx, [rbp + 0x80]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp + 0x80]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140004fb1
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1400058a4
mov r8d, 0x104
lea rdx, [rbp + 0x5d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rcx, [rbp + 0x5d0]
mov word [rax], r14w
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [0x140026778]
mov rcx, rdi
call fcn.140009dec
mov rbx, rax
test rax, rax
je 0x140005173
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x70], r14
xor r8d, r8d
mov qword [rsp + 0x68], r14
lea rdx, [rsp + 0x70]
lea rcx, [rbx + 0xe]
call qword [sym.imp.SHELL32.dll_SHEvaluateSystemCommandTemplate]
test eax, eax
js 0x1400050da
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
inc rsi
cmp word [rdx + rsi*2], r14w
jne 0x140005080
cmp esi, 0x103
jle 0x140005099
mov esi, 0x103
jmp 0x14000509d
test esi, esi
jle 0x1400050b9
mov eax, esi
mov r8d, 0x2400
movzx ecx, word [rdx + rax*2]
mov eax, 0x3ff
add cx, r8w
cmp cx, ax
ja 0x1400050b9
dec esi
movsxd rax, esi
lea rcx, [rbp + 0x3c0]
lea rbx, [rax + rax]
mov r8, rbx
call fcn.14000a280
mov word [rbp + rbx + 0x3c0], r14w
jmp 0x1400050f0
lfence
lea rdx, [rbp + 0x3c0]
lea rcx, [rbx + 0xe]
call fcn.140005f90
mov rdi, rax
xorps xmm0, xmm0
mov dword [rbp + 0x10], 0x70
xor eax, eax
mov dword [rbp + 0x14], 0x4000200
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x78], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x3c0]
mov qword [rbp + 0x30], rdi
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x28], rax
movups xmmword [rbp + 0x18], xmm0
mov dword [rbp + 0x40], 1
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140005155
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x68], r14
test rcx, rcx
je 0x1400058a4
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1400058a4
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_WaitDllInitThread_void_]
lea rdx, str._togglenew
mov rcx, rdi
call fcn.140009dec
test rax, rax
je 0x140005194
mov esi, 0xfffffffe
jmp 0x1400051fd
lea rdx, str._toggle
mov rcx, rdi
call fcn.140009dec
test rax, rax
je 0x1400051ad
mov esi, r14d
jmp 0x1400051fd
lea rdx, str._open
mov rcx, rdi
call fcn.140009dec
test rax, rax
je 0x1400051c8
mov esi, 2
jmp 0x1400051fd
lea rdx, str._settings
mov rcx, rdi
call fcn.140009dec
test rax, rax
je 0x1400051e3
mov esi, 3
jmp 0x1400051fd
lea rdx, str._exit
mov rcx, rdi
call fcn.140009dec
test rax, rax
mov ecx, 8
cmovne esi, ecx
lea rdx, str._xml
mov rcx, rdi
call fcn.140009dec
test rax, rax
je 0x14000524e
lea rcx, [rax + 0xa]
mov r8d, 0x104
lea rdx, [rbp + 0x9e0]
call fcn.1400064e0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.StartMenuDLL.dll_bool___cdecl_DllImportSettingsXml_wchar_t_const____ptr64_]
movzx ebx, al
call qword [sym.imp.ole32.dll_CoUninitialize]
test bl, bl
je 0x1400052a4
mov esi, 0xe
lea rdx, str._backup
mov rcx, rdi
call fcn.140009dec
test rax, rax
je 0x1400052ae
lea rcx, [rax + 0x10]
mov r8d, 0x104
lea rdx, [rbp + 0xbf0]
call fcn.1400064e0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [rbp + 0xbf0]
call qword [sym.imp.StartMenuDLL.dll_bool___cdecl_DllExportSettingsXml_wchar_t_const____ptr64_]
movzx ebx, al
call qword [sym.imp.ole32.dll_CoUninitialize]
test bl, bl
sete r14b
mov eax, r14d
jmp 0x1400058a6
mov eax, 1
jmp 0x1400058a6
mov qword [rsp + 0x1748], r12
lea rdx, str._nohook
mov rcx, rdi
mov qword [rsp + 0x1710], r15
call fcn.140009dec
test rax, rax
mov rdx, rax
sete r15b
test rax, rax
je 0x14000531e
movzx eax, word [rax + 0xe]
cmp ax, 0x31
jne 0x1400052f4
mov rcx, qword [sym.imp.StartMenuDLL.dll_enum__MINIDUMP_TYPE_MiniDumpType]
mov dword [rcx], r14d
movzx eax, word [rdx + 0xe]
cmp ax, 0x32
jne 0x14000530b
mov rax, qword [sym.imp.StartMenuDLL.dll_enum__MINIDUMP_TYPE_MiniDumpType]
mov dword [rax], 1
movzx eax, word [rdx + 0xe]
cmp ax, 0x33
jne 0x14000531e
mov rax, qword [sym.imp.StartMenuDLL.dll_enum__MINIDUMP_TYPE_MiniDumpType]
mov dword [rax], 2
test r15b, r15b
jne 0x140005330
mov rcx, qword [sym.imp.StartMenuDLL.dll_long_int___cdecl_TopLevelFilter_struct__EXCEPTION_POINTERS____ptr64_]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x100
lea rcx, [rbp + 0x7e0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0x60], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
xor r9d, r9d
xor r8d, r8d
mov rbx, rax
lea rax, [rsp + 0x60]
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 2]
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
mov ecx, dword [rsp + 0x60]
call fcn.14000e5f0
mov r9d, dword [rsp + 0x60]
mov rdi, rax
lea rax, [rsp + 0x60]
mov r8, rdi
mov edx, 2
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
lea rdx, str.Default
mov rcx, rdi
call fcn.14000e480
test eax, eax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x7e0]
mov edx, 0x400
lea r8, str.OpenShellMenu.Mutex._s._s
sete r12b
lea rcx, [rbp + 0xe00]
call fcn.140006420
mov rcx, rdi
call fcn.14000e5f8
cmp esi, 0xffffffff
jne 0x14000540a
lea r8, [rbp + 0xe00]
lea rdx, str.StartMenu:_mutex__s
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
xor r9d, r9d
lea r8, str.Progman
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rdi, rax
test rax, rax
je 0x140005434
lea rdx, [rsp + 0x64]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rbx, r14
test r15b, r15b
je 0x140005576
lea r8, [rbp + 0xe00]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140005473
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140005576
lea ecx, [rsi + 2]
test ecx, 0xfffffffd
je 0x1400054ba
cmp esi, 0xffffffff
je 0x140005522
mov ecx, dword [rsp + 0x64]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea rdx, str.StartHookWindow
lea rcx, str.OpenShellMenu.CStartHookWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140005522
movsxd r8, esi
xor r9d, r9d
mov edx, 0x40a
mov rcx, rax
jmp 0x14000551c
test rdi, rdi
je 0x140005522
mov ecx, dword [rsp + 0x64]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov ecx, dword [rsp + 0x64]
call qword [sym.imp.StartMenuDLL.dll_struct_HWND______ptr64___cdecl_FindTaskBar_unsigned_long_int_]
mov r15, rax
test rax, rax
je 0x1400054fc
cmp esi, 0xfffffffe
lea rcx, str.OpenShellMenu.StartMenuMsg
sete r14b
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor r9d, r9d
mov r8, r14
mov edx, eax
mov rcx, r15
jmp 0x14000551c
cmp esi, 0xfffffffe
mov eax, 0x57534d4b
mov r9d, 0x43534d
mov edx, 0x112
cmove r9d, eax
mov r8d, 0xf130
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
cmp esi, 8
jne 0x140005554
test rbx, rbx
je 0x140005894
mov edx, 0x7d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140005894
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x140005894
cmp esi, 0xffffffff
jne 0x140005894
lea rdx, str.StartMenu:_exit__mutex_exists_
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
jmp 0x140005894
cmp esi, 0xffffffff
je 0x14000559a
lea eax, [rsi - 2]
cmp eax, 1
jbe 0x14000559a
test rbx, rbx
je 0x140005894
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x140005894
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
test r15b, r15b
jne 0x1400055b5
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllUpdateSettings_void_]
mov cl, 1
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_InitManagers_bool_]
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
lea r9, [rbp - 0x40]
mov qword [rbp - 0x40], rax
lea r8, [0x14002ba30]
lea rax, vtable.CStartHookWindow.0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
mov dword [rbp - 0x48], r14d
call fcn.1400059c0
movzx edi, ax
mov rax, qword [rbp - 0x58]
test rax, rax
jne 0x140005613
call fcn.14000686c
mov qword [rbp - 0x58], rax
test rax, rax
jne 0x140005613
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400056d1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14000699c
test di, di
je 0x1400056d1
lea rax, [rbp - 0x80]
mov qword [rbp - 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, [0x14002c408]
mov dword [rbp - 0x68], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14002c430]
lea rcx, [0x14002c408]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
mov qword [0x14002c430], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9d, dword [0x14002ba24]
mov rdx, rdi
mov r8d, dword [0x14002ba2c]
mov r10d, dword [0x14002ba20]
sub r8d, r9d
mov rax, qword [0x14002c8c8]
mov ecx, dword [0x14002ba28]
mov qword [rsp + 0x58], r14
sub ecx, r10d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r8d
lea r8, str.StartHookWindow
mov dword [rsp + 0x30], ecx
xor ecx, ecx
mov dword [rsp + 0x28], r9d
mov r9d, 0x80000000
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_CreateWindowExW]
lea rcx, str.TaskbarCreated
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
lea rcx, str.user32.dll
mov dword [0x14002ddf4], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.ChangeWindowMessageFilterEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140005753
mov edx, dword [0x14002ddf4]
xor r9d, r9d
mov rcx, qword [rbp - 0x78]
lea r8d, [r9 + 1]
call rdi
mov rcx, qword [rbp - 0x78]
xor r9d, r9d
mov edx, 0x303
lea r8d, [r9 + 1]
call rdi
mov rcx, qword [rbp - 0x78]
xor r9d, r9d
mov edx, 0x40a
lea r8d, [r9 + 1]
call rdi
mov rcx, qword [rbp - 0x78]
xor r9d, r9d
lea edx, [r9 + 0x10]
lea r8d, [r9 + 1]
call rdi
jmp 0x140005792
mov ecx, dword [0x14002ddf4]
mov edx, 1
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov edx, 1
mov ecx, 0x303
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov edx, 1
mov ecx, 0x40a
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov edx, 1
lea ecx, [rdx + 0xf]
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov qword [rsp + 0x78], r14
test r15b, r15b
je 0x1400057a8
movzx r14d, r12b
xor r14d, 1
add r14d, 2
lea rdx, [rsp + 0x78]
mov ecx, r14d
call fcn.140004270
test al, al
je 0x140005847
test r15b, r15b
je 0x1400057e1
test esi, esi
js 0x1400057e1
lfence
mov rcx, qword [rbp - 0x78]
mov edx, 0x40a
movsxd r8, esi
mov r9d, 2
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.StartMenu:_start_message_loop
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
mov rdi, qword [rsp + 0x78]
nop word [rax + rax]
test r15b, r15b
jne 0x140005812
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140005847
xor r9d, r9d
lea rcx, [rbp + 0xb0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140005847
lea rcx, [rbp + 0xb0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140005800
lea rdx, str.StartMenu:_end_message_loop
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.USER32.dll_DestroyWindow]
test r15b, r15b
jne 0x140005872
mov cl, 1
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_CloseManagers_bool_]
call qword [sym.imp.ole32.dll_OleUninitialize]
test rbx, rbx
je 0x140005886
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140005894
call fcn.14000693c
mov r12, qword [rsp + 0x1748]
mov r15, qword [rsp + 0x1710]
xor eax, eax
mov rbx, qword [rsp + 0x1740]
mov rcx, qword [rbp + 0x1600]
xor rcx, rsp
call fcn.140007f60
add rsp, 0x1718
pop r14
pop rdi
pop rsi
pop rbp
ret