Function at 0x1400a2d40
Capabilities:
Get geographical location
Get graphical window text
Hide graphical window
Initialize winsock library
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xcc0]
sub rsp, 0xdc0
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0xcb0], rax
mov r15, qword [rbp + 0xd18]
lea rdx, [rbp + 0xc0]
mov r14, qword [rbp + 0xd10]
mov r12, rcx
xorps xmm0, xmm0
mov qword [rbp - 0x68], r15
mov ecx, 0x101
movups xmmword [rbp + 0x40], xmm0
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [0x14016fa38]
mov ecx, 0x400
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea rcx, [0x14018f198]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x14018f1c0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x14018f1e8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x14018f210]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.14008da10
call fcn.140038cb0
mov byte [0x14018ed1c], al
call fcn.1400c2ad0
mov rcx, r12
mov byte [0x14018ed1b], al
call qword [sym.imp.USER32.dll_GetMenu]
mov edx, 0x7f02
mov qword [0x14018ec78], r12
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f00
xor ecx, ecx
mov r13, rax
mov qword [rbp - 0x78], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, qword [0x1401896c0]
mov edx, 0xa
mov qword [0x14018ed28], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
mov qword [0x14018f250], rax
call qword [sym.imp.GDI32.dll_GetStockObject]
lea r8, [rbp + 0x60]
mov edx, 0x5c
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetObjectW]
lea rcx, [rbp + 0x60]
mov byte [rbp + 0x75], 1
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
lea rcx, str.commdlg_FindReplace
mov qword [0x140189c60], rax
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov edx, 2
mov rcx, rdi
mov dword [0x14018ec70], eax
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.USER32.dll_GetSubMenu]
mov qword [0x14018f260], rax
nop word [rax + rax]
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.USER32.dll_DeleteMenu]
test eax, eax
je 0x1400a2efe
mov rax, qword [0x14018f260]
jmp 0x1400a2ee0
mov eax, dword [0x14018a3f4]
xor esi, esi
mov ebx, esi
test eax, eax
jle 0x1400a2f95
lea r15, [0x14018a3f8]
xor r13d, r13d
nop word [rax + rax]
movsxd rax, ebx
lea esi, [rbx + 1]
imul r8, rax, 0x5f4
lea rcx, [rbp + 0x680]
add r8, r15
cmp ebx, 0xa
jge 0x1400a2f54
cmp ebx, 9
lea rdx, str._s_tCtrl_i
mov r9d, r13d
cmovne r9d, esi
call fcn.1400358d0
jmp 0x1400a2f5e
mov edx, 0x104
call fcn.1400e86e4
mov rcx, qword [0x14018f260]
lea eax, [rbx + 0x9ed9]
movsxd r8, eax
lea r9, [rbp + 0x680]
xor edx, edx
call qword [sym.imp.USER32.dll_AppendMenuW]
mov eax, dword [0x14018a3f4]
mov ebx, esi
cmp esi, eax
jl 0x1400a2f20
mov r15, qword [rbp - 0x68]
xor esi, esi
mov r13, qword [rbp - 0x78]
test eax, eax
jne 0x1400a2fb2
mov rcx, qword [0x14018f260]
lea r9, str._no_column_sets_saved_yet_
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov rcx, qword [0x1401896c0]
lea rdx, str.PRIORITY
call qword [sym.imp.USER32.dll_LoadMenuW]
xor edx, edx
mov rcx, rdi
mov qword [0x14018ed10], rax
call qword [sym.imp.USER32.dll_GetSubMenu]
mov edx, 1
mov r9d, 0x9cba
mov rcx, rax
mov r8d, 0x400
lea rax, str.Run_as_Limited_User...
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_InsertMenuW]
inc dword [0x14016fa90]
cmp dword [0x1401896c8], 1
jl 0x1400a302d
call fcn.14008f340
test al, al
jne 0x1400a3064
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
lea rax, str.Run_as_Administrator...
jmp 0x1400a3042
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
lea rax, str.Runas...
mov r9d, 0x9cb9
mov qword [rsp + 0x20], rax
mov r8d, 0x400
mov edx, 1
call qword [sym.imp.USER32.dll_InsertMenuW]
inc dword [0x14016fa90]
mov r9d, 0x9cbf
lea rbx, str.Above_Normal:_10
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rdi
lea edx, [r9 - 1]
call qword [sym.imp.USER32.dll_InsertMenuW]
mov rcx, qword [0x14018ed10]
mov r9d, 0x9cbf
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea edx, [r9 - 1]
call qword [sym.imp.USER32.dll_InsertMenuW]
mov r9d, 0x9cbd
lea rbx, str.Below_Normal:_6
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rdi
lea edx, [r9 - 2]
call qword [sym.imp.USER32.dll_InsertMenuW]
mov rcx, qword [0x14018ed10]
mov r9d, 0x9cbd
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea edx, [r9 - 2]
call qword [sym.imp.USER32.dll_InsertMenuW]
cmp dword [0x1401896c8], 1
jl 0x1400a31ab
mov r9d, 0x9cbc
lea rbx, str.Background:_4__Low_I_O_and_Memory_Priority_
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rdi
lea edx, [r9 - 1]
call qword [sym.imp.USER32.dll_InsertMenuW]
mov rcx, qword [0x14018ed10]
mov r9d, 0x9cbc
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea edx, [r9 - 1]
call qword [sym.imp.USER32.dll_InsertMenuW]
cmp dword [0x1401896c8], 1
jl 0x1400a31ab
call fcn.14008f340
test al, al
jne 0x1400a31ab
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetSubMenu]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov r8d, 0xc00
lea edx, [r9 + 3]
call qword [sym.imp.USER32.dll_InsertMenuW]
inc dword [0x14016fa90]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetSubMenu]
mov edx, 4
mov r9d, 0x9f12
mov rcx, rax
mov r8d, 0x400
lea rax, str.Show_Details_for_All_Processes
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_InsertMenuW]
inc dword [0x14016fa90]
jmp 0x1400a31c3
mov rax, qword [0x140194190]
test rax, rax
je 0x1400a31c3
mov edx, 1
mov ecx, 0x7f2
call rax
mov rcx, qword [0x1401896c0]
lea rdx, str.OPACITY
call qword [sym.imp.USER32.dll_LoadMenuW]
mov r9d, eax
mov edx, 0x9c6e
lea rax, str.Opacity
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_InsertMenuW]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov edx, 0x9c6e
mov r8d, 0x800
mov rcx, rdi
call qword [sym.imp.USER32.dll_InsertMenuW]
movzx eax, byte [0x14018dfa1]
mov edx, 0x9cb2
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018dfb0]
mov edx, 0x9cb3
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
cmp byte [0x14018dfb0], 0
mov r8d, esi
mov edx, 0x9f36
mov rcx, rdi
sete r8b
call qword [sym.imp.USER32.dll_EnableMenuItem]
cmp byte [0x14018dfb0], 0
je 0x1400a327c
call fcn.1400d7a00
movzx eax, byte [0x14018df8a]
mov edx, 0x9ec4
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018df8d]
mov edx, 0x9f0f
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018df8b]
mov edx, 0x9f16
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018df8c]
mov edx, 0x9f17
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018df9e]
mov edx, 0x9c83
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018df9c]
mov edx, 0x9c75
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018df9a]
mov edx, 0x9c99
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
cmp byte [0x14018df9d], 0
mov rsi, qword [0x14018ec78]
setne bl
mov rcx, rsi
mov byte [0x14018df9d], bl
call qword [sym.imp.USER32.dll_GetMenu]
movzx r8d, bl
mov edx, 0x9c82
shl r8d, 3
mov rcx, rax
call qword [sym.imp.USER32.dll_CheckMenuItem]
cmp byte [0x14018df9d], 0
je 0x1400a33e2
xor eax, eax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov rcx, rsi
lea rdx, [rax - 1]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x14018eca8]
xor esi, esi
test rcx, rcx
je 0x1400a3435
mov dword [rsp + 0x30], 3
lea rdx, [rsi - 1]
mov dword [rsp + 0x28], esi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x1400a3435
mov rcx, qword [0x14018eca8]
xor ebx, ebx
test rcx, rcx
je 0x1400a3410
mov dword [rsp + 0x30], 3
lea rdx, [rbx - 2]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_SetWindowPos]
xor r9d, r9d
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], ebx
lea rdx, [r9 - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
xor esi, esi
movzx eax, byte [0x14018df91]
mov edx, 0x9c6d
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018df9f]
mov edx, 0x9c96
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018dfa0]
mov edx, 0x9f25
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018dfa4]
mov edx, 0x9f0d
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov r9d, 0x9c7c
lea rax, str.System_Information..._tCtrlI
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 - 0x15]
call qword [sym.imp.USER32.dll_InsertMenuW]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x60]
call fcn.140068990
movabs rbx, 0x4059000000000000
test al, al
je 0x1400a35de
mov edx, 1
mov ecx, edx
mov r8d, edx
call fcn.1400657d0
mov qword [0x14018f9e8], rax
mov edx, 1
xor r8d, r8d
mov ecx, edx
mov dword [rax + 0x2c], 4
mov rax, qword [0x14018f9e8]
mov dword [rax + 0x48], 0x8080ff
mov rax, qword [0x14018f9e8]
mov qword [rax + 0x40], rbx
call fcn.1400657d0
mov qword [0x14018f9f0], rax
movabs rbx, 0x3ff0000000000000
mov dword [rax + 0x2c], 5
mov rax, qword [0x14018f9f0]
mov dword [rax + 0x48], 0xaaaa
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x1400a357b
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
mov rax, qword [0x14018f9f0]
cvtps2pd xmm1, xmm0
movsd qword [rax + 0x40], xmm1
jmp 0x1400a3586
mov rax, qword [0x14018f9f0]
mov qword [rax + 0x40], rbx
mov edx, 1
xor r8d, r8d
mov ecx, edx
call fcn.1400657d0
mov qword [0x14018f9f8], rax
mov dword [rax + 0x2c], 6
mov rax, qword [0x14018f9f8]
mov dword [rax + 0x48], 0x4080ff
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x1400a35d3
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
mov rax, qword [0x14018f9f8]
cvtps2pd xmm1, xmm0
movsd qword [rax + 0x40], xmm1
jmp 0x1400a35de
mov rax, qword [0x14018f9f8]
mov qword [rax + 0x40], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov edx, 0x9c67
mov r8d, 0x800
mov rcx, rdi
call qword [sym.imp.USER32.dll_InsertMenuW]
mov r9d, 0x9c7b
lea rax, str.Replace_Task_Manager
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 - 6]
call qword [sym.imp.USER32.dll_InsertMenuW]
call fcn.14008d6f0
neg al
mov edx, 0x9c7b
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
cmp dword [0x1401896c8], 1
jl 0x1400a366a
call fcn.14008f340
test al, al
jne 0x1400a366a
mov rbx, qword [0x140189c20]
call fcn.140041e00
mov r8, rax
lea rcx, [rbx + 0xc0]
mov edx, 0x9c7b
call fcn.14009f230
call fcn.14008d6f0
test al, al
je 0x1400a3681
mov rcx, qword [0x14018ec78]
xor edx, edx
call fcn.14008dbd0
call fcn.14008d2c0
neg al
mov edx, 0x9f30
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx eax, byte [0x14018df9b]
mov edx, 0x9c77
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov r9d, 0x9c78
lea rax, str.Configure_Symbols...
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 + 9]
call qword [sym.imp.USER32.dll_InsertMenuW]
xor r8d, r8d
mov edx, 0x9c50
mov rcx, rdi
call qword [sym.imp.USER32.dll_DeleteMenu]
mov r9d, 0x9c80
lea rax, str.Configure_Colors...
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 + 1]
call qword [sym.imp.USER32.dll_InsertMenuW]
xor edx, edx
lea rax, [rbp - 0x80]
lea r9, [rbp - 0x50]
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r8d, [rdx + 1]
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x1400a3795
cmp dword [rbp - 0x80], 0
je 0x1400a3795
lea rdx, [rbp - 0x48]
mov dword [rbp - 0x48], 0x28
mov rcx, rdi
mov dword [rbp - 0x44], 0x80000010
mov dword [rbp - 0x40], 0x8000000
call qword [sym.imp.USER32.dll_SetMenuInfo]
call qword [sym.imp.USER32.dll_CreateMenu]
lea rcx, str.Users
mov edx, 5
mov r9, rax
mov qword [0x14018f280], rax
mov qword [rsp + 0x20], rcx
mov r8d, 0x410
mov rcx, rdi
call qword [sym.imp.USER32.dll_InsertMenuW]
mov rcx, qword [rbp - 0x50]
inc dword [0x14016fa94]
call sub.WTSAPI32.dll_WTSFreeMemory
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x60], rsi
lea rcx, [rbp + 0xaa0]
mov qword [rsp + 0x58], rsi
lea r9, [rbp + 0x890]
mov qword [rsp + 0x50], rsi
xor r8d, r8d
mov qword [rsp + 0x48], rsi
mov edx, ebx
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], 0x104
call fcn.1400c4fa0
cmp word [rbp + 0xaa0], 0
je 0x1400a380b
cmp word [rbp + 0x890], 0
lea r9, [0x14011eb8c]
jne 0x1400a3812
lea r9, [0x14011eaa0]
lea rax, [rbp + 0x890]
lea r8, [rbp + 0xaa0]
mov qword [rsp + 0x20], rax
lea rdx, str._s_s_s
lea rcx, [0x14018ea60]
call fcn.1400358d0
mov rcx, qword [0x14018ec78]
lea rdx, [rbp + 0x260]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rbp + 0x260]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400a3860
mov edx, 0x104
lea rcx, [rbp + 0x260]
sub rdx, rax
lea rcx, [rcx + rax*2]
lea r9, [0x14018ea60]
lea r8, str.___s_
call fcn.1400192b0
call fcn.14008f340
test al, al
je 0x1400a38b1
lea r8, str.__Administrator_
mov edx, 0x104
lea rcx, [rbp + 0x260]
call fcn.1400f7f64
mov rcx, qword [0x14018ec78]
lea rdx, [rbp + 0x260]
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rcx, [0x14018e3d8]
call fcn.14007d1b0
lea rcx, [0x14018e3e0]
mov dword [0x14018f290], eax
call fcn.14007d1b0
lea rcx, [0x14018e3e8]
mov dword [0x14018f294], eax
call fcn.14007d1b0
lea rcx, [0x14018e3f0]
mov dword [0x14018f298], eax
call fcn.14007d1b0
lea rcx, [0x14018e3f8]
mov dword [0x14018f29c], eax
call fcn.14007d1b0
lea rcx, [0x14018ec68]
mov dword [0x14018f2a0], eax
call fcn.14008f0e0
cmp dword [0x14018ed70], 1
jbe 0x1400a3b7d
mov edx, 3
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetSubMenu]
mov edx, 2
mov r9d, 0x4a7
mov rcx, rax
mov r8d, 0x400
lea rax, str.Set_Affinity...
