Function at 0x425190
Capabilities:
Authenticate hmac
Check for time delay via gettickcount
Check http status code
Check if file exists
Create process on windows
Get file attributes
Open clipboard
Write clipboard data

Disassembly:
push r15
mov eax, 0x4098
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
mov rbp, qword [rsp + 0x4100]
mov rdi, rcx
mov ebx, r8d
mov rcx, qword [0x00826970]
mov r13, rbp
mov qword [rsp + 0x40e8], rdx
mov r12, r9
shr r13, 0x10
mov dword [rsp + 0x60], 0x2c
call sub.KERNEL32.dll_GetTickCount
cmp ebx, 0x202
mov r14, qword [rsp + 0x40e8]
mov esi, eax
je 0x4253f9
ja 0x4252a0
cmp ebx, 0x1f
je 0x4253f9
jbe 0x425350
cmp ebx, 0x200
je 0x425370
cmp ebx, 0x201
jne 0x42543e
mov r12d, dword [rdi + 0x80]
test r12d, r12d
je 0x425262
test bp, bp
je 0x425262
test r13w, r13w
je 0x425262
test byte [0x008d9200], 0x10
mov dword [rdi + 0x80], 0
jne 0x425262
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x42731a
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x4252e0
movsx ebp, bp
movsx r13d, r13w
mov dword [rdi + 0x18], 1
mov rcx, r14
mov dword [rdi + 0x10], ebp
mov dword [rdi + 0x14], r13d
call qword [sym.imp.USER32.dll_SetCapture]
jmp 0x4252e0
cmp ebx, 0x208
je 0x4253f9
jbe 0x4253f1
cmp ebx, 0x2a1
je 0x4253e0
cmp ebx, 0x2a3
jne 0x42543e
mov rcx, qword [0x008d92d0]
call fcn.00407cd0
nop word cs:[rax + rax]
mov rcx, qword [0x00826970]
call sub.KERNEL32.dll_GetTickCount
mov eax, eax
sub rax, rsi
cmp rax, 0x14
jle 0x425336
mov rdi, qword [0x00826910]
test byte [rdi + 0x2011], 2
je 0x425336
mov rcx, qword [0x00826970]
call sub.KERNEL32.dll_GetTickCount
mov r9d, ebx
mov rcx, rdi
lea r8, str.Main
mov eax, eax
lea rdx, str.GUI_lag_in__S__X_:__ld_n
sub rax, rsi
mov qword [rsp + 0x20], rax
call fcn.0041e020
xor edi, edi
mov rax, rdi
add rsp, 0x4098
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp ebx, 6
jne 0x42543e
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4252e0
mov eax, dword [rdi + 0x18]
sub eax, 1
cmp eax, 1
jbe 0x4263e0
lea r14, [rsp + 0x2090]
movsx ebp, bp
movsx r13d, r13w
mov rax, qword [0x00827d50]
mov dword [rsp + 0x2098], ebp
mov rdx, r14
mov dword [rsp + 0x209c], r13d
mov byte [rsp + 0x20a0], 0
add rax, 0x10
mov qword [rsp + 0x2090], rax
mov rax, qword [0x00828d90]
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, r14
call fcn.0040f5e0
jmp 0x4252e0
mov rcx, qword [0x008d92d0]
call fcn.00407c70
jmp 0x4252e0
cmp ebx, 0x205
jne 0x42543e
mov edx, 0x7f00
xor ecx, ecx
mov dword [rdi + 0x10], 0xffffffff
mov dword [rdi + 0x14], 0xffffffff
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
call qword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
cmp ebx, 0x202
je 0x425a44
movzx eax, al
mov dword [rdi + 0x18], 0
mov dword [rdi + 0x1c], eax
cmp ebx, 0x200
je 0x42537f
ja 0x425511
cmp ebx, 0x14
je 0x4267a0
jbe 0x425580
cmp ebx, 0x104
je 0x425c80
jbe 0x425840
cmp ebx, 0x112
je 0x4257c0
cmp ebx, 0x113
je 0x425f91
cmp ebx, 0x111
je 0x425cb0
mov r9, rbp
mov r8, r12
mov edx, ebx
mov rcx, qword [rsp + 0x40e8]
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [0x00826970]
mov rdi, rax
call sub.KERNEL32.dll_GetTickCount
mov eax, eax
sub rax, rsi
cmp rax, 0x14
jle 0x425338
mov rbp, qword [0x00826910]
test byte [rbp + 0x2011], 2
je 0x425338
mov rcx, qword [0x00826970]
call sub.KERNEL32.dll_GetTickCount
mov r9d, ebx
mov rcx, rbp
lea r8, str.MainD
mov eax, eax
lea rdx, str.GUI_lag_in__S__X_:__ld_n
sub rax, rsi
mov qword [rsp + 0x20], rax
call fcn.0041e020
jmp 0x425338
cmp ebx, 0x233
je 0x426390
jbe 0x425654
cmp ebx, 0x8003
je 0x426495
jbe 0x4259b3
cmp ebx, 0x8005
je 0x4257b0
jb 0x4266e0
cmp ebx, 0x8006
jne 0x425495
test byte [0x008d9203], 0x40
je 0x4252e0
mov rax, qword [0x008275b0]
mov rcx, rdi
mov edx, dword [rax]
call fcn.00423b70
jmp 0x4252e0
cmp ebx, 5
je 0x425a50
ja 0x425770
cmp ebx, 1
je 0x4260b0
cmp ebx, 2
jne 0x425495
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40e8]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x4255e7
mov eax, dword [rsp + 0x68]
mov dword [0x008d9220], eax
mov eax, dword [rsp + 0x84]
sub eax, dword [rsp + 0x7c]
mov dword [0x008d9218], eax
mov eax, dword [rsp + 0x88]
sub eax, dword [rsp + 0x80]
mov dword [0x008d921c], eax
mov rax, qword [0x00828d70]
