Function at 0x14007ea90
Capabilities:
Create thread
Get common file path
Get session user name
Identify system language via api

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x12d0]
mov eax, 0x13d0
call fcn.1400e5910
sub rsp, rax
mov qword [rbp + 0x140], 0xfffffffffffffffe
mov qword [rsp + 0x1410], rbx
mov rsi, rcx
xor r13d, r13d
mov dword [rbp + 0x1320], r13d
xor edx, edx
lea rcx, [rbp + 0x1c0]
call fcn.1400c9420
nop
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x1c0]
call fcn.1400c9590
test eax, eax
je 0x14007eb31
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1320]
lea r8, [rbp + 0x1320]
lea rdx, str.UseSetProcessDPIAware
lea rcx, [rbp + 0x1c8]
call fcn.1400dfc90
lea rcx, [rbp + 0x1c8]
call fcn.1400df740
cmp dword [rbp + 0x1320], 1
jne 0x14007eb7b
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x14007eb7b
lea rdx, str.SetProcessDPIAware
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007eb72
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rbp - 0x38], 8
mov dword [rbp - 0x34], 0xff
lea rcx, [rbp - 0x38]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, rsi
call fcn.14007feb0
mov dword [rsp + 0x20], r13d
mov r15d, 1
mov r9d, r15d
lea r8, str.SoftwareSynapticsSynTPEnhZoneConfig
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x190]
call fcn.1400c9490
nop
mov dword [rbp - 0x60], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x4c]
lea rdx, str.IsUsingZoneFlags
lea rcx, [rbp + 0x198]
call fcn.1400dfc90
cmp dword [rbp - 0x4c], 0
jne 0x14007ec0f
mov rcx, rsi
call fcn.14008aec0
xor r9d, r9d
mov r8d, r15d
lea rdx, str.IsUsingZoneFlags
lea rcx, [rbp + 0x198]
call fcn.1400e00f0
lea rcx, [rbp + 0x198]
call fcn.1400df740
lea r9, [0x140122f58]
lea r8, [0x14012fd40]
xor edx, edx
lea rcx, [rbp + 0x290]
call fcn.1400dd3b0
mov rbx, rax
mov qword [rbp - 0x40], rax
lea rcx, [0x140266de0]
or r12, 0xffffffffffffffff
cmp rcx, rax
je 0x14007ec5d
mov r9, r12
xor r8d, r8d
mov rdx, rax
call fcn.140007570
nop
cmp qword [rbx + 0x18], 8
jb 0x14007ec6c
mov rcx, qword [rbx]
call fcn.1400e4058
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r13
mov word [rbx], r13w
call fcn.1400afef0
lea rax, vtable.CSynList_class_CRegistryKey_.0
mov qword [rbp - 0x20], rax
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbp - 4], r15d
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov dword [rbp - 8], r13d
lea rax, vtable.CMultiLevelRegistryKey.0
mov qword [rbp - 0x20], rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x20]
call fcn.1400c9ae0
test eax, eax
je 0x14007fded
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r15d
mov r9d, r15d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x20]
call fcn.1400c9ae0
test eax, eax
je 0x14007fded
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x48]
call fcn.1400c9490
nop
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x70]
lea rdx, str.IgnoreFirstTPOnOffOSDAfterSessionChange
lea rcx, [rbp + 0x50]
call fcn.1400dfc90
mov eax, r13d
cmp dword [rbp - 0x70], eax
setne al
mov dword [rsi + 0x984], eax
lea r8, [rsi + 0x988]
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.ChangeCursorIconDuringTPONOFF
lea rcx, [rbp + 0x50]
call fcn.1400dfc90
cmp dword [rsi + 0x984], 0
je 0x14007ed8a
mov dword [rsi + 0x178c], r13d
lea r8, [rsi + 0x7cc]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SwapLeftRightEdgePullZoneIfLanguageIsRTL
lea rcx, [rbp + 0x50]
call fcn.1400dfc90
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x48]
lea rdx, str.AutoRotationFlag
lea rcx, [rbp - 0x20]
call fcn.1400c9db0
mov eax, dword [rbp - 0x48]
mov dword [rsi + 0x95c], eax
mov dword [rsp + 0x6c], 0x80
