Function at 0x1400d15a0
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x248]
sub rsp, 0x320
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov r14, rcx
mov qword [rbp - 0x28], rcx
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d20c2
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov dword [rbp - 0x40], 0x104
mov r12d, 1
mov dword [rbp - 0x3c], r12d
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d20cd
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov ecx, r12d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400d165d
mov edx, 0x104
lea rcx, [rsp + 0x38]
call fcn.14000bdf0
mov rbx, qword [rsp + 0x38]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x3c]
lea r8, str.Background
lea rdx, str.Control_PanelColors
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14028c900
test eax, eax
js 0x1400d20b7
cmp eax, dword [rbx - 0xc]
jg 0x1400d20b7
mov dword [rbx - 0x10], eax
cdqe
xor r15d, r15d
mov word [rbx + rax*2], r15w
cmp dword [rbx - 0x10], r15d
jne 0x1400d1756
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d20d8
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [r14], rax
lea rdx, [0x1402ec198]
lea rsi, [r15 - 1]
cmp rdx, 0x10000
jae 0x1400d16fd
movzx edx, dx
mov rcx, r14
call fcn.14000b690
jmp 0x1400d1716
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400d1700
mov r8d, eax
mov rcx, r14
call fcn.140010860
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1730
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400d19bc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
jmp 0x1400d19bc
lea rdx, str..jpg
lea rcx, [rbp - 0x20]
call fcn.14000a5c0
nop
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1400cedc0
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d179f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp]
call fcn.140289490
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.HaloDesktopData
lea rcx, [rbp]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.DesktopBkImage
lea rcx, [rbp]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d1807
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400d19ef
lea rax, [rbp]
mov rdi, rsi
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400d1830
mov rbx, qword [rsp + 0x30]
test edi, edi
jne 0x1400d189d
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400d1956
cmp dword [rdx + 0x10], 0
jge 0x1400d1871
cmp dword [rbx - 0xc], 0
jl 0x1400d20e3
mov dword [rbx - 0x10], r15d
mov word [rbx], r15w
jmp 0x1400d1956
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1886
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + SafeArrayCopy]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x1400d1956
mov r13d, dword [rbx - 0x10]
lea r15, [rbp]
sub r15, rbx
sar r15, 1
test edi, edi
js 0x1400d20ee
sub r12d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, r12d
jge 0x1400d18d2
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.14000bdf0
mov rbx, qword [rsp + 0x30]
movsxd rax, edi
cmp r15, r13
ja 0x1400d1929
lea rdx, [rbx + r15*2]
lea r15, [rax + rax]
test r15, r15
je 0x1400d1943
test rdx, rdx
jne 0x1400d18fe
call fcn.14028c79c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14028c64c
jmp 0x1400d1943
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r15
jae 0x1400d191c
call fcn.14028c79c
mov dword [rax], 0x22
call fcn.14028c64c
jmp 0x1400d1943
mov r8, r15
mov rcx, rbx
call fcn.140289020
jmp 0x1400d1943
lea r15, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r15
lea r8, [rbp]
mov rcx, rbx
call fcn.140015050
cmp edi, dword [rbx - 0xc]
jg 0x1400d20f9
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [r15 + rbx], ax
lea rcx, [rbx - 0x18]
call fcn.14000ae30
add rax, 0x18
mov qword [r14], rax
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1985
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d19a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [rbx - 8], esi
sub esi, 1
jg 0x1400d19bc
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r14
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140172190
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d2104
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, [0x1402fcc38]
cmp rdx, 0x10000
jae 0x1400d1a3c
movzx edx, dx
lea rcx, [rsp + 0x60]
call fcn.14000b690
jmp 0x1400d1a58
mov rax, rsi
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400d1a40
mov r8d, eax
lea rcx, [rsp + 0x60]
call fcn.140010860
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.1400d32b0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1a8b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
sub rax, rcx
sar rax, 3
cmp rax, 3
jae 0x1400d1beb
call fcn.14000b190
mov rcx, rax
test rax, rax
je 0x1400d210f
mov rax, qword [rax]
call qword [rax + SafeArrayCopy]
add rax, 0x18
mov qword [r14], rax
lea rdx, [0x1402ec198]
cmp rdx, 0x10000
jae 0x1400d1ae1
movzx edx, dx
mov rcx, r14
call fcn.14000b690
jmp 0x1400d1afa
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400d1ae4
mov r8d, eax
mov rcx, r14
call fcn.140010860
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400d1b8b
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1400d1b3c
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1b2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 8
cmp rbx, rdi
jne 0x1400d1b12
mov rbx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400d1b75
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d211a
mov rcx, rbx
call fcn.140171af0
mov qword [rsp + 0x50], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1baa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1bc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400d19bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
jmp 0x1400d19b9
mov rcx, qword [rcx]
call fcn.140291898
mov dword [rbp - 0x28], eax
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 8]
call fcn.140291898
mov dword [rbp - 0x34], eax
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
call fcn.140291898
mov dword [rbp - 0x30], eax
movdqa xmm0, xmmword [0x140305cc0]
movdqu xmmword [rbp - 0x10], xmm0
lea rax, vtable.ATL::CImage.0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov word [rbp - 0x68], 0
mov qword [rbp - 0x64], 0xffffffffffffffff
mov qword [rbp - 0x58], r15
mov dword [rbp - 0x50], r15d
mov qword [rbp - 0x48], r15
call fcn.1400d12c0
mov rbx, rax
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rbx + 0x30]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov edi, dword [rbp - 4]
sub edi, dword [rbp - 0xc]
mov eax, dword [rbp - 8]
sub eax, dword [rbp - 0x10]
mov dword [rbp - 0x38], eax
mov rbx, r15
mov ecx, 0x438
call fcn.14028fd08
test rax, rax
jne 0x1400d1cc0
mov rdx, r15
lea ecx, [rax + 0x14]
lea eax, [rcx - 4]
lea r8d, [rcx + 8]
lea r9d, [rcx + 0x10]
lea r10d, [rcx - 0x10]
lea r11d, [rcx - 0xc]
lea r15d, [rcx - 8]
lea r13d, [rcx - 6]
jmp 0x1400d1cea
mov qword [rax], r15
mov rbx, rax
lea rdx, [rax + 0x10]
lea rcx, [rax + 0x24]
lea r8, [rax + 0x2c]
lea r9, [rax + 0x34]
lea r10, [rax + 0x14]
lea r11, [rax + 0x18]
lea r15, [rax + 0x1c]
lea r13, [rax + 0x1e]
add rax, 0x20
test rdx, rdx
jne 0x1400d1f66
test rbx, rbx
je 0x1400d1d10
nop dword [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.14028fcf4
test rbx, rbx
jne 0x1400d1d00
xor r12d, r12d
inc dword [rbp - 0x50]
mov rbx, qword [rbp - 0x58]
test rbx, rbx
jne 0x1400d1d68
call fcn.1400d0560
mov r8, rax
mov edx, r12d
nop word [rax + rax]
movsxd rcx, edx
mov rax, r12
xchg qword [r8 + rcx*8], rax
test rax, rax
jne 0x1400d1d4e
inc edx
cmp edx, 4
jl 0x1400d1d30
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbp - 0x58], rax
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rbp - 0x48], rax
mov rbx, qword [rbp - 0x58]
movzx ecx, byte [rbp - 0x34]
shl ecx, 8
movzx eax, byte [rbp - 0x30]
shl eax, 0x10
or ecx, eax
movzx eax, byte [rbp - 0x28]
or ecx, eax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov r8, rax
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_FillRect]
sub dword [rbp - 0x50], 1
jne 0x1400d1dd4
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbx, qword [rbp - 0x58]
call fcn.1400d0560
mov ecx, r12d
movsxd rdx, ecx
xchg qword [rax + rdx*8], rbx
test rbx, rbx
je 0x1400d1dd0
inc ecx
cmp ecx, 4
jl 0x1400d1db4
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov qword [rbp - 0x58], r12
lea r8, [0x14030cb70]
lea rdx, [rbp]
lea rcx, [rsp + 0x70]
call fcn.1400d3010
mov r15d, eax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400d1e23
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x64], 0xffffffffffffffff
mov word [rbp - 0x68], 0
call qword [sym.imp.GDI32.dll_DeleteObject]
call fcn.1400d12c0
mov rbx, rax
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400d1e42
call sub.gdiplus.dll_GdiplusShutdown
mov qword [rbx], r12
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r15d, r15d
jne 0x1400d2007
mov r15, qword [rsp + 0x30]
lea rcx, [r15 - 0x18]
call fcn.14000ae30
add rax, 0x18
mov qword [r14], rax
lea rcx, [rsp + 0x70]
call fcn.1400ced20
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400d1f09
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1400d1eba
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1eac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 8
cmp rbx, rdi
jne 0x1400d1e90
mov rbx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400d1ef3
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d2120
mov rcx, rbx
call fcn.140171af0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1f28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d1f47
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [r15 - 8], esi
sub esi, 1
jg 0x1400d19bc
mov rcx, qword [r15 - 0x18]
mov rax, qword [rcx]
lea rdx, [r15 - 0x18]
jmp 0x1400d19b9
mov qword [rcx], 0
xor ecx, ecx
mov qword [r8], rcx
mov dword [r9], ecx
mov dword [rdx], 0x28
mov ecx, dword [rbp - 0x38]
mov dword [r10], ecx
mov dword [r11], edi
mov word [r15], r12w
mov ecx, 0x20
mov word [r13], cx
xor r12d, r12d
mov dword [rax], r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x80]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateDIBSection]
test rax, rax
jne 0x1400d1fd5
test rbx, rbx
je 0x1400d1d13
nop
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.14028fcf4
test rbx, rbx
jne 0x1400d1fc0
jmp 0x1400d1d13
sar edi, 0x1f
lea r8d, [rdi + 2]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400cf2e0
test rbx, rbx
je 0x1400d1d13
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.14028fcf4
test rbx, rbx
jne 0x1400d1ff2
jmp 0x1400d1d13
lea rdx, [0x1402ec198]
mov rcx, r14
call fcn.14000d920
nop
lea rcx, [rsp + 0x70]
call fcn.1400ced20
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1400d1b8b
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1400d206a
nop word [rax + rax]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d205c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 8
cmp rbx, rdi
jne 0x1400d2040
mov rbx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400d209f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d20b1
mov rcx, rbx
call fcn.140171af0
mov qword [rsp + 0x50], r12
jmp 0x1400d1b82
call fcn.14028c66c
nop
mov ecx, 0x80070057
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
nop
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
int3
mov ecx, 0x80070057
call fcn.14000adf0
nop
mov ecx, 0x80004005
call fcn.14000adf0
int3
mov ecx, 0x80004005
call fcn.14000adf0
nop
call fcn.14028c66c
int3
call fcn.14028c66c
int3