Function at 0x14003cb8c
Capabilities:
Check if file exists
Create process on windows
Delete registry value
Get common file path
Get file attributes
Persist via command processor registry key
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov r15, r8
mov rax, rdx
mov r13, rcx
xor esi, esi
mov byte [rsp + 0x60], sil
mov dword [r8], 0x64
lea rbx, [rcx + 0x2f8]
lea rdx, [0x1401759d0]
test rax, rax
cmovne rdx, rax
or r12, 0xffffffffffffffff
mov r8, r12
mov rcx, rbx
call fcn.140115190
mov rcx, rbx
call fcn.140054ee8
mov rdi, rax
mov rcx, rbx
call fcn.140054ee8
mov rcx, rax
call fcn.140118f08
mov qword [rbp - 0x60], rax
lea rcx, [rsp + 0x78]
call fcn.1401170c0
nop
lea rcx, [rbp - 0x50]
call fcn.1401170c0
nop
lea rcx, [rbp + 0x68]
call fcn.140114c40
nop
lea rcx, [rbp + 0x58]
call fcn.140114c40
nop
mov rcx, qword [0x14022a9e0]
add rcx, 0xae0
call fcn.140118eac
mov rdx, rax
mov r8, r12
lea rcx, [rbp + 0x68]
call fcn.140115190
lea rcx, [rbp + 0x68]
call fcn.140054ee8
mov rdx, rax
mov r8, r12
lea rcx, [rbp + 0x58]
call fcn.140115190
mov rcx, qword [rbp + 0x58]
call fcn.140118e88
test rax, rax
je 0x14003cc8a
mov word [rax], si
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.1401188b8
mov rbx, rax
test rax, rax
jne 0x14003ccaf
mov byte [rsp + 0x60], 1
mov dword [r15], esi
jmp 0x14003d29f
lea rcx, [rsp + 0x78]
call fcn.140054ee8
mov rcx, rax
call fcn.140118eac
mov rdi, rax
lea rcx, [rbp + 0x68]
call fcn.140054ee8
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14003ccf6
lea rcx, [rbp + 0x58]
call fcn.140054ee8
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14003cd07
mov rcx, rbx
call fcn.140118f08
mov rbx, rax
mov qword [rbp - 0x60], rax
jmp 0x14003cd0b
mov rbx, qword [rbp - 0x60]
mov edi, 0xfffd
test rbx, rbx
je 0x14003cd60
cmp word [rbx], si
je 0x14003cd60
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.1401188b8
test rax, rax
je 0x14003cd60
mov rax, qword [rsp + 0x78]
movzx ecx, word [rax]
sub cx, 0x2d
test di, cx
je 0x14003cd60
lea rcx, [r13 + 0x328]
mov r8, r12
mov rdx, rbx
call fcn.140115190
mov rbx, rsi
mov qword [rbp - 0x60], rbx
mov dword [r13 + 0x33c], r12d
lea rcx, [rsp + 0x78]
call fcn.1401175c4
lea rcx, [rbp - 0x50]
call fcn.1401175c4
mov r14d, 1
test rbx, rbx
je 0x14003d292
cmp word [rbx], si
je 0x14003d292
lea rcx, [r13 + 0x308]
mov r8, r12
mov rdx, rbx
call fcn.140115190
lea r8, [rbp + 8]
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.1401188b8
mov rsi, rax
mov qword [rsp + 0x68], rax
xor edi, edi
test rax, rax
je 0x14003d292
lea ebx, [rdi + 2]
lea rcx, [rsp + 0x78]
call fcn.1401185a4
test al, al
je 0x14003f21a
add dword [r13 + 0x33c], r14d
lea rdx, str._autosetup
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
jne 0x14003f019
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rax, str._demote
mov qword [rsp + 0x28], rax
lea rax, str._interactive:
mov qword [rsp + 0x20], rax
lea r9, str._system:
lea r8, [0x140183ff0]
lea rdx, str._bypass
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
jne 0x14003eaec
lea rdx, str._multi
lea rcx, [rsp + 0x78]
call fcn.14011863c
lea rcx, [rsp + 0x78]
test al, al
je 0x14003ce8f
call fcn.140054ee8
mov rdx, rax
xor r8d, r8d
mov rcx, qword [0x14022a9e0]
call fcn.14000e848
mov rax, qword [0x14022a9e0]
mov byte [rax + 0xa10], r14b
jmp 0x14003cec9
lea rdx, str._NoMulti
call fcn.14011863c
lea rcx, [rsp + 0x78]
test al, al
je 0x14003cee9
call fcn.140054ee8
mov rdx, rax
xor r8d, r8d
mov rcx, qword [0x14022a9e0]
call fcn.14000e848
mov rax, qword [0x14022a9e0]
mov byte [rax + 0xa10], dil
mov byte [rax + 0xa1c], r14b
cmp dword [rax + 0xa18], r14d
je 0x14003d25d
mov dword [rax + 0xa18], r14d
jmp 0x14003d25d
lea rdx, str._visible
call fcn.14011863c
test al, al
je 0x14003cf27
mov rax, qword [0x14022a9e0]
mov byte [rax + 0xa20], r14b
mov byte [rax + 0xa2c], r14b
cmp dword [rax + 0xa28], r14d
je 0x14003d25d
mov dword [rax + 0xa28], r14d
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rax, str._ct2
mov qword [rsp + 0x28], rax
lea rax, str._ct1
mov qword [rsp + 0x20], rax
lea r9, str._ct0
lea r8, str._cleartype
lea rdx, [0x140184230]
lea rcx, [rsp + 0x78]
call fcn.140118d90
lea rcx, [rsp + 0x78]
test al, al
je 0x14003cfda
call fcn.140054ee8
movzx ecx, word [rax + 6]
sub ecx, 0x30
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x844], r14b
je 0x14003cfb9
cmp ecx, 1
je 0x14003cfad
mov dword [rax + 0x838], 6
jmp 0x14003cfc3
mov dword [rax + 0x838], 4
jmp 0x14003cfc3
mov dword [rax + 0x838], 3
cmp dword [rax + 0x840], ebx
je 0x14003d25d
mov dword [rax + 0x840], ebx
jmp 0x14003d25d
lea rdx, str._lng
call fcn.14011863c
test al, al
je 0x14003d053
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14003f035
mov rax, qword [0x14022a9e0]
cmp byte [rax + 0x824], dil
jne 0x14003d25d
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rdx, rax
