Function at 0x14000d740
Capabilities:
Copy file
Find taskbar
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x14004e060]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rcx
cmp dl, 1
jne 0x14000dc41
lea r13, [rcx + 0x2b0]
mov rax, qword [r13]
mov qword [r13 + 8], rax
mov ebx, 0x80000000
mov edi, ebx
mov esi, 1
mov r12d, esi
mov r8d, esi
mov dword [rbp - 0x69], esi
xor r14d, r14d
mov edx, r8d
cmp ebx, 0x80000000
jne 0x14000d7bc
cmp edi, ebx
jne 0x14000d7c9
mov ebx, r14d
mov edi, r14d
jmp 0x14000d83b
test ebx, ebx
jne 0x14000d7c9
test edi, edi
jne 0x14000d7c9
lea ebx, [rdi + 1]
jmp 0x14000d839
test esi, esi
jne 0x14000d82b
test r12d, r12d
jne 0x14000d813
mov ecx, dword [r15 + 0x2c8]
cmp ebx, ecx
jne 0x14000d7e9
mov eax, ecx
neg eax
cmp edi, eax
je 0x14000d875
add ecx, ecx
lea eax, [r8 + 1]
cmp edx, ecx
cmovne r8d, eax
mov dword [rbp - 0x69], r8d
lea eax, [rdx + 1]
mov esi, edx
cmovne esi, eax
lea eax, [rdx + 1]
mov r12d, r14d
cmovne r12d, eax
test r8d, r8d
jne 0x14000d829
test r12d, r12d
jle 0x14000d83b
test ebx, ebx
jle 0x14000d820
inc edi
dec r12d
jmp 0x14000d83b
jns 0x14000d83b
dec edi
dec r12d
jmp 0x14000d83b
test esi, esi
jle 0x14000d83b
test edi, edi
jns 0x14000d835
inc ebx
jmp 0x14000d839
jle 0x14000d83b
dec ebx
dec esi
mov dword [rbp - 0x61], ebx
mov dword [rbp - 0x5d], edi
mov rax, qword [rbp - 0x61]
mov qword [rbp - 0x59], rax
mov rdx, qword [r13 + 8]
cmp rdx, qword [r13 + 0x10]
je 0x14000d860
mov qword [rdx], rax
add qword [r13 + 8], 8
jmp 0x14000d7a5
lea r8, [rbp - 0x59]
mov rcx, r13
call fcn.14000eac0
mov r8d, dword [rbp - 0x69]
jmp 0x14000d7a5
mov rcx, r15
call fcn.14000ceb0
mov r9, qword [r15 + 8]
lea r8, str.true
lea rdx, str.RunningState
lea rcx, str.SystemInfo
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov r9, qword [r15 + 8]
xor r8d, r8d
lea rdx, str.ShiftInterval
lea rcx, str.SystemInfo
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jle 0x14000d8c2
mov dword [r15 + 0x270], eax
lea rdx, [rbp - 0x51]
call fcn.14000dfd0
mov rbx, rax
lea rdi, [r15 + 0x278]
cmp rdi, rax
je 0x14000d947
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14000d919
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000d914
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000dfc3
mov rcx, r8
call fcn.140010990
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp - 0x39]
cmp rdx, 8
jb 0x14000d987
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d982
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dfc3
call fcn.140010990
lea rsi, [r15 + 0x298]
mov rax, qword [rsi]
mov qword [rsi + 8], rax
lea rdx, [rbp - 1]
call fcn.14000aa50
mov rbx, rax
movabs r12, 0x2aaaaaaaaaaaaaab
cmp rsi, rax
je 0x14000da38
mov r8, qword [rsi]
test r8, r8
je 0x14000da17
mov rcx, qword [rsi + 0x10]
sub rcx, r8
mov rax, r12
imul rcx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 9
cmp rdx, 0x1000
jb 0x14000da04
add rdx, 0x27
mov rcx, qword [r8 - 8]
sub r8, rcx
lea rax, [r8 - 8]
cmp rax, 0x1f
ja 0x14000dfc9
mov r8, rcx
mov rcx, r8
call fcn.140010990
mov qword [rsi], r14
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], r14