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x6c]
lea r8, [rsi + 0x20]
lea rdx, str.WM_TOUCHPADON_OEMOSD_String
lea rcx, [rbp - 0x20]
call fcn.1400c9eb0
mov dword [rbp - 0x68], 0x80
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x68]
lea r8, [rsi + 0xa0]
lea rdx, str.WM_TOUCHPADOFF_OEMOSD_String
lea rcx, [rbp - 0x20]
call fcn.1400c9eb0
mov dword [rsp + 0x78], 0x80
lea r8, [rsi + 0x120]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x78]
lea rdx, str.OEM_OSD_ProgramWindow
lea rcx, [rbp - 0x20]
call fcn.1400c9eb0
mov dword [rbp - 0x50], 0x80
lea r8, [rsi + 0x1a0]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x50]
lea rdx, str.OEM_OSD_ProgramFilePath
lea rcx, [rbp - 0x20]
call fcn.1400c9eb0
mov dword [rbp - 0x80], 0x80
lea r8, [rsi + 0x3a8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x80]
lea rdx, str.OEM_OSD_RegKeyPath
lea rcx, [rbp - 0x20]
call fcn.1400c9eb0
mov dword [rsp + 0x48], 0x80
lea r8, [rsi + 0x5b0]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x48]
lea rdx, str.OEM_OSD_RegValueName
lea rcx, [rbp - 0x20]
call fcn.1400c9eb0
mov qword [rsp + 0x20], r13
lea r9, [rsi + 0x7b8]
lea r8, [rsi + 0x7b8]
lea rdx, str.OEM_OSD_Program_NotRunInInit
lea rcx, [rbp - 0x20]
call fcn.1400c9db0
cmp dword [rsi + 0x7b8], 0
je 0x14007ef13
mov dword [rsi + 0x1790], r13d
lea r8, [rsi + 0x7bc]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SendMsgOffOnToOEMOSD_Feature
lea rcx, [rbp - 0x20]
call fcn.1400c9db0
lea rcx, [rsi + 0x20]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [rsi + 0x7c0], eax
lea rcx, [rsi + 0xa0]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [rsi + 0x7c4], eax
xor edx, edx
lea rcx, [rbp + 0x78]
call fcn.1400c9420
nop
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPCpl
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x78]
call fcn.1400c9590
test eax, eax
je 0x14007efab
lea r8, [rsi + 0x1620]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.UIStyle
lea rcx, [rbp + 0x80]
call fcn.1400dfc90
mov dword [rbp + 0x1328], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1328]
lea r8, [rbp + 0x1328]
lea rdx, str.ScrollMethod
lea rcx, [rbp + 0x50]
call fcn.1400dfc90
mov eax, dword [rbp + 0x1328]
mov dword [rsi + 0x162c], eax
lea r8, [rsi + 0x1630]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SynapticsScrollMethodSpeedFactor
lea rcx, [rbp + 0x50]
call fcn.1400dfc90
lea r8, [rsi + 0x98c]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.AdjustPointingSpeedBaseOnDesktopRes
lea rcx, [rbp + 0x50]
call fcn.1400dfc90
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi + 0x1680], rax
xor ecx, ecx
call fcn.1400dc0c0
cmp eax, 9
jl 0x14007f0df
lea rcx, str.DwmApi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi + 0x1678], rax
test rax, rax
jne 0x14007f066
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], r13
jmp 0x14007f092
lea rdx, str.DwmIsCompositionEnabled
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.DwmGetWindowAttribute
mov rcx, qword [rsi + 0x1678]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, [rsi + 0x9e0]
mov rcx, qword [rsi + 0x9d8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp - 0x78], r13d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x14008a960]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [rsi + 0x9e4]
mov ecx, dword [rsi + 0x9e0]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea r8, [rsi + 0x173c]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SynTPEnhExePriorityLevel
lea rcx, [rbp + 0x50]
call fcn.1400dfc90
xor edx, edx
lea rcx, [rbp + 0x158]
call fcn.1400c9420
nop
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnhShortcutConfig
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x158]
call fcn.1400c9590
test eax, eax
je 0x14007f172
mov eax, dword [rsi + 0x1788]
mov dword [rbp - 0x58], eax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x58]
lea r8, [rsp + 0x4c]
lea rdx, str.ShowForcePadDesktopShortcut
lea rcx, [rbp + 0x160]
call fcn.1400dfc90
mov eax, r13d
cmp dword [rsp + 0x4c], eax
setne al
mov dword [rsi + 0x1788], eax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsOEM
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x158]
call fcn.1400c9590
test eax, eax
je 0x14007f1d9
mov eax, dword [rsi + 0x1788]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x68]
lea rdx, str.ShowForcePadDesktopShortcut
lea rcx, [rbp + 0x160]
call fcn.1400dfc90
mov eax, r13d
cmp dword [rsp + 0x68], eax
setne al
mov dword [rsi + 0x1788], eax
mov edx, 2
mov rcx, rsi
call fcn.14008b150
mov rcx, rsi
call fcn.14008c3c0
xor ecx, ecx
call fcn.1400dc0c0
cmp eax, 0xa
je 0x14007f206
xor ecx, ecx
call fcn.1400dc0c0
cmp eax, 9
jne 0x14007f20d
xor ecx, ecx
call fcn.1400eccf4
mov rax, qword [rsi]
mov edx, 2
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1650], rax
test rax, rax
je 0x14007fdc8
lea rbx, [rsi + 0x800]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test eax, eax
je 0x14007fdc8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
test eax, eax
je 0x14007fdc8
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x7c]
lea rdx, str.DisplayRotationAngleFromSensorInfo
lea rcx, [rbp + 0x50]
call fcn.1400dfc90
mov eax, dword [rsp + 0x7c]
mov dword [rsi + 0x954], eax
mov rcx, rsi
call fcn.1400837b0
mov rcx, rsi
call fcn.140083b60
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + 0x48]
mov rax, qword [rbx]
xor r9d, r9d
mov r8, qword [rsi + 0x9d8]
lea rdx, str.SynTP
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
je 0x14007fdc8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x110]
lea r14, [rsi + 0x17e0]
mov rcx, r14
call fcn.14002af80
test eax, eax
je 0x14007fdc8
mov rcx, rsi
call fcn.14008c5f0
lea rcx, [rsi + 0xc20]
call fcn.140008370
test eax, eax
je 0x14007fdc8
mov rax, qword [rsi]
mov edx, 3
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1658], rax
test rax, rax
je 0x14007fdc8
mov rax, qword [rsi]
mov edx, r15d
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1668], rax
test rax, rax
je 0x14007fdc8
mov rax, qword [rsi]
mov edx, 4
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1660], rax
test rax, rax
je 0x14007fdc8
mov rax, qword [rsi]
mov edx, 0xc
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1688], rax
test rax, rax
je 0x14007fdc8
mov rax, qword [rsi]
mov edx, 0xd
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1670], rax
test rax, rax
je 0x14007fdc8
xor ecx, ecx
call fcn.1400dc0c0
cmp eax, 8
jne 0x14007f404
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x230]
call fcn.1400c9490
nop
mov dword [rsp + 0x3c], r15d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x3c]
lea rdx, str.XP64VideoOn
lea rcx, [rbp + 0x238]
call fcn.1400dfc90
mov eax, r13d
cmp dword [rsp + 0x3c], eax
setne al
mov dword [rsi + 0x1750], eax
lea rcx, [rbp + 0x230]
call fcn.1400c9530
call fcn.1400db140
mov rdx, rax
mov rcx, qword [rsi + 0x1668]
call fcn.14000d950
mov rdx, qword [rsi + 0x1658]
mov rcx, qword [rsi + 0x1650]
call fcn.1400431b0
test eax, eax
je 0x14007fdc8
mov eax, dword [rsi + 0x1620]
sub eax, 0x237c
cmp eax, 1
ja 0x14007f453
mov rcx, rsi
call fcn.140087750
test eax, eax
je 0x14007fdc8
lea rax, [rbp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x14008a490]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, r14
call fcn.14002ca80
mov edx, r15d
mov rcx, rsi
call fcn.140087e10
cmp dword [rsi + 0x7e4], 0
je 0x14007f4b4
mov r8d, r15d
xor edx, edx
mov rcx, r14
call fcn.14002ce50
test rax, rax
je 0x14007f4b4
test byte [rsi + 0x9a8], 1
je 0x14007f4b4
mov rcx, rsi
call fcn.140088880
lea rcx, [0x14026ef10]
call fcn.14008e600
test rax, rax
je 0x14007f4f4
test byte [rsi + 0x9ac], 1
je 0x14007f4f4
lea rcx, [0x14026ef10]
call fcn.14008e600
mov rcx, rax
call fcn.14008e4e0
mov dword [rsi + 0x7d8], eax
test eax, eax
je 0x14007f4f4
mov rcx, rsi
call fcn.140088900
mov rcx, rsi
call fcn.14008bf00
test eax, eax
jne 0x14007f51d
lea r9, [0x14008bd70]
mov edx, 0xfffe
lea r8d, [rax + 0x64]
mov rcx, qword [0x14026e108]
call qword [sym.imp.USER32.dll_SetTimer]
lea rbx, [rsi + 0x16c8]
mov dword [rbx], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x78]
call fcn.1400c9590
test eax, eax
je 0x14007f5bc
mov qword [rsp + 0x20], r13
mov r9, rbx
mov r8, rbx
lea rdx, str.MonitorScreenSaver
lea rcx, [rbp + 0x80]
call fcn.1400dfc90
test eax, eax
je 0x14007f5bc
cmp dword [rbx], 0
je 0x14007f5bc
xor edx, edx
lea rcx, str.SynTPEnhWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
lea rbx, [rsi + 0x16d0]
mov rcx, rbx
call fcn.14007e040
mov rcx, rbx
call fcn.14007e0c0
call fcn.1400ddb20
test eax, eax
je 0x14007f5bc
xor r9d, r9d
mov r8, rdi
xor edx, edx
lea rcx, str.SynSSHookRun.exe
call fcn.1400dee40
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x260]
call fcn.1400c9490
nop
mov eax, dword [rsi + 0x1634]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, str.EnableLUA
lea rcx, [rbp + 0x268]
call fcn.1400dfc90
test eax, eax
je 0x14007f617
mov eax, dword [rsp + 0x40]
mov dword [rsi + 0x1634], eax
mov dword [rsp + 0x20], r13d
mov r9d, r15d
lea r8, str.SoftwareSynapticsPersistentSynTPEnhScrybePopup
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0xa8]
call fcn.1400c9490
nop
mov dword [rbp + 0x1318], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0x1318]
lea rdx, str.FirstDelayDays
lea rcx, [rbp + 0xb0]
call fcn.1400dfc90
test eax, eax
je 0x14007f674
cmp dword [rbp + 0x1318], 0xffffffff
je 0x14007fa9b
mov rcx, rsi
call fcn.140086600
xor r9d, r9d
lea rcx, [rbp + 0xb0]
test eax, eax
je 0x14007f69f
or r8d, 0xffffffff
lea rdx, str.FirstDelayDays
call fcn.1400e00f0
jmp 0x14007fa9b
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x30]
lea rdx, str.FirstBootLow
call fcn.1400dfc90
test eax, eax
jne 0x14007f70e
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x14007f70e
xor r9d, r9d
mov r8d, dword [rbp - 0x30]
lea rdx, str.FirstBootLow
lea rcx, [rbp + 0xb0]
call fcn.1400e00f0
xor r9d, r9d
mov r8d, dword [rbp - 0x2c]
lea rdx, str.FirstBootHigh
lea rcx, [rbp + 0xb0]
call fcn.1400e00f0
mov dword [rbp - 0x7c], 0x400
mov qword [rsp + 0x28], r13
lea rax, str.0xFFFFFFFF_15_0xFFFFFFFF_1311_1312_1313
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7c]
lea r8, [rbp + 0xad0]
lea rdx, str.ScrybePopup
lea rcx, [rbp + 0x80]
call fcn.1400dfda0
lea r8, [rsi + 0x1758]
lea rdx, [0x140126c2c]
lea rcx, [rbp + 0xad0]
call fcn.1400dd6a0
mov rdi, qword [rsi + 0x1758]
add rdi, 0xc
call fcn.140004e00
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14007f789
mov ecx, 0x80004005
call fcn.140004c30
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15d, r13d
mov dword [rsp + 0x44], r13d
mov dword [rbp - 0x74], r13d
cmp rdi, qword [rsi + 0x1760]
je 0x14007fa07
lea r14, [rdi + 4]
nop dword [rax + rax]
xor r8d, r8d
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, dword [rdi]
lea rcx, [rbp + 0x38]
call fcn.1400b0550
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14007f830
cmp dword [rbx + 0x10], 0
jl 0x14007f821
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007f821
call fcn.14000bc70
mov r15, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14007f811
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r15 + 0x18]
mov qword [rsp + 0x30], rax
mov r15d, dword [rsp + 0x44]
jmp 0x14007f830
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000c250
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f848
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0x10], 0
jne 0x14007f87e
mov r8, qword [rsi + 0x1760]
sub r8, r14
sar r8, 2
lea r8, [r8*4]
mov rdx, r14
mov rcx, rdi
call fcn.1400e44c0
add qword [rsi + 0x1760], 0xfffffffffffffffc
jmp 0x14007f889
mov r15d, 1
mov dword [rsp + 0x44], r15d
add rdi, 4
add r14, 4
cmp rdi, qword [rsi + 0x1760]
jne 0x14007f7c0
test r15d, r15d
mov r13d, dword [rbp - 0x74]
je 0x14007fa07
mov rdi, qword [rsi + 0x1758]
add rdi, 0xc
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
cmp ax, 9
je 0x14007fa14
cmp rdi, qword [rsi + 0x1760]
je 0x14007fa07
xor r14d, r14d
nop
xor r8d, r8d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov edx, dword [rdi]
lea rcx, [rbp + 0x40]
call fcn.1400b0550
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14007f94e
cmp dword [rbx + 0x10], 0
jl 0x14007f93f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007f93f
call fcn.14000bc70
mov r14, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14007f931
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rsp + 0x30], rax
xor r14d, r14d
jmp 0x14007f94e
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000c250
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f966
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0x409
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov edx, dword [rdi]
lea rcx, [rbp - 0x40]
call fcn.1400b0550
nop
mov rdx, qword [rax]
mov eax, r14d
test rdx, rdx
setne al
test eax, eax
je 0x14007f9fc
mov rax, qword [rsp + 0x30]
sub rdx, rax
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14007f9b7
add rax, 2
test cx, cx
jne 0x14007f9a0
mov ebx, r14d
jmp 0x14007f9bc
sbb ebx, ebx
or ebx, 1
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f9d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
mov eax, 1
cmovne r13d, eax
add rdi, 4
mov rbx, qword [rsp + 0x30]
cmp rdi, qword [rsi + 0x1760]
jne 0x14007f8e0
test r13d, r13d
je 0x14007fa07
jmp 0x14007fa14
mov ecx, 0x80004005
call fcn.140004c30
nop
mov rax, qword [rsi + 0x1758]
mov dword [rax], 0xffffffff
mov rax, qword [rsi + 0x1758]
mov r8d, dword [rax]
mov dword [rbp + 0x1318], r8d
xor r9d, r9d
lea rdx, str.FirstDelayDays
lea rcx, [rbp + 0xb0]
call fcn.1400e00f0
xor r9d, r9d
lea r8d, [r9 + 3]
lea rdx, str.NextMsgIndex
lea rcx, [rbp + 0xb0]
call fcn.1400e00f0
mov rax, qword [rsi + 0x1758]
xor r9d, r9d
mov r8d, dword [rax + 8]
lea rdx, str.RepeatTimes
lea rcx, [rbp + 0xb0]
call fcn.1400e00f0
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007fa8b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15d, 1
xor r13d, r13d
lea r14, [rsi + 0x17e0]
mov dword [rsp + 0x38], 0xdbba0
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x38]
lea rdx, str.ScrybePopupTimerTimeout
lea rcx, [rbp + 0x80]
call fcn.1400dfc90
cmp dword [rbp + 0x1318], 0xffffffff
je 0x14007faec
lea r9, [0x14008bee0]
mov r8d, dword [rsp + 0x38]
mov edx, 0xfffc
mov rcx, qword [0x14026e108]
call qword [sym.imp.USER32.dll_SetTimer]
mov dword [rbp - 0x6c], 0x101
lea rdx, [rbp - 0x6c]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r9, [rbp + 0x8c0]
lea r8, str..pipe_s00781D6E_0417_44d2_8082_9257B2CA9E0A
mov edx, 0x200
lea rcx, [rbp + 0x4c0]
call fcn.1400e5e60
lea r9, [0x140122f58]
lea r8, [0x14012fd40]
xor edx, edx
lea rcx, [rbp + 0x210]
call fcn.1400dd3b0
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rbp + 0x228], 8
jb 0x14007fb5d
mov rcx, qword [rbp + 0x210]
call fcn.1400e4058
test bl, bl
je 0x14007fbc1
lea r9, [0x140122f58]
lea r8, [0x14012fd40]
xor edx, edx
lea rcx, [rbp + 0x1f0]
call fcn.1400dd3b0
cmp qword [rax + 0x18], 8
jb 0x14007fb87
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4c0]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rbp + 0x4c0]
call fcn.1400e5e60
cmp qword [rbp + 0x208], 8
jb 0x14007fbc1
mov rcx, qword [rbp + 0x1f0]
call fcn.1400e4058
mov edx, 0x3d
lea rcx, [rbp + 0x4c0]
call fcn.140002940
mov qword [rsi + 0x1780], rax
test rax, rax
je 0x14007fbea
lea rdx, [rsi + 8]
mov rcx, rax
call fcn.1400026f0
xor eax, eax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], rax
mov dword [rbp + 0x138], eax
mov dword [rsp + 0x20], 0x4c
lea r9, [rbp + 0xf0]
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 4]
call sub.POWRPROF.dll_CallNtPowerInformation
cmp byte [rbp + 0x104], 0
je 0x14007fd5b
mov dword [rsi + 0x16c4], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x78]
call fcn.1400c9590
test eax, eax
je 0x14007fcaf
mov qword [rsp + 0x20], r13
lea r9, [rsi + 0x16c4]
lea r8, [rsi + 0x16c4]
lea rdx, str.ConnectStandbyDisable
lea rcx, [rbp + 0x80]
call fcn.1400dfc90
cmp dword [rsi + 0x16c4], 0
jne 0x14007fd5b
mov edx, 0x104
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rbp + 0x2b0]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14007fce0
movups xmm0, xmmword [str.Powrprof.dll]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x1401332d8]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x1401332e0]
mov dword [rcx + 0x18], eax
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14007fd5b
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007fd5b
lea rdx, [0x140082c60]
mov qword [rbp + 0xd8], rdx
mov qword [rbp + 0xe0], rsi
lea r8, [rbp + 0x188]
lea rdx, [rbp + 0xd8]
mov ecx, 2
call rax
call fcn.14005d970
cmp dword [rax + 4], 0
je 0x14007fd73
call fcn.14005d970
mov rcx, rax
call fcn.14007af70
mov rcx, qword [rsi + 0x1660]
call fcn.140097d70
xor ecx, ecx
call fcn.1400dc0c0
cmp eax, 0xb
je 0x14007fd97
xor ecx, ecx
call fcn.1400dc0c0
cmp eax, 0xc
jne 0x14007fd9f
mov rcx, r14
call fcn.14002cce0
mov edx, r15d
mov rcx, rsi
call fcn.14008a0e0
mov esi, r15d
lea rcx, [rbp + 0xa8]
call fcn.1400c9530
nop
lea rcx, [rbp + 0x260]
call fcn.1400c9530
jmp 0x14007fdcb
mov esi, r13d
lea rcx, [rbp + 0x158]
call fcn.1400c9530
nop
lea rcx, [rbp + 0x78]
call fcn.1400c9530
nop
lea rcx, [rbp + 0x48]
call fcn.1400c9530
jmp 0x14007fdf0
mov esi, r13d
lea rax, vtable.CSynList_class_CRegistryKey_.0
mov qword [rbp - 0x20], rax
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x14007fe67
test rbx, rbx
je 0x14007fe67
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
test rcx, rcx
je 0x14007fe1c
mov qword [rcx + 8], rax
jmp 0x14007fe20
mov qword [rbp - 0x18], rax
mov rcx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
test rcx, rcx
je 0x14007fe33
mov qword [rcx + 0x10], rax
jmp 0x14007fe37
mov qword [rbp - 0x10], rax
mov rdi, qword [rbx + 8]
cmp dword [rbp - 4], 0
je 0x14007fe54
mov rcx, qword [rbx]
test rcx, rcx
je 0x14007fe54
mov rax, qword [rcx]
mov edx, r15d
call qword [rax]
mov qword [rbx], r13
mov rcx, rbx
call fcn.1400e4058
mov rbx, rdi
dec dword [rbp - 8]
test rdi, rdi
jne 0x14007fe04
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
lea rcx, [rbp + 0x190]
call fcn.1400c9530
nop
lea rcx, [rbp + 0x1c0]
call fcn.1400c9530
mov eax, esi
mov rbx, qword [rsp + 0x1410]
add rsp, 0x13d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret