Function at 0x140006830
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x14000b685], 0
jne 0x1400068c8
lea rcx, str.advapi32
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b638], rax
test rax, rax
je 0x140006b14
lea rdx, str.RegCloseKey
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b638]
lea rdx, str.RegEnumKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b638]
lea rdx, [0x140008a40]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b638]
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp byte [0x14000b681], 0
je 0x140006958
lea rcx, str.combase
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b630], rax
test rax, rax
je 0x140006958
lea rdx, str.RoGetActivationFactory
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b630]
lea rdx, str.RoInitialize
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b630]
lea rdx, str.RoUninitialize
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b630]
lea rdx, str.WindowsCreateStringReference
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rcx, str.kernelbase
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b628], rax
test rax, rax
je 0x140006b39
lea rdx, str.QuirkIsEnabled
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
lea rcx, str.ntdll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b640], rax
test rax, rax
je 0x140006b5e
lea rdx, str.EtwEventSetInformation
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b640]
lea rdx, str.RtlGetSystemTimePrecise
mov qword [0x14000b5f8], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
cmp byte [0x14000b683], 0
jne 0x140006ab2
lea rcx, str.user32
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b618], rax
test rax, rax
je 0x140006b83
lea rdx, str.EnumWindows
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
call fcn.140006764
test eax, eax
je 0x140006a54
mov rcx, qword [0x14000b618]
lea rdx, str.GetClassNameW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b618]
lea rdx, str.GetKeyboardLayout
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b618]
lea rdx, str.GetWindow
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b618]
lea rdx, str.GetWindowThreadProcessId
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b618]
lea rdx, str.IsWindowVisible
jmp 0x140006ae8
cmp byte [0x14000b684], 0
je 0x140006b0e
lea rcx, str.minuser
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
mov qword [0x14000b618], rax
test rax, rax
je 0x140006ba8
lea rdx, str.GetKeyboardLayout
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [0x14000b618]
lea rdx, str.MapVirtualKeyExW
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
add rsp, 0x28
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x50
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006bd4
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x6b
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006bd4
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x71
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006bd4
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x7b
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006bd4
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edx, 0x8a
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140006bd4
int3