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rax, qword [0x00828d80]
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rdi]
test rcx, rcx
je 0x425615
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [0x008d92d0]
test rdi, rdi
je 0x425647
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x425630
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x42563f
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, rdi
call fcn.007da050
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4252e0
cmp ebx, 0x20a
je 0x426060
jbe 0x4256c1
cmp ebx, 0x214
je 0x4262f0
cmp ebx, 0x219
jne 0x425495
mov rax, qword [0x00828bd0]
mov eax, dword [rax]
cmp eax, 1
je 0x4252e0
mov rcx, qword [0x00826910]
mov r9, rbp
mov r8, r12
lea rdx, str.WM_DEVICECHANGE__x__x__n
call fcn.0041e020
mov rax, qword [0x00828c10]
mov rcx, qword [0x008d9350]
or dword [rax], 4
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x4252e0
cmp ebx, 0x202
je 0x426650
cmp ebx, 0x205
jne 0x425495
mov rax, qword [0x00827d40]
movsx ebp, bp
movsx r13d, r13w
mov dword [rsp + 0x20a0], 0
lea r14, [rsp + 0x2090]
mov dword [rsp + 0x2098], ebp
mov dword [rsp + 0x209c], r13d
mov rdx, r14
mov dword [rsp + 0x20a4], 0
add rax, 0x10
mov byte [rsp + 0x20b0], 1
mov qword [rsp + 0x2090], rax
mov rax, qword [0x00828d90]
mov dword [rsp + 0x20a8], 2
mov dword [rsp + 0x20ac], 0
mov byte [rsp + 0x20b1], 0
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, r14
call fcn.0040f030
jmp 0x4252e0
cmp ebx, 0xf
je 0x425fc5
cmp ebx, 0x10
jne 0x425495
mov rbp, qword [0x00828bd0]
mov eax, dword [rbp]
test eax, eax
je 0x42579d
test byte [0x008d9201], 2
je 0x4267aa
mov rcx, qword [rsp + 0x40e8]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x4252e0
mov edx, ebp
mov rcx, rdi
call fcn.00424160
jmp 0x4252e0
cmp r12w, 0x1d
je 0x4272ef
ja 0x4268d0
cmp r12w, 0x13
je 0x427257
jbe 0x426bda
cmp r12w, 0x16
je 0x426f74
jbe 0x426f2d
cmp r12w, 0x17
je 0x4272cd
cmp r12w, 0x19
jne 0x4272ac
mov qword [rsp + 0x20], 0
lea r9, [0x0041edc0]
xor edi, edi
mov r8, qword [0x008d9290]
mov edx, 0x384
mov rcx, qword [0x008d9348]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x425338
cmp ebx, 0x46
je 0x425bc0
cmp ebx, 0x101
jne 0x425495
mov r11d, dword [rdi + 0x74]
test r11d, r11d
je 0x4268c0
cmp r12, 0x30
je 0x426c59
cmp r12, 0x60
je 0x426c59
cmp r12, 0xbb
je 0x426881
cmp r12, 0x6b
je 0x426881
cmp r12, 0xbd
je 0x426c26
cmp r12, 0x6d
je 0x426c26
mov ecx, dword [rdi + 0x74]
test ecx, ecx
setne al
cmp r12, 0x5a
jne 0x4258ba
test al, al
jne 0x426f0d
cmp r12, 0x41
jne 0x4258c8
test al, al
jne 0x426eb7
cmp r12, 0x4e
jne 0x4258e0
test al, al
jne 0x426ee2
nop word cs:[rax + rax]
cmp r12, 0x49
sete dl
and dl, al
jne 0x426ca0
cmp r12, 0x50
jne 0x4258fd
test al, al
jne 0x426e22
cmp r12, 0x52
jne 0x42590b
test al, al
jne 0x426d75
cmp r12, 0x74
je 0x426a7f
cmp r12, 0x75
je 0x426a48
cmp r12, 0x76
je 0x426cf1
cmp r12, 0x77
jne 0x426d28
mov eax, dword [0x008d9200]
mov edx, eax
and edx, 0x880000
cmp edx, 0x80000
je 0x426e12
cmp edx, str.________nddd_nddd
je 0x426e02
test edx, edx
jne 0x425968
xor eax, 0x80000
mov dword [0x008d9200], eax
mov rcx, qword [0x007e36f0]
xor r8d, r8d
mov edx, dword [0x008d9224]
call fcn.0042bb60
mov rcx, qword [0x007e36f0]
call fcn.0042d780
test byte [0x008d9200], 0x10
jne 0x4252e0
mov rcx, qword [rdi + 0x58]
test rcx, rcx
je 0x427332
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4252e0
cmp ebx, 0x8001
je 0x4265c5
cmp ebx, 0x8002
jne 0x425495
mov rcx, qword [rdi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r12, qword [0x00828d70]
mov rcx, qword [0x007e36f0]
mov rax, qword [r12]
mov rax, qword [rax]
mov rbp, qword [rax + 0x18]
call fcn.0042c990
mov rcx, qword [r12]
lea r8, [0x007fe074]
mov r9d, dword [rax + 0x11c]
mov rdx, qword [rdi + 0x60]
call rbp
mov rcx, qword [r12]
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
mov ebp, eax
js 0x426d16
mov rcx, qword [r12]
mov edx, ebp
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rdi + 0x60]
mov edx, ebp
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, rdi
call fcn.00421e60
jmp 0x4252e0
cmp dword [rdi + 0x18], 2
setne al
jmp 0x425431
mov r9d, 2
xor edx, edx
mov rcx, qword [rdi + 0x50]
movsx ebp, bp
mov r12, qword [0x00828d60]
movsx r13d, r13w
movzx r8d, byte [r12 + 0x260]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x008d92d0]
call fcn.00407d20
lea rdx, [rsp + 0x2090]
mov rcx, qword [rsp + 0x40e8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rdi + 0x40], ebp
mov r8d, dword [0x008d9214]
mov dword [rdi + 0x44], r13d
mov eax, dword [r12 + 0x21b0]
shl eax, 8
cdq
idiv r8d
mov ecx, eax
mov eax, dword [r12 + 0x21e0]
shl eax, 8
cdq
idiv r8d
mov edx, ecx
mov ecx, eax
call fcn.00411040
mov r8d, dword [0x008d9214]
mov r14d, eax
mov eax, dword [r12 + 0x2198]
shl eax, 8
cdq
idiv r8d
mov ecx, eax
mov eax, dword [r12 + 0x21c8]
shl eax, 8
cdq
idiv r8d
mov edx, ecx
mov ecx, eax
call fcn.00411020
mov ebp, eax
mov eax, dword [r12 + 0x21b0]
shl eax, 8
cdq
idiv dword [0x008d9214]
mov ecx, eax
call fcn.00411000
mov ecx, dword [0x008d9214]
mov r13d, eax
mov eax, dword [r12 + 0x21c8]
shl eax, 8
cdq
idiv ecx
mov r8d, eax
mov eax, dword [r12 + 0x2198]
shl eax, 8
cdq
idiv ecx
mov edx, r8d
mov ecx, eax
call fcn.00410fe0
mov rcx, qword [rdi + 0x58]
mov r9d, ebp
mov r8d, r13d
mov edx, eax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_MoveWindow]
mov rax, qword [0x00828d90]
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [0x007e36f0]
call fcn.0042d780
test byte [0x008d9200], 0x10
jne 0x4252e0
mov rcx, qword [rdi + 0x50]
test rcx, rcx
jne 0x4259a3
mov rcx, qword [0x00826910]
lea rdx, str.ERROR_in_redrawmainwnd__:_hMain_is_0_n
call fcn.0041db00
jmp 0x4252e0
mov rdi, qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4c
mov byte [0x008d9230], 0
call rdi
mov ecx, 0x4d
mov dword [rsp + 0x2090], eax
call rdi
mov ecx, 0x4e
mov dword [rsp + 0x2094], eax
call rdi
mov ecx, 0x4f
mov dword [rsp + 0x2098], eax
call rdi
mov rcx, qword [0x00828d60]
mov edx, dword [rsp + 0x2098]
mov dword [rsp + 0x209c], eax
cmp edx, dword [rcx + 0x290]
jl 0x425c28
cmp eax, dword [rcx + 0x2a8]
jge 0x4252e0
cmp edx, dword [rbp + 0x18]
jl 0x425c36
cmp eax, dword [rbp + 0x1c]
jge 0x4252e0
mov ecx, dword [rsp + 0x2094]
mov byte [0x008d9230], 1
mov r8d, dword [rsp + 0x2090]
sub eax, ecx
mov dword [rbp + 0x14], ecx
sub edx, r8d
mov ecx, eax
mov dword [rbp + 0x1c], eax
mov eax, 0x2ee00
mov dword [rbp + 0x18], edx
cdq
idiv ecx
mov dword [rbp + 0x10], r8d
lea rcx, [0x008d9240]
mov dword [0x008d9214], eax
call fcn.00421ff0
jmp 0x4252e0
cmp r12, 0x12
je 0x4252e0
mov r9, rbp
mov r8, r12
mov edx, 0x104
mov rcx, qword [rsp + 0x40e8]
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rdi, rax
jmp 0x425338
lea eax, [r12 - 0x17]
movzx r13d, r12w
cmp ax, 8
ja case.default.0x425cd4
lea rdx, [0x007fe458]
movzx eax, ax
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
xor dword [0x008d9200], 0x40
nop dword [rax]
mov rax, r12
shr rax, 0x10
cmp ax, 1
jne 0x4252e0
cmp r12w, 0x11
je 0x42734a
cmp r12w, 0x12
jne 0x4252e0
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov r13, qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x147
call r13
lea r9, [0x008bf200]
mov rcx, rbp
mov edx, 0x148
mov r12, rax
mov r8, rax
call r13
mov rax, qword [0x00828d80]
mov edx, r12d
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rdi
mov byte [0x008d9230], 0
call fcn.00421ff0
jmp 0x4252e0
mov rcx, qword [0x00826970]
mov dword [rsp + 0x20], 0
xor r8d, r8d
mov r9d, 5
lea rdx, str.devmgmt.msc
call fcn.0043f4d0
jmp 0x425ce0
mov dword [0x008d922c], 0x20
mov rax, qword [0x00828c10]
mov rcx, qword [0x008d9350]
or dword [rax], 0xa
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x425ce0
mov rcx, qword [0x007e36f0]
mov edx, r13d
call fcn.0042d630
cmp r12w, 0x3e7
jbe 0x425df1
call fcn.0040c490
add eax, 0x3e7
cmp r13d, eax
jg 0x425df1
mov rax, qword [0x00828c10]
mov dword [0x008d9228], r13d
mov rcx, qword [0x008d9350]
or dword [rax], 0xa
mov rax, qword [rcx]
call qword [rax + 0x20]
lea eax, [r13 - 0x64]
cmp eax, 0xc8
ja 0x425ce0
mov eax, r13d
mov edx, 0x51eb851f
mov rcx, qword [0x007e36f0]
imul edx
shr edx, 5
imul edx, edx, 0x64
sub r13d, edx
cmp r12w, 0xc7
mov edx, r13d
jbe 0x426ae4
call fcn.0042d5e0
lea r13, [rsp + 0x90]
lea rdx, str.http:__catalog.update.microsoft.com_v7_site_search.aspx_q_s
mov r8, rax
mov rcx, r13
call qword [sym.imp.USER32.dll_wsprintfW]
movzx edx, word [rsp + 0x90]
lea r14, [rsp + 0x2090]
mov rax, r14
test dx, dx
je 0x426ab6
mov rcx, r13