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_InsertMenuW]
cmp byte [0x14018dfa2], 0
mov edx, esi
mov r8d, 8
mov rcx, rdi
setne dl
add edx, 0x9cb6
call qword [sym.imp.USER32.dll_CheckMenuItem]
cmp qword [0x140194168], 0
mov dword [rsp + 0x70], esi
je 0x1400a39e8
call fcn.1400c40f0
lea r8, [rsp + 0x70]
mov dword [0x14018f9b8], eax
xor edx, edx
mov ecx, 0xffff
call qword [0x140194168]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400a3a2b
mov ecx, dword [rsp + 0x70]
call fcn.1400e8270
lea r8, [rsp + 0x70]
mov qword [0x14018f9c0], rax
mov rdx, rax
mov ecx, 0xffff
call qword [0x140194168]
jmp 0x1400a3a2b
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400a3a2b
mov ecx, dword [rsp + 0x70]
call fcn.1400e8270
lea rdx, [rsp + 0x70]
mov qword [0x14018f9c0], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
mov eax, dword [rsp + 0x70]
shr eax, 5
mov dword [0x14018f9b8], eax
mov ecx, dword [0x14018f9b8]
shl rcx, 3
call fcn.1400e8270
mov qword [0x14018f9c8], rax
mov eax, dword [0x14018f9b8]
test eax, eax
jle 0x1400a3b7b
xor ebx, ebx
movabs r13, 0x4059000000000000
nop dword [rax + rax]
xor r8d, r8d
mov ecx, eax
lea edx, [r8 + 2]
call fcn.1400657d0
mov rcx, qword [0x14018f9c8]
xor edx, edx
mov r9d, esi
mov qword [rbx + rcx], rax
mov dword [rax + 0x8b0], esi
mov rax, qword [0x14018f9c8]
mov r8d, dword [0x14018f9b8]
mov rcx, qword [rbx + rax]
lea rax, [rcx + 0x8a8]
add rcx, 0x8ac
cmp qword [0x140194168], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
setne dl
mov rcx, qword [0x14018f9c0]
call fcn.14008afb0
mov rax, qword [0x14018f9c8]
mov rcx, qword [rbx + rax]
mov dword [rcx + 0x30], 2
mov rax, qword [0x14018f9c8]
mov rcx, qword [rbx + rax]
mov dword [rcx + 0x2c], 0
mov rax, qword [0x14018f9c8]
mov rcx, qword [rbx + rax]
mov dword [rcx + 0x48], 0x3c943c
mov rax, qword [0x14018f9c8]
mov rcx, qword [rbx + rax]
mov qword [rcx + 0x40], r13
mov rax, qword [0x14018f9c8]
mov rcx, qword [rbx + rax]
mov dword [rcx + 0x68], 0xff
mov rax, qword [0x14018f9c8]
mov rcx, qword [rbx + rax]
mov qword [rcx + 0x60], r13
mov rax, qword [0x14018f9c8]
mov rcx, qword [rbx + rax]
mov rax, qword [0x14018f9e0]
mov qword [rcx + 0x8b8], rax
test esi, esi
je 0x1400a3b63
mov rax, qword [0x14018f9c8]
mov rcx, qword [rax]
mov rdx, qword [rbx + rax]
mov rax, qword [rcx + 0x898]
mov qword [rdx + 0x898], rax
mov eax, dword [0x14018f9b8]
inc esi
add rbx, 8
cmp esi, eax
jl 0x1400a3a60
mov r13, qword [rbp - 0x78]
xor esi, esi
call sub.POWRPROF.dll_IsPwrHibernateAllowed
test al, al
je 0x1400a3ba8
mov r9d, 0x9c87
lea rax, str.Hibernate
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 - 1]
call qword [sym.imp.USER32.dll_InsertMenuW]
call sub.POWRPROF.dll_IsPwrSuspendAllowed
test al, al
je 0x1400a3bd3
mov r9d, 0x9c88
lea rax, str.Stand_By
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 - 2]
call qword [sym.imp.USER32.dll_InsertMenuW]
mov r9d, 0x9c92
lea rax, str.Lock
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 - 0xc]
call qword [sym.imp.USER32.dll_InsertMenuW]
mov rcx, qword [0x1401896c0]
lea rdx, str.DLLMENU
call qword [sym.imp.USER32.dll_LoadMenuW]
movzx ecx, byte [0x14018df99]
mov edx, 0x9c50
neg cl
mov qword [0x14018f270], rax
mov rcx, rax
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov rcx, qword [0x1401896c0]
lea rdx, str.HANDLEMENU
call qword [sym.imp.USER32.dll_LoadMenuW]
mov rcx, qword [0x140189c20]
mov rdx, rax
add rcx, 0xc0
mov qword [0x14018f278], rax
call fcn.140074590
movzx eax, byte [0x14018df92]
mov edx, 0x9c47
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
lea r8, [rsp + 0x78]
mov rcx, 0xffffffff80000000
lea rdx, str.exefile_shellView_Dependencies
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
xor r8d, r8d
test eax, eax
je 0x1400a3d69
xor edx, edx
mov word [0x14018ed80], si
lea rcx, [0x14011ed30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x1400a3dc1
lea ecx, [rax + 1]
add rcx, rcx
call fcn.1400e8270
mov r8d, ebx
lea rcx, [0x14011ed30]
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [0x14018ed80]
mov r8d, ebx
mov rdx, rsi
lea rcx, str.depends.exe
call fcn.14008aa80
test al, al
je 0x1400a3d54
lea rbx, str.Launch_Depends...
mov r9d, 0x9c64
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, 0x9f22
mov rcx, rdi
call qword [sym.imp.USER32.dll_InsertMenuW]
mov rcx, qword [0x14018f270]
mov r9d, 0x9c60
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea edx, [r9 + 0x4f]
call qword [sym.imp.USER32.dll_InsertMenuW]
mov rcx, rsi
mov byte [0x14018ed1d], 1
call fcn.1400e825c
xor esi, esi
jmp 0x1400a3dc1
xor eax, eax
mov rcx, rsi
mov word [0x14018ed80], ax
call fcn.1400e825c
xor esi, esi
jmp 0x1400a3dc1
lea rbx, str.Launch_Depends...
mov byte [0x14018ed1d], 1
mov r9d, 0x9c64
mov qword [rsp + 0x20], rbx
mov edx, 0x9f22
mov rcx, rdi
call qword [sym.imp.USER32.dll_InsertMenuW]
mov rcx, qword [0x14018f270]
mov r9d, 0x9c60
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea edx, [r9 + 0x4f]
call qword [sym.imp.USER32.dll_InsertMenuW]
mov rcx, qword [rsp + 0x78]
mov word [0x14018ed80], si
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x140189c20]
mov rdx, qword [0x14018f270]
add rcx, 0xc0
call fcn.140074590
lea r8, [rsp + 0x78]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAeDebug
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400a3ecc
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x70]
lea rax, [rbp + 0x470]
mov dword [rsp + 0x70], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140124b48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a3ec1
mov edx, 0x104
lea rcx, [0x14018ef90]
call fcn.1400e8fb8
cmp word [rbp + 0x470], 0x22
lea rcx, [0x14018ef90]
mov edx, 0x104
jne 0x1400a3e8b
lea r8, [rbp + 0x472]
call fcn.1400e86e4
mov edx, 0x22
lea rcx, [0x14018ef90]
call fcn.1400e3bac
test rax, rax
je 0x1400a3ec1
mov edx, 0x22
jmp 0x1400a3eb2
lea r8, [rbp + 0x470]
call fcn.1400e86e4
mov edx, 0x20
lea rcx, [0x14018ef90]
call fcn.1400e3bac
test rax, rax
je 0x1400a3ec1
mov edx, 0x20
lea rcx, [0x14018ef90]
call fcn.1400e3bac
mov word [rax], si
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [0x14018ef90], 0
je 0x1400a3ef9
lea rax, str.Debug
mov r9d, 0x9c68
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x9f22
mov rcx, rdi
call qword [sym.imp.USER32.dll_InsertMenuW]
xor r8d, r8d
mov edx, 0x9f22
mov rcx, rdi
call qword [sym.imp.USER32.dll_DeleteMenu]
mov edx, 0x67
mov rcx, r12
call fcn.1400d6e30
mov qword [0x14018eca0], rax
test rax, rax
je 0x1400a494f
mov edx, 3
xor ecx, ecx
call fcn.14007cae0
mov rcx, qword [0x14018eca0]
lea rdx, [rbp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x4c]
xorps xmm0, xmm0
sub eax, dword [rbp + 0x44]
mov r9d, 0x52010000
mov rdx, qword [0x1401896c0]
add eax, 2
mov dword [0x14018f6bc], eax
mov r8d, 0x65
lea rax, [rbp + 0x50]
mov rcx, r14
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp + 0x50], xmm0
call fcn.140039130
mov qword [0x14018ec80], rax
test rax, rax
je 0x1400a494f
mov rdx, qword [0x140189c50]
mov rcx, rax
call fcn.14007df90
mov rcx, qword [0x14018ec80]
call fcn.14003b170
mov rbx, rax
xor edx, edx
lea rax, [0x140083a60]
mov rcx, rbx
mov qword [rbx + 0x158], rax
call fcn.14003ade0
lea rax, [0x140083c60]
mov edx, 0x6a
mov qword [rbx + 0x160], rax
mov rcx, qword [0x1401896c0]
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rdx, rax
mov rcx, rbx
call fcn.14003ef70
mov dl, 1
mov rcx, rbx
call fcn.14003add0
xor edx, edx
mov rcx, rbx
call fcn.14003eef0
xor edx, edx
mov rcx, rbx
call fcn.14003ef80
mov rcx, rbx
call fcn.14003bb00
mov rcx, rax
call fcn.14008a930
mov rcx, rbx
call fcn.14003b5c0
mov rcx, rax
call fcn.14008a930
mov rcx, rbx
call fcn.14003b5d0
mov rcx, rax
call fcn.14008a930
lea rcx, [0x140189e00]
call fcn.1400a0940
mov r9d, dword [0x14018a00c]
lea r8, [0x14018a010]
mov rcx, qword [0x14018ec80]
lea rdx, [0x14018a0d0]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call fcn.14007fca0
test eax, eax
je 0x1400a494f
mov rdx, qword [0x14018f4b0]
xor r8d, r8d
mov rcx, rbx
call fcn.14003eea0
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [0x14018f668]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, esi
lea r14, [0x140000000]
mov rcx, rsi
nop word [rax + rax]
cmp qword [r14 + rcx*8 + 0x18f4b8], 0xffffffffffffffff
jne 0x1400a40d4
inc rcx
cmp rcx, 0x35
jb 0x1400a40c0
mov rax, qword [r14 + rcx*8 + 0x18f4b8]
test al, 1
je 0x1400a40e9
inc edx
shr rax, 1
test al, 1
jne 0x1400a40e0
shl ecx, 6
mov r8, rbx
add edx, ecx
mov rcx, qword [0x14018f4b0]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov ecx, eax
cmp eax, 0xffffffff
jne 0x1400a411e
mov rcx, qword [0x14018f4b0]
mov r8, rbx
mov edx, eax
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov ecx, eax
cmp eax, 0xffffffff
je 0x1400a414e
movsxd r8, ecx
mov eax, 1
shr r8, 6
and ecx, 0x3f
shl rax, cl
mov rdx, qword [r14 + r8*8 + 0x18f4b8]
or rax, rdx
mov qword [r14 + r8*8 + 0x18f4b8], rax
cmp rdx, rax
je 0x1400a414e
inc dword [0x14018f660]
lea rcx, [0x14018f668]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [0x14018f488]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, esi
mov rcx, rsi
nop dword [rax]
cmp qword [r14 + rcx*8 + 0x18f2d8], 0xffffffffffffffff
jne 0x1400a4194
inc rcx
cmp rcx, 0x35
jb 0x1400a4180
mov rax, qword [r14 + rcx*8 + 0x18f2d8]
test al, 1
je 0x1400a41a9
inc edx
shr rax, 1
test al, 1
jne 0x1400a41a0
shl ecx, 6
mov r8, rbx
add edx, ecx
mov rcx, qword [0x14018f2d0]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov ecx, eax
cmp eax, 0xffffffff
jne 0x1400a41de
mov rcx, qword [0x14018f2d0]
mov r8, rbx
mov edx, eax
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov ecx, eax
cmp eax, 0xffffffff
je 0x1400a420e
movsxd r8, ecx
mov eax, 1
shr r8, 6
and ecx, 0x3f
shl rax, cl
mov rdx, qword [r14 + r8*8 + 0x18f2d8]
or rax, rdx
mov qword [r14 + r8*8 + 0x18f2d8], rax
cmp rdx, rax
je 0x1400a420e
inc dword [0x14018f480]
lea rcx, [0x14018f488]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [0x14018a00a], 0
jne 0x1400a4244
movzx r9d, byte [0x14018a254]
mov edx, 0xffffffff
mov r8d, dword [0x14018a250]
mov rcx, qword [0x14018ec80]
call fcn.1400830e0
mov eax, dword [0x14018a25c]
lea r9, [0x14018a260]
mov rcx, qword [r15 + 8]
lea r8, [0x14018a36c]
mov dword [rsp + 0x28], 0x66
mov edx, 0x40810405
mov dword [rsp + 0x20], eax
call fcn.14007c300
mov qword [0x14018ec88], rax
mov rbx, rax
test rax, rax
je 0x1400a494f
mov rcx, qword [r15 + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x28], rsi
lea r9, [0x1401356c0]
mov edx, eax
mov dword [rsp + 0x20], esi
mov r8, rbx
mov rcx, r15
call fcn.140086c90
movzx r9d, byte [0x14018a3f0]
mov edx, 0xffffffff
mov r8d, dword [0x14018a3ec]
