Function at 0x140009af0
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x140009af0
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x808]
sub rsp, 0x8e0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140074150]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
mov rdi, rcx
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x34], ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, str.nView64.dll
call fcn.1400178a0
mov r13, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000a0e2
lea rdx, str.NVIsHookEnabled
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009b7a
call rax
mov dword [rdi + 0x50], eax
cmp dword [rdi + 0x50], ebx
je 0x14000a0d4
mov dword [rsp + 0x40], r14d
lea rdx, str.DMGetCurrentDesktop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009ba4
lea rcx, [rsp + 0x40]
call rax
lea rdx, str.DMEnumDesktops
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.DMGetDesktopInfo
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test r15, r15
je 0x140009d03
test rax, rax
je 0x140009d03
mov esi, r14d
mov dword [rsp + 0x30], r14d
lea r8, [rdi + 0x5c]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call r15
test eax, eax
je 0x140009cdd
xor r13d, r13d
nop dword [rax]
mov ecx, dword [rsp + 0x30]
mov dword [rdi + r14*4 + 0x2dc], ecx
cmp dword [rsp + 0x40], ecx
jne 0x140009c15
mov dword [rdi + 0x58], esi
mov word [rbp - 0x30], r13w
mov word [rbp + 0x20], r13w
mov word [rbp + 0x228], r13w
mov word [rbp + 0x434], r13w
mov dword [rbp + 0x430], r13d
mov dword [rbp + 0x470], 0x64
mov byte [rbp + 0x474], bl
lea rdx, [rbp - 0x30]
call r12
imul rax, r14, 0x208
lea rcx, [rdi + 0x2fc]
add rcx, rax
mov edx, 0x820
lea r8, [rbp + 0x228]
sub r8, rcx
nop dword [rax]
lea rax, [rdx + 0x7ffff7de]
test rax, rax
je 0x140009c94
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140009c94
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140009c70
jmp 0x140009c99
test rdx, rdx
jne 0x140009c9d
sub rcx, 2
mov word [rcx], r13w
mov eax, dword [rbp + 0x430]
mov dword [rdi + r14*4 + 0x133c], eax
inc esi
mov r14d, esi
lea rax, [rsi + rsi*4]
shl rax, 4
lea r8, [rdi + 0x5c]
add r8, rax
lea rdx, [rsp + 0x30]
mov ecx, esi
call r15
test eax, eax
jne 0x140009c00
mov r13, qword [rsp + 0x58]
xor r14d, r14d
mov dword [rdi + 0x54], esi
test esi, esi
jne 0x140009d03
lea rcx, [rdi + 0x2fc]
lea r8, [0x14005d214]
mov edx, 0x208
call fcn.1400012da
mov dword [rdi + 0x133c], r14d
lea rdx, str.HKEnumActions
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.HKEnumCommands
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.HKGetProperty
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, str.HKGetActionProperties
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rsp + 0x60], rax
lea rdx, str.HKGetActionParamFlags
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r12, r12
je 0x140009f6a
test r15, r15
je 0x140009f6a
test rsi, rsi
je 0x140009f6a
test r14, r14
je 0x140009f6a
xor r14d, r14d
mov esi, r14d
mov r15d, r14d
mov qword [rsp + 0x48], r14
mov word [rbp + 0x520], r14w
xor edx, edx
mov r8d, 0x9e
lea rcx, [rbp + 0x522]
call fcn.14001cd00
mov r9d, 0xa0
lea r8, [rbp + 0x520]
lea rdx, [rsp + 0x48]
xor ecx, ecx
call r12
test eax, eax
je 0x140009f63
nop dword [rax]
nop dword [rax + rax]
mov word [rbp + 0x480], r14w
xor edx, edx
mov r8d, 0x9e
lea rcx, [rbp + 0x482]
call fcn.14001cd00
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x3c], r14d
mov qword [rsp + 0x20], 0xa0
lea r9, [rbp + 0x480]
lea r8, [rsp + 0x3c]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x60]
test eax, eax
je 0x140009f3f
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x50], r14d
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call r13
test dword [rsp + 0x50], 0x2000
je 0x140009f42
mov r14d, r15d
mov rax, qword [rsp + 0x48]
mov qword [rdi + r14*8 + 0x51e0], rax
mov eax, dword [rsp + 0x38]
mov dword [rdi + r14*4 + 0x5500], eax
xor r8d, r8d
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.140012e00
nop
lea rcx, [rsp + 0x70]
call fcn.140016750
test rax, rax
je 0x140009eae
xor r8d, r8d
mov edx, dword [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.140012e00
nop
or ebx, 1
jmp 0x140009ed5
cmp word [rbp + 0x480], 0
je 0x140009ec1
lea r8, [rbp + 0x480]
jmp 0x140009edd
xor r8d, r8d
mov edx, 0x26c8
lea rcx, [rbp - 0x50]
call fcn.140012e00
or ebx, 2
mov r8, qword [rax + 8]
mov dword [rsp + 0x34], ebx
lea rcx, [r14 + 0x1f]
lea rcx, [rcx + rcx*4]
shl rcx, 5
add rcx, rdi
mov edx, 0xa0
call fcn.1400012da
test bl, 2
je 0x140009f0c
and ebx, 0xfffffffd
mov dword [rsp + 0x34], ebx
lea rcx, [rbp - 0x50]
call fcn.1400133c0
nop
test bl, 1
je 0x140009f21
and ebx, 0xfffffffe
mov dword [rsp + 0x34], ebx
lea rcx, [rbp - 0x70]
call fcn.1400133c0
mov ecx, dword [rsp + 0x38]
call fcn.140001460
mov dword [rdi + r14*4 + 0x5690], eax
lea rcx, [rsp + 0x70]
call fcn.1400133c0
xor r14d, r14d
inc r15d
inc esi
mov r9d, 0xa0
lea r8, [rbp + 0x520]
lea rdx, [rsp + 0x48]
mov ecx, esi
call r12
test eax, eax
jne 0x140009de0
mov dword [rdi + 0x135c], r15d
lea rdx, str.PMEnum
mov r13, qword [rsp + 0x58]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.PMGetCurrentProfile
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.PMGetProfileInfo
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rsi, rsi
je 0x14000a0d4
test rbx, rbx
je 0x14000a0d4
test rax, rax
je 0x14000a0d4
lea rcx, [rdi + 0x5820]
call rbx
xor r12d, r12d
mov ebx, r12d
mov word [rbp + 0x5c0], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x5c2]
call fcn.14001cd00
lea rdx, [rbp + 0x5c0]
xor ecx, ecx
call rsi
test eax, eax
je 0x14000a0ce
nop dword [rax]
nop word [rax + rax]
mov r9d, ebx
imul rax, r9, 0x208
add rax, 0x5a28
add rax, rdi
mov edx, 0x104
lea r8, [rbp + 0x5c0]
sub r8, rax
lea rcx, [rdx + 0x7ffffefa]
test rcx, rcx
je 0x14000a056
movzx ecx, word [r8 + rax]
test cx, cx
je 0x14000a056
mov word [rax], cx
add rax, 2
dec rdx
jne 0x14000a032
jmp 0x14000a05b
test rdx, rdx
jne 0x14000a05f
sub rax, 2
mov word [rax], r12w
mov dword [rsp + 0x3c], r12d
imul rax, r9, 0xfa0
lea rdx, [rdi + 0x12548]
add rdx, rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, 0xfa0
lea rcx, [rbp + 0x5c0]
call r14
lea rdx, [rdi + 0x5820]
lea rcx, [rbp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x14000a0b9
mov dword [rdi + 0x73fc8], ebx
inc ebx
lea rdx, [rbp + 0x5c0]
mov ecx, ebx
call rsi
test eax, eax
jne 0x14000a010
mov dword [rdi + 0x73fcc], ebx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.14001ccd0
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret