Function at 0x1400054fe
Capabilities:
Hide graphical window

Disassembly:
push r15
xor rax, rax
push rax
push rax
push rax
sub rsp, 0x28
mov rax, qword [0x140034aa0]
push rax
sub rsp, 8
push rax
mov rdx, qword [0x140034aa0]
push rdx
push rdx
movabs rcx, 0
pop rdx
sub rsp, 0x20
call fcn.140008b70
add rsp, 0x20
mov rdx, qword [0x140034ac0]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140013f00
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.140018090
mov rcx, qword [rsp + 0x28]
call fcn.140013c80
and rax, rax
je 0x1400056c9
mov rax, qword [0x140034aa0]
push rax
sub rsp, 8
push rax
movabs rdx, 4
mov rcx, qword [rsp + 0x40]
pop r8
sub rsp, 0x20
call fcn.140013e50
add rsp, 0x28
add qword [0x140034aa0], 2
movabs rcx, str..TBI
pop rdx
mov qword [0x140034aa0], rdx
add rdx, qword [0x140034ac0]
call fcn.140018360
or rax, rax
je 0x140005668
mov rax, qword [0x140034aa0]
push rax
sub rsp, 8
push rax
movabs rcx, 0
pop rdx
sub rsp, 0x20
call fcn.140008b70
add rsp, 0x28
lea rcx, [0x1400346b0]
pop rdx
call fcn.140018090
mov rcx, qword [0x1400346b0]
call fcn.140014b94
mov r15, rax
and r15, r15
jle 0x140005663
call fcn.140006163
call fcn.1400065c8
mov rax, qword [0x140034aa0]
push rax
sub rsp, 8
push rax
movabs rdx, 1
mov rcx, qword [0x1400346b0]
pop r8
sub rsp, 0x20
call fcn.140013be0
add rsp, 0x28
lea rcx, [0x140034698]
pop rdx
call fcn.140018090
call fcn.140006d38
call fcn.140003127
jmp 0x1400013f1
jmp 0x1400013f1
push qword [rsp + 0x28]
movabs rcx, str._PESETTING
pop rdx
call fcn.140018360
or rax, rax
je 0x1400056a6
mov rcx, qword [0x140034678]
call fcn.140014b94
mov r15, rax
and r15, r15
jle 0x14000569c
call fcn.140001e89
jmp 0x1400056a1
call fcn.140003bda
jmp 0x1400013f1
push qword [rsp + 0x28]
movabs rcx, str._DISPLAYSAVE
pop rdx
call fcn.140018360
or rax, rax
je 0x1400056c9
call fcn.1400062a1
jmp 0x1400013f1
mov rcx, qword [0x140034678]
call fcn.140014b94
mov r15, rax
and r15, r15
jle 0x1400056f3
movabs rdx, 2
mov rcx, qword [0x140034678]
call fcn.140014d34
push qword [0x140034aa0]
sub rsp, 8
mov rcx, qword [0x1400346c8]
push qword [0x140034aa0]
sub rsp, 0x28
call fcn.140018160
add rsp, 0x28
movabs rcx, str.folder.ico
sub rsp, 0x28
call fcn.140018160
add rsp, 0x28
mov rdx, qword [0x140034ac0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140014b94
add rsp, 0x28
pop qword [0x140034aa0]
mov r15, rax
and r15, r15
jle 0x1400057c1
push qword [0x140034aa0]
sub rsp, 8
mov rcx, qword [0x1400346c8]
push qword [0x140034aa0]
sub rsp, 0x28
call fcn.140018160
add rsp, 0x28
movabs rcx, str.Desktop.ini
sub rsp, 0x28
call fcn.140018160
add rsp, 0x28
mov rdx, qword [0x140034ac0]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140014b94
add rsp, 0x28
pop qword [0x140034aa0]
mov r15, rax
cmp r15, 0xffffffffffffffff
jne 0x1400057c1
mov rax, 1
jmp 0x1400057c4
xor rax, rax
and rax, rax
je 0x1400057d5
mov rcx, qword [0x1400346c8]
call fcn.1400026f1
call fcn.140006163
call fcn.1400065c8
mov byte [rsp + 0x30], 0xff
mov rax, 0x4e
push rax
mov rax, 0x1c2
push rax
xor rax, rax
push rax
xor rax, rax
mov rcx, rax
pop rdx
pop r8
pop r9
call fcn.1400074ac
movabs rcx, 0
call fcn.14000b82c
mov qword [0x140034708], rax
call fcn.14000b84c
mov dword [rsp + 0x38], eax
movsxd rax, dword [rsp + 0x38]
push rax
mov r15, 0x333c
cmp r15d, dword [rsp]
jne 0x140005848
add rsp, 0xfffffffffffffff8
jmp 0x1400013f1
mov r15, 0x332d
cmp r15d, dword [rsp]
jne 0x14000586b
sub rsp, 8
sub rsp, 0x20
call fcn.140016088
add rsp, 0x28
jmp 0x140005d7b
mov r15, 0x332c
cmp r15d, dword [rsp]
jne 0x140005d7b
sub rsp, 8
movabs rcx, 1
sub rsp, 0x20
call fcn.14000145d
add rsp, 0x28
mov r15, rax
and r15, r15
jne 0x1400058a4
jmp 0x140005d7b
sub rsp, 8
sub rsp, 0x20
call fcn.1400160a4
add rsp, 0x28
push rax
mov r15, 1
cmp r15, qword [rsp]
jne 0x1400059a8
sub rsp, 8
push 0x39
movabs r9, 0x6e
movabs r8, 0xd
movabs rdx, 0xd
movabs rcx, 1
sub rsp, 0x20
call fcn.14000a848
add rsp, 0x30
movabs rcx, 0x96
sub rsp, 0x20
call fcn.14000b664
add rsp, 0x20
sub rsp, 8
push 0x39
movabs r9, 0x6e
movabs r8, 0xa
movabs rdx, 0xa
movabs rcx, 1
sub rsp, 0x20
call fcn.14000a848
add rsp, 0x30
movabs rdx, 0
mov rcx, qword [0x140034708]
sub rsp, 0x20
call sub.USER32.dll_ShowWindow
add rsp, 0x20
sub rsp, 0x20
call fcn.140002c21
add rsp, 0x20
movabs rdx, 5
mov rcx, qword [0x140034708]
sub rsp, 0x20
call sub.USER32.dll_ShowWindow
add rsp, 0x20
jmp 0x140005d7a
mov r15, 2
cmp r15, qword [rsp]
jne 0x140005bc0
sub rsp, 8
push 0x39
movabs r9, 0x6e
movabs r8, 0xd
movabs rdx, pe_nt_image_headers64
movabs rcx, 2
sub rsp, 0x20
call fcn.14000a848
add rsp, 0x30
movabs rcx, 0x96
sub rsp, 0x20
call fcn.14000b664
add rsp, 0x20
sub rsp, 8
push 0x39
movabs r9, 0x6e
movabs r8, 0xa
movabs rdx, 0x7d
movabs rcx, 2
sub rsp, 0x20
call fcn.14000a848
add rsp, 0x30
movabs rdx, 0
mov rcx, qword [0x140034708]
sub rsp, 0x20
call sub.USER32.dll_ShowWindow
add rsp, 0x20
mov rcx, qword [0x140034698]
push qword [0x140034aa0]
sub rsp, 0x28
call fcn.140018160
add rsp, 0x28
movabs rcx, str.:Backup_
sub rsp, 0x28
call fcn.140018160
add rsp, 0x28
mov rcx, qword [0x1400346e0]
sub rsp, 0x28
call fcn.140018160
add rsp, 0x28
lea rcx, [0x1400346b0]
pop rdx
sub rsp, 0x20
call fcn.140018090
add rsp, 0x20
mov rcx, qword [0x1400346b0]
sub rsp, 0x20
call fcn.140014b94
add rsp, 0x20
mov r15, rax
cmp r15, 0xffffffffffffffff
jne 0x140005b90
push qword [0x140034aa0]
sub rsp, 8
mov rax, 0xfffd
push rax
mov rax, 1
push rax
push qword [0x140034aa0]
movabs rcx, 0x14001e746
sub rsp, 0x28
call fcn.140018160
add rsp, 0x28
mov rcx, qword [0x1400346e0]
sub rsp, 0x28
call fcn.140018160
add rsp, 0x28
movabs rcx, 0x140020140
sub rsp, 0x28
call fcn.140018160
add rsp, 0x28
add qword [0x140034aa0], 2
movabs rax, 0x14001eea0
push rax
movabs rax, 0x14001e23e
push rax
xor rax, rax
push rax
mov rdx, qword [0x140034ac0]
add qword [rsp + 0x18], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14000393b
add rsp, 0x38
pop qword [0x140034aa0]
jmp 0x140005b9d
sub rsp, 0x20
call fcn.140003127
add rsp, 0x20
movabs rdx, 5
mov rcx, qword [0x140034708]
sub rsp, 0x20
call sub.USER32.dll_ShowWindow
add rsp, 0x20
jmp 0x140005d7a
mov r15, 3
cmp r15, qword [rsp]
jne 0x140005cd1
sub rsp, 8
push 0x39
movabs r9, 0x6e
movabs r8, 0xd
movabs rdx, 0xf3
movabs rcx, 3
sub rsp, 0x20
call fcn.14000a848
add rsp, 0x30
movabs rcx, 0x96
sub rsp, 0x20
call fcn.14000b664
add rsp, 0x20
sub rsp, 8
push 0x39
movabs r9, 0x6e
movabs r8, 0xa
movabs rdx, 0xf0
movabs rcx, 3
sub rsp, 0x20
call fcn.14000a848
add rsp, 0x30
movabs rdx, 0
mov rcx, qword [0x140034708]
sub rsp, 0x20
call sub.USER32.dll_ShowWindow
add rsp, 0x20
movabs rax, 0x14001e028
push rax
movabs rax, 0x14001e028
mov rdx, rax
mov rcx, qword [0x140034680]
pop r8
sub rsp, 0x20
call fcn.1400083d8
add rsp, 0x20
movabs rcx, 0xbb8
sub rsp, 0x20
call fcn.14000b664
add rsp, 0x20
jmp 0x1400013f1
mov r15, 4
cmp r15, qword [rsp]
jne 0x140005d7a
sub rsp, 8
push 0x39
movabs r9, 0x6e
movabs r8, 0xd
movabs rdx, 0x166
movabs rcx, 4
sub rsp, 0x20
call fcn.14000a848
add rsp, 0x30
movabs rcx, 0x96
sub rsp, 0x20
call fcn.14000b664
add rsp, 0x20
sub rsp, 8
push 0x39
movabs r9, 0x6e
movabs r8, 0xa
movabs rdx, 0x163
movabs rcx, 4
sub rsp, 0x20
call fcn.14000a848
add rsp, 0x30
jmp 0x1400013f1
pop rax
pop rax
movsx r15, byte [rsp + 0x30]
and r15, r15
jl 0x14000581e
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400182c0
add rsp, 0x28
pop rax
add rsp, 0x40
pop r15
ret