jmp 0x425eb0
cmp dx, 0x5c
mov word [rax], dx
jne 0x425e9c
mov r8d, 0x25
mov r9d, 0x35
mov r10d, 0x43
mov word [rax], r8w
add rax, 4
mov word [rax - 2], r9w
mov word [rax], r10w
add rcx, 2
movzx edx, word [rcx]
add rax, 2
test dx, dx
je 0x426ab6
cmp dx, 0x26
jne 0x425e70
mov r11d, 0x25
mov r13d, 0x32
mov r15d, 0x36
mov word [rax], r11w
add rax, 4
mov word [rax - 2], r13w
mov word [rax], r15w
jmp 0x425e9c
mov dword [0x008d922c], 0x40
jmp 0x425d91
mov rax, qword [0x008d92d0]
mov rdx, qword [rax + 0x38]
cmp rdx, 0xd
je 0x42739a
mov rcx, qword [0x007e36f0]
xor r8d, r8d
call fcn.0042da10
jmp 0x425ce0
mov eax, dword [0x008d9200]
xor r8d, r8d
mov edx, 0xd
mov rcx, qword [0x007e36f0]
xor ah, 4
test ah, 4
mov dword [0x008d9200], eax
sete r8b
call fcn.0042d580
mov rcx, qword [0x007e36f0]
xor edx, edx
call fcn.0042dc10
jmp 0x425ce0
mov rax, qword [0x008d92d0]
mov rcx, qword [0x007e36f0]
mov rdx, qword [rax + 0x38]
call fcn.0042e4f0
test byte [0x008d9200], 0x10
jne 0x425ce0
mov rcx, qword [rdi + 0x58]
test rcx, rcx
je 0x427514
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x425ce0
mov rcx, qword [0x007e36f0]
call fcn.0042e7d0
test eax, eax
jne 0x425989
cmp r12, 2
je 0x426d5b
mov rdx, r12
mov rcx, qword [rsp + 0x40e8]
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x4252e0
lea rdx, [rsp + 0x2090]
mov rcx, qword [rsp + 0x40e8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x40e8]
mov r9d, dword [rsp + 0x209c]
mov r8d, dword [rsp + 0x2098]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 1
call qword [rax + 0x18]
mov eax, dword [rsp + 0x209c]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi]
add eax, 1
mov r10, qword [rcx]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x2098]
mov dword [rsp + 0x28], 0
lea r9d, [rax + 1]
call qword [r10 + 0x48]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 0x38]
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [rdi]
call fcn.00410340
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x4252e0
mov eax, dword [rdi + 0x74]
shr r12, 0x10
movsx r12d, r12w
test eax, eax
je 0x426840
mov eax, r12d
mov edx, 0x66666667
imul edx
mov eax, r12d
sar eax, 0x1f
sar edx, 3
sub eax, edx
add eax, dword [0x008d9214]
cmp eax, 0x95
mov dword [0x008d9214], eax
jg 0x426b51
mov dword [0x008d9214], 0x96
jmp 0x4252e0
call fcn.00407310
mov r9d, 0x50200000
xor r8d, r8d
xor ecx, ecx
mov qword [rdi], rax
mov rdx, qword [0x008d9348]
mov rax, qword [rsp + 0x40e8]
mov r12, qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rdi + 0x50], rax
mov qword [rsp + 0x50], rdx
lea rdx, str.classSDIField
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r12
mov ecx, 0x48
mov qword [rdi + 0x58], rax
call fcn.007da0a0
mov qword [rax], 0
mov rbp, rax
mov dword [rax + 8], 0
mov dword [rax + 0xc], 1
mov dword [rax + 0x10], 1
mov byte [rax + 0x14], 0
mov dword [rax + 0x18], 0
mov qword [rax + 0x20], 0
call fcn.00405b60
mov qword [rbp + 0x28], rax
call fcn.00405b60
mov qword [rbp + 0x30], rax
mov rax, qword [0x008d9348]
mov r9d, 0x80000000
mov ecx, 0x8080028
mov qword [rbp + 0x38], 0
lea r8, [0x007fdb40]
mov dword [rbp + 0x40], 0
lea rdx, str.classSDIPopup
mov qword [0x008d92d0], rbp
mov qword [rsp + 0x50], rax
mov rax, qword [0x008d9290]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r12
lea r12, [rsp + 0x40e8]
mov edx, 0x11
mov qword [rbp + 0x20], rax
mov rcx, r12
call fcn.00405f10
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov rcx, qword [rsp + 0x40e8]
mov qword [rdi + 0x60], rax
mov rbp, qword [sym.imp.USER32.dll_PostMessageW]
call rbp
mov edx, 0x12
mov rcx, r12
call fcn.00405f10
xor r9d, r9d
mov r8d, 1
mov edx, 0x8003
mov rcx, qword [rsp + 0x40e8]
mov qword [rdi + 0x68], rax
call rbp
mov rax, qword [0x00828d70]
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rax, qword [0x00828d80]
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov edx, 1
mov rcx, qword [rsp + 0x40e8]
call qword [sym.imp.SHELL32.dll_DragAcceptFiles]
mov rax, qword [0x008d92d8]
test rax, rax
je 0x4262be
mov edx, 1
mov ecx, 0x233
call rax
mov edx, 1
mov ecx, 0x4a
call qword [0x008d92d8]
mov edx, 1
mov ecx, 0x49
call qword [0x008d92d8]
mov rcx, qword [0x007e36f0]
call fcn.00431890
mov edx, dword [0x008d9224]
xor r8d, r8d
