Function at 0x14008c48c
Capabilities:
Get file system object information
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2d8]
sub rsp, 0x3d8
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov r10, r9
mov eax, r8d
mov r12, rdx
mov qword [rbp - 0x40], rdx
mov rbx, rcx
mov rsi, qword [rbp + 0x340]
xor r15d, r15d
mov dword [rsp + 0x30], r15d
cmp r8d, 0x4e
jne 0x14008d6ea
mov ecx, dword [rsi + 0x10]
mov eax, r15d
lea rdx, [0x140229530]
mov r13d, 0x8000
cmp dword [rax + rdx], ecx
je 0x14008c506
add rax, 4
cmp rax, 0x1c
jb 0x14008c4e8
jmp 0x14008c51c
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, qword [0x140233a48]
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rsi + 0x10]
mov ecx, 0xffffff93
cmp eax, ecx
ja 0x14008d460
je 0x14008d426
cmp eax, 0xffffff4f
je 0x14008d033
cmp eax, 0xffffff50
je 0x14008c929
cmp eax, 0xffffff51
je 0x14008c80c
cmp eax, 0xffffff65
je 0x14008c6c2
cmp eax, 0xffffff8e
jne 0x14008ccf9
mov qword [rbp - 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov r8d, 0xb
lea rdx, str.SingleClick
lea rcx, [rbp - 0x40]
call fcn.1400041b8
nop
mov r15d, 1
mov dword [rsp + 0x30], r15d
xor esi, esi
mov qword [rbp - 0x60], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
lea r14d, [r15 + 7]
mov r8d, r14d
lea rdx, str.FileList
lea rcx, [rbp - 0x60]
call fcn.1400041b8
nop
lea edi, [rsi + 3]
mov dword [rsp + 0x30], edi
xor r8d, r8d
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.1401165ec
test eax, eax
je 0x14008c5e2
mov rcx, rbx
call fcn.140089850
test eax, eax
jne 0x14008c5e5
mov r15b, sil
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
mov r12d, 0x1000
mov rdx, qword [rbp - 0x48]
cmp rdx, r14
jb 0x14008c62d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x14008c628
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d724
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], si
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp - 0x28]
cmp rdx, r14
jb 0x14008c680
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, r12
jb 0x14008c67b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d72a
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], si
test r15b, r15b
je 0x14008ccf9
int3
mov edx, 2
mov rcx, rbx
call fcn.14008b378
jmp 0x14008ccf9
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
movsx edi, ax
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
movsx r14d, ax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
movsx r15d, ax
cmp word [rsi + 0x18], 0x79
jne 0x14008c707
test r13d, edi
jne 0x14008c6ff
test r13d, r14d
je 0x14008c719
mov rcx, rbx
call fcn.140092c8c
test r13d, edi
jne 0x14008ccf9
test r13d, r14d
jne 0x14008ccf9
test r13d, r15d
jne 0x14008ccf9
movzx ecx, word [rsi + 0x18]
sub ecx, 9
je 0x14008c7d8
sub ecx, 4
je 0x14008c7b0
sub ecx, 0x13
je 0x14008c7a3
sub ecx, 0xd
je 0x14008c7a3
sub ecx, 0x43
je 0x14008c785
sub ecx, 1
je 0x14008c778
sub ecx, 2
je 0x14008c767
cmp ecx, 1
jne 0x14008ccf9
lea rcx, [0x140236e60]
call fcn.140090e7c
jmp 0x14008ccf9
lea rcx, [0x140236a08]
call fcn.140005a0c
jmp 0x14008ccf9
mov rcx, rbx
call fcn.140090e18
jmp 0x14008ccf9
xor r9d, r9d
mov edx, 0x111
lea r8d, [rdx + 7]
mov rcx, qword [0x140233a48]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14008ccf9
mov rcx, rbx
call fcn.140089ee0
jmp 0x14008ccf9
int3
xor eax, eax
cmp qword [0x140234a18], rax
je 0x14008ccf9
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rbx + 0x90]
jne 0x14008ccf9
mov rcx, qword [0x140234a18]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x14008ccf9
lea rcx, [0x140236030]
call fcn.14000e954
cmp dword [0x140233a40], r15d
jne 0x14008c8e9
cmp byte [rbx + 0xf0], r15b
jne 0x14008c8e9
cmp byte [0x140233a44], r15b
je 0x14008c84c
test al, 0x40
jne 0x14008c84c
cmp byte [rbx + 0xad], r15b
je 0x14008c8e9
cmp byte [rbx + 0xad], r15b
jne 0x14008ccf9
mov eax, dword [rsi + 0x1c]
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], r15d
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x104b
mov rcx, qword [rbx + 0x90]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14008c8e9
imul rdi, qword [rsp + 0x68], 0xc8
add rdi, qword [rbx + 0x38]
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.1400e393c
nop
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1018
mov rcx, qword [rbx + 0x90]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.140028160
lea rdx, [0x1401dc478]
lea rcx, [rbp - 0x20]
call fcn.140082420
test al, al
je 0x14008c8f3
lea rcx, [rbp - 0x20]
call fcn.140006b94
mov eax, 1
jmp 0x14008d6fb
cmp byte [rdi + 0xa4], r15b
jne 0x14008c924
lea rcx, [rbp - 0x20]
int3
jmp 0x14008d452
lea rdi, [rbx + 0xb0]
mov rax, rdi
mov r14d, 8
cmp qword [rdi + 0x18], r14
jb 0x14008c942
mov rax, qword [rdi]
mov qword [rdi + 0x10], r15
mov word [rax], r15w
mov rdx, qword [rsi + 0x30]
mov r13d, 7
test rdx, rdx
jne 0x14008c9b2
cmp byte [rbx + 0xad], r15b
je 0x14008ccf9
xor r9d, r9d
mov r8d, dword [rsi + 0x1c]
mov rdx, qword [rbx + 0x90]
lea rcx, [rbp - 0x20]
call fcn.140027d4c
mov rsi, rax
cmp rdi, rax
je 0x14008c9a7
mov rcx, rdi
call fcn.140006b94
movups xmm0, xmmword [rsi]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r13
mov word [rsi], r15w
lea rcx, [rbp - 0x20]
call fcn.140006b94
jmp 0x14008c9ba
mov rcx, rdi
call fcn.140012fc0
cmp qword [rbx + 0xc0], r15
je 0x14008ccf9
cmp byte [rbx + 0xad], r15b
je 0x14008cc07
mov byte [rbx + 0xad], r15b
mov r15d, 1
xor r13d, r13d
cmp byte [0x140233a44], r13b
je 0x14008cba9
mov qword [rbp - 0x60], r13
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x60], r13w
mov qword [rbp - 0x40], r13
movdqu xmmword [rbp - 0x30], xmm0
movdqu xmmword [rbp - 0x30], xmm1
mov word [rbp - 0x40], r13w
mov qword [rbp - 0x20], r13
movdqu xmmword [rbp - 0x10], xmm0
lea r8d, [r15 + 5]
lea rdx, str.Rar_MD
lea rcx, [rbp - 0x20]
call fcn.1400041b8
nop
xor r8d, r8d
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.140161aec
mov bl, al
lea rcx, [rbp - 0x20]
call fcn.140006b94
test bl, bl
je 0x14008cb45
lea r8, [rbp - 0x60]
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.1400e2e28
lea rcx, [rbp - 0x60]
int3
mov rdx, qword [rbp - 0x28]
cmp rdx, r14
jb 0x14008cb86
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
mov r12d, 0x1000
cmp rdx, r12
jb 0x14008cb81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d730
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r13w
lea rcx, [rbp - 0x60]
call fcn.140006b94
mov rsi, r13
jmp 0x14008d001
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
call fcn.1400894b8
mov rcx, rdi
int3
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r13
mov word [rbp], r15w
mov qword [rbp + 0x20], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqa xmmword [rbp + 0x30], xmm1
mov word [rbp + 0x20], r15w
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], r15
lea rdx, [rbp]
mov rcx, rbx
call fcn.140088730
test al, al
jne 0x14008cd00
mov r12d, 0x1000
mov rdx, qword [rbp + 0x38]
cmp rdx, r14
jb 0x14008cc9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, r12
jb 0x14008cc9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d736
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqa xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r15w
mov rdx, qword [rbp + 0x18]
cmp rdx, r14
jb 0x14008ccec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, r12
jb 0x14008cce7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d748
call fcn.1401af9bc
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r13
mov word [rbp], r15w
xor eax, eax
jmp 0x14008d6fb
xor esi, esi
lea r15d, [rsi + 1]
mov r12d, 0x1000
cmp byte [0x140233a44], sil
je 0x14008ce8e
xor ecx, ecx
call fcn.1401547d0
lea rdx, [0x140234eb0]
lea rcx, [0x140236030]
call fcn.14000e854
mov eax, dword [0x140236034]
mov dword [0x140234e30], eax
mov qword [rbp - 0x20], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
lea rdx, [rbp]
cmp qword [rbp + 0x18], r14
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.1400042c0
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400e1f54
lea rdx, [rbp]
lea rcx, [0x140234ff0]
call fcn.1400ff114
mov qword [rbp - 0x60], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x60], si
lea r8, [rbp - 0x60]
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.1400e2e28
lea rcx, [0x1402352b0]
call fcn.1400ff2e4
lea rdx, [rbp - 0x60]
lea rcx, [0x1402352b0]
call fcn.1400ff114
lea rcx, [rbx + 0x38]
lea rdx, [rbp - 0x60]
call fcn.140082300
test al, al
je 0x14008ce31
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], r14
cmovae rdx, qword [rbp - 0x60]
lea rcx, [rbp]
cmp qword [rbp + 0x18], r14
cmovae rcx, qword [rbp]
int3
mov rcx, rdi
cmp qword [rdi + 0x18], r14
jb 0x14008ce3d
mov rcx, qword [rdi]
mov rax, qword [rdi + 0x10]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.140089904
test al, al
je 0x14008ce67
xor edx, edx
lea rcx, [0x140236030]
call fcn.1400126b0
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.140004958
nop
lea rcx, [rbp - 0x60]
call fcn.140006b94
nop
lea rcx, [rbp - 0x20]
call fcn.140006b94
xor ebx, ebx
jmp 0x14008cf6a
mov qword [rbp - 0x60], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x60], si
lea r8, [rbp - 0x60]
lea rdx, [rbp]
mov rcx, rbx
call fcn.1400894b8
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
call fcn.1400894b8
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.1400cce8c
test al, al
je 0x14008cee0
mov rsi, r15
xor ebx, ebx
jmp 0x14008cf1e
mov rsi, rdi
cmp qword [rdi + 0x18], r14
jb 0x14008ceec
mov rsi, qword [rdi]
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], r14
cmovae rbx, qword [rbp - 0x60]
mov ecx, 0x20a
call fcn.1400f70b0
mov qword [rsp + 0x20], rsi
mov r9, rbx
mov r8, rax
mov rdx, qword [rbp - 0x40]
mov ecx, r15d
call fcn.14016b824
xor ebx, ebx
mov esi, ebx
mov rdx, qword [rbp - 0x48]
cmp rdx, r14
jb 0x14008cf59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x14008cf54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d73c
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], bx
mov rdx, qword [rbp + 0x38]
cmp rdx, r14
jb 0x14008cfa5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, r12
jb 0x14008cfa0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d742
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqa xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], bx
mov rdx, qword [rbp + 0x18]
cmp rdx, r14
jb 0x14008cff1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, r12
jb 0x14008cfec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d748
call fcn.1401af9bc
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], r13
xor r13d, r13d
mov word [rbp], r13w
cmp byte [0x140234e6a], r13b
jne 0x14008d02b
cmp qword [rdi + 0x18], r14
jb 0x14008d013
mov rdi, qword [rdi]
mov r9, rdi
mov r8, r15
mov edx, 0x8002
mov rcx, qword [0x140233a48]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, rsi
jmp 0x14008d6fb
mov edi, 3
test byte [rsi + 0x18], dil
je 0x14008ccf9
mov rcx, qword [rbx + 0x40]
sub rcx, qword [rbx + 0x38]
movabs rax, 0xa3d70a3d70a3d70b
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp qword [rsi + 0x40], rdx
jae 0x14008ccf9
imul r13, qword [rsi + 0x40], 0xc8
add r13, qword [rbx + 0x38]
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
lea r15d, [rdi - 2]
xor r12d, r12d
lea rcx, [rbp - 0x60]
cmp byte [0x140233a44], r12b
je 0x14008d0b9
mov rdx, r13
call fcn.140004958
jmp 0x14008d0e5
cmp dword [0x140233a70], r15d
jne 0x14008d0c9
call fcn.1400e1888
jmp 0x14008d0d5
lea rdx, [rbx + 0xf8]
call fcn.140004958
lea r8, [rbp - 0x60]
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.1400e2e28
mov edi, 0x4401
mov r14d, 8
mov rcx, qword [rbp - 0x50]
cmp byte [0x140233a44], r12b
je 0x14008d14d
mov edi, 0x4411
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], r14
cmovae r8, qword [rbp - 0x60]
cmp rcx, r15
jne 0x14008d14d
mov r9, rcx
lea rdx, [0x1401dc78c]
test rcx, rcx
je 0x14008d139
sub r8, rdx
movzx eax, word [r8 + rdx]
cmp ax, word [rdx]
jne 0x14008d14d
add rdx, 2
sub r9, r15
jne 0x14008d126
lea rdx, [0x1401e1c18]
lea rcx, [rbp - 0x60]
call fcn.140012fc0
mov rcx, qword [rbp - 0x50]
lea rax, [rcx - 1]
mov r12d, 0x1000
cmp rax, 0xff
jbe 0x14008d212
or edi, 0x10
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.1400e1950
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x60]
cmp rcx, rax
je 0x14008d1ea
mov rdx, qword [rbp - 0x48]
cmp rdx, r14
jb 0x14008d1bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x14008d1b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d74e
call fcn.1401af9bc
mov rax, qword [rbp - 0x40]
xor edx, edx
mov qword [rbp - 0x50], rdx
lea ecx, [rdx + 7]
mov qword [rbp - 0x48], rcx
mov word [rbp - 0x60], dx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
mov word [rax], dx
lea rcx, [rbp - 0x20]
call fcn.140006b94
mov rax, qword [rbp - 0x50]
dec rax
cmp rax, 0x100
jbe 0x14008d212
lea rdx, str.dummy
lea rcx, [rbp - 0x60]
call fcn.140012fc0
xor eax, eax
mov qword [rbp - 0x40], rax
cmp byte [0x140233a44], al
je 0x14008d24d
mov r12d, eax
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], r14
cmovae rax, qword [rbp - 0x60]
movzx ecx, word [rax + r12*2]
call fcn.1400e2d9c
test al, al
je 0x14008d243
add r12, r15
jmp 0x14008d223
mov qword [rbp - 0x40], r12
mov r12d, 0x1000
mov al, byte [r13 + 0xa4]
neg al
sbb edx, edx
and edx, 0x10
mov dword [rsp + 0x34], edx
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], r14
cmovae rax, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x40]
lea rcx, [rax + rcx*2]
mov dword [rsp + 0x20], edi
mov r9d, 0x2b8
lea r8, [rbp]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor edx, edx
test rax, rax
setne cl
test rax, rax
jne 0x14008d2d3
test dil, 0x10
jne 0x14008d2d3
or edi, 0x10
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], r14
cmovae rax, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x40]
lea rcx, [rax + rcx*2]
mov dword [rsp + 0x20], edi
mov r9d, 0x2b8
lea r8, [rbp]
mov edx, dword [rsp + 0x34]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor edx, edx
test rax, rax
setne cl
test cl, cl
je 0x14008d41d
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], rdx
lea rax, [rbp + 0x218]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], dx
jne 0x14008d2f2
mov r8, rdi
lea rdx, [rbp + 0x218]
lea rcx, [rbp - 0x40]
call fcn.1400041b8
nop
mov ecx, dword [r13 + 0xa0]
sub ecx, 1
je 0x14008d344
sub ecx, 1
je 0x14008d344
sub ecx, 1
je 0x14008d33d
sub ecx, 1
je 0x14008d336
cmp ecx, 1
jne 0x14008d35a
mov ecx, 0x61b
jmp 0x14008d349
mov ecx, 0x61a
jmp 0x14008d349
mov ecx, 0x618
jmp 0x14008d349
mov ecx, 0x619
call fcn.1400f70b0
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140012fc0
xor edi, edi
cmp qword [rbp - 0x30], rdi
jne 0x14008d396
mov ecx, dword [r13 + 0x68]
call fcn.1400cc274
test al, al
je 0x14008d387
mov ecx, 0x573
call fcn.1400f70b0
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140012fc0
jmp 0x14008d396
lea r8, [rbp - 0x40]
mov rdx, r13
mov rcx, rbx
call fcn.140089050
test byte [rsi + 0x18], r15b
je 0x14008d3c6
mov eax, dword [0x1402374f4]
cmp dword [rsi + 0x20], eax
jne 0x14008d3c6
cmp dword [rsi + 0x38], edi
jle 0x14008d3c6
movsxd r8, dword [rsi + 0x38]
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], r14
cmovae rdx, qword [rbp - 0x40]
mov rcx, qword [rsi + 0x30]
call fcn.1400ff058
test byte [rsi + 0x18], 2
je 0x14008d3d2
mov eax, dword [rbp + 8]
mov dword [rsi + 0x3c], eax
mov rdx, qword [rbp - 0x28]
cmp rdx, r14
jb 0x14008d40d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, r12
jb 0x14008d408
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d754
call fcn.1401af9bc
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], di
or dword [rsi + 0x18], r12d
jmp 0x14008d50d
mov qword [rbp - 0x20], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
xor r8d, r8d
lea rdx, [0x1401dbff0]
lea rcx, [rbp - 0x20]
call fcn.1400041b8
nop
lea rdx, [rbp - 0x20]
xor ecx, ecx
call fcn.140029c98
nop
lea rcx, [rbp - 0x20]
call fcn.140006b94
jmp 0x14008ccf9
cmp eax, 0xffffff94
je 0x14008d6da
cmp eax, 0xfffffff4
je 0x14008d52b
cmp eax, 0xfffffffd
je 0x14008d516
cmp eax, 0xffffffff
jne 0x14008ccf9
mov ecx, 0x65
call fcn.1400f70b0
mov qword [rbp - 0x60], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
or rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rax + r8*2], r15w
jne 0x14008d4a1
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.1400041b8
nop
mov ecx, 0x1f4
call fcn.1400f70b0
mov qword [rbp - 0x20], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
inc rdi
cmp word [rax + rdi*2], r15w
jne 0x14008d4ce
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400041b8
nop
mov r9d, 0x30
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x20]
mov rcx, qword [0x140233a48]
call fcn.1401635d0
nop
lea rcx, [rbp - 0x20]
call fcn.140006b94
nop
lea rcx, [rbp - 0x60]
jmp 0x14008d456
mov rcx, rbx
call fcn.140089850
test eax, eax
je 0x14008ccf9
jmp 0x14008c6b0
mov ecx, dword [rsi + 0x18]
sub ecx, 1
je 0x14008d6c6
cmp ecx, 0x10000
jne 0x14008ccf9
mov ecx, dword [0x14022954c]
or rdi, 0xffffffffffffffff
cmp ecx, edi
jne 0x14008d686
mov qword [rbp - 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
lea r14d, [rdi + 9]
mov r8d, r14d
lea rdx, str.AltColor
lea rcx, [rbp - 0x40]
call fcn.1400041b8
nop
mov qword [rbp - 0x20], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
lea edi, [r14 + 0x2b]
mov r8d, edi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
lea rcx, [rbp - 0x20]
call fcn.1400041b8
nop
mov r8d, 0xff0000
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1401165ec
mov dword [0x14022954c], eax
lea rcx, [rbp - 0x20]
call fcn.140006b94
nop
lea rcx, [rbp - 0x40]
call fcn.140006b94
mov qword [rbp - 0x60], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
lea r8d, [r14 + 0xa]
lea rdx, str.AltEncryptionColor
lea rcx, [rbp - 0x60]
call fcn.1400041b8
nop
mov qword [rbp - 0x20], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov r8d, edi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
lea rcx, [rbp - 0x20]
call fcn.1400041b8
nop
mov r8d, 0xd9213
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.1401165ec
mov dword [0x140237514], eax
lea rcx, [rbp - 0x20]
call fcn.140006b94
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, r14
jb 0x14008d66e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
mov r12d, 0x1000
cmp rdx, r12
jb 0x14008d669
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008d71e
call fcn.1401af9bc
movdqa xmm0, xmmword [0x1401dc090]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r15w
mov ecx, dword [0x14022954c]
imul rax, qword [rsi + 0x48], 0xc8
add rax, qword [rbx + 0x38]
cmp byte [rax + 0xaa], r15b
jne 0x14008ccf9
test dword [rax + 0x68], 0x800
je 0x14008d6ab
mov dword [rsi + 0x50], ecx
test dword [rax + 0x68], 0x4000
je 0x14008ccf9
mov eax, dword [0x140237514]
mov dword [rsi + 0x50], eax
jmp 0x14008ccf9
cmp byte [0x14023717c], r15b
je 0x14008ccf9
mov eax, 0x20
jmp 0x14008d6fb
mov edx, dword [rsi + 0x1c]
mov rcx, rbx
call fcn.14008b2f0
jmp 0x14008ccf9
mov r9, rsi
mov r8, r10
mov edx, eax
mov rcx, r12
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.1401afad0
add rsp, 0x3d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3