Function at 0x140006e60
Capabilities:
Check mutex on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x540
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rsp + 0x530], rax
xor edi, edi
mov rbx, rcx
lea esi, [rdi + 1]
mov byte [rcx], dil
cmp qword [0x1400263e8], rdi
jne 0x140006ed7
lea r8, str.http:__www.microsoft.com_windowsxp_mediacenter_ehtray.exe_singleinstancemutex
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1400263e8], rax
cmp rax, rdi
je 0x14000770c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140009d14
mov ebx, 2
cmp qword [0x140024040], rdi
jne 0x140006efe
lea rcx, str.EHRes.dll
mov r8d, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140024040], rax
cmp byte [0x1400263f8], dil
jne 0x140006f20
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, edi
jl 0x14000770c
mov byte [0x1400263f8], sil
mov ebx, 0x40
lea r15, str.Media_Center_Tray_Applet
lea ebp, [rbx - 0x3d]
lea r12d, [rbx - 0x3a]
cmp di, word [0x1400263fc]
jne 0x140006fa1
lea rcx, [rsp + 0xc8]
mov r8, rbx
xor edx, edx
call fcn.140001ef0
lea rax, [0x1400012f8]
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
mov rax, qword [0x1400263f0]
mov dword [rsp + 0xc0], ebp
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0x100], r15
mov qword [rsp + 0xd8], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
mov word [0x1400263fc], ax
cmp di, ax
je 0x14000770c
cmp di, word [0x140026400]
jne 0x140007015
lea rcx, [rsp + 0x78]
mov r8, rbx
xor edx, edx
call fcn.140001ef0
lea rax, [0x14000e110]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rax, qword [0x1400263f0]
mov dword [rsp + 0x70], ebp
mov qword [rsp + 0x88], rax
lea rax, str.Windows_Media_Center_Log
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x84], 8
call qword [sym.imp.USER32.dll_RegisterClassW]
mov word [0x140026400], ax
cmp di, ax
je 0x14000770c
cmp qword [0x140024068], rdi
jne 0x140007065
mov ecx, 0x50
call fcn.140002220
mov rbx, rax
cmp rax, rdi
je 0x140009d1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x40], rdi
mov dword [rbx + 0x48], edi
mov dword [rbx + 0x4c], edi
jmp 0x140007055
mov qword [0x140024068], rbx
cmp rbx, rdi
je 0x14000770c
cmp qword [section..data], rdi
jne 0x140007087
lea rdx, [section..data]
mov ecx, 5
call fcn.1400085c0
cmp eax, edi
jl 0x14000770c
cmp qword [0x1400240a0], rdi
jne 0x1400070be
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400240a0], rax
cmp rax, rdi
je 0x1400070be
mov rcx, qword [section..data]
mov r8d, ebp
mov rdx, rax
call fcn.1400089f0
cmp byte [0x1400263fa], dil
jne 0x1400070fe
cmp qword [0x1400240a8], rdi
jne 0x1400070fe
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov qword [0x1400240a8], rax
cmp rax, rdi
je 0x1400070fe
mov rcx, qword [section..data]
mov r8d, 4
mov rdx, rax
call fcn.1400089f0
cmp dword [0x140026424], edi
jne 0x140007119
lea rcx, str.Media_Center_Ten_Foot_Navigate
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x140026424], eax
cmp dword [0x140026428], edi
jne 0x140007134
lea rcx, str.IsWMCEShellFullscreen
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x140026428], eax
cmp dword [0x140024038], edi
jne 0x14000714f
lea rcx, str.Media_Center_Input_Ping
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x140024038], eax
cmp dword [0x140024048], edi
jne 0x14000716a
lea rcx, str.Media_Center_Navigate_To_Page
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x140024048], eax
cmp dword [0x14002404c], edi
jne 0x140007185
lea rcx, str.Media_Center_Tray_Optimization
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x14002404c], eax
cmp dword [0x140024050], edi
jne 0x1400071a0
lea rcx, str.Media_Center_Jump_List
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x140024050], eax
mov ebp, 0x32
mov r13d, 0x2000
lea r12d, [rbp - 1]
cmp qword [0x140026430], rdi
jne 0x1400071f5
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, r12d
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, qword [0x140024040]
lea rdx, str.ehtray.icon.recording
mov r8d, esi
mov r9d, eax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [0x140026430], rax
cmp qword [0x140026438], rdi
jne 0x14000723b
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, r12d
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, qword [0x140024040]
lea rdx, str.ehtray.icon.warning
mov r8d, esi
mov r9d, eax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [0x140026438], rax
cmp qword [0x140026440], rdi
jne 0x140007281
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, r12d
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rcx, qword [0x140024040]
lea rdx, str.ehtray.icon.downloading
mov r8d, esi
mov r9d, eax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [0x140026440], rax
cmp qword [0x140026448], rdi
jne 0x1400072a5
mov rcx, qword [0x140024040]
lea rdx, str.ehtray.icon.shutdown
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [0x140026448], rax
mov ebx, 0x64
cmp di, word [0x140026480]
jne 0x1400072cf
mov rcx, qword [0x140024040]
lea r8, [0x140026480]
mov r9d, 0x100
mov edx, ebx
call qword [sym.imp.USER32.dll_LoadStringW]
cmp di, word [0x140026458]
jne 0x1400072f6
mov rcx, qword [0x140024040]
mov r9d, 0xa
lea r8, [0x140026458]
lea edx, [r9 + 0x5b]
call qword [sym.imp.USER32.dll_LoadStringW]
cmp di, word [0x140026680]
jne 0x14000731d
mov rcx, qword [0x140024040]
mov r9d, 0xc8
lea r8, [0x140026680]
lea edx, [r9 - 0x57]
call qword [sym.imp.USER32.dll_LoadStringW]
cmp di, word [0x140026810]
jne 0x140007342
mov rcx, qword [0x140024040]
lea r8, [0x140026810]
mov r9d, ebx
mov edx, 0x72
call qword [sym.imp.USER32.dll_LoadStringW]
mov r12d, 0x2001f
lea rbx, str.SoftwareMicrosoftWindowsCurrentVersionMedia_Center
lea ebp, [r12 - 6]
cmp qword [0x140024138], rdi
jne 0x1400073ab
lea r14, [0x140024138]
mov r13, 0xffffffff80000001
mov r9d, r12d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x140009d24
mov rcx, qword [0x140024138]
cmp rcx, rdi
je 0x1400073ab
lea rdx, str.EnableNotifications
mov r8b, sil
call fcn.1400014f4
mov byte [0x140024130], al
cmp qword [0x140024010], rdi
jne 0x14000741e
mov r9d, r12d
lea r13, [0x140024010]
mov r12, 0xffffffff80000002
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x140009d53
mov rcx, qword [0x140024010]
cmp rcx, rdi
je 0x14000741e
lea rdx, str.EnableLaunchErrors
mov r8b, sil
call fcn.1400014f4
mov rcx, qword [0x140024010]
lea rdx, str.EnableSPADLaunchErrors
mov r8b, sil
mov byte [0x140024018], al
call fcn.1400014f4
mov byte [0x14002401a], al
mov rcx, qword [0x140024138]
xor r8d, r8d
xor edx, edx
call fcn.140008938
mov rcx, qword [0x140024010]
mov r8d, esi
mov edx, esi
call fcn.140008938
cmp qword [0x140026450], rdi
jne 0x140007464
lea r9, str.eHomeResetEvent
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140026450], rax
call fcn.140005c00
call fcn.140005b50
cmp qword [0x140024058], rdi
jne 0x1400074e7
mov rax, qword [0x1400263f0]
mov qword [rsp + 0x58], rdi
lea r8, [0x140026480]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov eax, 0x80000000
mov r9d, 0x80000000
mov rdx, r15
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x140024058], rax
cmp rax, rdi
je 0x14000770c
mov r9, qword [0x140026448]
mov r8, rsi
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x140026404], edi
jne 0x1400075e2
cmp qword [0x140024058], rdi
je 0x1400075e2
mov ebx, 0x206
lea rcx, [rsp + 0x322]
xor edx, edx
mov r8, rbx
mov word [rsp + 0x320], di
call fcn.140001ef0
lea rcx, [rsp + 0x112]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x110], di
call fcn.140001ef0
xor r9d, r9d
lea r11, [rsp + 0x110]
lea edx, [r9 + 0x2e]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jl 0x14000770c
mov rcx, qword [0x140024040]
lea r8, [rsp + 0x320]
mov r9d, 0x104
mov edx, 0x68
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x110]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp eax, edi
je 0x14000770c
lea rcx, str.MCE_Shortcuts_changed
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x14002403c], eax
cmp eax, edi
je 0x14000770c
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x110]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
cmp eax, edi
jge 0x140009d82
cmp qword [0x140024060], rdi
jne 0x140007685
mov ebp, 0x360
mov rcx, rbp
call fcn.140002220
mov rbx, rax
cmp rax, rdi
je 0x140009dc6
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.140001ef0
mov r11, qword [0x140024058]
or dword [rbx + 0xc], 0xffffffff
lea rax, [0x14001e500]
mov qword [rbx], r11
mov dword [rbx + 8], 0x8014
mov qword [rbx + 0x18], rax
or eax, 0xffffffff
mov dword [rbx + 0x10], 0x3a98
mov dword [rbx + 0x20], 0x29
mov byte [rbx + 0x24], dil
mov byte [rbx + 0x25], sil
mov dword [rbx + 0x2c], eax
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x38], eax
mov dword [rbx + 0x148], eax
mov qword [rbx + 0x30], rdi
mov word [rbx + 0x3c], di
jmp 0x140007667
mov qword [0x140024060], rbx
cmp rbx, rdi
je 0x14000770c
mov dl, byte [0x140024130]
mov rcx, rbx
call fcn.140005fa8
cmp qword [0x140024080], rdi
jne 0x1400076b2
mov ecx, 8
call fcn.140002220
cmp rax, rdi
je 0x140009dce
mov rcx, rax
call fcn.140005ff8
mov qword [0x140024080], rax
jmp 0x1400076b2
mov rcx, qword [0x140024058]
xor edx, edx
call fcn.1400052f4
cmp qword [0x140024030], rdi
jne 0x1400076d2
call fcn.1400086ec
cmp eax, edi
jl 0x14000770c
cmp byte [0x1400263fe], dil
jne 0x140009dda
mov rcx, qword [0x140024058]
xor r9d, r9d
mov edx, 0x8027
mov r8d, 0x493e0
mov byte [0x1400263fe], sil
call qword [sym.imp.USER32.dll_SetTimer]
call fcn.140001df0
nop
jmp 0x140009dda
mov al, dil
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400012d0
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov byte [rbx], sil
jmp 0x14000770c
mov rbx, rdi
jmp 0x140007055
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
jmp 0x14000738a
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
jmp 0x1400073e1
mov r9d, dword [0x14002403c]
mov rcx, qword [0x140024058]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov edx, 0x8003
mov r8d, 0x301f
mov dword [rsp + 0x20], esi
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov rcx, qword [rsp + 0x60]
mov dword [0x140026404], eax
call qword [sym.imp.SHELL32.dll_ILFree]
nop
jmp 0x1400075e2
mov rbx, rdi
jmp 0x140007667
mov qword [0x140024080], rdi
jmp 0x1400076b2
mov dil, sil
jmp 0x14000770c