mov rcx, qword [0x007e36f0]
call fcn.0042bb60
mov rcx, qword [0x007e36f0]
call fcn.0042d780
jmp 0x4252e0
cmp r12, 8
ja 0x4252e0
mov rcx, qword [0x00828d60]
mov r9d, 1
mov r8d, dword [0x008d9214]
mov eax, dword [rcx + 0x2c0]
shl eax, 8
cdq
idiv r8d
mov edx, dword [rcx + 0x2d8]
mov ecx, r12d
shl r9, cl
test r9d, 0x16c
mov rcx, r9
jne 0x426b6b
test r9b, 0x92
je 0x426354
mov r9d, dword [rbp + 8]
mov r10d, r9d
sub r10d, dword [rbp]
cmp eax, r10d
jle 0x426354
sub r9d, eax
mov dword [rbp], r9d
mov eax, edx
shl eax, 8
cdq
idiv r8d
test ecx, 0x1c6
jne 0x426b8a
and ecx, 0x38
je 0x4252e0
mov edx, dword [rbp + 0xc]
mov ecx, edx
sub ecx, dword [rbp + 4]
cmp eax, ecx
jle 0x4252e0
sub edx, eax
mov dword [rbp + 4], edx
jmp 0x4252e0
lea r14, [rsp + 0x2090]
xor edx, edx
mov r8d, 0x208
mov rcx, r14
call sub.msvcrt.dll_memset
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r12
mov rdi, qword [sym.imp.SHELL32.dll_DragQueryFileW]
call rdi
cmp eax, 1
je 0x4269c3
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragFinish]
jmp 0x4252e0
lea r14, [rsp + 0x2090]
mov rcx, qword [rdi + 0x50]
mov rdx, r14
call qword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [rdi + 0x18], 2
je 0x426aa3
mov edx, dword [rdi + 0x10]
movsx ebp, bp
mov eax, edx
sub eax, ebp
mov ecx, eax
sar ecx, 0x1f
xor eax, ecx
sub eax, ecx
cmp eax, 2
jle 0x426954
mov r10d, dword [rdi + 0x14]
movsx r13d, r13w
mov eax, ebp
mov r8d, dword [rsp + 0x2094]
mov dword [rdi + 0x18], 2
sub eax, edx
mov r9d, dword [rsp + 0x209c]
mov edx, eax
mov rax, qword [0x00828d30]
mov r11d, dword [rsp + 0x2090]
mov rcx, qword [rdi + 0x50]
sub r9d, r8d
add r8d, r13d
mov r15d, dword [rax]
xor eax, eax
mov dword [rsp + 0x20], r9d
mov r9d, dword [rsp + 0x2098]
mov dword [rsp + 0x28], 1
test r15d, r15d
setne al
sub r9d, r11d
sub r8d, r10d
neg eax
or eax, 1
imul edx, eax
add edx, r11d
call qword [sym.imp.USER32.dll_MoveWindow]
jmp 0x42538e
mov rcx, qword [rdi + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r13, qword [0x00828d80]
xor r9d, r9d
mov rdx, qword [rdi + 0x68]
lea r8, [0x007fe080]
mov rcx, qword [r13]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rdi + 0x68]
lea rdx, [0x008bf200]
mov rax, qword [rcx]
call qword [rax + 0x20]
cmp eax, 0xffffffff
mov ebp, eax
je 0x426ce0
mov rcx, qword [r13]
mov edx, ebp
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, dword [0x008d9218]
test eax, eax
je 0x4264fd
mov rdx, qword [0x00828d60]
mov dword [rdx + 0x290], eax
mov eax, dword [0x008d921c]
test eax, eax
je 0x426514
mov rdx, qword [0x00828d60]
mov dword [rdx + 0x2a8], eax
mov rcx, qword [rdi + 0x68]
mov edx, ebp
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, rdi
call fcn.00421ff0
test r12, r12
je 0x4252e0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x2090]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [0x008d9220]
mov rcx, qword [0x00828d60]
mov r9d, dword [rsp + 0x209c]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x2098]
mov r8d, dword [rcx + 0x290]
mov ecx, dword [rcx + 0x2a8]
sub eax, r8d
mov edx, eax
sub r9d, ecx
shr edx, 0x1f
add edx, eax
mov eax, r9d
shr eax, 0x1f
sar edx, 1
add eax, r9d
mov dword [rsp + 0x7c], edx
add edx, r8d
sar eax, 1
mov dword [rsp + 0x84], edx
mov dword [rsp + 0x80], eax
lea rdx, [rsp + 0x60]
add eax, ecx
mov rcx, qword [rsp + 0x40e8]
mov dword [rsp + 0x88], eax
call qword [sym.imp.USER32.dll_SetWindowPlacement]
jmp 0x4252e0
mov rcx, qword [0x00826910]
lea rdx, str.Sync
mov rdi, qword [0x007e36f0]
call fcn.0041e020
cmp byte [0x008d931c], 0
jne 0x42698c
mov rcx, qword [0x00826910]
lea rdx, str...._n
call fcn.0041e020
mov eax, dword [0x008d9318]
add eax, 1
and eax, 1
mov dword [0x008d9318], eax
cdqe
lea rdx, [rax*4]
add rax, rdx
lea rdx, [0x008d9380]
lea rcx, [rdx + rax*8]
mov rax, qword [r12 + 0x8f0]
mov rdx, rdi
mov qword [0x007e36f0], rcx
mov qword [rcx + 0x20], rax
call fcn.00431c50
jmp 0x4252e0
mov eax, dword [rdi + 0x1c]
test eax, eax
je 0x4252e0
mov rax, qword [0x00827d40]
movsx ebp, bp
movsx r13d, r13w
mov dword [rsp + 0x20a0], 0
lea r14, [rsp + 0x2090]
mov dword [rsp + 0x2098], ebp
mov dword [rsp + 0x209c], r13d
mov rdx, r14
mov dword [rsp + 0x20a4], 0
add rax, 0x10
mov byte [rsp + 0x20b0], 0
mov qword [rsp + 0x2090], rax
mov rax, qword [0x00828d90]
mov dword [rsp + 0x20a8], 2
mov dword [rsp + 0x20ac], 0
mov byte [rsp + 0x20b1], 0
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x48]
jmp 0x425759
test rbp, rbp
je 0x426979
cmp rbp, 1
jne 0x4252e0
mov rax, qword [0x00828c60]
mov rbp, qword [rax + 0xd88]
mov r12, qword [0x008d9308]
test rbp, rbp
lea rax, [0x007fdb40]
cmove rbp, rax
test r12, r12
je 0x4252e0
lea r13, [rsp + 0x2090]
xor eax, eax
mov ecx, 0xa
mov rdi, r13
xor r8d, r8d
mov r9, r13
rep stosq qword [rdi], rax
mov edx, 0x14
mov rcx, r12
mov dword [rsp + 0x2090], 0x50
mov dword [rsp + 0x2094], 0x42
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x4252e0
mov qword [rsp + 0x20c8], rbp
mov r9, r13
xor r8d, r8d
mov edx, 0x14
mov dword [rsp + 0x2098], 0
mov rcx, r12
mov dword [rsp + 0x209c], 0
call qword [sym.imp.USER32.dll_SetMenuItemInfoW]
jmp 0x4252e0
mov edi, 1
jmp 0x425338
mov rdx, qword [0x00828c60]
lea rax, [0x007fdb40]
mov r9d, 0x24
mov rcx, qword [rdi + 0x50]
mov r8, qword [rdx + 0x14a8]
mov rdx, qword [rdx + 0x14c0]
test r8, r8
cmove r8, rax
test rdx, rdx
cmove rdx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4252e0
mov rax, qword [0x008269c0]
mov dword [rbp], 2
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x4252e0
mov dword [0x008d9234], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov dword [0x008d9218], 0
mov rcx, qword [rsp + 0x40e8]
mov dword [0x008d921c], 0
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax]
mov eax, dword [rdi + 0x78]
test eax, eax
je 0x42699e
mov rcx, qword [0x008d92d0]
mov eax, r12d
mov edx, 0x66666667
sar r12d, 0x1f
imul edx
mov eax, dword [rcx + 0x18]
sar edx, 1
sub r12d, edx
mov edx, 0
add eax, r12d
test eax, eax
cmovg eax, edx
mov dword [rcx + 0x18], eax
mov rcx, qword [rcx + 0x20]
jmp 0x4259a3
mov eax, dword [0x008d9214]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0x40e8]
sub eax, 6
mov dword [0x008d9214], eax
mov dword [0x008d9234], eax
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9d, dword [rdi + 0x74]
test r9d, r9d
jne 0x42588d
nop dword [rax]
xor eax, eax
xor ecx, ecx
jmp 0x4258e0
cmp r12w, 0x35
je 0x42723d
jbe 0x426ba4
cmp r12w, 0x37
je 0x427092
jb 0x42707d
cmp r12w, 0x39
je 0x426fec
cmp r12w, 0x2710
jne 0x4272ac
mov ecx, 0x2d0
call fcn.007da0a0
mov rcx, rax
mov rbx, rax
call fcn.0044f130
mov rcx, rbx
mov qword [0x008d9370], rbx
call fcn.0044ee80
mov rbx, qword [0x008d9370]
test rbx, rbx
je 0x425336
mov rcx, rbx
xor edi, edi
call fcn.00701800
mov rcx, rbx
call fcn.007da050
jmp 0x425338
mov r10d, dword [rdi + 0x14]
movsx r13d, r13w
mov eax, r10d
sub eax, r13d
mov ecx, eax
sar ecx, 0x1f
xor eax, ecx
sub eax, ecx
cmp eax, 2
jg 0x426423
jmp 0x42538e
mov rax, qword [0x00828c60]
mov rbp, qword [rax + 0xd70]
jmp 0x426701
lea rcx, [0x008d9320]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x4265ec
test r12d, r12d
mov rcx, qword [rdi + 0x58]
mov r9d, 0
mov edx, 0x115
setle r8b
movzx r8d, r8b
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4252e0
xor ebp, ebp
xor edx, edx
mov r9d, 0x104
mov word [rsp + 0x2090], bp
mov r8, r14
mov rcx, r12
call rdi
test eax, eax
je 0x4263c8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4269fb
test al, 0x10
jne 0x427437
lea rdx, str..snp
mov rcx, r14
call sub.SHELL32.dll_StrStrIW
test rax, rax
je 0x4263c8
lea rcx, [0x008cf200]
mov rdx, r14
call fcn.0068bb48
mov rax, qword [0x00828c10]
mov dword [0x008d9204], 1
mov rcx, qword [0x008d9350]
or dword [rax], 0xe
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x4263c8
mov r8d, dword [rdi + 0x74]
test r8d, r8d
je 0x4252e0
mov rcx, qword [0x007e36f0]
call fcn.0042ddc0
mov rcx, qword [0x007e36f0]
call fcn.0042d780
test byte [0x008d9200], 0x10
je 0x425996
jmp 0x4252e0
test ecx, ecx
mov rax, qword [0x00828c10]
jne 0x4256ac
mov rcx, qword [0x008d9350]
or dword [rax], 0xf
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x4252e0
movsx ebp, bp
movsx r13d, r13w
mov edx, dword [rdi + 0x10]
mov r10d, dword [rdi + 0x14]
jmp 0x426423
mov rcx, qword [0x00826970]
xor edx, edx
mov r9d, 5
mov r8, r14
mov word [rax], dx
lea rdx, [0x007fdb78]
mov dword [rsp + 0x20], 0
call fcn.0043f4d0
jmp 0x425ce0
call fcn.0042d5e0
mov rcx, rax
mov r14, rax
call sub.msvcrt.dll_wcslen
mov ecx, 2
