Function at 0x140197b30
Capabilities:
Accept command line arguments
Check for unmoving mouse cursor
Create process on windows
Empty the recycle bin
Get common file path
Get keyboard layout
Get session user name
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0xe18
mov byte [rsp + 0xe28], 0xb3
lea rcx, [rsp + 0x6e0]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [rsp + 0xa4], eax
mov byte [rsp + 0xe28], 0x35
mov byte [rsp + 0xe30], 0x40
movabs rax, 0x716503cb720460
mov qword [rsp + 0xe38], rax
lea rcx, [rsp + 0x8c0]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov dword [rsp + 0x90], eax
mov r8w, 0xd1
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.COMDLG32.dll_GetFileTitleW]
mov word [rsp + 0x50], ax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
lea rcx, [rsp + 0x5f0]
call qword [sym.imp.COMDLG32.dll_ChooseFontW]
mov dword [rsp + 0xb4], eax
mov eax, reloc.COMCTL32.dll_LBItemFromPt
mov word [rsp + 0x50], ax
lea rcx, [rsp + 0x850]
call qword [sym.imp.COMDLG32.dll_ChooseFontW]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0xe28]
cmp eax, 0x34
jne 0x140197d16
movzx eax, byte [rsp + 0xe28]
mov byte [rsp + 0x1d0], al
cmp byte [rsp + 0x1d0], 0x72
je 0x140197c71
cmp byte [rsp + 0x1d0], 0xd9
je 0x140197c93
jmp 0x140197cec
lea rcx, [rsp + 0x850]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov qword [rsp + 0x130], rax
mov eax, 0x306
mov word [rsp + 0x50], ax
jmp 0x140197cec
mov dword [rsp + 0x20], reloc.SHELL32.dll_SHGetNewLinkInfoW
lea r9, [rsp + 0xf0]
mov r8, qword [rsp + 0x138]
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x8c], eax
mov eax, 0x211
mov word [rsp + 0x50], ax
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ILIsParent]
mov dword [rsp + 0xb4], eax
mov dword [rsp + 0xe20], 0x9bcd
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xb4]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x9c], eax
jmp 0x140197e31
movzx eax, byte [rsp + 0xe28]
add eax, 0xfc
cmp eax, 0xbb
jl 0x140197da8
mov eax, 0xcf
mov word [rsp + 0x50], ax
mov r8, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0x118], rax
mov byte [rsp + 0xe30], 6
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
mov ecx, 0x93
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0x90], eax
mov eax, 0x45d
mov word [rsp + 0x50], ax
jmp 0x140197e31
movzx eax, byte [rsp + 0xe28]
sub eax, 0xbd
cmp eax, 8
jne 0x140197df8
lea r9, [rsp + 0x118]
lea r8, [rsp + 0x50]
mov edx, 0x80
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rsp + 0x398], rax
mov eax, ILSaveToStream
mov word [rsp + 0x50], ax
mov eax, 0x77b
mov word [rsp + 0x50], ax
jmp 0x140197e31
mov edx, 0xda
lea rcx, [rsp + 0xa4]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
lea rcx, [rsp + 0x660]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0x268], rax
mov byte [rsp + 0xe28], 0x76
mov byte [rsp + 0xe28], 0x4b
lea rcx, [rsp + 0x118]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
lea rcx, [rsp + 0x8c]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x258], rax
mov ecx, ILFree
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [rsp + 0x8c], eax
movsx eax, word [rsp + 0x50]
mov dword [rsp + 0x28c], eax
cmp dword [rsp + 0x28c], 0x15d
je 0x140197e82
jmp 0x140197ed5
mov eax, 0x361
mov word [rsp + 0x50], ax
mov edx, 0x8d
lea rcx, [rsp + 0x258]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
lea r8, [rsp + 0x8c0]
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x338]
call qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x130]
call qword [sym.imp.SHELL32.dll_ILFree]
jmp 0x140197f31
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x138]
mov edx, ILSaveToStream
lea rcx, [rsp + 0x268]
call qword [sym.imp.SHELL32.dll_PathMakeUniqueName]
mov dword [rsp + 0x90], eax
mov eax, 0x7b9
mov word [rsp + 0x50], ax
mov eax, 0x322
mov word [rsp + 0x50], ax
mov eax, 0x7b9
mov word [rsp + 0x50], ax
mov eax, 0x1c6
mov word [rsp + 0x50], ax
movabs rax, 0x7ce53d0df097ba
mov qword [rsp + 0xe38], rax
mov r8, qword [rsp + 0x248]
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0x5f0]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x250], rax
mov byte [rsp + 0xe28], 0x4c
mov eax, 0x444
mov word [rsp + 0x50], ax
lea r9, [rsp + 0x130]
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x240]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExA]
mov dword [rsp + 0xe0], eax
mov eax, 0x236
mov word [rsp + 0x50], ax
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x8c0]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x320], rax
mov eax, 0x6d
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0xe28]
sar eax, 0x3a
cmp eax, 0xe4
jg 0x140198020
mov eax, 0x3fb
mov word [rsp + 0x50], ax
mov byte [rsp + 0xe30], 0xd
mov eax, 0x2eb
mov word [rsp + 0x50], ax
jmp 0x14019804c
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x73
jg 0x14019804c
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Unlock]
mov dword [rsp + 0xb4], eax
mov eax, 0x13d
mov word [rsp + 0x50], ax
mov byte [rsp + 0xe28], 0x38
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0x318], rax
movsx eax, byte [rsp + 0xe30]
or eax, 0x4e
cmp eax, 0x1a
jg 0x1401980ac
mov eax, 0x559
mov word [rsp + 0x50], ax
mov edx, 0xb6
lea rcx, [rsp + 0x140]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
mov byte [rsp + 0xe30], 0x43
jmp 0x140198208
movzx eax, byte [rsp + 0xe28]
cmp eax, 0xb6
jg 0x1401980dd
mov eax, 0x484
mov word [rsp + 0x50], ax
mov edx, 1
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.SHELL32.dll_DragAcceptFiles]
jmp 0x140198208
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x69
jle 0x140198155
lea rdx, [rsp + 0xa4]
lea rcx, [rsp + 0x320]
call qword [sym.imp.SHELL32.dll_ILIsEqual]
mov dword [rsp + 0x8c], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
mov byte [rsp + 0xe30], 0x13
mov eax, 0x105
mov word [rsp + 0x50], ax
mov eax, reloc.SHELL32.dll_PathMakeUniqueName
mov word [rsp + 0x50], ax
mov byte [rsp + 0xe28], 0xe0
jmp 0x140198208
mov r8, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.SHELL32.dll_FindExecutableW]
mov qword [rsp + 0x118], rax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
lea rcx, [rsp + 0x5f0]
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [rsp + 0x5c], eax
movabs rax, 0x7048c1f9c41a0c
cmp qword [rsp + 0xe38], rax
jbe 0x1401981f5
mov eax, 0x743
mov word [rsp + 0x50], ax
mov eax, 0x1d8
mov word [rsp + 0x50], ax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0xe20], eax
lea rcx, [rsp + 0x258]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
jmp 0x140198208
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x5c], eax
mov byte [rsp + 0xe30], 0x2c
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x43
je 0x14019822a
mov eax, 0x6c4
mov word [rsp + 0x50], ax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x5c], eax
mov byte [rsp + 0xe28], 0x76
mov dword [rsp + 0x20], PathMakeUniqueName
lea r9, [rsp + 0x240]
lea r8, [rsp + 0x228]
mov edx, 0x7f
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.SHELL32.dll_ExtractIconExW]
mov dword [rsp + 0x64], eax
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x64], eax
mov edx, 0x3b
mov rcx, qword [rsp + 0x140]
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0xd0], eax
movsx eax, byte [rsp + 0xe30]
xor eax, 0x75
cmp eax, 0x23
jle 0x1401982e7
mov byte [rsp + 0xe30], 0x51
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.SHELL32.dll_DuplicateIcon]
mov qword [rsp + 0x318], rax
lea rdx, [rsp + 0xa40]
mov ecx, 0x6a
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsp + 0xcc], eax
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.SHELL32.dll_ILFree]
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x64], eax
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x458], rax
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0xa40]
call qword [sym.imp.SHELL32.dll_ILFindChild]
mov qword [rsp + 0x198], rax
movsx eax, word [rsp + 0x50]
cmp eax, 0x9c
je 0x140198357
lea rcx, [rsp + 0x6c]
call qword [sym.imp.SHELL32.dll_ILRemoveLastID]
mov dword [rsp + 0xb4], eax
mov eax, 0x319
mov word [rsp + 0x50], ax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.SHELL32.dll_ILSaveToStream]
mov dword [rsp + 0x1e4], eax
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x6e0]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0xb0], eax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, SHSetInstanceExplorer
lea r8, [rsp + 0x9c]
lea rdx, [rsp + 0x8c0]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.SHELL32.dll_SHDoDragDrop]
mov dword [rsp + 0x9c], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x5c], eax
mov eax, 0x616
mov word [rsp + 0x50], ax
mov r8d, reloc.SHELL32.dll_ILClone
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
mov dword [rsp + 0xb0], eax
lea r9, [rsp + 0x268]
lea r8, [rsp + 0x240]
lea rdx, [rsp + 0x4e0]
lea rcx, [rsp + 0x228]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x98], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x5c]
call fcn.140197b30
mov eax, 0x59
mov word [rsp + 0x50], ax
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x28
jl 0x140198483
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0xe20], eax
cmp dword [rsp + 0x6c], 0x58378113
jl 0x1401984c2
lea rcx, [rsp + 0x780]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0xb4], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0xe20], eax
mov eax, 0x50e
mov word [rsp + 0x50], ax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0xe20], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x64], eax
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x3c8]
mov ecx, 0xa0
call qword [sym.imp.SHELL32.dll_SHGetImageList]
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x1d4], eax
cmp dword [rsp + 0x1d4], 0x8cb1
je 0x14019851d
cmp dword [rsp + 0x1d4], 0xba3a
je 0x1401985fd
jmp 0x140198669
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x5c]
call fcn.140197b30
mov dword [rsp + 0x6c], 0x520584cb
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x5e
jne 0x140198573
mov eax, 0x393
mov word [rsp + 0x50], ax
mov byte [rsp + 0xe30], 0x17
mov byte [rsp + 0xe28], 0x3a
jmp 0x1401985fb
cmp dword [rsp + 0x6c], 0x36692e03
jg 0x1401985ac
lea r9, [rsp + 0x130]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0xa40]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x98], eax
jmp 0x1401985fb
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x70
jge 0x1401985c6
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x5c], eax
jmp 0x1401985fb
mov dword [rsp + 0x20], 0xe4
lea r9, [rsp + 0x320]
mov r8, qword [rsp + 0x220]
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0xcc], eax
jmp 0x140198669
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x1d8], eax
cmp dword [rsp + 0x1d8], 0x1037
je 0x140198647
cmp dword [rsp + 0x1d8], 0xb5d9
je 0x140198624
jmp 0x140198657
mov edx, 0xf9
mov rcx, qword [rsp + 0x348]
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0xa4], eax
mov byte [rsp + 0xe30], 0x20
jmp 0x140198657
mov dword [rsp + 0x6c], 0xbff1811
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x64], eax
movabs rax, 0x7b5d7523e97c48
mov qword [rsp + 0xe38], rax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x2b4], eax
cmp dword [rsp + 0x2b4], 0x2de71573
je 0x140198686
jmp 0x140198718
mov edx, reloc.SHELL32.dll_SHGetNewLinkInfoW
mov rcx, qword [rsp + 0x398]
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0xd0], eax
mov r9, qword [rsp + 0x230]
mov r8, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.SHELL32.dll_ShellAboutW]
mov dword [rsp + 0x7c], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x64]
call fcn.140197b30
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0xe20], eax
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.SHELL32.dll_DragFinish]
lea rcx, [rsp + 0x3c8]
call qword [sym.imp.SHELL32.dll_ILGetSize]
mov dword [rsp + 0x74], eax
jmp 0x14019878c
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x368], rax
mov eax, 0x68
mov word [rsp + 0x50], ax
mov eax, 0x276
mov word [rsp + 0x50], ax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
mov r8d, 0xd7
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.SHELL32.dll_SHSetLocalizedName]
mov dword [rsp + 0x9c], eax
mov dword [rsp + 0x20], 0x66
lea r9, [rsp + 0x338]
mov r8, qword [rsp + 0x138]
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x8c], eax
mov eax, 0x139
mov word [rsp + 0x50], ax
lea rdx, [rsp + 0x5f0]
lea rcx, [rsp + 0x660]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0xe20], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x5c], eax
lea rcx, [rsp + 0x260]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rsp + 0x9c], eax
mov dword [rsp + 0x28], ILGetSize
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x128]
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0x6a0]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov qword [rsp + 0x410], rax
lea rcx, [rsp + 0x780]
call qword [sym.imp.SHELL32.dll_ILClone]
mov qword [rsp + 0x488], rax
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0x3c8]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0x9c], eax
mov eax, 0x708
mov word [rsp + 0x50], ax
mov eax, 0x4e3
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0xe28]
mov byte [rsp + 0x1dc], al
cmp byte [rsp + 0x1dc], 0x78
je 0x140198a47
cmp byte [rsp + 0x1dc], 0xc3
je 0x1401988e4
jmp 0x140198abd
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x1e0], eax
cmp dword [rsp + 0x1e0], 0x28db7d16
je 0x140198912
cmp dword [rsp + 0x1e0], 0x471a4f35
je 0x140198a04
jmp 0x140198a45
lea rax, [rsp + 0x268]
mov qword [rsp + 0x20], rax
mov r9d, 0x41
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x1f8]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.SHELL32.dll_SHDoDragDrop]
mov dword [rsp + 0x1e4], eax
mov eax, 0xd9
mov word [rsp + 0x50], ax
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x20], rax
mov r9d, 0xca
mov r8, qword [rsp + 0x150]
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x378]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ILGetSize
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6e0]
mov r8, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x348]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x5c], eax
lea r9, [rsp + 0x4d0]
mov r8d, 0xd0
mov rdx, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x140]
call sub.WINSPOOL.DRV_SetFormW
mov dword [rsp + 0x8c], eax
jmp 0x140198a45
lea rax, [rsp + 0x258]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 0xc2
lea r8, [rsp + 0x130]
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x260]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x70], eax
jmp 0x140198abd
movabs rax, 0x744727a8cc4cab
mov qword [rsp + 0xe38], rax
mov dword [rsp + 0x20], ILIsEqual
lea r9, [rsp + 0x250]
mov r8d, 0x91
lea rdx, [rsp + 0x4d0]
mov rcx, qword [rsp + 0x3f8]
call sub.WINSPOOL.DRV_FlushPrinter
mov dword [rsp + 0x90], eax
lea r9, [rsp + 0x4e0]
mov r8d, 0x29
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x220]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0xa4], eax
mov byte [rsp + 0xe28], 0xeb
lea rax, [rsp + 0x6a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x70
lea r8, [rsp + 0xa40]
mov edx, 0x22
mov rcx, qword [rsp + 0x328]
call sub.WINSPOOL.DRV_GetPrinterW
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0xe20], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x130]
mov r8d, reloc.SHELL32.dll_ILFree
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x328]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x74], eax
movzx eax, byte [rsp + 0xe28]
cmp eax, 0xba
jge 0x140198d20
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ILGetSize
lea rax, [rsp + 0x1e4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8, qword [rsp + 0x220]
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x2d8]
call sub.WINSPOOL.DRV_GetPrinterDataExW
mov dword [rsp + 0x64], eax
movzx eax, byte [rsp + 0xe28]
mov byte [rsp + 0x1e8], al
cmp byte [rsp + 0x1e8], 0x21
je 0x140198d16
cmp byte [rsp + 0x1e8], 0x49
je 0x140198bb7
jmp 0x140198d20
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], SHDoDragDrop
lea r9, [rsp + 0xa8]
mov r8d, 0xd5
mov rdx, qword [rsp + 0xf8]
mov ecx, 0x6d
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x8c], eax
lea r9, [rsp + 0x118]
mov r8d, 0x26
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0xd8]
call sub.WINSPOOL.DRV_SetPortW
mov dword [rsp + 0xc8], eax
lea rax, [rsp + 0x328]
mov qword [rsp + 0x20], rax
mov r9d, 0x86
mov r8, qword [rsp + 0x330]
mov rdx, qword [rsp + 0x340]
mov rcx, qword [rsp + 0x140]
call sub.WINSPOOL.DRV_EnumPrinterKeyW
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x318]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x780]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x38
lea r9, [rsp + 0x1f8]
mov r8d, 0x6d
mov rdx, qword [rsp + 0x100]
mov ecx, 0xef
call sub.WINSPOOL.DRV_EnumPrintersW
mov dword [rsp + 0x98], eax
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x100]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x110], eax
lea rax, [rsp + 0x850]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0xc7
lea r8, [rsp + 0x1f8]
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x238]
call sub.WINSPOOL.DRV_EnumPrinterDataExW
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x74], eax
jmp 0x140198d20
mov eax, 0x1aa
mov word [rsp + 0x50], ax
mov dword [rsp + 0x28], 0xde
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9d, 0xd6
mov r8, qword [rsp + 0x2f0]
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x140]
call sub.WINSPOOL.DRV_SetPrinterDataExW
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x250]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa6
lea r9, [rsp + 0x6a0]
lea r8, [rsp + 0x780]
mov rdx, qword [rsp + 0x2f0]
mov rcx, qword [rsp + 0x238]
call sub.WINSPOOL.DRV_GetPrinterDataW
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 9
lea r9, [rsp + 0x50]
mov r8d, 0x45
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x3a0]
call sub.WINSPOOL.DRV_GetFormW
mov dword [rsp + 0xc8], eax
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x2f
jl 0x140198ee6
mov dword [rsp + 0x20], 0x8a
lea r9, [rsp + 0x9c]
mov r8d, 0xe8
mov edx, 0xed
mov rcx, qword [rsp + 0x238]
call sub.WINSPOOL.DRV_SetJobW
mov dword [rsp + 0x8c], eax
mov r8, qword [rsp + 0x128]
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x150]
call sub.WINSPOOL.DRV_ConfigurePortW
mov dword [rsp + 0x2a8], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x74], eax
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x20], rax
mov r9d, reloc.SHELL32.dll_ILIsParent
lea r8, [rsp + 0x368]
mov edx, 0xc8
mov rcx, qword [rsp + 0x400]
call sub.WINSPOOL.DRV_EnumFormsW
mov dword [rsp + 0xc8], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x1ec], eax
cmp dword [rsp + 0x1ec], 0x2e4c4218
je 0x140198eaa
cmp dword [rsp + 0x1ec], 0x7cc1b47d
je 0x140198ed9
jmp 0x140198ee1
mov edx, 0x8e
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0xe20], eax
jmp 0x140198ee1
mov byte [rsp + 0xe30], 0x4c
jmp 0x140198fde
mov eax, dword [rsp + 0xe20]
mov ecx, dword [rsp + 0x64]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x5c]
mov edx, dword [rsp + 0x74]
add edx, ecx
mov ecx, edx
cmp eax, ecx
ja 0x140198f54
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x6c], eax
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0x8c], eax
lea r8, [rsp + 0x3f8]
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x400]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov dword [rsp + 0x3ec], eax
jmp 0x140198fde
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x1f0], eax
cmp dword [rsp + 0x1f0], 0x36a76624
je 0x140198f7b
cmp dword [rsp + 0x1f0], 0x594b07d6
je 0x140198fa4
jmp 0x140198fde
lea rdx, [rsp + 0x2f0]
mov rcx, qword [rsp + 0x330]
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
mov dword [rsp + 0x90], eax
mov eax, 0x34c
mov word [rsp + 0x50], ax
jmp 0x140198fde
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
lea rcx, [rsp + 0x7f0]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0xe38]
mov qword [rsp + 0x408], rax
movabs rax, 0x74c47571bbc4cd
cmp qword [rsp + 0x408], rax
je 0x140199004
jmp 0x140199013
mov eax, SHGetImageList
mov word [rsp + 0x50], ax
jmp 0x1401990c5
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0xe4], eax
mov r9d, 0xc2
mov r8d, 0xe0
mov edx, 0x1d
mov rcx, qword [rsp + 0xc0]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x5d0], rax
mov r9d, 0xef
mov r8d, 0xd8
mov edx, 0xa2
mov rcx, qword [rsp + 0xe8]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x5d8], rax
mov byte [rsp + 0xe28], 0xd7
mov r8d, 1
mov rdx, qword [rsp + 0x360]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x84], eax
mov r9d, 0x66
lea r8, [rsp + 0x6c]
lea rdx, [fcn.140197b30]
mov rcx, qword [rsp + 0xa8]
call sub.COMCTL32.dll_SetWindowSubclass
mov dword [rsp + 0xe0], eax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x74], eax
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x29
jle 0x140199248
mov r9d, 0x8e
mov r8d, 0xa1
mov edx, 0xb9
mov rcx, qword [rsp + 0xe8]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x300], rax
lea r9, [rsp + 0x258]
lea r8, [rsp + 0x198]
lea rdx, [fcn.140197b30]
mov rcx, qword [rsp + 0x158]
call sub.COMCTL32.dll_Ordinal_411
mov dword [rsp + 0x108], eax
mov eax, 0x22f
mov word [rsp + 0x50], ax
lea rax, [rsp + 0x338]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x2e0]
mov r8, qword [rsp + 0x220]
mov rdx, qword [rsp + 0x138]
mov ecx, 0xf7
call sub.VERSION.dll_VerInstallFileW
mov dword [rsp + 0x5c], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x64]
call fcn.140197b30
lea rax, [rsp + 0x228]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x5e0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x150]
mov r8, qword [rsp + 0x340]
mov rdx, qword [rsp + 0x450]
mov ecx, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
call sub.VERSION.dll_VerInstallFileW
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x64], eax
lea r9, [rsp + 0x7c]
lea r8, [rsp + 0x88]
mov rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0x410]
call sub.VERSION.dll_VerQueryValueW
mov dword [rsp + 0xc8], eax
jmp 0x140199344
movzx eax, byte [rsp + 0xe28]
cmp eax, 0x42
je 0x140199344
mov byte [rsp + 0xe30], 0x43
lea rax, [rsp + 0x300]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x360]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x100]
mov r8, qword [rsp + 0x2e0]
mov rdx, qword [rsp + 0x438]
mov ecx, 0xa9
call sub.VERSION.dll_VerFindFileW
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x200], eax
cmp dword [rsp + 0x200], 0x16c058a9
je 0x140199332
cmp dword [rsp + 0x200], 0x1a7017d4
je 0x1401992e5
jmp 0x140199344
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0xe20], eax
lea r9, [rsp + 0x228]
lea r8, [rsp + 0x5f0]
mov rdx, qword [rsp + 0x3b0]
lea rcx, [rsp + 0x4e0]
call sub.VERSION.dll_VerQueryValueW
mov dword [rsp + 0xcc], eax
mov rcx, qword [rsp + 0x378]
call sub.WINSPOOL.DRV_AbortPrinter
mov dword [rsp + 0xd0], eax
jmp 0x140199344
movabs rax, 0x7936c97537ce83
mov qword [rsp + 0xe38], rax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x5c]
call fcn.140197b30
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x294], eax
cmp dword [rsp + 0x294], 0x2195c785
je 0x140199383
jmp 0x14019946f
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x34
jge 0x140199456
lea r9, [rsp + 0x1f8]
mov r8d, reloc.SHELL32.dll_ILSaveToStream
lea rdx, [rsp + 0x2e0]
mov rcx, qword [rsp + 0x238]
call sub.WINSPOOL.DRV_WritePrinter
mov dword [rsp + 0x98], eax
lea r9, [rsp + 0xd8]
mov r8d, 0x9c
lea rdx, [rsp + 0x4e0]
mov rcx, qword [rsp + 0x140]
call sub.WINSPOOL.DRV_ReadPrinter
mov dword [rsp + 0xb8], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0xe20], eax
mov eax, 0x4db
mov word [rsp + 0x50], ax
mov byte [rsp + 0xe28], 0x9c
lea r9, [rsp + 0x228]
mov r8d, 0xd6
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x2d8]
call sub.WINSPOOL.DRV_WritePrinter
mov dword [rsp + 0x90], eax
jmp 0x14019946a
mov rcx, qword [rsp + 0x348]
call sub.WINSPOOL.DRV_AbortPrinter
mov dword [rsp + 0x298], eax
jmp 0x14019954d
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x6c], eax
mov eax, 0x4cc
mov word [rsp + 0x50], ax
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x1f
jge 0x1401994de
mov eax, 0x2da
mov word [rsp + 0x50], ax
lea r9, [rsp + 0x64]
mov r8d, 0x39
mov edx, 0x82
mov rcx, qword [rsp + 0x238]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0x2d8], rax
mov rcx, qword [rsp + 0x518]
call sub.WINSPOOL.DRV_FindClosePrinterChangeNotification
mov dword [rsp + 0xa4], eax
mov byte [rsp + 0xe28], 0xa1
jmp 0x14019954d
mov eax, dword [rsp + 0x6c]
movzx ecx, al
mov eax, dword [rsp + 0x88]
shl eax, cl
mov ecx, dword [rsp + 0x84]
mov edx, dword [rsp + 0x7c]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x14019954d
mov dword [rsp + 0x38], PathYetAnotherMakeUniqueName
mov dword [rsp + 0x30], 0xdc
mov dword [rsp + 0x28], 0xd4
mov dword [rsp + 0x20], 0x5e
mov r9d, 0xdd
mov r8, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x428]
call qword [sym.imp.USER32.dll_DeferWindowPos]
mov qword [rsp + 0x520], rax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_DrawMenuBar]
mov dword [rsp + 0xc8], eax
movsx eax, word [rsp + 0x50]
mov dword [rsp + 0x204], eax
cmp dword [rsp + 0x204], 0x471
je 0x1401995a5
cmp dword [rsp + 0x204], 0x7e6
je 0x14019958d
jmp 0x14019964e
mov ecx, 0x51
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x420], rax
jmp 0x14019964e
mov cx, 0xe0
call qword [sym.imp.USER32.dll_IsCharUpperW]
mov dword [rsp + 0x120], eax
mov byte [rsp + 0xe28], 0x8d
mov r8d, 0xc2
mov edx, 0x63
mov rcx, qword [rsp + 0x430]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov dword [rsp + 0x98], eax
mov r9d, 0x44
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x130]
mov cx, 0xec
call qword [sym.imp.USER32.dll_CharPrevExA]
mov qword [rsp + 0x528], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.SHELL32.dll_ILIsParent
mov r9d, ILGetSize
mov r8d, 6
mov edx, 0xcc
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov dword [rsp + 0xcc], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x64], eax
movzx eax, byte [rsp + 0xe28]
mov byte [rsp + 0x208], al
cmp byte [rsp + 0x208], 0xdb
je 0x14019969d
cmp byte [rsp + 0x208], 0xe8
je 0x14019967b
jmp 0x1401996eb
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x64], eax
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [rsp + 0xa4], eax
jmp 0x1401996eb
mov byte [rsp + 0xe30], 1
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x74], eax
movabs rax, 0x7388f470c25de0
mov qword [rsp + 0xe38], rax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x5c]
call fcn.140197b30
mov eax, 0x58a
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0xe28]
mov byte [rsp + 0x20c], al
cmp byte [rsp + 0x20c], 0xab
je 0x140199713
cmp byte [rsp + 0x20c], 0xe3
je 0x140199764
jmp 0x140199827
mov eax, 0x107
mov word [rsp + 0x50], ax
call qword [sym.imp.USER32.dll_CountClipboardFormats]
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x660]
call qword [sym.imp.USER32.dll_IsRectEmpty]
mov dword [rsp + 0xd0], eax
mov cx, 0x5e
call qword [sym.imp.USER32.dll_IsCharAlphaNumericW]
mov dword [rsp + 0x110], eax
movabs rax, 0x7124b343f2e8fe
mov qword [rsp + 0xe38], rax
jmp 0x140199827
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x300]
call qword [sym.imp.USER32.dll_EqualRect]
mov dword [rsp + 0xe0], eax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x64], eax
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0x460], rax
lea rdx, [rsp + 0x3c8]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.USER32.dll_GetComboBoxInfo]
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0xe38]
mov qword [rsp + 0x418], rax
movabs rax, 0x735a9126bba2da
cmp qword [rsp + 0x418], rax
je 0x1401997e5
jmp 0x14019981d
mov byte [rsp + 0xe30], 0x3b
mov eax, 0x21
mov word [rsp + 0x50], ax
mov edx, 0xd7
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0xa4], eax
mov eax, 0x74e
mov word [rsp + 0x50], ax
jmp 0x140199827
mov eax, 0x1a5
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0xe28]
cmp eax, 0xb8
jne 0x140199888
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x64], eax
lea r8, [rsp + 0x420]
mov rdx, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov dword [rsp + 0x6c], eax
mov byte [rsp + 0xe30], 0x54
mov rdx, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.USER32.dll_SetParent]
mov qword [rsp + 0xc0], rax
jmp 0x1401998f6
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
mov eax, ILSaveToStream
mov word [rsp + 0x50], ax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
lea rdx, [rsp + 0x6e0]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x64], eax
mov edx, 1
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_GetMenuItemID]
mov dword [rsp + 0x5c], eax
mov ecx, 5
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov dword [rsp + 0xc8], eax
movsx eax, word [rsp + 0x50]
mov dword [rsp + 0x210], eax
cmp dword [rsp + 0x210], 0x9b
je 0x14019994e
cmp dword [rsp + 0x210], 0x753
je 0x140199a71
jmp 0x140199b0b
movsx eax, word [rsp + 0x50]
cmp eax, 0x158
jl 0x1401999e6
mov rax, qword [rsp + 0xe38]
mov qword [rsp + 0x350], rax
movabs rax, 0x71a35c99d8175e
cmp qword [rsp + 0x350], rax
je 0x140199998
movabs rax, 0x786ff0ec9c0982
cmp qword [rsp + 0x350], rax
je 0x1401999cb
jmp 0x1401999e1
mov eax, 0x8c
mov word [rsp + 0x50], ax
mov eax, 0xaa
mov word [rsp + 0x50], ax
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_SetMenu]
mov dword [rsp + 0x2ac], eax
jmp 0x1401999e1
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_SetClipboardViewer]
mov qword [rsp + 0x160], rax
jmp 0x140199a6c
movabs rax, 0x79dfa6a79af567
cmp qword [rsp + 0xe38], rax
jae 0x140199a1f
xor r9d, r9d
mov r8d, PathYetAnotherMakeUniqueName
mov edx, 0xc9
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_SetDlgItemInt]
mov dword [rsp + 0x114], eax
jmp 0x140199a6c
mov eax, dword [rsp + 0x7c]
mov ecx, dword [rsp + 0x6c]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x84]
mov edx, dword [rsp + 0x88]
xor edx, ecx
mov ecx, edx
cmp eax, ecx
jge 0x140199a55
movabs rax, 0x77b32d5b812d9b
mov qword [rsp + 0xe38], rax
jmp 0x140199a6c
movsx eax, word [rsp + 0x50]
cmp eax, 0x739
jne 0x140199a6c
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x88], eax
jmp 0x140199b0b
mov edx, SHTestTokenMembership
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0xe38]
mov qword [rsp + 0x358], rax
movabs rax, 0x7101e0226cef9b
cmp qword [rsp + 0x358], rax
je 0x140199ae3
movabs rax, 0x77e2068d8016d7
cmp qword [rsp + 0x358], rax
je 0x140199ac2
jmp 0x140199b0b
mov eax, 0x775
mov word [rsp + 0x50], ax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x70], eax
mov eax, 0x654
mov word [rsp + 0x50], ax
jmp 0x140199b0b
mov r9d, 0x76
lea r8, [rsp + 0x2d8]
lea rdx, [rsp + 0x780]
mov cx, 0x3c
call qword [sym.imp.USER32.dll_CharPrevExA]
mov qword [rsp + 0x478], rax
mov byte [rsp + 0xe28], 0xa6
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x5c], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x78], eax
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov word [rsp + 0x54], ax
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x1e
jg 0x140199c64
mov eax, dword [rsp + 0xe20]
movzx ecx, al
mov eax, dword [rsp + 0x64]
shr eax, cl
mov ecx, dword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jbe 0x140199b7d
mov edx, 0x72
lea rcx, [rsp + 0x960]
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
mov dword [rsp + 0x7c], eax
movabs rax, 0x7a677a75bd419d
cmp qword [rsp + 0xe38], rax
ja 0x140199c35
mov edx, 1
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_EnableWindow]
mov dword [rsp + 0x120], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0xe20], eax
lea rcx, [rsp + 0x428]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
mov dword [rsp + 0x90], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x70]
call fcn.140197b30
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0xe20], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x74], eax
jmp 0x140199c5f
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x88]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x7c]
mov edx, dword [rsp + 0x84]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jg 0x140199c5f
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x78], eax
jmp 0x140199cec
movsx eax, byte [rsp + 0xe30]
or eax, 2
cmp eax, 0x42
jg 0x140199cec
mov r8, qword [rsp + 0x448]
mov edx, 0x38
mov ecx, ILFindLastID
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov dword [rsp + 0x94], eax
lea rdx, [rsp + 0x360]
mov rcx, qword [rsp + 0x1c8]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov dword [rsp + 0xb8], eax
movsx eax, word [rsp + 0x50]
add eax, 0x280
movsx ecx, word [rsp + 0x54]
cmp eax, ecx
jg 0x140199cec
mov ecx, 0xc2
call qword [sym.imp.USER32.dll_EnumClipboardFormats]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x78], eax
mov byte [rsp + 0xe30], 0x4e
movzx eax, word [rsp + 0x54]
mov word [rsp + 0x50], ax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x64]
call fcn.140197b30
mov r9d, SHDoDragDrop
mov r8d, 0xc9
mov rdx, qword [rsp + 0x530]
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0xcc], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCursor]
mov dword [rsp + 0x84], eax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
lea rcx, [rsp + 0x368]
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0xe20], eax
lea rdx, [rsp + 0x6e0]
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.USER32.dll_InvertRect]
mov dword [rsp + 0x298], eax
mov rdx, qword [rsp + 0x538]
lea rcx, [rsp + 0x5f0]
call qword [sym.imp.USER32.dll_PtInRect]
mov dword [rsp + 0xb4], eax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x5c], eax
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0x1c0]
mov ecx, 0x7e
call qword [sym.imp.USER32.dll_SetSysColors]
mov dword [rsp + 0x17c], eax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x214], eax
cmp dword [rsp + 0x214], 0x8532
je 0x140199e21
cmp dword [rsp + 0x214], 0xbb97
je 0x140199ebc
jmp 0x140199f7c
mov rcx, qword [rsp + 0x540]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x29c], eax
cmp dword [rsp + 0x29c], 0xeb4a
je 0x140199e50
jmp 0x140199e77
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov qword [rsp + 0x148], rax
mov ecx, SHGetNewLinkInfoW
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [rsp + 0x64], eax
jmp 0x140199eb7
mov edx, 1
mov rcx, qword [rsp + 0x548]
call qword [sym.imp.USER32.dll_GetSystemMenu]
mov qword [rsp + 0x430], rax
lea r8, [rsp + 0x2e8]
lea rdx, [rsp + 0x2e8]
lea rcx, [rsp + 0xa40]
call qword [sym.imp.USER32.dll_SubtractRect]
mov dword [rsp + 0xe0], eax
jmp 0x140199f7c
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x94], eax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x70], eax
mov byte [rsp + 0xe28], 0xa3
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x94]
call fcn.140197b30
mov r8d, 1
mov rdx, qword [rsp + 0x3a0]
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.USER32.dll_UserHandleGrantAccess]
mov dword [rsp + 0x8c], eax
mov dword [rsp + 0x20], 1
mov r9d, reloc.SHELL32.dll_SHTestTokenMembership
mov r8d, 0x70
mov edx, 0xd4
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_SetScrollRange]
mov dword [rsp + 0x180], eax
mov r8d, 0x8a
mov rdx, qword [rsp + 0x550]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_GetDCEx]
mov qword [rsp + 0x468], rax
mov byte [rsp + 0xe28], 0x43
movzx eax, word [rsp + 0x54]
mov word [rsp + 0x50], ax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0xa8], rax
movzx eax, byte [rsp + 0xe28]
cmp eax, 0x84
jne 0x14019a00a
mov dword [rsp + 0x20], PathYetAnotherMakeUniqueName
mov r9d, 0x29
mov r8, qword [rsp + 0x438]
mov edx, 0xa4
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.USER32.dll_GetMenuStringW]
mov dword [rsp + 0x6c], eax
mov ecx, reloc.COMCTL32.dll_MakeDragList
call qword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov qword [rsp + 0x370], rax
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
mov qword [rsp + 0x160], rax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
jmp 0x14019a139
movabs rax, 0x7de911a3346970
cmp qword [rsp + 0xe38], rax
je 0x14019a139
mov byte [rsp + 0xe28], 0xb3
movzx eax, byte [rsp + 0xe30]
mov byte [rsp + 0x168], al
cmp byte [rsp + 0x168], 0xb
je 0x14019a127
cmp byte [rsp + 0x168], 0x31
je 0x14019a056
jmp 0x14019a139
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.USER32.dll_WindowFromDC]
mov qword [rsp + 0x1b8], rax
mov rcx, qword [rsp + 0x1c8]
call qword [sym.imp.USER32.dll_IsWindowUnicode]
mov dword [rsp + 0x108], eax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
movzx eax, byte [rsp + 0xe28]
cmp eax, 0xd3
jne 0x14019a0cd
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x5c], eax
mov ecx, 0x73
call qword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov qword [rsp + 0x370], rax
mov rcx, qword [rsp + 0x558]
call qword [sym.imp.USER32.dll_SetFocus]
mov qword [rsp + 0x1c8], rax
jmp 0x14019a125
movsx eax, word [rsp + 0x50]
or eax, 0x126
movsx ecx, word [rsp + 0x54]
cmp eax, ecx
jl 0x14019a118
mov qword [rsp + 0x20], 0xe5
mov r9, qword [rsp + 0x1a8]
mov r8, qword [rsp + 0x308]
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x88], eax
jmp 0x14019a125
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0xa0], eax
jmp 0x14019a139
movabs rax, 0x7729bf5d3c10db
mov qword [rsp + 0xe38], rax
movzx eax, word [rsp + 0x54]
mov word [rsp + 0x50], ax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x2a0], eax
cmp dword [rsp + 0x2a0], 0x7ab9
je 0x14019a163
jmp 0x14019a22a
movzx eax, byte [rsp + 0xe28]
cmp eax, 0x46
jg 0x14019a1ee
movzx eax, byte [rsp + 0xe28]
mov byte [rsp + 0x2a4], al
cmp byte [rsp + 0x2a4], 0xcf
je 0x14019a18b
jmp 0x14019a1e2
mov ecx, 0x46
call qword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov qword [rsp + 0x370], rax
mov r8, qword [rsp + 0x138]
mov edx, 0xdc
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dword [rsp + 0xb8], eax
mov r8d, ILGetSize
mov edx, 0x89
mov rcx, qword [rsp + 0x1c8]
call qword [sym.imp.USER32.dll_EnableScrollBar]
mov dword [rsp + 0x2b0], eax
jmp 0x14019a1ec
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [rsp + 0x5c], eax
jmp 0x14019a225
movsx eax, word [rsp + 0x50]
sub eax, 0x63b
movsx ecx, word [rsp + 0x54]
cmp eax, ecx
jl 0x14019a20e
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0xe20], eax
jmp 0x14019a225
mov edx, 0x5c
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_GetPriorityClipboardFormat]
mov dword [rsp + 0x6c], eax
jmp 0x14019a2f2
mov rax, qword [rsp + 0xe38]
mov qword [rsp + 0x440], rax
movabs rax, 0x79b6c013c1027b
cmp qword [rsp + 0x440], rax
je 0x14019a250
jmp 0x14019a2c1
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xa0]
call fcn.140197b30
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x78], eax
mov ecx, 0xdd
call qword [sym.imp.USER32.dll_LockSetForegroundWindow]
mov dword [rsp + 0x10c], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x64], eax
jmp 0x14019a2f2
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
movzx eax, word [rsp + 0x54]
mov word [rsp + 0x50], ax
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.USER32.dll_ArrangeIconicWindows]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x78], eax
mov r8d, 0xfa
mov edx, 0x7b
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_InflateRect]
mov dword [rsp + 0x2a8], eax
mov edx, reloc.SHELL32.dll_SHGetNewLinkInfoW
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [rsp + 0x84], eax
mov byte [rsp + 0xe28], 0x7a
mov eax, dword [rsp + 0x74]
mov ecx, dword [rsp + 0x70]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x94]
mov edx, dword [rsp + 0xa0]
xor edx, ecx
mov ecx, edx
cmp eax, ecx
ja 0x14019a3da
movsx eax, word [rsp + 0x50]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 0x1ca
je 0x14019a382
cmp dword [rsp + 0x16c], 0x758
je 0x14019a3bd
jmp 0x14019a3da
movabs rax, 0x764525888814ad
mov qword [rsp + 0xe38], rax
mov r8w, 0x5a
mov edx, 0x82
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_SetClassWord]
mov word [rsp + 0x58], ax
movzx eax, word [rsp + 0x54]
mov word [rsp + 0x50], ax
jmp 0x14019a3da
lea rdx, [rsp + 0x2ac]
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.USER32.dll_SetWindowPlacement]
mov dword [rsp + 0x10c], eax
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.USER32.dll_SetPropW]
mov dword [rsp + 0x114], eax
mov byte [rsp + 0xe28], 0x47
movzx eax, byte [rsp + 0xe28]
cmp eax, 0xac
jne 0x14019a420
mov eax, 0x722
mov word [rsp + 0x58], ax
lea rcx, [rsp + 0x448]
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [rsp + 0xe4], eax
xor edx, edx
mov rcx, qword [rsp + 0x3b8]
call qword [sym.imp.USER32.dll_ShowOwnedPopups]
mov dword [rsp + 0x98], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x64]
call fcn.140197b30
mov byte [rsp + 0xe28], 0xc5
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x170], eax
cmp dword [rsp + 0x170], 0x6782
je 0x14019a53d
cmp dword [rsp + 0x170], 0x73b9
je 0x14019a4a4
jmp 0x14019a624
movzx eax, byte [rsp + 0xe28]
or eax, 0xe0
cmp eax, 0xf4
jge 0x14019a50f
mov eax, 0x239
mov word [rsp + 0x58], ax
lea rdx, [rsp + 0x7f0]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov dword [rsp + 0x2b0], eax
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [rsp + 0xcc], eax
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x78], eax
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov qword [rsp + 0x4a0], rax
jmp 0x14019a538
movabs rax, 0x7444156be88cd2
cmp qword [rsp + 0xe38], rax
je 0x14019a538
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.USER32.dll_ClipCursor]
mov dword [rsp + 0x98], eax
jmp 0x14019a624
movzx eax, byte [rsp + 0xe30]
mov byte [rsp + 0x174], al
cmp byte [rsp + 0x174], 0x38
je 0x14019a604
cmp byte [rsp + 0x174], 0x79
je 0x14019a569
jmp 0x14019a624
mov byte [rsp + 0xe30], 0x32
mov rdx, qword [rsp + 0x3c0]
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.USER32.dll_ChangeClipboardChain]
mov dword [rsp + 0xe0], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x78]
call fcn.140197b30
mov eax, 0x6aa
mov word [rsp + 0x58], ax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x7c], eax
mov r8d, ILGetSize
mov edx, 0x20
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_CheckDlgButton]
mov dword [rsp + 0x17c], eax
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.USER32.dll_IsZoomed]
mov dword [rsp + 0x98], eax
jmp 0x14019a624
mov r8d, 0x6e
mov edx, reloc.SHELL32.dll_SHGetNewLinkInfoW
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.USER32.dll_AnimateWindow]
mov dword [rsp + 0x190], eax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x450]
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rsp + 0x90], eax
movzx eax, word [rsp + 0x58]
cmp eax, 0x1c8
jle 0x14019a68b
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0xe20], eax
movzx eax, word [rsp + 0x54]
mov word [rsp + 0x50], ax
mov edx, 0x83
mov rcx, qword [rsp + 0x560]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov dword [rsp + 0xa0], eax
jmp 0x14019a78a
mov eax, dword [rsp + 0xe20]
movzx ecx, al
mov eax, dword [rsp + 0x78]
shl eax, cl
mov ecx, dword [rsp + 0x74]
mov edx, dword [rsp + 0x94]
shr edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x14019a78a
mov rdx, qword [rsp + 0x568]
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.USER32.dll_RealChildWindowFromPoint]
mov qword [rsp + 0x2f8], rax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x178], eax
cmp dword [rsp + 0x178], 0x4aa2d130
je 0x14019a6fa
cmp dword [rsp + 0x178], 0x6aabe41a
je 0x14019a736
jmp 0x14019a78a
mov eax, 0xca8
mov word [rsp + 0x58], ax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0xe20], eax
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x458]
lea rcx, [rsp + 0x238]
call qword [sym.imp.USER32.dll_IntersectRect]
mov dword [rsp + 0x180], eax
jmp 0x14019a78a
mov dword [rsp + 0x38], SHDoDragDrop
lea rax, [rsp + 0x7f0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x158]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8d, reloc.SHELL32.dll_ILSaveToStream
mov edx, 0x91
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.USER32.dll_ScrollWindowEx]
mov dword [rsp + 0x88], eax
xor r8d, r8d
mov rdx, qword [rsp + 0x470]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_InvalidateRgn]
mov dword [rsp + 0xd0], eax
mov eax, 0x660
mov word [rsp + 0x58], ax
movzx eax, byte [rsp + 0xe28]
mov byte [rsp + 0x2b8], al
cmp byte [rsp + 0x2b8], 0xae
je 0x14019a7d2
jmp 0x14019a85e
movzx eax, byte [rsp + 0xe28]
cmp eax, 0x42
jle 0x14019a85c
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x70]
call fcn.140197b30
movabs rax, 0x71316ae882d300
mov qword [rsp + 0xe38], rax
mov edx, 0xdc
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.USER32.dll_GetClassWord]
mov word [rsp + 0x68], ax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x94], eax
mov rdx, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_RemovePropW]
mov qword [rsp + 0x570], rax
mov byte [rsp + 0xe30], 0x19
jmp 0x14019a89c
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [rsp + 0x74], eax
lea r9, [rsp + 0x378]
lea r8, [rsp + 0x98]
mov edx, 0x62
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.USER32.dll_DrawAnimatedRects]
mov dword [rsp + 0x98], eax
movzx eax, word [rsp + 0x68]
mov word [rsp + 0x58], ax
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x578], rax
mov dword [rsp + 0x40], PathMakeUniqueName
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], reloc.SHELL32.dll_SHSetInstanceExplorer
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x460]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa40]
lea r8, [rsp + 0x1a8]
mov rdx, qword [rsp + 0x468]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_UpdateLayeredWindow]
mov dword [rsp + 0xb8], eax
lea rdx, [rsp + 0x5f0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov dword [rsp + 0x194], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xa0]
call fcn.140197b30
movabs rax, 0x732cffe32d0679
cmp qword [rsp + 0xe38], rax
jae 0x14019a98c
movzx eax, word [rsp + 0x58]
mov word [rsp + 0x68], ax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
movzx eax, word [rsp + 0x58]
mov word [rsp + 0x68], ax
jmp 0x14019aa21
movsx eax, word [rsp + 0x54]
sub eax, 0x2f
movsx ecx, word [rsp + 0x50]
cmp eax, ecx
jl 0x14019aa21
mov r8d, 1
mov rdx, qword [rsp + 0x470]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.USER32.dll_InvalidateRgn]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x94], eax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1a8]
mov r8d, SHTestTokenMembership
mov edx, 0xca
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [rsp + 0x2d4], eax
lea rdx, [rsp + 0x478]
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0xe20], eax
mov eax, dword [rsp + 0x84]
mov ecx, dword [rsp + 0x88]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x7c]
mov edx, dword [rsp + 0x6c]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jge 0x14019aae9
mov rax, qword [rsp + 0xe38]
mov qword [rsp + 0x380], rax
movabs rax, 0x73c2724eb2ea67
cmp qword [rsp + 0x380], rax
je 0x14019aa8c
movabs rax, 0x7517227cac3382
cmp qword [rsp + 0x380], rax
je 0x14019aadc
jmp 0x14019aae4
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
mov cx, 1
call qword [sym.imp.USER32.dll_VkKeyScanW]
mov word [rsp + 0x60], ax
movzx eax, word [rsp + 0x58]
mov word [rsp + 0x68], ax
mov rdx, qword [rsp + 0x2f0]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_OemToCharW]
mov dword [rsp + 0xb8], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x1c8], rax
jmp 0x14019aae4
mov byte [rsp + 0xe28], 0x64
jmp 0x14019ac5a
movsx eax, byte [rsp + 0xe30]
cmp eax, 0x18
jle 0x14019ab88
movsx eax, word [rsp + 0x50]
movsx ecx, word [rsp + 0x54]
sar eax, cl
movsx ecx, word [rsp + 0x60]
cmp eax, ecx
jge 0x14019ab37
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x78], eax
mov r8d, 0x78
mov edx, 0x7c
lea rcx, [rsp + 0x9c]
call qword [sym.imp.USER32.dll_InflateRect]
mov dword [rsp + 0xe4], eax
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
mov dword [rsp + 0x2d0], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
movabs rax, 0x79f2947fa8b18a
mov qword [rsp + 0xe38], rax
jmp 0x14019ac5a
mov rax, qword [rsp + 0xe38]
mov qword [rsp + 0x480], rax
movabs rax, 0x7b7796aa705395
cmp qword [rsp + 0x480], rax
je 0x14019abb1
jmp 0x14019ac3a
movsx eax, word [rsp + 0x50]
movsx ecx, word [rsp + 0x54]
or eax, ecx
movsx ecx, word [rsp + 0x60]
cmp eax, ecx
jl 0x14019ac12
mov byte [rsp + 0xe30], 0x15
lea rdx, [rsp + 0x488]
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.USER32.dll_GetMenuInfo]
mov dword [rsp + 0x110], eax
lea rdx, [rsp + 0x268]
lea rcx, [rsp + 0x198]
call qword [sym.imp.USER32.dll_EqualRect]
mov dword [rsp + 0x108], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x64], eax
jmp 0x14019ac38
movsx eax, word [rsp + 0x60]
movsx ecx, word [rsp + 0x50]
sub eax, ecx
movsx ecx, word [rsp + 0x54]
cmp eax, ecx
jle 0x14019ac38
mov cx, 0xa0
call qword [sym.imp.USER32.dll_IsCharUpperW]
mov dword [rsp + 0x114], eax
jmp 0x14019ac5a
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
mov dword [rsp + 0x3e8], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x6c], eax
lea rdx, [rsp + 0xa40]
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.USER32.dll_ValidateRect]
mov dword [rsp + 0x10c], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x78]
call fcn.140197b30
movzx eax, word [rsp + 0x68]
mov word [rsp + 0x58], ax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x60], ax
movabs rax, 0x7eb1a0c24cab78
cmp qword [rsp + 0xe38], rax
ja 0x14019ad3f
movzx eax, word [rsp + 0x68]
mov dword [rsp + 0x2bc], eax
cmp dword [rsp + 0x2bc], 0xe7c
je 0x14019acdc
jmp 0x14019ad37
movzx eax, word [rsp + 0x60]
mov word [rsp + 0x50], ax
lea rdx, [rsp + 0x1f8]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rsp + 0x194], eax
lea rdx, [rsp + 0x300]
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.USER32.dll_GetTitleBarInfo]
mov dword [rsp + 0x2c8], eax
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.USER32.dll_IsWindow]
mov dword [rsp + 0x17c], eax
jmp 0x14019ad3f
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x20], 0xa7
mov r9d, 0xfe
mov r8d, 0xdd
mov rdx, qword [rsp + 0x3b8]
lea rcx, [fcn.140197b30]
call qword [sym.imp.USER32.dll_CallWindowProcW]
mov qword [rsp + 0x580], rax
mov rax, qword [rsp + 0xe38]
mov qword [rsp + 0x490], rax
movabs rax, 0x7a2c5ee2bbbfdc
cmp qword [rsp + 0x490], rax
je 0x14019ad97
jmp 0x14019ade3
movzx eax, word [rsp + 0x58]
mov word [rsp + 0x68], ax
movzx eax, word [rsp + 0x68]
mov word [rsp + 0x58], ax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov r9d, 0x73
lea r8, [rsp + 0xb4]
mov edx, 0x86
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.USER32.dll_TileWindows]
mov word [rsp + 0x80], ax
jmp 0x14019aec8
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.USER32.dll_DragDetect]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0xe20]
mov ecx, dword [rsp + 0x64]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x70]
mov edx, dword [rsp + 0xa0]
xor edx, ecx
mov ecx, edx
cmp eax, ecx
ja 0x14019ae51
movzx eax, word [rsp + 0x80]
mov word [rsp + 0x58], ax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0xe20], eax
lea rcx, [rsp + 0x960]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x8c], eax
jmp 0x14019aec8
movabs rax, 0x742bcc155809c0
cmp qword [rsp + 0xe38], rax
jbe 0x14019ae8a
mov r9d, 0x1f
mov r8b, reloc.SHELL32.dll_ILGetSize
mov edx, reloc.SHELL32.dll_ILFree
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov dword [rsp + 0x108], eax
jmp 0x14019aec8
movzx eax, word [rsp + 0x68]
movzx ecx, word [rsp + 0x80]
add eax, ecx
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jg 0x14019aebb
lea rdx, [rsp + 0x78]
mov ecx, SHTestTokenMembership
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov dword [rsp + 0x84], eax
jmp 0x14019aec8
movzx eax, word [rsp + 0x80]
mov word [rsp + 0x58], ax
movsx eax, word [rsp + 0x60]
mov dword [rsp + 0x2c0], eax
cmp dword [rsp + 0x2c0], 0x724
je 0x14019aee6
jmp 0x14019af79
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x64]
call fcn.140197b30
mov eax, dword [rsp + 0x88]
movzx ecx, al
mov eax, dword [rsp + 0x6c]
shl eax, cl
mov ecx, dword [rsp + 0x84]
mov edx, dword [rsp + 0x7c]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x14019af37
movzx eax, word [rsp + 0x58]
mov word [rsp + 0x68], ax
jmp 0x14019af6c
movsx eax, word [rsp + 0x50]
movsx ecx, word [rsp + 0x54]
add eax, ecx
movsx ecx, word [rsp + 0x60]
cmp eax, ecx
jg 0x14019af6c
mov r8d, 0x23
mov edx, 0x89
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.USER32.dll_OffsetRect]
mov dword [rsp + 0x288], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0xe20], eax
jmp 0x14019aff4
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [rsp + 0x70], eax
movzx eax, word [rsp + 0x80]
mov dword [rsp + 0x2c4], eax
cmp dword [rsp + 0x2c4], 0x5ba
je 0x14019afa1
jmp 0x14019afea
mov byte [rsp + 0xe30], 0x65
mov edx, 0x84
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.USER32.dll_SetWindowContextHelpId]
mov dword [rsp + 0x10c], eax
mov r8, qword [rsp + 0x270]
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x588]
call qword [sym.imp.USER32.dll_MenuItemFromPoint]
mov dword [rsp + 0x84], eax
jmp 0x14019aff4
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x60], ax
lea rdx, [rsp + 0x270]
mov rcx, qword [rsp + 0x590]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rsp + 0x2c8], eax
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.USER32.dll_PaintDesktop]
mov dword [rsp + 0x180], eax
mov r8d, 0x79
mov edx, 0xc4
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.USER32.dll_EnableScrollBar]
mov dword [rsp + 0xd0], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xa0]
call fcn.140197b30
movzx eax, byte [rsp + 0xe28]
cmp eax, 0x29
jl 0x14019b08a
movzx eax, word [rsp + 0x68]
mov word [rsp + 0x80], ax
jmp 0x14019b133
mov eax, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x6c]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x7c]
mov edx, dword [rsp + 0x84]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x14019b133
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x94], eax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rsp + 0x3e4], eax
mov rax, qword [rsp + 0xe38]
mov qword [rsp + 0x390], rax
movabs rax, 0x76f9fc613ed2f1
cmp qword [rsp + 0x390], rax
je 0x14019b114
movabs rax, 0x794a1faff1c226
cmp qword [rsp + 0x390], rax
je 0x14019b120
jmp 0x14019b133
movzx eax, word [rsp + 0x68]
mov word [rsp + 0x58], ax
jmp 0x14019b133
mov ecx, 0xea
call qword [sym.imp.USER32.dll_GetSysColorBrush]
mov qword [rsp + 0x4b8], rax
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.USER32.dll_GetMenu]
mov qword [rsp + 0x1b0], rax
mov byte [rsp + 0xe28], 0x77
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x78]
call fcn.140197b30
movzx eax, word [rsp + 0x80]
mov dword [rsp + 0x184], eax
cmp dword [rsp + 0x184], 0x2c6
je 0x14019b1a1
cmp dword [rsp + 0x184], 0xaa9
je 0x14019b1e5
jmp 0x14019b2bb
movzx eax, word [rsp + 0x58]
mov word [rsp + 0x68], ax
mov rax, qword [rsp + 0x598]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x5a0]
mov r8d, reloc.SHELL32.dll_ILRemoveLastID
mov edx, 0xe7
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov dword [rsp + 0xe4], eax
jmp 0x14019b2bb
movzx eax, word [rsp + 0x80]
mov word [rsp + 0x58], ax
mov dword [rsp + 0x20], 0xa8
mov r9d, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov r8d, ILIsEqual
mov edx, 0xca
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [rsp + 0x3e0], eax
lea rax, [rsp + 0x398]
mov qword [rsp + 0x20], rax
mov r9d, 0xa1
lea r8, [rsp + 0x7f0]
mov edx, 0xff
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.USER32.dll_TileWindows]
mov word [rsp + 0x58], ax
mov byte [rsp + 0xe28], 0xe4
movsx eax, byte [rsp + 0xe30]
cmp eax, 2
jge 0x14019b2bb
movzx eax, word [rsp + 0x58]
mov word [rsp + 0x68], ax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x4a8]
call qword [sym.imp.USER32.dll_SetParent]
mov qword [rsp + 0xc0], rax
mov r8d, 4
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_RealGetWindowClassW]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0xe20], eax
movzx eax, byte [rsp + 0xe28]
mov byte [rsp + 0x2cc], al
cmp byte [rsp + 0x2cc], 9
je 0x14019b2d6
jmp 0x14019b2ea
movabs rax, 0x79f8e8fe9e8170
mov qword [rsp + 0xe38], rax
jmp 0x14019b352
mov ecx, 0x23
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov dword [rsp + 0x3dc], eax
lea r8, [rsp + 0xa40]
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x270]
call qword [sym.imp.USER32.dll_UnionRect]
mov dword [rsp + 0x110], eax
movzx eax, word [rsp + 0x54]
mov word [rsp + 0x60], ax
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCursor]
mov dword [rsp + 0x84], eax
call qword [sym.imp.USER32.dll_GetCapture]
mov qword [rsp + 0x4a8], rax
movzx eax, word [rsp + 0x60]
mov word [rsp + 0x50], ax
mov dword [rsp + 0x20], 9
mov r9d, 0xeb
mov r8d, 0x65
mov edx, 0x9e
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.USER32.dll_SetRect]
mov dword [rsp + 0x3d8], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x74]
call fcn.140197b30
movzx eax, word [rsp + 0x68]
mov word [rsp + 0x58], ax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x60], ax
mov eax, dword [rsp + 0xe20]
movzx ecx, al
mov eax, dword [rsp + 0x5c]
shr eax, cl
mov ecx, dword [rsp + 0x74]
mov edx, dword [rsp + 0x78]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jne 0x14019b507
movzx eax, byte [rsp + 0xe30]
mov byte [rsp + 0x188], al
cmp byte [rsp + 0x188], 0x1b
je 0x14019b3ff
cmp byte [rsp + 0x188], 0x64
je 0x14019b40c
jmp 0x14019b456
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0x78], eax
jmp 0x14019b456
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4b8]
mov r8d, 0x67
mov edx, 0xe8
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [rsp + 0xe4], eax
mov rcx, qword [rsp + 0x5a8]
call qword [sym.imp.USER32.dll_IsZoomed]
mov dword [rsp + 0x114], eax
mov r8d, 0xc1
lea rdx, [fcn.140197b30]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.USER32.dll_EnumPropsExW]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0xe20], eax
mov dword [rsp + 0x40], 0x62
mov rax, qword [rsp + 0x5b0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xe5
mov dword [rsp + 0x28], 0xc3
mov dword [rsp + 0x20], SHGetNewLinkInfoW
mov r9, qword [rsp + 0x5b8]
mov r8d, 0x1f
mov edx, 0xfb
mov rcx, qword [rsp + 0x3a8]
call qword [sym.imp.USER32.dll_DrawIconEx]
mov dword [rsp + 0xa4], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x94]
call fcn.140197b30
movzx eax, word [rsp + 0x60]
mov word [rsp + 0x50], ax
movzx eax, word [rsp + 0x58]
mov word [rsp + 0x68], ax
mov edx, 0xa0
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [rsp + 0x70], eax
mov edx, 0x24
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov qword [rsp + 0x1b0], rax
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x18c], eax
cmp dword [rsp + 0x18c], 0x3daa
je 0x14019b574
cmp dword [rsp + 0x18c], 0x616e
je 0x14019b673
jmp 0x14019b727
movzx eax, byte [rsp + 0xe28]
cmp eax, 0x4b
jg 0x14019b62e
movzx eax, word [rsp + 0x58]
mov word [rsp + 0x80], ax
mov byte [rsp + 0xe30], 0x73
mov dword [rsp + 0x20], 0x34
lea r9, [rsp + 0x4e0]
lea r8, [rsp + 0x5f0]
mov edx, 0x5f
mov ecx, SHGetNewLinkInfoW
call qword [sym.imp.USER32.dll_ToAscii]
mov dword [rsp + 0x4c8], eax
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.USER32.dll_CharUpperW]
mov qword [rsp + 0x3b0], rax
mov rcx, qword [rsp + 0x5c0]
call qword [sym.imp.USER32.dll_SetFocus]
mov qword [rsp + 0x4c0], rax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x94], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0x74]
call fcn.140197b30
movzx eax, word [rsp + 0x60]
mov word [rsp + 0x50], ax
jmp 0x14019b66e
mov eax, dword [rsp + 0x84]
mov ecx, dword [rsp + 0x88]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x6c]
mov edx, dword [rsp + 0x7c]
xor edx, ecx
mov ecx, edx
cmp eax, ecx
jge 0x14019b65c
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [rsp + 0x5c], eax
jmp 0x14019b66e
movabs rax, 0x7574ba42a62376
mov qword [rsp + 0xe38], rax
jmp 0x14019b727
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.USER32.dll_ChildWindowFromPoint]
mov qword [rsp + 0xa8], rax
movsx eax, word [rsp + 0x54]
movsx ecx, word [rsp + 0x50]
and eax, ecx
movsx ecx, word [rsp + 0x60]
cmp eax, ecx
je 0x14019b6fd
movzx eax, word [rsp + 0x68]
mov word [rsp + 0x58], ax
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rsp + 0x1a8]
mov edx, PathMakeUniqueName
mov rcx, qword [rsp + 0x3b8]
call qword [sym.imp.USER32.dll_TileWindows]
mov word [rsp + 0x290], ax
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.USER32.dll_HideCaret]
mov dword [rsp + 0x2d0], eax
jmp 0x14019b727
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0xe20]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xa0]
mov edx, dword [rsp + 0x78]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jae 0x14019b727
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x1c0]
mov rcx, qword [rsp + 0x5c8]
call qword [sym.imp.USER32.dll_GetTitleBarInfo]
mov dword [rsp + 0x120], eax
lea r8, [rsp + 0x280]
lea rdx, [rsp + 0x6a0]
mov ecx, 0xd2
call qword [sym.imp.USER32.dll_SetSysColors]
mov dword [rsp + 0x2d4], eax
mov r8d, 1
mov edx, 0x5f
mov ecx, PathYetAnotherMakeUniqueName
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rsp + 0x190], eax
mov r9, qword [rsp + 0xe38]
movzx r8d, byte [rsp + 0xe30]
movzx edx, byte [rsp + 0xe28]
mov ecx, dword [rsp + 0xe20]
call fcn.140197b30
movsx eax, word [rsp + 0x60]
movsx ecx, word [rsp + 0x54]
shl eax, cl
movsx ecx, word [rsp + 0x50]
cmp eax, ecx
jge 0x14019b7c5
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x74], eax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x60], ax
mov byte [rsp + 0xe30], 0xd
mov r8d, ILGetSize
mov edx, 0xc1
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov dword [rsp + 0x288], eax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x60], ax
mov ecx, 0xff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov dword [rsp + 0x3f0], eax
mov dword [rsp + 0x20], 0xa1
mov r9d, 0x88
mov r8d, 0xc4
mov edx, reloc.SHELL32.dll_ILClone
lea rcx, [rsp + 0x198]
call qword [sym.imp.USER32.dll_SetRect]
mov dword [rsp + 0x194], eax
mov eax, PathMakeUniqueName
add rsp, 0xe18
ret