Function at 0x14007e300
Capabilities:
Create thread
Get common file path
Get session user name
Identify system language via api

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x12d0]
mov eax, 0x13d0
call fcn.1400e5730
sub rsp, rax
mov qword [rbp + 0x140], 0xfffffffffffffffe
mov qword [rsp + 0x1410], rbx
mov rsi, rcx
xor r13d, r13d
mov dword [rbp + 0x1320], r13d
xor edx, edx
lea rcx, [rbp + 0x1c0]
call fcn.1400c91f0
nop
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x1c0]
call fcn.1400c9360
test eax, eax
je 0x14007e3a1
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1320]
lea r8, [rbp + 0x1320]
lea rdx, str.UseSetProcessDPIAware
lea rcx, [rbp + 0x1c8]
call fcn.1400dfa30
lea rcx, [rbp + 0x1c8]
call fcn.1400df4e0
cmp dword [rbp + 0x1320], 1
jne 0x14007e3eb
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x14007e3eb
lea rdx, str.SetProcessDPIAware
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007e3e2
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rbp - 0x38], 8
mov dword [rbp - 0x34], 0xff
lea rcx, [rbp - 0x38]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, rsi
call fcn.14007f720
mov dword [rsp + 0x20], r13d
mov r15d, 1
mov r9d, r15d
lea r8, str.SoftwareSynapticsSynTPEnhZoneConfig
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x190]
call fcn.1400c9260
nop
mov dword [rbp - 0x60], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x4c]
lea rdx, str.IsUsingZoneFlags
lea rcx, [rbp + 0x198]
call fcn.1400dfa30
cmp dword [rbp - 0x4c], 0
jne 0x14007e47f
mov rcx, rsi
call fcn.14008a7b0
xor r9d, r9d
mov r8d, r15d
lea rdx, str.IsUsingZoneFlags
lea rcx, [rbp + 0x198]
call fcn.1400dfe90
lea rcx, [rbp + 0x198]
call fcn.1400df4e0
lea r9, [0x140122f68]
lea r8, [0x14012fd50]
xor edx, edx
lea rcx, [rbp + 0x290]
call fcn.1400dd150
mov rbx, rax
mov qword [rbp - 0x40], rax
lea rcx, [0x140266e30]
or r12, 0xffffffffffffffff
cmp rcx, rax
je 0x14007e4cd
mov r9, r12
xor r8d, r8d
mov rdx, rax
call fcn.140007890
nop
cmp qword [rbx + 0x18], 8
jb 0x14007e4dc
mov rcx, qword [rbx]
call fcn.1400e3e78
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r13
mov word [rbx], r13w
call fcn.1400afca0
lea rax, vtable.CSynList_class_CRegistryKey_.0
mov qword [rbp - 0x20], rax
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbp - 4], r15d
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov dword [rbp - 8], r13d
lea rax, vtable.CMultiLevelRegistryKey.0
mov qword [rbp - 0x20], rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x20]
call fcn.1400c98b0
test eax, eax
je 0x14007f65d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r15d
mov r9d, r15d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x20]
call fcn.1400c98b0
test eax, eax
je 0x14007f65d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x48]
call fcn.1400c9260
nop
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x70]
lea rdx, str.IgnoreFirstTPOnOffOSDAfterSessionChange
lea rcx, [rbp + 0x50]
call fcn.1400dfa30
mov eax, r13d
cmp dword [rbp - 0x70], eax
setne al
mov dword [rsi + 0x98c], eax
lea r8, [rsi + 0x990]
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.ChangeCursorIconDuringTPONOFF
lea rcx, [rbp + 0x50]
call fcn.1400dfa30
cmp dword [rsi + 0x98c], 0
je 0x14007e5fa
mov dword [rsi + 0x1794], r13d
lea r8, [rsi + 0x7cc]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SwapLeftRightEdgePullZoneIfLanguageIsRTL
lea rcx, [rbp + 0x50]
call fcn.1400dfa30
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x48]
lea rdx, str.AutoRotationFlag
lea rcx, [rbp - 0x20]
call fcn.1400c9b80
mov eax, dword [rbp - 0x48]
mov dword [rsi + 0x964], eax
mov dword [rsp + 0x6c], 0x80
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x6c]
lea r8, [rsi + 0x20]
lea rdx, str.WM_TOUCHPADON_OEMOSD_String
lea rcx, [rbp - 0x20]
call fcn.1400c9c80
mov dword [rbp - 0x68], 0x80
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x68]
lea r8, [rsi + 0xa0]
lea rdx, str.WM_TOUCHPADOFF_OEMOSD_String
lea rcx, [rbp - 0x20]
call fcn.1400c9c80
mov dword [rsp + 0x78], 0x80
lea r8, [rsi + 0x120]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x78]
lea rdx, str.OEM_OSD_ProgramWindow
lea rcx, [rbp - 0x20]
call fcn.1400c9c80
mov dword [rbp - 0x50], 0x80
lea r8, [rsi + 0x1a0]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x50]
lea rdx, str.OEM_OSD_ProgramFilePath
lea rcx, [rbp - 0x20]
call fcn.1400c9c80
mov dword [rbp - 0x80], 0x80
lea r8, [rsi + 0x3a8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x80]
lea rdx, str.OEM_OSD_RegKeyPath
lea rcx, [rbp - 0x20]
call fcn.1400c9c80
mov dword [rsp + 0x48], 0x80
lea r8, [rsi + 0x5b0]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x48]
lea rdx, str.OEM_OSD_RegValueName
lea rcx, [rbp - 0x20]
call fcn.1400c9c80
mov qword [rsp + 0x20], r13
lea r9, [rsi + 0x7b8]
lea r8, [rsi + 0x7b8]
lea rdx, str.OEM_OSD_Program_NotRunInInit
lea rcx, [rbp - 0x20]
call fcn.1400c9b80
cmp dword [rsi + 0x7b8], 0
je 0x14007e783
mov dword [rsi + 0x1798], r13d
lea r8, [rsi + 0x7bc]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SendMsgOffOnToOEMOSD_Feature
lea rcx, [rbp - 0x20]
call fcn.1400c9b80
lea rcx, [rsi + 0x20]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [rsi + 0x7c0], eax
lea rcx, [rsi + 0xa0]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [rsi + 0x7c4], eax
xor edx, edx
lea rcx, [rbp + 0x78]
call fcn.1400c91f0
nop
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPCpl
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x78]
call fcn.1400c9360
test eax, eax
je 0x14007e81b
lea r8, [rsi + 0x1628]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.UIStyle
lea rcx, [rbp + 0x80]
call fcn.1400dfa30
mov dword [rbp + 0x1328], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1328]
lea r8, [rbp + 0x1328]
lea rdx, str.ScrollMethod
lea rcx, [rbp + 0x50]
call fcn.1400dfa30
mov eax, dword [rbp + 0x1328]
mov dword [rsi + 0x1634], eax
lea r8, [rsi + 0x1638]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SynapticsScrollMethodSpeedFactor
lea rcx, [rbp + 0x50]
call fcn.1400dfa30
lea r8, [rsi + 0x994]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.AdjustPointingSpeedBaseOnDesktopRes
lea rcx, [rbp + 0x50]
call fcn.1400dfa30
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi + 0x1688], rax
xor ecx, ecx
call fcn.1400dbe60
cmp eax, 9
jl 0x14007e94f
lea rcx, str.DwmApi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi + 0x1680], rax
test rax, rax
jne 0x14007e8d6
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], r13
jmp 0x14007e902
lea rdx, str.DwmIsCompositionEnabled
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.DwmGetWindowAttribute
mov rcx, qword [rsi + 0x1680]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, [rsi + 0x9e8]
mov rcx, qword [rsi + 0x9e0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp - 0x78], r13d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x14008a250]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [rsi + 0x9ec]
mov ecx, dword [rsi + 0x9e8]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea r8, [rsi + 0x1744]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SynTPEnhExePriorityLevel
lea rcx, [rbp + 0x50]
call fcn.1400dfa30
xor edx, edx
lea rcx, [rbp + 0x158]
call fcn.1400c91f0
nop
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnhShortcutConfig
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x158]
call fcn.1400c9360
test eax, eax
je 0x14007e9e2
mov eax, dword [rsi + 0x1790]
mov dword [rbp - 0x58], eax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x58]
lea r8, [rsp + 0x4c]
lea rdx, str.ShowForcePadDesktopShortcut
lea rcx, [rbp + 0x160]
call fcn.1400dfa30
mov eax, r13d
cmp dword [rsp + 0x4c], eax
setne al
mov dword [rsi + 0x1790], eax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsOEM
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x158]
call fcn.1400c9360
test eax, eax
je 0x14007ea49
mov eax, dword [rsi + 0x1790]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x68]
lea rdx, str.ShowForcePadDesktopShortcut
lea rcx, [rbp + 0x160]
call fcn.1400dfa30
mov eax, r13d
cmp dword [rsp + 0x68], eax
setne al
mov dword [rsi + 0x1790], eax
mov edx, 2
mov rcx, rsi
call fcn.14008aa40
mov rcx, rsi
call fcn.14008bcb0
xor ecx, ecx
call fcn.1400dbe60
cmp eax, 0xa
je 0x14007ea76
xor ecx, ecx
call fcn.1400dbe60
cmp eax, 9
jne 0x14007ea7d
xor ecx, ecx
call fcn.1400eca5c
mov rax, qword [rsi]
mov edx, 2
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1658], rax
test rax, rax
je 0x14007f638
lea rbx, [rsi + 0x808]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test eax, eax
je 0x14007f638
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
test eax, eax
je 0x14007f638
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x7c]
lea rdx, str.DisplayRotationAngleFromSensorInfo
lea rcx, [rbp + 0x50]
call fcn.1400dfa30
mov eax, dword [rsp + 0x7c]
mov dword [rsi + 0x95c], eax
mov rcx, rsi
call fcn.140083020
mov rcx, rsi
call fcn.1400833d0
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + 0x48]
mov rax, qword [rbx]
xor r9d, r9d
mov r8, qword [rsi + 0x9e0]
lea rdx, str.SynTP
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
je 0x14007f638
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x110]
lea r14, [rsi + 0x17e8]
mov rcx, r14
call fcn.140029f10
test eax, eax
je 0x14007f638
mov rcx, rsi
call fcn.14008bee0
lea rcx, [rsi + 0xc28]
call fcn.140008170
test eax, eax
je 0x14007f638
mov rax, qword [rsi]
mov edx, 3
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1660], rax
test rax, rax
je 0x14007f638
mov rax, qword [rsi]
mov edx, r15d
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1670], rax
test rax, rax
je 0x14007f638
mov rax, qword [rsi]
mov edx, 4
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1668], rax
test rax, rax
je 0x14007f638
mov rax, qword [rsi]
mov edx, 0xc
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1690], rax
test rax, rax
je 0x14007f638
mov rax, qword [rsi]
mov edx, 0xd
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1678], rax
test rax, rax
je 0x14007f638
xor ecx, ecx
call fcn.1400dbe60
cmp eax, 8
jne 0x14007ec74
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x230]
call fcn.1400c9260
nop
mov dword [rsp + 0x3c], r15d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x3c]
lea rdx, str.XP64VideoOn
lea rcx, [rbp + 0x238]
call fcn.1400dfa30
mov eax, r13d
cmp dword [rsp + 0x3c], eax
setne al
mov dword [rsi + 0x1758], eax
lea rcx, [rbp + 0x230]
call fcn.1400c9300
call fcn.1400daec0
mov rdx, rax
mov rcx, qword [rsi + 0x1670]
call fcn.14000d760
mov rdx, qword [rsi + 0x1660]
mov rcx, qword [rsi + 0x1658]
call fcn.140042c90
test eax, eax
je 0x14007f638
mov eax, dword [rsi + 0x1628]
sub eax, 0x237c
cmp eax, 1
ja 0x14007ecc3
mov rcx, rsi
call fcn.140086fc0
test eax, eax
je 0x14007f638
lea rax, [rbp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x140089d80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, r14
call fcn.14002bac0
mov edx, r15d
mov rcx, rsi
call fcn.140087680
cmp dword [rsi + 0x7ec], 0
je 0x14007ed24
mov r8d, r15d
xor edx, edx
mov rcx, r14
call fcn.14002c3c0
test rax, rax
je 0x14007ed24
test byte [rsi + 0x9b0], 1
je 0x14007ed24
mov rcx, rsi
call fcn.140088100
lea rcx, [0x14026ef98]
call fcn.14008dee0
test rax, rax
je 0x14007ed64
test byte [rsi + 0x9b4], 1
je 0x14007ed64
lea rcx, [0x14026ef98]
call fcn.14008dee0
mov rcx, rax
call fcn.14008ddc0
mov dword [rsi + 0x7e0], eax
test eax, eax
je 0x14007ed64
mov rcx, rsi
call fcn.140088180
mov rcx, rsi
call fcn.14008b7f0
test eax, eax
jne 0x14007ed8d
lea r9, [0x14008b660]
mov edx, 0xfffe
lea r8d, [rax + 0x64]
mov rcx, qword [0x14026e190]
call qword [sym.imp.USER32.dll_SetTimer]
lea rbx, [rsi + 0x16d0]
mov dword [rbx], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x78]
call fcn.1400c9360
test eax, eax
je 0x14007ee2c
mov qword [rsp + 0x20], r13
mov r9, rbx
mov r8, rbx
lea rdx, str.MonitorScreenSaver
lea rcx, [rbp + 0x80]
call fcn.1400dfa30
test eax, eax
je 0x14007ee2c
cmp dword [rbx], 0
je 0x14007ee2c
xor edx, edx
lea rcx, str.SynTPEnhWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
lea rbx, [rsi + 0x16d8]
mov rcx, rbx
call fcn.14007d8e0
mov rcx, rbx
call fcn.14007d960
call fcn.1400dd8c0
test eax, eax
je 0x14007ee2c
xor r9d, r9d
mov r8, rdi
xor edx, edx
lea rcx, str.SynSSHookRun.exe
call fcn.1400debe0
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x260]
call fcn.1400c9260
nop
mov eax, dword [rsi + 0x163c]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, str.EnableLUA
lea rcx, [rbp + 0x268]
call fcn.1400dfa30
test eax, eax
je 0x14007ee87
mov eax, dword [rsp + 0x40]
mov dword [rsi + 0x163c], eax
mov dword [rsp + 0x20], r13d
mov r9d, r15d
lea r8, str.SoftwareSynapticsPersistentSynTPEnhScrybePopup
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0xa8]
call fcn.1400c9260
nop
mov dword [rbp + 0x1318], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0x1318]
lea rdx, str.FirstDelayDays
lea rcx, [rbp + 0xb0]
call fcn.1400dfa30
test eax, eax
je 0x14007eee4
cmp dword [rbp + 0x1318], 0xffffffff
je 0x14007f30b
mov rcx, rsi
call fcn.140085e70
xor r9d, r9d
lea rcx, [rbp + 0xb0]
test eax, eax
je 0x14007ef0f
or r8d, 0xffffffff
lea rdx, str.FirstDelayDays
call fcn.1400dfe90
jmp 0x14007f30b
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x30]
lea rdx, str.FirstBootLow
call fcn.1400dfa30
test eax, eax
jne 0x14007ef7e
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x14007ef7e
xor r9d, r9d
mov r8d, dword [rbp - 0x30]
lea rdx, str.FirstBootLow
lea rcx, [rbp + 0xb0]
call fcn.1400dfe90
xor r9d, r9d
mov r8d, dword [rbp - 0x2c]
lea rdx, str.FirstBootHigh
lea rcx, [rbp + 0xb0]
call fcn.1400dfe90
mov dword [rbp - 0x7c], 0x400
mov qword [rsp + 0x28], r13
lea rax, str.0xFFFFFFFF_15_0xFFFFFFFF_1311_1312_1313
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7c]
lea r8, [rbp + 0xad0]
lea rdx, str.ScrybePopup
lea rcx, [rbp + 0x80]
call fcn.1400dfb40
lea r8, [rsi + 0x1760]
lea rdx, [0x140126c68]
lea rcx, [rbp + 0xad0]
call fcn.1400dd440
mov rdi, qword [rsi + 0x1760]
add rdi, 0xc
call fcn.140005220
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14007eff9
mov ecx, 0x80004005
call fcn.1400051c0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15d, r13d
mov dword [rsp + 0x44], r13d
mov dword [rbp - 0x74], r13d
cmp rdi, qword [rsi + 0x1768]
je 0x14007f277
lea r14, [rdi + 4]
nop dword [rax + rax]
xor r8d, r8d
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, dword [rdi]
lea rcx, [rbp + 0x38]
call fcn.1400b0300
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14007f0a0
cmp dword [rbx + 0x10], 0
jl 0x14007f091
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007f091
call fcn.14000bab0
mov r15, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14007f081
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r15 + 0x18]
mov qword [rsp + 0x30], rax
mov r15d, dword [rsp + 0x44]
jmp 0x14007f0a0
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000c060
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f0b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0x10], 0
jne 0x14007f0ee
mov r8, qword [rsi + 0x1768]
sub r8, r14
sar r8, 2
lea r8, [r8*4]
mov rdx, r14
mov rcx, rdi
call fcn.1400e42e0
add qword [rsi + 0x1768], 0xfffffffffffffffc
jmp 0x14007f0f9
mov r15d, 1
mov dword [rsp + 0x44], r15d
add rdi, 4
add r14, 4
cmp rdi, qword [rsi + 0x1768]
jne 0x14007f030
test r15d, r15d
mov r13d, dword [rbp - 0x74]
je 0x14007f277
mov rdi, qword [rsi + 0x1760]
add rdi, 0xc
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
cmp ax, 9
je 0x14007f284
cmp rdi, qword [rsi + 0x1768]
je 0x14007f277
xor r14d, r14d
nop
xor r8d, r8d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov edx, dword [rdi]
lea rcx, [rbp + 0x40]
call fcn.1400b0300
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14007f1be
cmp dword [rbx + 0x10], 0
jl 0x14007f1af
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007f1af
call fcn.14000bab0
mov r14, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14007f1a1
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rsp + 0x30], rax
xor r14d, r14d
jmp 0x14007f1be
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000c060
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f1d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0x409
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov edx, dword [rdi]
lea rcx, [rbp - 0x40]
call fcn.1400b0300
nop
mov rdx, qword [rax]
mov eax, r14d
test rdx, rdx
setne al
test eax, eax
je 0x14007f26c
mov rax, qword [rsp + 0x30]
sub rdx, rax
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14007f227
add rax, 2
test cx, cx
jne 0x14007f210
mov ebx, r14d
jmp 0x14007f22c
sbb ebx, ebx
or ebx, 1
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f244
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
mov eax, 1
cmovne r13d, eax
add rdi, 4
mov rbx, qword [rsp + 0x30]
cmp rdi, qword [rsi + 0x1768]
jne 0x14007f150
test r13d, r13d
je 0x14007f277
jmp 0x14007f284
mov ecx, 0x80004005
call fcn.1400051c0
nop
mov rax, qword [rsi + 0x1760]
mov dword [rax], 0xffffffff
mov rax, qword [rsi + 0x1760]
mov r8d, dword [rax]
mov dword [rbp + 0x1318], r8d
xor r9d, r9d
lea rdx, str.FirstDelayDays
lea rcx, [rbp + 0xb0]
call fcn.1400dfe90
xor r9d, r9d
lea r8d, [r9 + 3]
lea rdx, str.NextMsgIndex
lea rcx, [rbp + 0xb0]
call fcn.1400dfe90
mov rax, qword [rsi + 0x1760]
xor r9d, r9d
mov r8d, dword [rax + 8]
lea rdx, str.RepeatTimes
lea rcx, [rbp + 0xb0]
call fcn.1400dfe90
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f2fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15d, 1
xor r13d, r13d
lea r14, [rsi + 0x17e8]
mov dword [rsp + 0x38], 0xdbba0
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x38]
lea rdx, str.ScrybePopupTimerTimeout
lea rcx, [rbp + 0x80]
call fcn.1400dfa30
cmp dword [rbp + 0x1318], 0xffffffff
je 0x14007f35c
lea r9, [0x14008b7d0]
mov r8d, dword [rsp + 0x38]
mov edx, 0xfffc
mov rcx, qword [0x14026e190]
call qword [sym.imp.USER32.dll_SetTimer]
mov dword [rbp - 0x6c], 0x101
lea rdx, [rbp - 0x6c]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r9, [rbp + 0x8c0]
lea r8, str..pipe_s00781D6E_0417_44d2_8082_9257B2CA9E0A
mov edx, 0x200
lea rcx, [rbp + 0x4c0]
call fcn.1400e5c80
lea r9, [0x140122f68]
lea r8, [0x14012fd50]
xor edx, edx
lea rcx, [rbp + 0x210]
call fcn.1400dd150
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rbp + 0x228], 8
jb 0x14007f3cd
mov rcx, qword [rbp + 0x210]
call fcn.1400e3e78
test bl, bl
je 0x14007f431
lea r9, [0x140122f68]
lea r8, [0x14012fd50]
xor edx, edx
lea rcx, [rbp + 0x1f0]
call fcn.1400dd150
cmp qword [rax + 0x18], 8
jb 0x14007f3f7
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4c0]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rbp + 0x4c0]
call fcn.1400e5c80
cmp qword [rbp + 0x208], 8
jb 0x14007f431
mov rcx, qword [rbp + 0x1f0]
call fcn.1400e3e78
mov edx, 0x3d
lea rcx, [rbp + 0x4c0]
call fcn.140002990
mov qword [rsi + 0x1788], rax
test rax, rax
je 0x14007f45a
lea rdx, [rsi + 8]
mov rcx, rax
call fcn.140002740
xor eax, eax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], rax
mov dword [rbp + 0x138], eax
mov dword [rsp + 0x20], 0x4c
lea r9, [rbp + 0xf0]
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 4]
call sub.POWRPROF.dll_CallNtPowerInformation
cmp byte [rbp + 0x104], 0
je 0x14007f5cb
mov dword [rsi + 0x16cc], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x78]
call fcn.1400c9360
test eax, eax
je 0x14007f51f
mov qword [rsp + 0x20], r13
lea r9, [rsi + 0x16cc]
lea r8, [rsi + 0x16cc]
lea rdx, str.ConnectStandbyDisable
lea rcx, [rbp + 0x80]
call fcn.1400dfa30
cmp dword [rsi + 0x16cc], 0
jne 0x14007f5cb
mov edx, 0x104
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rbp + 0x2b0]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14007f550
movups xmm0, xmmword [str.Powrprof.dll]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x1401332b8]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x1401332c0]
mov dword [rcx + 0x18], eax
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14007f5cb
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007f5cb
lea rdx, [0x1400824d0]
mov qword [rbp + 0xd8], rdx
mov qword [rbp + 0xe0], rsi
lea r8, [rbp + 0x188]
lea rdx, [rbp + 0xd8]
mov ecx, 2
call rax
call fcn.14005d220
cmp dword [rax + 4], 0
je 0x14007f5e3
call fcn.14005d220
mov rcx, rax
call fcn.14007a8b0
mov rcx, qword [rsi + 0x1668]
call fcn.140097bc0
xor ecx, ecx
call fcn.1400dbe60
cmp eax, 0xb
je 0x14007f607
xor ecx, ecx
call fcn.1400dbe60
cmp eax, 0xc
jne 0x14007f60f
mov rcx, r14
call fcn.14002bd20
mov edx, r15d
mov rcx, rsi
call fcn.140089960
mov esi, r15d
lea rcx, [rbp + 0xa8]
call fcn.1400c9300
nop
lea rcx, [rbp + 0x260]
call fcn.1400c9300
jmp 0x14007f63b
mov esi, r13d
lea rcx, [rbp + 0x158]
call fcn.1400c9300
nop
lea rcx, [rbp + 0x78]
call fcn.1400c9300
nop
lea rcx, [rbp + 0x48]
call fcn.1400c9300
jmp 0x14007f660
mov esi, r13d
lea rax, vtable.CSynList_class_CRegistryKey_.0
mov qword [rbp - 0x20], rax
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x14007f6d7
test rbx, rbx
je 0x14007f6d7
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
test rcx, rcx
je 0x14007f68c
mov qword [rcx + 8], rax
jmp 0x14007f690
mov qword [rbp - 0x18], rax
mov rcx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
test rcx, rcx
je 0x14007f6a3
mov qword [rcx + 0x10], rax
jmp 0x14007f6a7
mov qword [rbp - 0x10], rax
mov rdi, qword [rbx + 8]
cmp dword [rbp - 4], 0
je 0x14007f6c4
mov rcx, qword [rbx]
test rcx, rcx
je 0x14007f6c4
mov rax, qword [rcx]
mov edx, r15d
call qword [rax]
mov qword [rbx], r13
mov rcx, rbx
call fcn.1400e3e78
mov rbx, rdi
dec dword [rbp - 8]
test rdi, rdi
jne 0x14007f674
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
lea rcx, [rbp + 0x190]
call fcn.1400c9300
nop
lea rcx, [rbp + 0x1c0]
call fcn.1400c9300
mov eax, esi
mov rbx, qword [rsp + 0x1410]
add rsp, 0x13d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret