Function at 0x10001218c
Capabilities:
Get common file path
Resume thread
Set current directory

Disassembly:
mov rcx, rbx
call fcn.10000c80c
lea rcx, str.MSFTEDIT.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, r13
je 0x10003971d
lea rcx, str._CTF_ENABLE_PROCESS_ATOM_
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rbx + 0x360], ax
lea rcx, str._CTF_PROCESS_ATOM_
call qword [sym.imp.KERNEL32.dll_AddAtomW]
mov word [rbx + 0x362], ax
mov edx, 9
mov rcx, rbx
call sub.MFC42u.dll_CPropertyPage::OnCtlColor
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
lea rcx, [0x1000fc260]
call sub.MFC42u.dll_CThreadData::CThreadData
lea rcx, [rbx + 0x2b0]
mov r9d, r14d
lea r8, [0x1000fc260]
lea rdx, [0x1000b6a20]
call sub.MFC42u.dll_ConstructElements
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 4
xor r9d, r9d
lea r8d, [r9 - 0xf]
mov rdx, rbx
lea rcx, [0x100012014]
call sub.MFC42u.dll_Ordinal_1404
mov qword [rbx + 0x358], rax
cmp rax, r13
je 0x100006807
mov dword [rax + 0x50], r13d
mov rcx, qword [rbx + 0x358]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call fcn.10000c910
cmp eax, r13d
jl 0x10003977b
cmp dword [rbx + 0x19c], r13d
jne 0x100039845
cmp dword [rbx + 0x1a0], r13d
jne 0x100039845
mov dword [rbx + reloc.MFC42u.dll_CTabCtrl::CTabCtrl], r14d
lea rcx, [rbx + 0x1f0]
mov edx, 0xf03e
call sub.MFC42u.dll_CPropertySheet::OnCtlColor
mov rcx, rbx
call fcn.10000f1f0
mov byte [rbx + 0x34c], r13b
mov dword [rbx + reloc.MFC42u.dll_CTabCtrl::CTabCtrl], r13d
or dword [rbx + 0xe0], 0xffffffff
cmp qword [rbx + 0x40], r13
je 0x100039782
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov rcx, rax
call sub.MFC42u.dll_COleControl::XDataObject::GetCanonicalFormatEtc
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x68], rax
mov ecx, 0x50
call sub.MFC42u.dll_CMonthCalCtrl::SetDayState
mov rdi, rax
mov qword [rsp + 0x78], rax
cmp rax, r13
je 0x100039789
mov r14d, 7
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r13
mov word [rsp + 0x48], r13w
lea r8d, [r14 + 1]
lea rdx, str._restart
lea rcx, [rsp + 0x40]
call fcn.100006330
nop
lea r12d, [r14 - 6]
mov dword [rsp + 0x38], r12d
mov r8d, r12d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.100008a50
jmp 0x1000068f3
mov qword [rbx + 0x368], rax
test r12b, 1
je 0x100006916
and r12d, 0xfffffffe
cmp qword [rsp + 0x60], 8
jb 0x100006916
mov rcx, qword [rsp + 0x48]
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
call sub.MFC42u.dll_Ordinal_1463
cmp qword [rax + 0x20], r13
cmovne r15, qword [rax + 0x20]
mov ecx, 0x50
call sub.MFC42u.dll_CMonthCalCtrl::SetDayState
mov r13, rax
mov qword [rsp + 0x78], rax
xor eax, eax
cmp r13, rax
je 0x100039797
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], rax
mov word [rsp + 0x48], ax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.100006330
nop
or r12d, 2
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x20], 0x12c
mov r9d, 5
lea r8, [rsp + 0x40]
mov rdx, qword [rbx + 0x368]
mov rcx, r13
call fcn.10000a5cc
xor r13d, r13d
jmp 0x10000699f
mov qword [rbx + 0x370], rax
test r12b, 2
je 0x1000069b8
cmp qword [rsp + 0x60], 8
jae 0x10003979f
mov ecx, DispGetParam
call sub.MFC42u.dll_CMonthCalCtrl::SetDayState
cmp rax, r13
je 0x1000397af
lea rcx, vtable.CWordPadRecoveryCallback.0
mov qword [rax], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
jmp 0x1000069e0
mov qword [rbx + 0x378], rax
mov rdx, rax
mov rcx, qword [rbx + 0x370]
call fcn.100008a34
mov rdx, qword [rbx + 0xd8]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r13
mov word [rsp + 0x48], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.100006330
nop
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x368]
call fcn.100009fe0
mov edi, eax
cmp qword [rsp + 0x60], 8
jb 0x100006a50
mov rcx, qword [rsp + 0x48]
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
cmp edi, r13d
jne 0x1000397b7
lea rcx, [rsp + 0x78]
call sub.MFC42u.dll_CButton::CButton
nop
mov rax, qword [rbx + 0x1a8]
cmp dword [rax - 8], r13d
je 0x100006a7b
mov edx, dword [rsp + 0x30]
mov dword [rbx + 0xe0], edx
cmp dword [rbx + 0x1a4], r13d
je 0x100006a9c
lea rdx, [rbx + 0x190]
mov rcx, rbx
call sub.MFC42u.dll_COleServerDoc::XPersistStorage::Save
cmp eax, r13d
je 0x1000397de
call sub.MFC42u.dll_CMemFile::Alloc
mov edx, 1
mov rcx, qword [rbx + 0x40]
call sub.MFC42u.dll_CDragListBox::DrawInsert
xor r9d, r9d
lea r8d, [r9 + 5]
lea rdx, [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, r13d
je 0x100006ad9
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [0x1000fb1f4], r13d
jne 0x1000397ea
mov rcx, qword [rbx + 0x370]
call fcn.10000776c
lea rdx, [rsp + 0x98]
mov rcx, qword [rbx + 0x370]
call fcn.1000079d0
nop
xor r8d, r8d
lea rdx, [rsp + 0x98]
mov rcx, qword [rbx + 0x368]
call fcn.1000077a8
mov rcx, qword [rbx + 0x368]
call fcn.100007ad0
call fcn.100007904
nop
cmp qword [rsp + 0xb8], 8
jb 0x100006b48
mov rcx, qword [rsp + 0xa0]
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
mov eax, 1
jmp 0x100006b4f
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1000011e0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1000f6188]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rbx, rcx
mov qword [rsp + 0x70], rcx
xor r13d, r13d
mov r12d, r13d
mov dword [rsp + 0x38], r13d
lea r9, [0x1000fc250]
lea r8, [0x1000fb1d0]
lea rdx, [0x10007b060]
lea rcx, [0x1000b4ae0]
call fcn.10000c8f0
mov r11d, dword [0x1000fb1f4]
cmp r11d, r13d
jne 0x100039552
movabs rdi, 0x4000000000000000
movabs rsi, 0x8000000000000000
xor r9d, r9d
xor r8d, r8d
lea r14d, [r9 + 1]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rdx, [rbx + 0x190]
mov rcx, rbx
call sub.MFC42u.dll_CMapWordToPtr::RemoveKey
xor edx, edx
lea rcx, str.WordPadClass
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, r13
jne 0x100039635
lea rdx, str.MicrosoftWindowsCurrentVersionApplets
mov rcx, rbx
call sub.MFC42u.dll_CHtmlView::CHtmlView
mov rcx, qword [rbx + 0x118]
cmp rcx, r13
je 0x10001227a
call qword [sym.imp.msvcrt.dll_free]
lea r15, str.Wordpad
mov rcx, r15
call qword [sym.imp.msvcrt.dll__wcsdup]
mov qword [rbx + 0x118], rax
xor r8d, r8d
lea edx, [r8 + 3]
lea rcx, [0x1000fc240]
call sub.ntdll.dll_WinSqmStartSession
mov rcx, rbx
call fcn.10001016c
cmp dword [rbx + 0x19c], r13d
jne 0x100039663
mov eax, dword [rbx + 0xe0]
cmp eax, r14d
je 0x1000122d6
cmp eax, 2
jle 0x1000122e3
cmp eax, 5
jle 0x1000122d6
add eax, 0xfffffff8
cmp eax, 2
ja 0x1000122e3
cmp dword [rbx + reloc.MFC42u.dll_CString::CString], r13d
jne 0x100039654
mov eax, dword [rbx + 0xe0]
mov dword [rsp + 0x30], eax
mov rcx, rbx
call fcn.10000c858
mov rcx, qword [rbx + 0x110]
cmp rcx, r13
je 0x100012307
call qword [sym.imp.msvcrt.dll_free]
lea rcx, str.WORDPAD.HLP
call qword [sym.imp.msvcrt.dll__wcsdup]
mov qword [rbx + 0x110], rax
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionWordpadCOMChecks
call fcn.10001234c
mov dword [0x1000f6164], eax
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
cmp eax, r13d
jne 0x10003966f
jmp 0x1000396ca
mov dl, byte [0x1000fb1f8]
cmp dl, 4
jae 0x100039575
cmp dl, r13b
je 0x100039575
movabs rdi, 0x4000000000000000
mov rcx, qword [0x1000fb1e8]
jmp 0x1000395ca
movabs rdi, 0x4000000000000000
test qword [0x1000fb1e0], rdi
je 0x1000395c3
mov rcx, qword [0x1000fb1e8]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x1000395ca
lea rdx, [0x1000ccce8]
mov rcx, qword [0x1000fc250]
call fcn.100054630
mov dl, byte [0x1000fb1f8]
mov r11d, dword [0x1000fb1f4]
mov rcx, qword [0x1000fb1e8]
jmp 0x1000395ca
mov rcx, qword [0x1000fb1e8]
cmp r11d, r13d
je 0x100039626
cmp dl, 4
jae 0x1000395e8
cmp dl, r13b
je 0x1000395e8
movabs rsi, 0x8000000000000000
jmp 0x10001221d
movabs rsi, 0x8000000000000000
test qword [0x1000fb1e0], rsi
je 0x10001221d
mov rax, rcx
and rax, rsi
cmp rax, rcx
jne 0x10001221d
lea rdx, [0x1000ccda8]
mov rcx, qword [0x1000fc250]
call fcn.100054630
jmp 0x10001221d
movabs rsi, 0x8000000000000000
jmp 0x10001221d
mov rdx, qword [rbx + 0x1a8]
mov rcx, rbx
call fcn.10007b1b0
cmp eax, r13d
je 0x100012259
xor eax, eax
jmp 0x100006b4f
mov dword [rbx + 0xe0], 3
jmp 0x1000122e3
mov dword [rbx + 0xe0], r14d
jmp 0x1000122e3
or r8d, 0xffffffff
xor edx, edx
lea ecx, [rdx + 0x64]
call sub.MFC42u.dll_Ordinal_1498
cmp dword [0x1000fb1f4], r13d
je 0x1000396c3
mov al, byte [0x1000fb1f8]
cmp al, 2
jae 0x100039695
cmp al, r13b
jne 0x1000396c3
test qword [0x1000fb1e0], rdi
je 0x1000396c3
mov rcx, qword [0x1000fb1e8]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x1000396c3
lea rdx, [0x1000ccd08]
mov rcx, qword [0x1000fc250]
call fcn.100054630
xor eax, eax
jmp 0x100006b4f
mov dword [rbx + 0x364], r14d
cmp dword [0x1000f6164], r13d
je 0x100006738
lea r8, [rsp + 0x38]
lea rdx, [0x1000d48a8]
lea rcx, [0x1000fce60]
call fcn.10007ac88
cmp eax, r13d
jge 0x100039702
xor eax, eax
jmp 0x100006b4f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoRegisterActivationFilter]
cmp eax, r13d
jge 0x100006738
xor eax, eax
jmp 0x100006b4f
or r8d, 0xffffffff
mov edx, 0x30
lea ecx, [rdx + 0x3c]
call sub.MFC42u.dll_Ordinal_1498
cmp dword [0x1000fb1f4], r13d
je 0x100039774
mov al, byte [0x1000fb1f8]
cmp al, 2
jae 0x100039746
cmp al, r13b
jne 0x100039774
test qword [0x1000fb1e0], rdi
je 0x100039774
mov rcx, qword [0x1000fb1e8]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x100039774
lea rdx, [0x1000ccd18]
mov rcx, qword [0x1000fc250]
call fcn.100054630
xor eax, eax
jmp 0x100006b4f
xor eax, eax
jmp 0x100006b4f
xor eax, eax
jmp 0x100006b4f
mov rax, r13
mov r14d, 7
jmp 0x1000068f3
xor r13d, r13d
jmp 0x10000699f
mov rcx, qword [rsp + 0x48]
call sub.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek
nop
jmp 0x1000069b8
mov rax, r13
jmp 0x1000069e0
mov rcx, qword [rbx + 0x370]
call fcn.100042128
mov rcx, qword [rbx + 0x370]
call fcn.1000427c0
mov edx, dword [rsp + 0x30]
mov dword [rbx + 0xe0], edx
jmp 0x100006aa1
call sub.MFC42u.dll_CMemFile::Alloc
xor eax, eax
jmp 0x100006b4f
mov al, byte [0x1000fb1f8]
cmp al, 4
jae 0x1000397fd
cmp al, r13b
jne 0x100006ae6
test qword [0x1000fb1e0], rsi
je 0x100006ae6
mov rcx, qword [0x1000fb1e8]
mov rax, rcx
and rax, rsi
cmp rax, rcx
jne 0x100006ae6
lea rdx, [0x1000ccdb8]
mov rcx, qword [0x1000fc250]
call fcn.100054630
nop
jmp 0x100006ae6
cmp dword [0x1000fb1f4], r13d
je 0x10003988b
mov al, byte [0x1000fb1f8]
cmp al, 4
jae 0x10003985d
cmp al, r13b
jne 0x10003988b
test qword [0x1000fb1e0], rdi
je 0x10003988b
mov rcx, qword [0x1000fb1e8]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x10003988b
lea rdx, [0x1000ccd28]
mov rcx, qword [0x1000fc250]
call fcn.100054630
call sub.MFC42u.dll_CPreviewDC::SetBkColor
xor ecx, ecx
call sub.MFC42u.dll_Ordinal_1519
cmp dword [0x1000fb1f4], r13d
je 0x1000398dd
mov al, byte [0x1000fb1f8]
cmp al, 4
jae 0x1000398af
cmp al, r13b
jne 0x1000398dd
test qword [0x1000fb1e0], rsi
je 0x1000398dd
mov rcx, qword [0x1000fb1e8]
mov rax, rcx
and rax, rsi
cmp rax, rcx
jne 0x1000398dd
lea rdx, [0x1000ccdb8]
mov rcx, qword [0x1000fc250]
call fcn.100054630
mov eax, r14d
jmp 0x100006b4f