Function at 0x1400a32f0
Capabilities:
Accept command line arguments
Check mutex on windows
Check os version
Create process on windows
Get common file path
Query or enumerate registry value

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x140136e20]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov r15, rcx
mov qword [rsp + 0x68], rcx
lea rcx, [rbp + 0x20]
mov r14d, r9d
mov dword [rbp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400a335f
cmp dword [rbp + 0x24], 5
jae 0x1400a335f
lea r8, [0x1401070c0]
lea rdx, str.This_application_needs_at_least_Windows_XP_or_above_to_run_properly.
mov r9d, reloc.SHELL32.dll_ILFindLastID
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x1400a3b5d
mov qword [rsp + 0x4a8], rbx
mov qword [rsp + 0x470], rdi
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x468], r12
mov dword [rsp + 0x78], 8
mov dword [rsp + 0x7c], 0xc605
mov qword [rsp + 0x460], r13
call fcn.14001b0b0
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
call fcn.1400a2be0
cmp byte [0x140149684], 0
mov r13d, eax
je 0x1400a342f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400a33fa
lea r8, [rbp + 0x140]
mov r9d, 0x104
xor edx, edx
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.Explorer.log
lea rcx, [rbp + 0x140]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x140]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.140063f70
xor edi, edi
mov qword [rsp + 0x478], rsi
cmp qword [0x140149b28], rdi
lea r12d, [rdi + 1]
jbe 0x1400a36a8
lea rax, [rsp + 0x60]
lea edx, [rdi + 3]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rdi
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
js 0x1400a36a8
mov rax, qword [0x140149b20]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400a3691
mov r15d, r12d
nop dword [rax]
cmp qword [rbx + 0x28], 8
jb 0x1400a349d
mov rcx, qword [rbx + 0x10]
jmp 0x1400a34a1
lea rcx, [rbx + 0x10]
test rcx, rcx
je 0x1400a34b2
lea rdx, [rsp + 0x50]
call fcn.140094590
jmp 0x1400a34b7
mov eax, 0x80004005
mov r12d, edi
test eax, eax
js 0x1400a3676
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_ILIsParent]
test eax, eax
je 0x1400a34f4
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call fcn.140092a30
test eax, eax
jne 0x1400a34f4
mov r12d, r15d
jmp 0x1400a3575
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400a3666
cmp dword [rbp + 0x24], 6
jb 0x1400a3666
lea rdx, [rsp + 0x58]
lea rcx, [0x140107180]
mov qword [rsp + 0x58], rdi
call fcn.140094590
test eax, eax
js 0x1400a3666
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_ILIsParent]
test eax, eax
je 0x1400a3561
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.140092a30
test eax, eax
cmove r12d, r15d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r12d, r12d
je 0x1400a3666
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x400
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400a35dd
lea r8, [rsp + 0x70]
mov edx, ILFindLastID
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400a35d4
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0x140]
lea rdx, [0x1401071d8]
mov r9d, 0x104
call qword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx + 0x28], 8
jb 0x1400a35ea
mov r9, qword [rbx + 0x10]
jmp 0x1400a35ee
lea r9, [rbx + 0x10]
lea r8, [rbp + 0x140]
lea rdx, [0x140107208]
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rbx, qword [0x140149b20]
mov rdi, qword [rbx]
je 0x1400a3661
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
cmp qword [rbx + 0x28], 8
jb 0x1400a3640
mov rcx, qword [rbx + 0x10]
call fcn.14004b088
xor eax, eax
mov qword [rbx + 0x28], 7
mov rcx, rbx
mov qword [rbx + 0x20], rax
mov word [rbx + 0x10], ax
call fcn.14004b088
dec qword [0x140149b28]
mov rbx, rdi
xor edi, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r12d, r12d
jne 0x1400a3679
mov rbx, qword [rbx]
cmp rbx, qword [0x140149b20]
jne 0x1400a3490
mov r15, qword [rsp + 0x68]
mov r12d, 1
cmp qword [0x140149b28], 0
mov rcx, qword [rsp + 0x60]
cmove r13d, r12d
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13d, r13d
jne 0x1400a38f4
call fcn.1400c4390
mov esi, eax
test eax, eax
je 0x1400a36c3
call fcn.140098b30
jmp 0x1400a36c8
call fcn.1400b8710
lea r8, [0x1401070d8]
mov edx, r12d
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r13, rax
test ebx, ebx
jne 0x1400a3849
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400a3849
lea rcx, [0x1401068e8]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov r12, rax
test rax, rax
je 0x1400a3849
cmp qword [0x140149b28], 0
je 0x1400a3807
mov rdi, qword [0x140149b20]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400a3822
xor esi, esi
nop word [rax + rax]
lea rdx, [rbx + 0x10]
lea rcx, [rbp - 8]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov qword [rbp + 0x10], 7
mov qword [rbp + 8], rsi
mov word [rbp - 8], si
call fcn.140009660
cmp qword [rbp + 0x10], 8
lea r8, [rbp - 8]
lea rax, [rbp + 0x140]
mov edx, 0x104
cmovae r8, qword [rbp - 8]
lea rcx, [rbp + 0x140]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400a37b4
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400a37b4
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400a3790
jmp 0x1400a37b9
test rdx, rdx
jne 0x1400a37bd
sub rcx, 2
mov eax, dword [rbp + 8]
xor r8d, r8d
mov word [rcx], si
lea eax, [rax + rax + 2]
lea r9, [rbp - 0x80]
lea edx, [r8 + 0x4a]
mov dword [rbp - 0x78], eax
lea rax, [rbp + 0x140]
mov rcx, r12
mov qword [rbp - 0x70], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp qword [rbp + 0x10], 8
jb 0x1400a37f9
mov rcx, qword [rbp - 8]
call fcn.14004b088
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400a3740
jmp 0x1400a3822
xor r8d, r8d
lea r9, [rbp - 0x80]
mov rcx, rax
lea edx, [r8 + 0x4a]
mov dword [rbp - 0x78], edi
mov qword [rbp - 0x70], rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r12
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 9
mov rcx, r12
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400a3b35
lea rcx, str.Riched20.dll
call fcn.14000afd0
mov rcx, r15
mov r12, rax
call fcn.1400a3210
test ax, ax
jne 0x1400a386e
lea rdx, str.Could_not_register_class
jmp 0x1400a38d0
lea rcx, [0x1400a29a0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x80000000
lea rdx, [0x1401068d0]
lea rcx, [0x1401068e8]
mov r9d, 0x80000000
mov r8d, 0xcf0000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call fcn.14001ad70
mov rdi, rax
test rax, rax
jne 0x1400a38fb
lea rdx, str.Could_not_create_main_window.
lea r8, [0x1401068d0]
mov r9d, reloc.SHELL32.dll_ILFindLastID
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call qword [sym.imp.ole32.dll_OleUninitialize]
xor eax, eax
jmp 0x1400a3b35
test esi, esi
je 0x1400a390e
lea rcx, [rbp - 0x38]
call fcn.140098dd0
xor esi, esi
mov ebx, eax
jmp 0x1400a3983
lea rax, [rsp + 0x68]
lea rdx, [0x140108960]
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400a3983
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea rdx, [0x1401089a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 0x2c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x50], 0x2c
jne 0x1400a3983
cmp dword [rbp - 0x38], 0x2c
mov eax, 1
cmove ebx, eax
test ebx, ebx
jne 0x1400a3a14
xor ecx, ecx
mov dword [rbp - 0x30], r14d
mov qword [rbp - 0x38], 0x2c
mov qword [rbp - 0x2c], 0
mov qword [rbp - 0x24], 0xffffffffffffffff
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm1, ebx
movd xmm2, eax
cvtdq2pd xmm1, xmm1
movapd xmm0, xmm1
mulsd xmm1, qword [0x1401129a0]
mulsd xmm0, qword [0x140112998]
cvtdq2pd xmm2, xmm2
cvttsd2si eax, xmm1
cvttsd2si ecx, xmm0
movapd xmm0, xmm2
mulsd xmm2, qword [0x140112990]
mulsd xmm0, qword [0x140112988]
mov dword [rbp - 0x1c], ecx
sub ecx, eax
cvttsd2si eax, xmm2
mov dword [rbp - 0x14], ecx
cvttsd2si edx, xmm0
mov dword [rbp - 0x18], edx
sub edx, eax
mov dword [rbp - 0x10], edx
cmp r14d, 6
je 0x1400a3a26
cmp r14d, 2
je 0x1400a3a26
cmp r14d, 3
jne 0x1400a3a2a
mov dword [rbp - 0x30], r14d
lea rdx, [rbp - 0x38]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowPlacement]
mov rcx, rdi
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, reloc.SHELL32.dll_ILGetSize
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
lea rcx, [rbp - 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400a3b15
nop dword [rax + rax]
mov rcx, qword [0x1401495c0]
lea rdx, [rbp - 0x68]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x1400a3aca
mov rcx, qword [0x1401495b8]
lea r9, [rbp - 0x68]
xor r8d, r8d
mov edx, 0x475
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x1400a3aca
lea r8, [rbp - 0x68]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1400a3aca
lea rcx, [rbp - 0x68]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x68]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rcx, qword [0x1401495b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x476
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jne 0x1400a3afb
mov rcx, qword [0x1401495b8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x1401495b8], rsi
lea rcx, [rbp - 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x1400a3a70
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call qword [sym.imp.ole32.dll_OleUninitialize]
test r13, r13
je 0x1400a3b32
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x58]
mov rsi, qword [rsp + 0x478]
mov rdi, qword [rsp + 0x470]
mov r12, qword [rsp + 0x468]
mov rbx, qword [rsp + 0x4a8]
mov r13, qword [rsp + 0x460]
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14004ae00
add rsp, 0x480
pop r15
pop r14
pop rbp
ret