mov rcx, qword [0x14018ec88]
call fcn.1400830e0
mov eax, dword [0x14018a328]
lea r9, [0x14018a32c]
mov rcx, qword [r15 + 8]
lea r8, [0x14018a2a0]
mov edx, 0x40810405
mov dword [rsp + 0x28], 0x68
mov dword [rsp + 0x20], eax
call fcn.14007c300
mov qword [0x14018ec90], rax
test rax, rax
je 0x1400a494f
mov r9d, 1
mov qword [rsp + 0x20], rsi
lea r8, str.DLLs
mov rdx, rax
mov rcx, r15
call fcn.14009f580
movzx r9d, byte [0x14018a324]
mov edx, 0xffffffff
mov r8d, dword [0x14018a320]
mov rcx, qword [0x14018ec90]
call fcn.1400830e0
mov r8, qword [0x14018ec78]
lea rdx, [0x14011eaa0]
mov r9d, 0x6a
mov ecx, 0x50000000
call qword [sym.imp.COMCTL32.dll_CreateStatusWindowW]
mov rcx, rax
mov qword [0x14018ec98], rax
call fcn.1400d5cd0
mov rcx, qword [0x1401896c0]
mov edx, 0x69
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x14018f6c0], rax
test rax, rax
jne 0x1400a43b2
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x14018f6c0], rax
mov rcx, qword [0x1401896c0]
mov edx, 0x6a
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x14018f6c8], rax
test rax, rax
jne 0x1400a43e4
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x14018f6c8], rax
movzx eax, byte [0x14018df99]
mov edx, 0x9c50
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov rcx, qword [0x14018ec80]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x14018a00a], 0
mov r9, rsi
mov rcx, qword [0x14018eca0]
mov edx, 0x401
sete r9b
mov r8d, 0x9c67
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x14018a00a], 0
mov ebx, esi
mov rcx, qword [0x14018ec78]
setne bl
call qword [sym.imp.USER32.dll_GetMenu]
mov r8d, ebx
mov edx, 0x9c67
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov rcx, qword [0x14018ec78]
call qword [sym.imp.USER32.dll_GetMenu]
mov edx, 0x9c6c
mov r8d, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rdx, [0x14018ed30]
mov rcx, r12
mov qword [0x14018f238], rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x14018ed34]
lea rcx, str.TaskbarCreated
mov edx, dword [0x14018f6bc]
dec eax
add edx, eax
mov dword [0x14018ed40], esi
mov eax, dword [0x14018ed3c]
sub eax, edx
mov dword [0x14018ed34], edx
mov dword [0x14018ed3c], eax
sub eax, edx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x140189de8]
cvttsd2si eax, xmm0
add eax, edx
mov dword [0x14018ed44], eax
add eax, 7
mov dword [0x14018ed4c], eax
mov eax, dword [0x14018ed38]
mov dword [0x14018ed48], eax
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x14018f268], eax
call fcn.140060ba0
mov rcx, qword [0x14018ec80]
mov dl, 1
call fcn.1400c81d0
movzx r9d, byte [0x14018a00a]
mov edx, 0x7e8
mov rcx, qword [0x14018ec78]
mov r8d, 0x65
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14018ec80]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [0x14018ec90]
lea r9, [rbp - 0x20]
xor r8d, r8d
mov dword [rbp - 0x10], 3
mov edx, 0x102b
mov dword [rbp - 0x14], 3
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14018ec88]
lea r9, [rbp - 0x20]
xor r8d, r8d
mov dword [rbp - 0x10], 3
mov edx, 0x102b
mov dword [rbp - 0x14], 3
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.14008f340
test al, al
je 0x1400a464d
mov dl, 1
lea rcx, [0x140189740]
call fcn.140095280
test eax, eax
jne 0x1400a464d
mov r9d, 0x9f2a
lea rax, str.Disk_History
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 - 0x14]
call qword [sym.imp.USER32.dll_InsertMenuW]
movzx eax, byte [0x14018df8f]
mov edx, 0x9f2a
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov r9d, 0x9f2b
lea rax, [0x140135720]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 - 0x15]
call qword [sym.imp.USER32.dll_InsertMenuW]
movzx eax, byte [0x14018df8e]
mov edx, 0x9f2b
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
cmp dword [0x1401896a8], 0
je 0x1400a4696
mov r9d, 0x9f2c
lea rax, str.GPU_History
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 - 0x16]
call qword [sym.imp.USER32.dll_InsertMenuW]
movzx eax, byte [0x14018df90]
mov edx, 0x9f2c
neg al
mov rcx, rdi
sbb r8d, r8d
and r8d, 8
call qword [sym.imp.USER32.dll_CheckMenuItem]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [0x14018ece8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x14018ecf0], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [0x14018f248], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x14018ecf8], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [0x14018ed00], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x1400a0c40]
mov qword [0x14018ed08], rax
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call fcn.1400f7ce8
mov qword [0x14018f240], rax
mov eax, dword [0x140189df8]
cmp eax, 0x7d0
jg 0x1400a4802
je 0x1400a47ed
test eax, eax
je 0x1400a47a7
cmp eax, 0x1f4
je 0x1400a478c
cmp eax, 0x3e8
jne 0x1400a4850
mov rcx, qword [0x14018ec78]
call qword [sym.imp.USER32.dll_GetMenu]
mov r9d, 0x9c55
jmp 0x1400a4838
mov rcx, qword [0x14018ec78]
call qword [sym.imp.USER32.dll_GetMenu]
mov r9d, 0x9c57
mov r8d, r9d
jmp 0x1400a483e
mov rcx, qword [0x14018ec78]
call qword [sym.imp.USER32.dll_GetMenu]
mov edx, 0x9c52
mov dword [rsp + 0x20], esi
mov rcx, rax
mov r9d, edx
lea r8d, [rdx + 5]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov edx, dword [0x1401a9438]
lea r8, str.Paused
mov rcx, qword [0x140189c20]
dec edx
xor r9d, r9d
call fcn.140088500
jmp 0x1400a4850
mov rcx, qword [0x14018ec78]
call qword [sym.imp.USER32.dll_GetMenu]
mov r9d, 0x9c53
jmp 0x1400a4838
cmp eax, 0x1388
je 0x1400a4825
cmp eax, 0x2710
jne 0x1400a4850
mov rcx, qword [0x14018ec78]
call qword [sym.imp.USER32.dll_GetMenu]
mov r9d, 0x9c56
jmp 0x1400a4838
mov rcx, qword [0x14018ec78]
call qword [sym.imp.USER32.dll_GetMenu]
mov r9d, 0x9c54
mov r8d, 0x9c57
mov edx, 0x9c52
mov dword [rsp + 0x20], esi
mov rcx, rax
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov rcx, qword [0x14018eca0]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, r13
call qword [sym.imp.USER32.dll_SetCursor]
cmp qword [0x1401a0a70], 0
jne 0x1400a4887
xor r8d, r8d
mov edx, 0x9f0f
mov rcx, rdi
call qword [sym.imp.USER32.dll_DeleteMenu]
call fcn.1400a2460
mov ecx, dword [0x14018dfb4]
cmp ecx, 0x64
je 0x1400a4911
mov rcx, qword [0x14018ec78]
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov rcx, qword [0x14018ec78]
mov edx, 0xffffffec
bts eax, 0x13
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
imul ecx, dword [0x14018dfb4], 0xff
mov eax, 0x51eb851f
imul ecx
mov rcx, qword [0x14018ec78]
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add r8d, edx
xor edx, edx
lea r9d, [rdx + 2]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x14018ec78]
mov r9d, 0x485
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov ecx, dword [0x14018dfb4]
mov eax, 0x66666667
mov r8d, 8
imul ecx
mov rcx, rdi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, 0x9c9d
add edx, eax
call qword [sym.imp.USER32.dll_CheckMenuItem]
cmp byte [0x14018ed18], 0
je 0x1400a494b
mov rcx, qword [0x14018ec78]
call fcn.14008d8b0
xor eax, eax
jmp 0x1400a4956
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0xcb0]
xor rcx, rsp
call fcn.1400e17a0
lea r11, [rsp + 0xdc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret