Function at 0x140007198
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x14000cc39], 0
jne 0x140007230
lea rcx, str.advapi32
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000c630], rax
test rax, rax
je 0x14000747c
lea rdx, str.RegCloseKey
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c630]
lea rdx, str.RegEnumKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c630]
lea rdx, [0x140009a00]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c630]
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp byte [0x14000c681], 0
je 0x1400072c0
lea rcx, str.combase
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000c628], rax
test rax, rax
je 0x1400072c0
lea rdx, str.RoGetActivationFactory
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c628]
lea rdx, str.RoInitialize
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c628]
lea rdx, str.RoUninitialize
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c628]
lea rdx, str.WindowsCreateStringReference
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rcx, str.kernelbase
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000c620], rax
test rax, rax
je 0x1400074a1
lea rdx, str.QuirkIsEnabled
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rcx, str.ntdll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000c638], rax
test rax, rax
je 0x1400074c6
lea rdx, str.EtwEventSetInformation
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c638]
lea rdx, str.RtlGetSystemTimePrecise
mov qword [0x14000c5f8], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp byte [0x14000c683], 0
jne 0x14000741a
lea rcx, str.user32
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000c610], rax
test rax, rax
je 0x1400074eb
lea rdx, str.EnumWindows
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
call fcn.140007170
test eax, eax
je 0x1400073bc
mov rcx, qword [0x14000c610]
lea rdx, str.GetClassNameW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c610]
lea rdx, str.GetKeyboardLayout
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c610]
lea rdx, str.GetWindow
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c610]
lea rdx, str.GetWindowThreadProcessId
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c610]
lea rdx, str.IsWindowVisible
jmp 0x140007450
cmp byte [0x14000cc38], 0
je 0x140007476
lea rcx, str.minuser
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000c610], rax
test rax, rax
je 0x140007510
lea rdx, str.GetKeyboardLayout
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000c610]
lea rdx, str.MapVirtualKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
add rsp, 0x28
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x50
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000753c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x6b
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000753c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x71
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000753c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x7b
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000753c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x8a
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14000753c
int3