Function at 0x14009bf1e
Capabilities:
Check mutex on windows
Create process on windows
Get session user name
Log keystrokes via polling
Set current directory

Disassembly:
jmp 0x1400bf7b0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x20d8
call fcn.14009be9c
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x6a6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x20f8]
mov rax, qword [0x14023ac40]
xor rax, rbp
mov qword [rbp + 0x2080], rax
mov byte [rbp + 0x2034], 0
call fcn.14009bc80
mov r8, qword [rbp + 0x20c0]
lea rdx, str.StartMenu:_start__s
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
lea rdx, str._startup
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
jne 0x1400bf873
lea rdx, str._autorun
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
je 0x1400bf8cc
mov eax, dword [0x14023ec18]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
cmp eax, 0x602
jge 0x1400bf8cc
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_WaitDllInitThread_void_]
lea rcx, str.AutoStart
call qword [sym.imp.StartMenuDLL.dll_bool___cdecl_DllGetSettingBool_wchar_t_const____ptr64_]
movzx eax, al
test eax, eax
jne 0x1400bf8a8
lea rdx, str.StartMenu:_quit___no_AutoStart
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
xor eax, eax
jmp 0x1400c0766
lea rcx, str.AutoStartDelay
call qword [sym.imp.StartMenuDLL.dll_int___cdecl_DllGetSettingInt_wchar_t_const____ptr64_]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jle 0x1400bf8c7
mov ecx, dword [rbp + 4]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400bf9c0
lea rdx, str._autorun
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
je 0x1400bf9c0
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_WaitDllInitThread_void_]
call fcn.14009e03e
movzx eax, al
test eax, eax
je 0x1400bf972
mov edx, 0xbb9
lea rcx, [rbp + 0x1ef8]
call qword [sym.imp.StartMenuDLL.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_DllLoadStringEx_int_]
mov rcx, rax
call fcn.14009bbd1
mov qword [rbp + 0x2068], rax
mov edx, 0xdf7
lea rcx, [rbp + 0x1f18]
call qword [sym.imp.StartMenuDLL.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_DllLoadStringEx_int_]
mov rcx, rax
call fcn.14009bbd1
mov qword [rbp + 0x2070], rax
xor r9d, r9d
mov r8, qword [rbp + 0x2068]
mov rdx, qword [rbp + 0x2070]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rbp + 0x1f18]
call fcn.14009c69e
lea rcx, [rbp + 0x1ef8]
call fcn.14009c69e
call fcn.14009e6e7
lea rcx, str.AutoStart
call qword [sym.imp.StartMenuDLL.dll_bool___cdecl_DllGetSettingBool_wchar_t_const____ptr64_]
movzx eax, al
test eax, eax
jne 0x1400bf9a1
lea rdx, str.StartMenu:_quit___no_AutoStart
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
xor eax, eax
jmp 0x1400c0766
lea rcx, str.AutoStartDelay
call qword [sym.imp.StartMenuDLL.dll_int___cdecl_DllGetSettingInt_wchar_t_const____ptr64_]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jle 0x1400bf9c0
mov ecx, dword [rbp + 0x24]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._upgrade
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
je 0x1400bfa31
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_WaitDllInitThread_void_]
call fcn.14009e03e
movzx eax, al
test eax, eax
je 0x1400bfa2a
lea rdx, str._silent
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
je 0x1400bfa0b
mov byte [rbp + 0x2064], 1
jmp 0x1400bfa12
mov byte [rbp + 0x2064], 0
movzx eax, byte [rbp + 0x2064]
mov byte [rbp + 0x44], al
movzx ecx, byte [rbp + 0x44]
call fcn.1400a0401
jmp 0x1400c0766
xor eax, eax
jmp 0x1400c0766
lea rdx, str._cmd
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
je 0x1400bfae3
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_WaitDllInitThread_void_]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [rbp + 0x68]
add rax, 0xa
lea r9, [0x1401ebed8]
mov r8d, 0x64
lea rdx, [rbp + 0x90]
mov rcx, rax
call fcn.14009bea1
lea rcx, [rbp + 0x90]
call qword [sym.imp.StartMenuDLL.dll_bool___cdecl_DllExecuteNamedCommand_wchar_t_const____ptr64_]
movzx eax, al
test eax, eax
je 0x1400bfad6
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x178]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400bfad6
lea rcx, [rbp + 0x178]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x178]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400bfa99
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400c0766
mov r8d, 0x104
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor ecx, ecx
mov word [rax], cx
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, str._runas
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
mov qword [rbp + 0x3f8], rax
cmp qword [rbp + 0x3f8], 0
je 0x1400bfca0
mov rax, qword [rbp + 0x3f8]
add rax, 0xe
mov qword [rbp + 0x3f8], rax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rbp + 0x648], 0
lea rcx, [rbp + 0x668]
call fcn.14009ca22
lea rcx, [rbp + 0x688]
call fcn.14009ca22
lea rcx, [rbp + 0x688]
call fcn.14009f461
mov qword [rbp + 0x2068], rax
lea rcx, [rbp + 0x668]
call fcn.14009f461
mov qword [rbp + 0x2070], rax
mov r9, qword [rbp + 0x2068]
xor r8d, r8d
mov rdx, qword [rbp + 0x2070]
mov rcx, qword [rbp + 0x3f8]
call qword [sym.imp.SHELL32.dll_SHEvaluateSystemCommandTemplate]
test eax, eax
jl 0x1400bfbf9
lea rcx, [rbp + 0x688]
call fcn.14009c7c5
mov qword [rbp + 0x648], rax
lea rcx, [rbp + 0x668]
call fcn.14009c7c5
mov r8, rax
mov edx, 0x104
lea rcx, [rbp + 0x420]
call fcn.14009d2bf
jmp 0x1400bfc13
lea rdx, [rbp + 0x420]
mov rcx, qword [rbp + 0x3f8]
call fcn.14009e5d4
mov qword [rbp + 0x648], rax
mov dword [rbp + 0x6b0], 0x70
mov dword [rbp + 0x6b4], 0x4000200
lea rax, [rbp + 0x6b8]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0x420]
mov qword [rbp + 0x6c8], rax
mov rax, qword [rbp + 0x648]
mov qword [rbp + 0x6d0], rax
mov dword [rbp + 0x6e0], 1
lea rcx, [rbp + 0x6b0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov dword [rbp + 0x1f34], 0
lea rcx, [rbp + 0x688]
call fcn.14009caa9
lea rcx, [rbp + 0x668]
call fcn.14009caa9
mov eax, dword [rbp + 0x1f34]
jmp 0x1400c0766
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_WaitDllInitThread_void_]
mov dword [rbp + 0x734], 0xffffffff
lea rdx, str._togglenew
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
je 0x1400bfcd7
mov dword [rbp + 0x734], 0xfffffffe
jmp 0x1400bfd8c
lea rdx, str._toggle
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
je 0x1400bfcfe
mov dword [rbp + 0x734], 0
jmp 0x1400bfd8c
lea rdx, str._open
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
je 0x1400bfd22
mov dword [rbp + 0x734], 2
jmp 0x1400bfd8c
lea rdx, str._settings
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
je 0x1400bfd46
mov dword [rbp + 0x734], 3
jmp 0x1400bfd8c
lea rdx, str._reloadsettings
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
je 0x1400bfd6a
mov dword [rbp + 0x734], ILClone
jmp 0x1400bfd8c
lea rdx, str._exit
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
je 0x1400bfd8c
mov dword [rbp + 0x734], 8
lea rdx, str._xml
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
mov qword [rbp + 0x758], rax
cmp qword [rbp + 0x758], 0
je 0x1400bfe19
mov rax, qword [rbp + 0x758]
add rax, 0xa
lea r9, [0x1401ebed8]
mov r8d, 0x104
lea rdx, [rbp + 0x780]
mov rcx, rax
call fcn.14009bea1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [rbp + 0x780]
call qword [sym.imp.StartMenuDLL.dll_bool___cdecl_DllImportSettingsXml_wchar_t_const____ptr64_]
mov byte [rbp + 0x9a4], al
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, byte [rbp + 0x9a4]
test eax, eax
je 0x1400bfe0f
mov dword [rbp + 0x734], ILClone
jmp 0x1400bfe19
mov eax, 1
jmp 0x1400c0766
lea rdx, str._backup
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
mov qword [rbp + 0x9c8], rax
cmp qword [rbp + 0x9c8], 0
je 0x1400bfeb1
mov rax, qword [rbp + 0x9c8]
add rax, 0x10
lea r9, [0x1401ebed8]
mov r8d, 0x104
lea rdx, [rbp + 0x9f0]
mov rcx, rax
call fcn.14009bea1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [rbp + 0x9f0]
call qword [sym.imp.StartMenuDLL.dll_bool___cdecl_DllExportSettingsXml_wchar_t_const____ptr64_]
mov byte [rbp + 0xc14], al
call qword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, byte [rbp + 0xc14]
test eax, eax
je 0x1400bfe9c
mov dword [rbp + 0x2064], 0
jmp 0x1400bfea6
mov dword [rbp + 0x2064], 1
mov eax, dword [rbp + 0x2064]
jmp 0x1400c0766
lea rdx, str._nohook
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
mov qword [rbp + 0xc38], rax
cmp qword [rbp + 0xc38], 0
jne 0x1400bfee1
mov dword [rbp + 0x2064], 1
jmp 0x1400bfeeb
mov dword [rbp + 0x2064], 0
movzx eax, byte [rbp + 0x2064]
mov byte [rbp + 0xc54], al
cmp qword [rbp + 0xc38], 0
je 0x1400bff68
mov rax, qword [rbp + 0xc38]
add rax, 0xe
mov qword [rbp + 0xc38], rax
mov rax, qword [rbp + 0xc38]
movzx eax, word [rax]
cmp eax, 0x31
jne 0x1400bff30
mov rax, qword [sym.imp.StartMenuDLL.dll_enum__MINIDUMP_TYPE_MiniDumpType]
mov dword [rax], 0
mov rax, qword [rbp + 0xc38]
movzx eax, word [rax]
cmp eax, 0x32
jne 0x1400bff4c
mov rax, qword [sym.imp.StartMenuDLL.dll_enum__MINIDUMP_TYPE_MiniDumpType]
mov dword [rax], 1
mov rax, qword [rbp + 0xc38]
movzx eax, word [rax]
cmp eax, 0x33
jne 0x1400bff68
mov rax, qword [sym.imp.StartMenuDLL.dll_enum__MINIDUMP_TYPE_MiniDumpType]
mov dword [rax], 2
movzx eax, byte [rbp + 0xc54]
test eax, eax
jne 0x1400bff80
mov rcx, qword [sym.imp.StartMenuDLL.dll_long_int___cdecl_TopLevelFilter_struct__EXCEPTION_POINTERS____ptr64_]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rdx, str._testsettings
mov rcx, qword [rbp + 0x20c0]
call fcn.14009bbc2
test rax, rax
jne 0x1400bffa8
mov ecx, ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x1400bffd7
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov cl, 1
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_InitManagers_bool_]
xor edx, edx
mov cl, 1
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_EditSettings_bool__int_]
mov cl, 1
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_CloseManagers_bool_]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x1400c0766
mov dword [rbp + 0xe94], 0x100
lea rdx, [rbp + 0xe94]
lea rcx, [rbp + 0xc80]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rbp + 0xe94], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov qword [rbp + 0xeb8], rax
lea rax, [rbp + 0xe94]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, qword [rbp + 0xeb8]
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
mov eax, dword [rbp + 0xe94]
mov ecx, eax
call fcn.14009e04d
mov qword [rbp + 0xed8], rax
lea rax, [rbp + 0xe94]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0xe94]
mov r8, qword [rbp + 0xed8]
mov edx, 2
mov rcx, qword [rbp + 0xeb8]
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
lea rdx, str.Default
mov rcx, qword [rbp + 0xed8]
call fcn.14009fff6
test eax, eax
jne 0x1400c009b
mov dword [rbp + 0x2064], 1
jmp 0x1400c00a5
mov dword [rbp + 0x2064], 0
movzx eax, byte [rbp + 0x2064]
mov byte [rbp + 0xef4], al
mov rax, qword [rbp + 0xed8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xc80]
lea r8, str.OpenShellMenu.Mutex._s._s
mov edx, 0x400
lea rcx, [rbp + 0xf20]
call fcn.14009f673
mov rcx, qword [rbp + 0xed8]
call fcn.14009cd33
cmp dword [rbp + 0x734], 0xffffffff
jne 0x1400c010d
lea r8, [rbp + 0xf20]
lea rdx, str.StartMenu:_mutex__s
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
xor r9d, r9d
lea r8, str.Progman
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [rbp + 0x1738], rax
cmp qword [rbp + 0x1738], 0
je 0x1400c014d
mov byte [rbp + 0x2034], 1
lea rdx, [rbp + 0x1754]
mov rcx, qword [rbp + 0x1738]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov qword [rbp + 0x1778], 0
movzx eax, byte [rbp + 0xc54]
test eax, eax
je 0x1400c0378
lea r8, [rbp + 0xf20]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbp + 0x1778], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400c019e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400c0378
cmp dword [rbp + 0x734], 0
je 0x1400c01b4
cmp dword [rbp + 0x734], 0xfffffffe
jne 0x1400c02b0
cmp qword [rbp + 0x1738], 0
je 0x1400c02ae
cmp byte [rbp + 0x2034], 0
jne 0x1400c01d7
lea rcx, [0x1401e9220]
call fcn.14009bd1b
mov ecx, dword [rbp + 0x1754]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp byte [rbp + 0x2034], 0
jne 0x1400c01f8
lea rcx, [0x1401e9220]
call fcn.14009bd1b
mov ecx, dword [rbp + 0x1754]
call qword [sym.imp.StartMenuDLL.dll_struct_HWND______ptr64___cdecl_FindTaskBar_unsigned_long_int_]
mov qword [rbp + 0x1798], rax
cmp qword [rbp + 0x1798], 0
je 0x1400c026d
cmp dword [rbp + 0x734], 0xfffffffe
jne 0x1400c022a
mov dword [rbp + 0x2064], 1
jmp 0x1400c0234
mov dword [rbp + 0x2064], 0
movsxd rax, dword [rbp + 0x2064]
mov qword [rbp + 0x2068], rax
lea rcx, str.OpenShellMenu.StartMenuMsg
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor r9d, r9d
mov rcx, qword [rbp + 0x2068]
mov r8, rcx
mov edx, eax
mov rcx, qword [rbp + 0x1798]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400c02ae
cmp dword [rbp + 0x734], 0xfffffffe
jne 0x1400c0282
mov dword [rbp + 0x2064], 0x57534d4b
jmp 0x1400c028c
mov dword [rbp + 0x2064], 0x43534d
movsxd rax, dword [rbp + 0x2064]
mov r9, rax
mov r8d, 0xf130
mov edx, 0x112
mov rcx, qword [rbp + 0x1738]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400c031e
cmp dword [rbp + 0x734], 0xffffffff
je 0x1400c031e
cmp byte [rbp + 0x2034], 0
jne 0x1400c02ce
lea rcx, [0x1401e9220]
call fcn.14009bd1b
mov ecx, dword [rbp + 0x1754]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea rdx, str.StartHookWindow
lea rcx, str.OpenShellMenu.CStartHookWindow
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rbp + 0x17b8], rax
cmp qword [rbp + 0x17b8], 0
je 0x1400c031e
movsxd rax, dword [rbp + 0x734]
xor r9d, r9d
mov r8, rax
mov edx, 0x40a
mov rcx, qword [rbp + 0x17b8]
call qword [sym.imp.USER32.dll_PostMessageW]
cmp dword [rbp + 0x734], 8
jne 0x1400c0354
cmp qword [rbp + 0x1778], 0
je 0x1400c0354
mov edx, 0x7d0
mov rcx, qword [rbp + 0x1778]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400c0354
mov rcx, qword [rbp + 0x1778]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [rbp + 0x734], 0xffffffff
jne 0x1400c0371
lea rdx, str.StartMenu:_exit__mutex_exists_
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
xor eax, eax
jmp 0x1400c0766
cmp dword [rbp + 0x734], 0xffffffff
je 0x1400c03b1
cmp dword [rbp + 0x734], 2
je 0x1400c03b1
cmp dword [rbp + 0x734], 3
je 0x1400c03b1
cmp qword [rbp + 0x1778], 0
je 0x1400c03aa
mov rcx, qword [rbp + 0x1778]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x1400c0766
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
movzx eax, byte [rbp + 0xc54]
test eax, eax
jne 0x1400c03d2
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllUpdateSettings_void_]
mov cl, 1
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_InitManagers_bool_]
lea rcx, [rbp + 0x17e0]
call fcn.1400a0050
lea rax, [rbp + 0x1f58]
mov qword [rbp + 0x1f78], rax
xor edx, edx
mov rcx, qword [rbp + 0x1f78]
call fcn.14009b870
mov rax, qword [rax]
mov qword [rbp + 0x1ff8], rax
lea rax, [rbp + 0x1f98]
mov qword [rbp + 0x1fb8], rax
xor edx, edx
mov rcx, qword [rbp + 0x1fb8]
call fcn.14009f3b7
mov rax, qword [rax]
mov qword [rbp + 0x1fd8], rax
mov qword [rsp + 0x38], 0
mov rax, qword [rbp + 0x1ff8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
lea r9, str.StartHookWindow
mov r8, qword [rbp + 0x1fd8]
xor edx, edx
lea rcx, [rbp + 0x17e0]
call fcn.14009b677
lea rcx, str.TaskbarCreated
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x14023ec1c], eax
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x1848], rax
lea rdx, str.ChangeWindowMessageFilterEx
mov rcx, qword [rbp + 0x1848]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1868], rax
cmp qword [rbp + 0x1868], 0
je 0x1400c05a5
mov rax, qword [rbp + 0x1868]
mov qword [rbp + 0x2068], rax
mov eax, dword [0x14023ec1c]
mov dword [rbp + 0x2070], eax
lea rax, [rbp + 0x17e8]
mov rcx, rax
call fcn.14009ccac
mov qword [rbp + 0x2078], rax
xor r9d, r9d
mov r8d, 1
mov edx, dword [rbp + 0x2070]
mov rcx, qword [rbp + 0x2078]
call qword [rbp + 0x2068]
mov rax, qword [rbp + 0x1868]
mov qword [rbp + 0x2068], rax
lea rax, [rbp + 0x17e8]
mov rcx, rax
call fcn.14009ccac
xor r9d, r9d
mov r8d, 1
mov edx, 0x303
mov rcx, rax
call qword [rbp + 0x2068]
mov rax, qword [rbp + 0x1868]
mov qword [rbp + 0x2068], rax
lea rax, [rbp + 0x17e8]
mov rcx, rax
call fcn.14009ccac
xor r9d, r9d
mov r8d, 1
mov edx, 0x40a
mov rcx, rax
call qword [rbp + 0x2068]
mov rax, qword [rbp + 0x1868]
mov qword [rbp + 0x2068], rax
lea rax, [rbp + 0x17e8]
mov rcx, rax
call fcn.14009ccac
xor r9d, r9d
mov r8d, 1
mov edx, ILClone
mov rcx, rax
call qword [rbp + 0x2068]
jmp 0x1400c05e6
mov edx, 1
mov ecx, dword [0x14023ec1c]
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov edx, 1
mov ecx, 0x303
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov edx, 1
mov ecx, 0x40a
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov edx, 1
mov ecx, ILClone
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
mov qword [rbp + 0x18d8], 0
movzx eax, byte [rbp + 0xc54]
test eax, eax
je 0x1400c062b
movzx eax, byte [rbp + 0xef4]
test eax, eax
je 0x1400c0613
mov dword [rbp + 0x2064], 2
jmp 0x1400c061d
mov dword [rbp + 0x2064], 3
mov eax, dword [rbp + 0x2064]
mov dword [rbp + 0x2068], eax
jmp 0x1400c0635
mov dword [rbp + 0x2068], 0
lea rdx, [rbp + 0x18d8]
mov ecx, dword [rbp + 0x2068]
call fcn.1400bc920
movzx eax, al
test eax, eax
je 0x1400c06fa
movzx eax, byte [rbp + 0xc54]
test eax, eax
je 0x1400c0695
cmp dword [rbp + 0x734], 0
jl 0x1400c0695
lea rax, [rbp + 0x17e8]
mov qword [rbp + 0x2068], rax
movsxd rax, dword [rbp + 0x734]
mov r9d, 2
mov r8, rax
mov edx, 0x40a
mov rcx, qword [rbp + 0x2068]
call fcn.14009eb29
lea rdx, str.StartMenu:_start_message_loop
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
movzx eax, byte [rbp + 0xc54]
test eax, eax
jne 0x1400c06c5
mov rcx, qword [rbp + 0x18d8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400c06fa
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1888]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400c06fa
lea rcx, [rbp + 0x1888]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1888]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400c06a9
lea rdx, str.StartMenu:_end_message_loop
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
lea rcx, [rbp + 0x17e0]
call fcn.14009d300
movzx eax, byte [rbp + 0xc54]
test eax, eax
jne 0x1400c072d
mov cl, 1
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_CloseManagers_bool_]
call qword [sym.imp.ole32.dll_OleUninitialize]
cmp qword [rbp + 0x1778], 0
je 0x1400c074a
mov rcx, qword [rbp + 0x1778]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rbp + 0x2014], 0
lea rcx, [rbp + 0x17e0]
call fcn.14009f38a
mov eax, dword [rbp + 0x2014]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1401e9690]
call fcn.14009f330
mov rax, rdi
mov rcx, qword [rbp + 0x2080]
xor rcx, rbp
call fcn.14009d7b0
lea rsp, [rbp + 0x2098]
pop rdi
pop rbp
ret