mov rax, qword [rbx]
mov qword [rsi], rax
mov rax, qword [rbx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rbx + 0x10]
mov qword [rsi + 0x10], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov r8, qword [rbp - 1]
test r8, r8
je 0x14000da9d
mov rcx, qword [rbp + 0xf]
sub rcx, r8
mov rax, r12
imul rcx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 9
mov rax, r8
cmp rdx, 0x1000
jb 0x14000da89
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dfc9
mov rcx, r8
call fcn.140010990
mov qword [rbp - 1], r14
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
mov r11, qword [rsi]
mov rcx, qword [rsi + 8]
sub rcx, r11
mov rax, r12
imul rcx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x14000dbe2
mov r10, r11
mov r13, qword [rdi + 0x18]
mov r9, r14
nop dword [rax + rax]
mov r8, rdi
cmp r13, 8
jb 0x14000dadc
mov r8, qword [rdi]
lea rbx, [r9 + r9*2]
shl rbx, 9
lea rax, [rbx + r11]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000db04
add rax, 2
test ecx, ecx
jne 0x14000daf0
test edx, edx
je 0x14000db3d
inc r14d
mov r10, qword [r15 + 0x298]
movsxd r9, r14d
mov rcx, qword [r15 + 0x2a0]
sub rcx, r10
mov rax, r12
imul rcx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r9, rdx
jb 0x14000dad0
jmp 0x14000dbe2
lea rdx, [rbx + r10]
lea r8, [rdx + 0x200]
mov r9, qword [r15 + 8]
lea rcx, str.WallpaperInfo
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea rdx, [r15 + 0x250]
cmp qword [rdx + 0x18], 8
jb 0x14000db6a
mov rdx, qword [rdx]
mov rcx, qword [rsi]
add rcx, 0x200
add rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, 0x5c
lea rdi, str.D:WorkMyASUSAbout_AsusOLEDShifterReleaseAsusOLEDShifterAsusOLEDShifterAsusOLEDShifterOLEDShifterManager.cpp
mov rcx, rdi
call fcn.14001275c
test rax, rax
je 0x14000dbaa
mov edx, 0x5c
mov rcx, rdi
call fcn.14001275c
lea rdi, [rax + 1]
mov rcx, qword [rsi]
add rcx, 0x200
add rcx, rbx
mov qword [rsp + 0x28], rcx
lea rax, str.Copy_wallpaper__s
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.SwitchShifterTimer
mov edx, 0x393
mov rcx, rdi
call fcn.140005160
mov rax, qword [0x140050eb0]
cmp byte [rax], 1
jne 0x14000dc1f
mov dword [rbp - 0x31], 0x30
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rbp - 0x29], rax
mov qword [rbp - 9], 1
lea rdx, [rbp - 0x31]
mov ecx, 0xa
call qword [sym.imp.SHELL32.dll_SHAppBarMessage]
imul r8d, dword [r15 + 0x270], 0x3e8
xor r9d, r9d
mov edx, 0x1e63
mov rcx, qword [r15 + 0x18]
call qword [sym.imp.USER32.dll_SetTimer]
jmp 0x14000df90
mov edx, 0x1e63
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_KillTimer]
xor r14d, r14d
mov dword [r15 + 0x2d0], r14d
mov byte [r15 + 0x2d4], 1
mov esi, r14d
mov r9, qword [r15 + 0x298]
mov rcx, qword [r15 + 0x2a0]
sub rcx, r9
movabs r12, 0x2aaaaaaaaaaaaaab
mov rax, r12
imul rcx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x14000dd3d
mov eax, r14d
nop dword [rax]
lea r8, [r15 + 0x278]
cmp qword [r15 + 0x290], 8
jb 0x14000dcb8
mov r8, qword [r15 + 0x278]
lea rbx, [rax + rax*2]
shl rbx, 9
lea rax, [rbx + r9]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000dce4
add rax, 2
test ecx, ecx
jne 0x14000dcd0
test edx, edx
jne 0x14000dd0a
call fcn.14000e220
test eax, eax
je 0x14000dd0a
mov rdx, qword [r15 + 0x298]
add rdx, rbx
lea r8, [rdx + 0x200]
mov rcx, r15
call fcn.14000ae10
inc esi
mov r9, qword [r15 + 0x298]
mov rcx, qword [r15 + 0x2a0]
sub rcx, r9
mov rax, r12
imul rcx
sar rdx, 8
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movsxd rax, esi
cmp rax, rdx
jb 0x14000dca0
lea rax, [rbp - 1]
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], r14
movdqa xmm0, xmmword [0x140047660]
movdqu xmmword [rbp - 0x41], xmm0
mov word [rbp - 0x51], r14w
mov r8d, 4
lea rdx, str..jpg
lea rcx, [rbp - 0x51]
call fcn.1400036a0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], r14
mov ecx, 0x20
call fcn.1400109c4
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
lea rbx, [rax + 0x20]
mov qword [rbp + 0xf], rbx
lea rcx, [rbp - 1]
mov qword [rbp - 0x61], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
lea rcx, [rbp - 1]
mov qword [rbp + 0x27], rcx
lea rdx, [rbp - 0x51]
mov rcx, rax
call fcn.140007160
nop
mov rdx, rbx
mov rcx, rbx
call fcn.1400086d0
mov qword [rbp + 7], rbx
lea rdx, [r15 + 0x230]
lea rcx, [rbp - 0x31]
call fcn.140007160
nop
lea r8, [rbp - 1]
mov rdx, rax
call fcn.14000bf70
nop
lea r9, [fcn.140003630]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp - 0x51]
call fcn.140010c70
mov dword [r15 + 0x2f8], r14d
mov byte [r15 + 0x2fc], 1
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r15 + 0x2e0]
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [r15], 1
jne 0x14000df45
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rax
lea rdx, [rbp - 1]
mov rcx, r15
call fcn.14000cdc0
mov rax, qword [rbp + 7]
mov r8, qword [rbp - 1]
sub rax, r8
sar rax, 3
test rax, rax
je 0x14000deda
mov rbx, r14
nop word [rax + rax]
mov edx, 0xfffffff0
mov rcx, qword [r8 + rbx]
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
bt rax, 0x18
jae 0x14000debc
mov edx, 9
mov rcx, qword [rbp - 1]
mov rcx, qword [rcx + rbx]
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 3
mov rcx, qword [rbp - 1]
mov rcx, qword [rcx + rbx]
call qword [sym.imp.USER32.dll_ShowWindow]
inc r14d
add rbx, 8
mov rcx, qword [rbp + 7]
mov r8, qword [rbp - 1]
sub rcx, r8
sar rcx, 3
movsxd rax, r14d
cmp rax, rcx
jb 0x14000de80
mov dword [rbp - 0x31], 0x30
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rbp - 0x29], rax
mov qword [rbp - 9], 2
lea rdx, [rbp - 0x31]
mov ecx, 0xa
call qword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x14000df45
mov rdx, qword [rbp + 0xf]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dfbd
call fcn.140010990
mov r9, qword [r15 + 8]
lea r8, str.false
lea rdx, str.RunningState
lea rcx, str.SystemInfo
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov r9, qword [r15 + 8]
xor r8d, r8d
xor edx, edx
lea rcx, str.WallpaperInfo
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov r9, qword [r15 + 8]
xor r8d, r8d
xor edx, edx
lea rcx, str.LastSetWallpaper
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140010720
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001750c
int3
call fcn.14001750c
int3
call fcn.14001750c
int3