mov rcx, qword [0x14022a9e0]
add rcx, 0x818
mov r8d, 4
call fcn.14003f6b0
lea rcx, [rbp - 0x50]
call fcn.140054ee8
lea rdx, str._lng
jmp 0x14003d147
lea rdx, str._lngfile
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d0ce
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14003f035
mov rax, qword [0x14022a9e0]
cmp byte [rax + 0x834], dil
jne 0x14003d25d
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rdx, rax
mov rcx, qword [0x14022a9e0]
add rcx, 0x828
mov r8d, 4
call fcn.14003f6b0
lea rcx, [rbp - 0x50]
call fcn.140054ee8
lea rdx, str._lngfile
jmp 0x14003d147
lea rdx, str._Font
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d15b
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14003f035
mov rax, qword [0x14022a9e0]
cmp byte [rax + 0x854], dil
jne 0x14003d25d
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rdx, rax
mov rcx, qword [0x14022a9e0]
add rcx, 0x848
mov r8d, 4
call fcn.14003f6b0
lea rcx, [rbp - 0x50]
call fcn.140054ee8
lea rdx, str._font
mov r8, rax
mov rcx, qword [0x14022a9e0]
call fcn.14000e848
jmp 0x14003d25d
lea rdx, str._FontSize
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
jne 0x14003e98a
lea rdx, str._Size
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
jne 0x14003e98a
lea rdx, str._FontFile
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d2f5
mov qword [rbp + 0x20], rdi
mov dword [rbp + 0x28], 4
mov byte [rbp + 0x2c], dil
mov byte [rsp + 0x20], dil
mov r9d, 0x104
lea r8, [rbp + 0x20]
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.14003c52c
test al, al
je 0x14003e9d5
mov rbx, qword [rbp + 0x20]
mov edi, dword [rbp + 0x28]
mov sil, byte [rbp + 0x2c]
xor ecx, ecx
test sil, sil
je 0x14003d200
lea eax, [rdi - 4]
cmp eax, 2
ja 0x14003d200
test rbx, rbx
je 0x14003d200
cmp word [rbx], cx
mov r8, rbx
jne 0x14003d203
mov r8, rcx
lea rdx, str._FontFile
mov rcx, qword [0x14022a9e0]
call fcn.14000e848
test sil, sil
je 0x14003d231
lea eax, [rdi - 4]
cmp eax, 2
ja 0x14003d231
xor edi, edi
test rbx, rbx
je 0x14003d233
cmp word [rbx], di
jne 0x14003d236
jmp 0x14003d233
xor edi, edi
mov rbx, rdi
mov r8d, r14d
mov rdx, rbx
mov rcx, qword [0x14022ab90]
call fcn.1400536c4
nop
lea rcx, [rbp + 0x20]
call fcn.14003c3e4
nop
mov rsi, qword [rsp + 0x68]
mov ebx, 2
lea rcx, [rsp + 0x78]
call fcn.1401175c4
lea rcx, [rbp - 0x50]
call fcn.1401175c4
lea r8, [rbp + 8]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x14003cdc4
mov rcx, r13
call fcn.14003f3ec
mov byte [rsp + 0x60], r14b
lea rcx, [rbp + 0x58]
call fcn.140114ca4
nop
lea rcx, [rbp + 0x68]
call fcn.140114ca4
nop
lea rcx, [rbp - 0x50]
call fcn.1401170e4
nop
lea rcx, [rsp + 0x78]
call fcn.1401170e4
mov al, byte [rsp + 0x60]
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14012bda0
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, str._FontDir
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d3bd
mov qword [rbp + 0x30], rdi
mov dword [rbp + 0x38], 4
mov byte [rbp + 0x3c], dil
mov byte [rsp + 0x20], dil
mov r9d, 0x104
lea r8, [rbp + 0x30]
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.14003c52c
test al, al
je 0x14003e9e4
mov rbx, qword [rbp + 0x30]
mov edi, dword [rbp + 0x38]
mov sil, byte [rbp + 0x3c]
xor ecx, ecx
test sil, sil
je 0x14003d368
lea eax, [rdi - 4]
cmp eax, 2
ja 0x14003d368
test rbx, rbx
je 0x14003d368
cmp word [rbx], cx
mov r8, rbx
jne 0x14003d36b
mov r8, rcx
lea rdx, str._FontDir
mov rcx, qword [0x14022a9e0]
call fcn.14000e848
test sil, sil
je 0x14003d399
lea eax, [rdi - 4]
cmp eax, 2
ja 0x14003d399
xor edi, edi
test rbx, rbx
je 0x14003d39b
cmp word [rbx], di
jne 0x14003d39e
jmp 0x14003d39b
xor edi, edi
mov rbx, rdi
mov rdx, rbx
mov rcx, qword [0x14022ab90]
call fcn.14004f954
nop
lea rcx, [rbp + 0x30]
call fcn.14003c3e4
nop
jmp 0x14003d253
lea rdx, [0x1401842d8]
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d3e5
mov rax, qword [0x14022a9e0]
mov dword [rax + 0x8a8], 0x521
jmp 0x14003d460
lea rdx, str._max
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d40d
mov rax, qword [0x14022a9e0]
mov dword [rax + 0x8a8], 0x520
jmp 0x14003d460
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._normal
lea rdx, str._nor
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
je 0x14003d47e
mov rax, qword [0x14022a9e0]
mov dword [rax + 0x8a8], 0x51f
mov byte [rax + 0x8b4], r14b
cmp dword [rax + 0x8b0], ebx
je 0x14003d25d
mov dword [rax + 0x8b0], ebx
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, str._StartTSA
lea r8, str._MinTSA
lea rdx, str._min
lea rcx, [rsp + 0x78]
call fcn.140118d90
lea rcx, [rsp + 0x78]
test al, al
je 0x14003d51e
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x3ea0], r14b
lea rdx, str._min
call fcn.14011863c
test al, al
jne 0x14003d25d
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x3ea1], r14b
lea rdx, str._MinTSA
lea rcx, [rsp + 0x78]
call fcn.14011863c
mov cl, al
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x3ea2], cl
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._tray
lea rdx, str._tsa
call fcn.140118d90
test al, al
je 0x14003d56e
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x3ea3], r14b
jmp 0x14003d25d
lea rdx, str._detached
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d5b7
mov rax, qword [0x14022a9e0]
mov dword [rax + 0x7c4], ebx
mov byte [r13 + 0x578], r14b
mov byte [r13 + 0x584], r14b
cmp dword [r13 + 0x580], r14d
je 0x14003d25d
mov dword [r13 + 0x580], r14d
jmp 0x14003d25d
lea rdx, str._NoAutoClose
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d5f3
mov byte [r13 + 0x588], r14b
mov byte [r13 + 0x594], r14b
cmp dword [r13 + 0x590], r14d
je 0x14003d25d
mov dword [r13 + 0x590], r14d
jmp 0x14003d25d
lea rdx, str._NoAutoEnvReload
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d62f
mov byte [r13 + 0x598], r14b
mov byte [r13 + 0x5a4], r14b
cmp dword [r13 + 0x5a0], r14d
je 0x14003d25d
mov dword [r13 + 0x5a0], r14d
jmp 0x14003d25d
lea rdx, str._here
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d665
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x7c8], r14b
xor edx, edx
mov rcx, qword [0x14022a9e0]
call fcn.140022924
jmp 0x14003d25d
lea rdx, str._update
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d6a8
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x908], r14b
mov byte [rax + 0x914], r14b
cmp dword [rax + 0x910], r14d
je 0x14003d25d
mov dword [rax + 0x910], r14d
jmp 0x14003d25d
lea rdx, str._NoUpdate
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d6eb
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x8f8], r14b
mov byte [rax + 0x904], r14b
cmp dword [rax + 0x900], r14d
je 0x14003d25d
mov dword [rax + 0x900], r14d
jmp 0x14003d25d
lea rdx, str._NoHooksWarn
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d72e
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x8e8], r14b
mov byte [rax + 0x8f4], r14b
cmp dword [rax + 0x8f0], r14d
je 0x14003d25d
mov dword [rax + 0x8f0], r14d
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, str._NoKeybHooks
mov qword [rsp + 0x20], rax
lea r9, str._NoKeybHook
lea r8, str._NoKeyHooks
lea rdx, str._NoKeyHook
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
je 0x14003d78e
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x3ea4], r14b
jmp 0x14003d25d
lea rdx, str._NoCloseConfirm
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d7b6
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x3ea9], r14b
jmp 0x14003d25d
lea rdx, str._NoMacro
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d7de
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x3ea5], r14b
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._NoHotkeys
lea rdx, str._NoHotkey
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
je 0x14003d833
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x3ea6], r14b
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._NoDefTerm
lea rdx, str._NoDefTrm
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
je 0x14003d888
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x3ea7], r14b
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._NoRegFonts
lea rdx, str._NoRegFont
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
je 0x14003d8dd
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x3ea8], r14b
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x140184550]
lea rdx, str._inside
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
je 0x14003d97a
mov bl, dil
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x7c8], r14b
xor edx, edx
mov rcx, qword [0x14022a9e0]
call fcn.140022924
lea rdx, [0x140184550]
lea rcx, [rsp + 0x78]
call fcn.14011863c
xor ecx, ecx
test al, al
je 0x14003d961
mov bl, r14b
mov rdi, qword [rsp + 0x78]
add rdi, 0x10
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rdi
mov dl, bl
call fcn.1400618c0
xor edi, edi
jmp 0x14003d258
lea rdx, str._InsidePID
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d9e6
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14003f035
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rcx, rax
mov r8d, 0xa
lea rdx, [rbp + 0x78]
call fcn.1401358a4
test eax, eax
je 0x14003d25d
mov qword [rsp + 0x20], rdi
mov r9d, eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400618c0
jmp 0x14003d25d
lea rdx, str._InsideWnd
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003da9e
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14003f035
mov rcx, qword [rbp - 0x50]
movzx edx, word [rcx]
mov eax, 0x30
cmp dx, ax
jne 0x14003da43
movzx eax, word [rcx + 2]
sub ax, 0x58
mov edx, 0xffdf
test dx, ax
jne 0x14003da59
add rcx, 4
jmp 0x14003da59
lea rax, [rcx + 2]
sub dx, 0x58
mov r8d, 0xffdf
test r8w, dx
cmove rcx, rax
mov r8d, 0x10
lea rdx, [rbp + 0x80]
call fcn.1401358d0
mov ebx, eax
test eax, eax
je 0x14003d258
mov ecx, ebx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14003d258
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400618c0
jmp 0x14003d258
lea rdx, [0x140180278]
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003db43
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14003f035
mov rax, qword [0x14022a9e0]
cmp byte [rax + 0x864], dil
jne 0x14003d25d
lea rcx, [rbp - 0x50]
call fcn.14011513c
test al, al
jne 0x14003d25d
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x858], r14b
mov byte [rax + 0x864], r14b
cmp dword [rax + 0x860], r14d
je 0x14003db1c
mov dword [rax + 0x860], r14d
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rcx, rax
call fcn.14011ad0c
mov rcx, rax
mov rax, qword [0x14022a9e0]
mov qword [rax + 0x1590], rcx
jmp 0x14003d25d
lea rdx, [0x1401845a8]
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003dc09
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14003f035
lea rcx, [rbp - 0x50]
call fcn.14011513c
test al, al
jne 0x14003d25d
lea rcx, [rbp - 0x18]
call fcn.140114c40
nop
mov ebx, 0x25
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rcx, rax
movzx edx, bx
call fcn.14012cc40
test rax, rax
je 0x14003dbe2
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rcx, rax
call fcn.14011ad0c
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x18]
call fcn.140114cd0
mov rcx, rax
call fcn.140114d88
test al, al
lea rcx, [rbp - 0x18]
jne 0x14003dbe6
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rdx, rax
mov rcx, qword [0x14022a9e0]
call fcn.140022924
nop
lea rcx, [rbp - 0x18]
call fcn.140114ca4
jmp 0x14003d258
lea rdx, str._UpdateJumpList
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003dc31
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x15b0], r14b
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, str._log4
mov qword [rsp + 0x30], rax
lea rax, str._log3
mov qword [rsp + 0x28], rax
lea rax, str._log2
mov qword [rsp + 0x20], rax
lea r9, str._log1
lea r8, str._log0
lea rdx, [0x140184628]
lea rcx, [rsp + 0x78]
call fcn.140118d90
mov qword [rsp + 0x50], rdi
xor r9d, r9d
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
test al, al
je 0x14003dd3d
lea r8, str._log0
lea rdx, [0x140184628]
call fcn.140118d90
test al, al
je 0x14003dcf7
mov rax, qword [0x14022a9e0]
mov dword [rax + 0xa40], r14d
mov byte [rax + 0xa4c], r14b
cmp dword [rax + 0xa48], ebx
je 0x14003dd2c
mov dword [rax + 0xa48], ebx
jmp 0x14003dd2c
lea rcx, [rsp + 0x78]
call fcn.140054ee8
mov cl, byte [rax + 8]
sub cl, 0x30
movzx eax, cl
mov rcx, qword [0x14022a9e0]
mov dword [rcx + 0xa40], eax
mov byte [rcx + 0xa4c], r14b
cmp dword [rcx + 0xa48], ebx
je 0x14003dd2c
mov dword [rcx + 0xa48], ebx
mov rcx, qword [0x14022a9e0]
call fcn.140011028
jmp 0x14003d25d
lea r8, str._Reuse
lea rdx, str._Single
call fcn.140118d90
lea rcx, [rsp + 0x78]
test al, al
je 0x14003dd83
call fcn.140054ee8
mov rdx, rax
xor r8d, r8d
mov rcx, qword [0x14022a9e0]
call fcn.14000e848
mov rax, qword [0x14022ab58]
mov dword [rax + 0x11b34], r14d
jmp 0x14003d25d
lea rdx, str._NoSingle
call fcn.14011863c
lea rcx, [rsp + 0x78]
test al, al
je 0x14003ddbb
call fcn.140054ee8
mov rdx, rax
xor r8d, r8d
mov rcx, qword [0x14022a9e0]
call fcn.14000e848
mov rax, qword [0x14022ab58]
jmp 0x14003ded6
lea rdx, str._DesktopMode
call fcn.14011863c
test al, al
je 0x14003ddf9
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x968], r14b
mov byte [rax + 0x974], r14b
cmp dword [rax + 0x970], r14d
je 0x14003d25d
mov dword [rax + 0x970], r14d
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, str._NoQuake
lea r8, str._QuakeAuto
lea rdx, str._Quake
lea rcx, [rsp + 0x78]
call fcn.140118d90
lea rcx, [rsp + 0x78]
test al, al
je 0x14003dee1
lea rdx, str._Quake
call fcn.14011863c
test al, al
je 0x14003de6f
mov rax, qword [0x14022a9e0]
mov dword [rax + 0x948], r14d
mov byte [rax + 0x954], r14b
jmp 0x14003de98
lea rdx, str._QuakeAuto
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x954], r14b
je 0x14003deaf
mov dword [rax + 0x948], ebx
cmp dword [rax + 0x950], ebx
je 0x14003d25d
mov dword [rax + 0x950], ebx
jmp 0x14003d25d
mov dword [rax + 0x948], edi
cmp dword [rax + 0x950], ebx
je 0x14003dec3
mov dword [rax + 0x950], ebx
mov rax, qword [0x14022ab58]
cmp dword [rax + 0x11b34], edi
jne 0x14003d25d
mov dword [rax + 0x11b34], ebx
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._Frame
lea rdx, str._FrameWidth
call fcn.140118d90
test al, al
je 0x14003df77
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14003f035
mov rax, qword [0x14022a9e0]
cmp byte [rax + 0x964], dil
jne 0x14003d25d
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rcx, qword [0x14022a9e0]
add rcx, 0x958
mov rdx, rax
mov r8d, 0xa
call fcn.14003f678
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._ShowHideTSA
lea rdx, str._ShowHide
lea rcx, [rsp + 0x78]
call fcn.140118d90
lea rcx, [rsp + 0x78]
test al, al
je 0x14003dff0
mov rax, qword [0x14022ab58]
mov dword [rax + 0x11b34], r14d
lea rdx, str._ShowHide
call fcn.14011863c
neg al
sbb ecx, ecx
add ecx, ebx
mov rax, qword [0x14022ab58]
mov dword [rax + 0x11b38], ecx
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, str._Basic
lea r8, str._ResetDefault
lea rdx, str._Reset
call fcn.140118d90
test al, al
je 0x14003e0bc
mov rax, qword [0x14022a9e0]
mov byte [rax + 0xa30], r14b
mov byte [rax + 0xa3c], r14b
cmp dword [rax + 0xa38], r14d
je 0x14003e05a
mov dword [rax + 0xa38], r14d
lea rdx, str._ResetDefault
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e082
mov rax, qword [0x14022ab58]
mov byte [rax + 0x11b2f], r14b
jmp 0x14003d25d
lea rdx, str._Basic
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003d25d
mov rax, qword [0x14022ab58]
mov byte [rax + 0x11b2f], r14b
mov rax, qword [0x14022ab58]
mov byte [rax + 0x11b2e], r14b
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._DontCascade
lea rdx, str._NoCascade
lea rcx, [rsp + 0x78]
call fcn.140118d90
lea rcx, [rsp + 0x78]
test al, al
je 0x14003e12d
call fcn.140054ee8
mov rdx, rax
xor r8d, r8d
mov rcx, qword [0x14022a9e0]
call fcn.14000e848
mov rax, qword [0x14022ab58]
mov byte [rax + 0x11b30], r14b
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, str._WndHeight
mov qword [rsp + 0x30], rax
lea rax, str._WndH
mov qword [rsp + 0x28], rax
lea rax, str._WndWidth
mov qword [rsp + 0x20], rax
lea r9, str._WndW
lea r8, str._WndY
lea rdx, str._WndX
call fcn.140118d90
lea rcx, [rsp + 0x78]
test al, al
je 0x14003e27a
call fcn.140054ee8
movzx ecx, word [rax + 8]
mov word [rsp + 0x70], cx
mov edx, r14d
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
mov qword [rbp + 0x10], rdi
mov esi, 4
mov dword [rbp + 0x18], esi
mov byte [rbp + 0x1c], dil
mov byte [rsp + 0x20], dil
lea r9d, [rsi + 0x1c]
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.14003c52c
test al, al
je 0x14003e9f3
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x978], r14b
movzx ecx, word [rsp + 0x70]
lea eax, [rcx - 0x58]
cmp ax, r14w
ja 0x14003e209
mov rax, qword [0x14022ab58]
mov byte [rax + 0x11b30], r14b
movzx ecx, word [rsp + 0x70]
movzx ecx, cx
sub ecx, 0x48
je 0x14003e250
sub ecx, 0xf
je 0x14003e240
sub ecx, 1
je 0x14003e230
cmp ecx, 1
jne 0x14003e26b
mov rcx, qword [0x14022a9e0]
add rcx, 0x990
jmp 0x14003e25e
mov rcx, qword [0x14022a9e0]
add rcx, 0x980
jmp 0x14003e25e
mov rcx, qword [0x14022a9e0]
add rcx, 0x9a0
jmp 0x14003e25e
mov rcx, qword [0x14022a9e0]
add rcx, 0x9b0
mov r8d, esi
mov rdx, qword [rbp + 0x10]
call fcn.14003f6b0
nop
lea rcx, [rbp + 0x10]
call fcn.14003c3e4
nop
jmp 0x14003e87a
lea rdx, str._Monitor
call fcn.14011863c
test al, al
je 0x14003e323
mov qword [rbp - 0x28], rdi
mov dword [rbp - 0x20], 4
mov byte [rbp - 0x1c], dil
mov byte [rsp + 0x20], dil
mov r9d, 0x40
lea r8, [rbp - 0x28]
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.14003c52c
test al, al
je 0x14003ea02
mov rcx, qword [rbp - 0x28]
call fcn.140121984
mov rcx, rax
mov rax, qword [0x14022a9e0]
mov qword [rax + 0x9d0], rcx
test rcx, rcx
je 0x14003e314
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x9dc], r14b
mov rax, qword [0x14022a9e0]
mov dword [rax + 0x9d8], ebx
mov rax, qword [0x14022a9e0]
mov rcx, qword [rax + 0x9d0]
mov rax, qword [0x14022a9d0]
mov qword [rax + 0x70], rcx
lea rcx, [rbp - 0x28]
call fcn.14003c3e4
nop
jmp 0x14003e87a
lea rdx, str._Theme
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e3a6
test rsi, rsi
je 0x14003e381
movzx eax, word [rsi]
sub ax, 0x2d
mov ecx, 0xfffd
test cx, ax
je 0x14003e381
mov r8, qword [0x14022a9e0]
add r8, 0x9c0
mov byte [rsp + 0x20], dil
mov r9d, 0x80
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.14003c52c
mov rsi, qword [rsp + 0x68]
test al, al
jne 0x14003d25d
mov rcx, qword [0x14022a9e0]
add rcx, 0x9c0
mov r8d, 4
lea rdx, str.DarkMode_Explorer
call fcn.14003f6b0
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._BufferHeight
lea rdx, str._Buffer
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
je 0x14003e4f4
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14003f035
mov rax, qword [0x14022a9e0]
cmp byte [rax + 0x884], dil
jne 0x14003d25d
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rdx, rax
mov rcx, qword [0x14022a9e0]
add rcx, 0x878
mov r8d, 0xa
call fcn.14003f678
mov rcx, qword [0x14022a9e0]
cmp byte [rcx + 0x884], dil
je 0x14003e483
cmp dword [rcx + 0x880], ebx
jne 0x14003e483
cmp dword [rcx + 0x878], edi
jge 0x14003e483
mov eax, dword [rcx + 0x878]
neg eax
mov dword [rcx + 0x878], eax
mov byte [rcx + 0x884], r14b
cmp dword [rcx + 0x880], ebx
je 0x14003e483
mov dword [rcx + 0x880], ebx
mov rax, qword [0x14022a9e0]
cmp byte [rax + 0x884], dil
je 0x14003e4e8
cmp dword [rax + 0x880], ebx
jne 0x14003e4e8
cmp dword [rax + 0x878], 0x12c
jl 0x14003e4e8
cmp dword [rax + 0x880], ebx
jne 0x14003d25d
mov ecx, 0x7ffe
cmp dword [rax + 0x878], ecx
jle 0x14003d25d
mov dword [rax + 0x878], ecx
mov byte [rax + 0x884], r14b
cmp dword [rax + 0x880], ebx
je 0x14003d25d
mov dword [rax + 0x880], ebx
jmp 0x14003d25d
mov dword [rax + 0x878], 0x12c
jmp 0x14003e4ca
lea rdx, str._Config
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e527
mov r8, qword [0x14022a9e0]
add r8, 0x888
mov byte [rsp + 0x20], dil
mov r9d, 0x7f
jmp 0x14003e6ef
lea rdx, str._Palette
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e55a
mov r8, qword [0x14022a9e0]
add r8, 0x898
mov byte [rsp + 0x20], dil
mov r9d, 0x104
jmp 0x14003e6ef
lea rdx, str._LoadRegistry
lea rcx, [rsp + 0x78]
call fcn.14011863c
lea rcx, [rsp + 0x78]
test al, al
je 0x14003e5b9
call fcn.140054ee8
mov rdx, rax
xor r8d, r8d
mov rcx, qword [0x14022a9e0]
call fcn.14000e848
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x8b8], r14b
mov byte [rax + 0x8c4], r14b
cmp dword [rax + 0x8c0], r14d
je 0x14003d25d
mov dword [rax + 0x8c0], r14d
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._LoadXmlFile
lea rdx, str._LoadCfgFile
call fcn.140118d90
test al, al
je 0x14003e60f
mov r8, qword [0x14022a9e0]
add r8, 0x8c8
mov r9d, 0x104
jmp 0x14003e6ea
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str._SaveXmlFile
lea rdx, str._SaveCfgFile
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
je 0x14003e661
mov r8, qword [0x14022a9e0]
add r8, 0x8d8
jmp 0x14003e604
lea rdx, str._GuiMacro
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e691
mov r8, qword [0x14022a9e0]
add r8, 0x938
mov byte [rsp + 0x20], dil
mov r9d, 0x8000
jmp 0x14003e6ef
lea rdx, str._UpdateSrcSet
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e6c1
mov r8, qword [0x14022a9e0]
add r8, 0x918
mov byte [rsp + 0x20], dil
mov r9d, 0x410
jmp 0x14003e6ef
lea rdx, str._AnsiLog
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e709
mov r8, qword [0x14022a9e0]
add r8, 0x928
mov r9d, 0xdc
mov byte [rsp + 0x20], r14b
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.14003c52c
test al, al
je 0x14003d29f
jmp 0x14003e87a
lea rdx, str._SetDefTerm
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e74c
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x9e0], r14b
mov byte [rax + 0x9ec], r14b
cmp dword [rax + 0x9e8], r14d
je 0x14003d25d
mov dword [rax + 0x9e8], r14d
jmp 0x14003d25d
lea rdx, str._ZoneId
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e78f
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x9f0], r14b
mov byte [rax + 0x9fc], r14b
cmp dword [rax + 0x9f8], r14d
je 0x14003d25d
mov dword [rax + 0x9f8], r14d
jmp 0x14003d25d
lea rdx, [0x1401849d8]
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e7d2
mov rax, qword [0x14022a9e0]
mov byte [rax + 0xa00], r14b
mov byte [rax + 0xa0c], r14b
cmp dword [rax + 0xa08], r14d
je 0x14003d25d
mov dword [rax + 0xa08], r14d
jmp 0x14003d25d
lea rdx, str._QuitOnClose
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e7fa
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x7c9], r14b
jmp 0x14003d25d
lea rdx, str._Title
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e884
mov qword [rbp - 8], rdi
mov dword [rbp], 4
mov byte [rbp + 4], dil
mov byte [rsp + 0x20], dil
mov r9d, 0x7f
lea r8, [rbp - 8]
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.14003c52c
test al, al
je 0x14003ea11
cmp byte [rbp + 4], dil
je 0x14003e860
mov eax, dword [rbp]
add eax, 0xfffffffc
cmp eax, ebx
ja 0x14003e860
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x14003e860
cmp word [rdx], di
jne 0x14003e863
mov rdx, rdi
mov rcx, qword [0x14022a9e0]
call fcn.140021ba0
nop
lea rcx, [rbp - 8]
call fcn.14003c3e4
nop
mov rsi, qword [rsp + 0x68]
jmp 0x14003d25d
lea rdx, str._Settings
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e8ac
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x7ca], r14b
jmp 0x14003d25d
lea rdx, str._FindBugMode
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003e8d4
mov rax, qword [0x14022a9e0]
mov byte [rax + 0x15b1], r14b
jmp 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, str._debugi
lea r8, str._debugw
lea rdx, str._debug
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
jne 0x14003d25d
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, str._help
lea r8, [0x140184a5c]
lea rdx, [0x140184a64]
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
je 0x14003ea20
mov rcx, qword [0x14022b158]
test rcx, rcx
je 0x14003e97b
xor edx, edx
call fcn.140063918
xor ecx, ecx
call fcn.140001694
mov dword [r15], r12d
jmp 0x14003d29f
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rsi, rax
test rax, rax
je 0x14003f035
mov rax, qword [0x14022a9e0]
cmp byte [rax + 0x874], dil
jne 0x14003d25d
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rcx, qword [0x14022a9e0]
add rcx, 0x868
jmp 0x14003df64
lea rcx, [rbp + 0x20]
call fcn.14003c3e4
nop
jmp 0x14003d29f
lea rcx, [rbp + 0x30]
call fcn.14003c3e4
nop
jmp 0x14003d29f
lea rcx, [rbp + 0x10]
call fcn.14003c3e4
nop
jmp 0x14003d29f
lea rcx, [rbp - 0x28]
call fcn.14003c3e4
nop
jmp 0x14003d29f
lea rcx, [rbp - 8]
call fcn.14003c3e4
nop
jmp 0x14003d29f
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rbx, [0x140184a70]
mov qword [rsp + 0x20], rbx
lea r9, [0x140180288]
lea r8, [0x140184a88]
lea rdx, [0x140180298]
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
je 0x14003f21a
mov rcx, qword [r13 + 0x308]
test rcx, rcx
je 0x14003ea8c
mov rax, qword [rbp + 8]
sub rax, qword [rbp - 0x60]
sar rax, 1
mov word [rcx + rax*2], di
mov rcx, rsi
call fcn.140118f08
mov rdx, rax
lea rcx, [r13 + 0x328]
mov r8, r12
call fcn.140115190
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
lea rdx, [0x140184a88]
lea rcx, [rsp + 0x78]
call fcn.140118d90
mov byte [r13 + 0x338], al
jmp 0x14003d292
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rbx, rax
test rax, rax
je 0x14003eb47
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x140180288]
lea rdx, [0x140180298]
lea rcx, [rbp - 0x50]
call fcn.140118d90
test al, al
mov rdx, rbx
jne 0x14003eb4a
mov rdx, rsi
lea rdi, [r13 + 0x328]
mov r8, r12
mov rcx, rdi
call fcn.140115190
mov rcx, rdi
call fcn.14011513c
xor ebx, ebx
test al, al
je 0x14003ebdb
lea rcx, [rsp + 0x78]
call fcn.140054ee8
mov r8, rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, str._exists__command_line_is_empty
lea rdx, str.Invalid_command_line._
lea rcx, [rbp - 0x18]
call fcn.140114ba8
nop
lea rcx, [rbp - 0x18]
call fcn.140054ee8
mov rcx, rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
call fcn.140113304
nop
lea rcx, [rbp - 0x18]
call fcn.140114ca4
jmp 0x14003d29f
mov dword [rbp + 0x90], 0x68
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rbp + 0x98]
call fcn.14012d4b0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
mov dword [rbp + 0xcc], r14d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [0x140183ff0]
lea rdx, str._demote
lea rcx, [rsp + 0x78]
call fcn.140118d90
test al, al
mov word [rbp + 0xd0], r14w
jne 0x14003ec5c
mov word [rbp + 0xd0], bx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x140]
call fcn.14012d4b0
lea rdx, [rbp + 0x140]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x70], ebx
mov sil, bl
lea rcx, [rsp + 0x78]
call fcn.140054ee8
mov r9, rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rax, [0x140175e48]
mov qword [rsp + 0x30], rax
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
lea rax, [0x140184090]
mov qword [rsp + 0x20], rax
lea r8, [0x140184098]
lea rdx, str.Starting_process
lea rcx, [rbp - 0x18]
call fcn.140114ba8
nop
lea rcx, [rbp - 0x18]
call fcn.140054ee8
mov rcx, rax
mov r8b, r14b
mov dl, r14b
call fcn.1400296e4
nop
lea rcx, [rbp - 0x18]
call fcn.140114ca4
lea rdx, str._demote
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003ed61
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x20
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r13 + 0x328]
call fcn.1400406d8
jmp 0x14003edd5
lea rdx, str._system:
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003eddf
mov rcx, qword [rsp + 0x78]
add rcx, 0x10
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401358d0
mov qword [rsp + 0x50], rbx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r13 + 0x328]
mov ecx, eax
call fcn.140041018
mov ebx, eax
xor r13d, r13d
jmp 0x14003eec0
lea rdx, str._interactive:
lea rcx, [rsp + 0x78]
call fcn.14011863c
test al, al
je 0x14003ee64
mov rcx, qword [rsp + 0x78]
add rcx, 0x1a
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401358d0
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [r13 + 0x328]
xor edx, edx
mov ecx, eax
call fcn.140040904
mov ebx, eax
xor r13d, r13d
jmp 0x14003eebd
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r13 + 0x328]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
xor r13d, r13d
test eax, eax
je 0x14003eeb3
mov eax, r13d
jmp 0x14003eeb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov sil, r14b
lea rcx, [rbp - 0x28]
call fcn.140114c40
nop
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rbp + 0x100]
call fcn.14012d4b0
test ebx, ebx
je 0x14003ef07
mov rax, qword [rbp + 0x50]
test eax, eax
je 0x14003eefe
mov r8d, eax
lea rdx, str.__PID_u
lea rcx, [rbp + 0x100]
call fcn.1400011a0
lea rcx, str.Process_was_created_successfully
jmp 0x14003ef26
mov r8d, dword [rsp + 0x70]
lea rdx, str.__ErrorCode_u
lea rcx, [rbp + 0x100]
call fcn.1400011a0
lea rcx, str.Failed_to_start_process
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x100]
call fcn.1401146e0
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x28]
call fcn.140114cd0
lea rcx, [rbp - 0x28]
call fcn.140054ee8
mov rcx, rax
mov r8b, r14b
mov dl, r14b
call fcn.1400296e4
nop
lea rcx, [rbp - 0x28]
call fcn.140114ca4
cmp dword [rsp + 0x70], r13d
je 0x14003efa9
mov rcx, rdi
call fcn.140054ee8
mov rcx, rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x70]
call fcn.140113304
test sil, sil
je 0x14003efcb
mov r8b, r14b
mov dl, r14b
lea rcx, str.Sleeping_for_5_seconds
call fcn.1400296e4
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x14003efd2
mov dword [r15], r13d
mov rcx, qword [rbp + 0x40]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003efef
mov qword [rbp + 0x40], r13
cmp rcx, r12
je 0x14003efef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x48]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003d29f
mov qword [rbp + 0x48], r13
cmp rcx, r12
je 0x14003d29f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003d29f
mov edi, r14d
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.1401188b8
mov rbx, rax
xor esi, esi
test rax, rax
jne 0x14003f041
mov dword [r15], 0x65
jmp 0x14003d29f
xor r8d, r8d
lea rdx, [0x140183f80]
lea rcx, [rbp - 0x50]
call fcn.140114f64
test eax, eax
jne 0x14003f05c
mov edi, esi
jmp 0x14003f0ad
xor r8d, r8d
lea rdx, [0x140183f84]
lea rcx, [rbp - 0x50]
call fcn.140114f64
test eax, eax
jne 0x14003f035
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1401188b8
mov rbx, rax
test rax, rax
je 0x14003f035
lea rcx, [rbp - 0x50]
call fcn.140054ee8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003f20e
test al, 0x10
jne 0x14003f20e
mov qword [rbp - 0x60], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCommand_Processor
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14003f0ff
mov dword [r15], 0x67
jmp 0x14003d29f
test edi, edi
je 0x14003f1d8
lea rcx, [rbp - 0x50]
call fcn.1401150e8
mov rsi, rax
xor ecx, ecx
mov edi, ecx
cmp word [rbx], cx
je 0x14003f12e
mov rdi, rbx
mov rax, r12
inc rax
cmp word [rbx + rax*2], cx
jne 0x14003f122
add rsi, rax
mov edx, 2
lea rcx, [rsi + 0x10]
call fcn.140113de8
mov rbx, rax
lea rax, [0x140179218]
lea rdx, [0x1401759d0]
mov rcx, rdx
test rdi, rdi
cmovne rcx, rax
mov rax, rdx
cmovne rax, rdi
lea r8, [0x140183f88]
cmovne rdx, r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov r9, qword [rbp - 0x50]
lea r8, str.__s__s_s_s
lea rdx, [rsi + 0x10]
mov rcx, rbx
call fcn.1401145a0
xor edi, edi
inc r12
cmp word [rbx + r12*2], di
jne 0x14003f191
lea eax, [r12*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r14d
xor r8d, r8d
lea rdx, [0x14017f6b8]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov edi, 0x64
cmove edi, r14d
mov rcx, rbx
call fcn.140113e18
jmp 0x14003f1f4
lea rdx, [0x14017f6b8]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, 0x64
test eax, eax
cmove edi, r14d
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r13
call fcn.14003f4e8
mov dword [r15], edi
jmp 0x14003d29f
mov dword [r15], 0x66
jmp 0x14003d29f
mov r15, qword [rbp + 8]
mov rax, r15
test rax, rax
je 0x14003d292
mov edx, r14d
mov rcx, qword [0x14022ab50]
call fcn.14007f158
lea r13, str._r_n_r_n
test eax, eax
je 0x14003f2a5
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
mov r9, r15
lea r8, [0x140184aa0]
lea rdx, [0x1401759f4]
lea rcx, [rbp - 0x28]
call fcn.140114ba8
nop
lea rcx, [rbp - 0x28]
call fcn.140054ee8
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x14022a9e0]
call fcn.1400157d0
nop
lea rcx, [rbp - 0x28]
call fcn.140114ca4
lea rcx, [rbp - 0x18]
call fcn.140114c40
nop
movzx eax, word [r15]
sub ax, 0x2d
mov ecx, 0xfffd
test cx, ax
je 0x14003f2c6
mov rbx, r15
jmp 0x14003f2da
lea rbx, [r15 + 2]
movzx eax, word [rbx]
sub ax, 0x2d
test cx, ax
jne 0x14003f2da
lea rbx, [r15 + 4]
mov esi, 0xb
mov r8d, esi
lea rdx, str.new_console
mov rcx, rbx
call fcn.140113fbc
test eax, eax
je 0x14003f30b
mov r8d, esi
lea rdx, str.cur_console
mov rcx, rbx
call fcn.140113fbc
test eax, eax
jne 0x14003f350
xor edx, edx
lea ecx, [rdx + 0x41]
call fcn.140064138
mov rdx, rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
call fcn.1401146e0
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x18]
call fcn.140114cd0
xor edx, edx
lea ecx, [rdx + 0x40]
call fcn.140064138
mov rsi, rax
xor edx, edx
lea ecx, [rdx + 0x3f]
call fcn.140064138
mov rbx, rax
lea rcx, [rbp - 0x18]
call fcn.140054ee8
mov rdi, rax
xor edx, edx
lea ecx, [rdx + 0x3e]
call fcn.140064138
mov rdx, rax
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
lea rax, str._r_nhttps:__conemu.github.io_en_ConEmuArgs.html_r_n_r_n
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
mov r9, r15
mov r8, r13
lea rcx, [rbp - 8]
call fcn.140114ba8
nop
lea rcx, [rbp - 8]
call fcn.140054ee8
mov rcx, rax
mov byte [rsp + 0x20], r14b
mov r9, r12
xor r8d, r8d
lea edx, [r8 + 0x40]
call fcn.1400297d8
nop
lea rcx, [rbp - 8]
call fcn.140114ca4
nop
jmp 0x14003ebcd