lea r15, [rax + rax + 2]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r13, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, r15
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, r13
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x425ce0
cmp eax, 0x15e
jle 0x426809
mov dword [0x008d9214], 0x15e
jmp 0x4252e0
mov r10d, dword [rbp]
mov r9d, dword [rbp + 8]
sub r9d, r10d
cmp eax, r9d
jle 0x426354
add eax, r10d
mov dword [rbp + 8], eax
jmp 0x426354
mov ecx, dword [rbp + 4]
mov edx, dword [rbp + 0xc]
sub edx, ecx
cmp eax, edx
jle 0x4252e0
add eax, ecx
mov dword [rbp + 0xc], eax
jmp 0x4252e0
cmp r12w, 0x33
je 0x426fc1
ja 0x426f96
cmp r12w, 0x32
jne 0x4272ac
mov rcx, qword [0x00826970]
lea rdx, [0x007fe1a6]
xor edi, edi
call fcn.0043f8c0
jmp 0x425338
cmp r12w, 0x11
je 0x427047
ja 0x427017
cmp r12w, 0x10
jne 0x4272ac
mov qword [rsp + 0x20], 0
lea r9, [0x0041e9b0]
xor edi, edi
mov r8, qword [0x008d9290]
mov edx, 0x320
mov rcx, qword [0x008d9348]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x425338
mov eax, dword [0x008d9214]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0x40e8]
add eax, 6
mov dword [0x008d9214], eax
mov dword [0x008d9234], eax
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4258a4
xor r9d, r9d
xor r8d, r8d
mov dword [0x008d9214], 0x100
mov edx, 0x8003
mov dword [0x008d9234], 0x100
mov rcx, qword [rsp + 0x40e8]
call qword [sym.imp.USER32.dll_PostMessageW]
mov r10d, dword [rdi + 0x74]
test r10d, r10d
jne 0x425876
xor ecx, ecx
xor eax, eax
jmp 0x4258ba
mov rax, qword [0x00828bd0]
mov r8d, dword [rax]
mov eax, edx
test r8d, r8d
jne 0x4258ef
test byte [0x008d9202], 1
je 0x4274d3
mov rcx, qword [0x007e36f0]
mov edx, 1
call fcn.0042d160
mov ecx, dword [rdi + 0x74]
test ecx, ecx
setne al
jmp 0x4258ef
mov rcx, qword [r13]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ebp, eax
jmp 0x4264da
call fcn.0041d840
mov rcx, qword [rdi + 0x50]
xor r9d, r9d
lea r8, str.Message
lea rdx, str.Windows_data_recorded_into_the_log.
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4252e0
mov rcx, qword [rdi + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x28]
lea ebp, [rax - 1]
jmp 0x425a1f
cmp r12, 0x20
jne 0x4252e0
mov rax, qword [0x008d92d0]
mov dword [rdi + 0x78], 0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax + 0x20]
mov dword [rax + 0x18], 0
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4252e0
mov rax, qword [0x008275b0]
lea rcx, [0x008d9240]
mov edx, dword [rax]
call fcn.00423b70
jmp 0x425faf
mov rax, qword [0x00827d40]
lea r14, [rsp + 0x2090]
mov dword [rsp + 0x2098], 0
mov dword [rsp + 0x209c], 0
mov rdx, r14
mov dword [rsp + 0x20a0], 0x28
mov dword [rsp + 0x20a4], 0
add rax, 0x10
mov byte [rsp + 0x20b0], 0
mov qword [rsp + 0x2090], rax
mov rax, qword [0x00828d90]
mov dword [rsp + 0x20a8], 2
mov dword [rsp + 0x20ac], 0
mov byte [rsp + 0x20b1], 0
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, r14
call fcn.0040f030
jmp 0x42591f
xor eax, str.________nddd_nddd
mov dword [0x008d9200], eax
jmp 0x425968
xor eax, 0x880000
mov dword [0x008d9200], eax
jmp 0x425968
mov rax, qword [0x00827d40]
lea r14, [rsp + 0x2090]
mov dword [rsp + 0x2098], 0
mov dword [rsp + 0x209c], 0
mov rdx, r14
mov dword [rsp + 0x20a0], 0x27
mov dword [rsp + 0x20a4], 0
add rax, 0x10
mov byte [rsp + 0x20b0], 0
mov qword [rsp + 0x2090], rax
mov rax, qword [0x00828d90]
mov dword [rsp + 0x20a8], 2
mov dword [rsp + 0x20ac], 0
mov byte [rsp + 0x20b1], 0
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, r14
call fcn.0040f030
mov ecx, dword [rdi + 0x74]
test ecx, ecx
setne al
jmp 0x4258fd
lea rax, [0x00841400]
xor edx, edx
lea rcx, [rsp + 0x2090]
mov qword [rsp + 0x2090], rax
call fcn.0041f6c0
mov ecx, dword [rdi + 0x74]
test ecx, ecx
setne al
jmp 0x4258c8
lea rax, [0x008414e0]
xor edx, edx
lea rcx, [rsp + 0x2090]
mov qword [rsp + 0x2090], rax
call fcn.0041f620
mov ecx, dword [rdi + 0x74]
test ecx, ecx
setne al
jmp 0x4258e0
mov rcx, qword [0x00826910]
lea rdx, str._n_n
call fcn.0041e020
mov ecx, dword [rdi + 0x74]
test ecx, ecx
setne al
jmp 0x4258ba
cmp r12w, 0x14
jne 0x4272ac
mov rbx, qword [0x008269c0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x425336
mov rax, qword [rcx]
and dword [0x008d9200], 0xbfffffff
call qword [rax + 0x50]
mov rcx, qword [rbx]
test al, al
mov rax, qword [rcx]
je 0x427462
call qword [rax + 0x98]
jmp 0x425336
lea rcx, [0x008d9240]
mov edx, 1
xor edi, edi
mov dword [0x008d92f0], 0
call fcn.00423b70
jmp 0x425338
mov rcx, qword [0x00826970]
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edi, edi
lea rdx, str._windir_System32SystemPropertiesProtection.exe
mov r9d, 1
call fcn.0043f5c0
jmp 0x425338
mov rcx, qword [0x00826970]
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edi, edi
lea rdx, str.compmgmt.msc
mov r9d, 5
call fcn.0043f4d0
jmp 0x425338
mov rcx, qword [0x00826970]
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edi, edi
lea rdx, str.SystemPropertiesAdvanced
mov r9d, 1
call fcn.0043f5c0
jmp 0x425338
mov qword [rsp + 0x20], 0
lea r9, [0x0041f8e0]
xor edi, edi
mov r8, qword [0x008d9290]
mov edx, 0x12d
mov rcx, qword [0x008d9348]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x425338
mov dword [rsp + 0x28], 5
xor r9d, r9d
mov rcx, qword [0x008d9290]
xor edi, edi
mov qword [rsp + 0x20], 0
lea r8, [0x008cd200]
lea rdx, str.explore
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x425338
mov rcx, qword [0x00826970]
xor edx, edx
xor edi, edi
call fcn.0043f8c0
jmp 0x425338
lea r14, [rsp + 0x2090]
lea rax, [r14 + 0x10]
lea rcx, str._windir__system32_restore_rstrui.exe
mov qword [rsp + 0x2090], rax
call sub.msvcrt.dll_wcslen
lea rsi, [rax + rax]
mov r8, rsi
sar r8, 1
cmp r8, 7
mov qword [rsp + 0x90], r8
ja 0x42746f
mov rdx, qword [rsp + 0x2090]
cmp r8, 1
mov rax, rdx
je 0x4274bc
lea rbx, [rsp + 0x90]
test r8, r8
jne 0x42749d
mov rax, qword [rsp + 0x90]
xor ecx, ecx
mov r8, r14
mov qword [rsp + 0x2098], rax
mov word [rdx + rax*2], cx
mov rdx, qword [0x00826970]
mov rcx, rbx
call fcn.0043f100
mov rcx, qword [rsp + 0x2090]
lea rax, [r14 + 0x10]
cmp rcx, rax
je 0x427132
call fcn.007da050
mov rdx, qword [rsp + 0x90]
mov rcx, qword [0x00826970]
call fcn.0043e770
test al, al
je 0x42740e
lea rcx, [0x007fe2a2]
call sub.msvcrt.dll_wcslen
mov rcx, r14
mov qword [rsp + 0x2098], 0
mov word [rsp + 0x20a0], 0
mov rsi, rax
lea rax, [r14 + 0x10]
mov rdx, rsi
add rdx, qword [rsp + 0x98]
mov qword [rsp + 0x2090], rax
call fcn.0079f5c0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x2098]
cmp rsi, rax
ja 0x4275ba
lea rdx, [0x007fe2a2]
mov r8, rsi
mov rcx, r14
call fcn.0079f760
mov r8, qword [rsp + 0x98]
mov rcx, r14
mov rdx, qword [rsp + 0x90]
call fcn.0079f760
mov rdx, r14
mov rcx, rbx
add r14, 0x10
call fcn.007a0180
mov rcx, qword [rsp + 0x2090]
cmp rcx, r14
je 0x4271f8
call fcn.007da050
mov r8, qword [rsp + 0x90]
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [0x00826970]
lea rdx, [0x007fe2c0]
call fcn.0043f4d0
mov rcx, qword [rsp + 0x90]
add rbx, 0x10
cmp rcx, rbx
je 0x425336
call fcn.007da050
jmp 0x425336
mov rcx, qword [0x00826970]
lea rdx, str._name_Microsoft.DevicesAndPrinters
xor edi, edi
call fcn.0043f8c0
jmp 0x425338
mov rax, qword [0x00828c60]
lea r8, [0x007fdb40]
mov rcx, qword [0x00826970]
lea rdx, [0x008c7200]
mov rax, qword [rax + 0x350]
test rax, rax
cmovne r8, rax
call fcn.0043e600
test al, al
je 0x425336
mov rax, qword [0x00828c10]
xor edi, edi
mov rcx, qword [0x008d9350]
or dword [rax], 9
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x425338
mov r9, rbp
mov r8, r12
mov edx, 0x112
mov rcx, qword [rsp + 0x40e8]
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rdi, rax
jmp 0x425338
lea rcx, [0x008d9240]
mov edx, 2
xor edi, edi
mov dword [0x008d92f0], 0
call fcn.00423b70
jmp 0x425338
mov rcx, qword [0x00826970]
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edi, edi
lea rdx, str.devmgmt.msc
mov r9d, 5
call fcn.0043f4d0
jmp 0x425338
mov rcx, qword [0x00826910]
lea rdx, str.ERROR_in_redrawmainwnd__:_hMain_is_0_n
call fcn.0041db00
jmp 0x425262
mov rcx, qword [0x00826910]
lea rdx, str.ERROR_in_redrawfield__:_hField_is_0_n
call fcn.0041db00
jmp 0x4252e0
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov r13, qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x147
call r13
lea r9, [0x008bd200]
mov rcx, rbp
mov edx, 0x148
mov r12, rax
mov r8, rax
call r13
mov rax, qword [0x00828d70]
mov edx, r12d
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rdi
call fcn.00421e60
jmp 0x4252e0
mov rcx, qword [0x00826970]
xor r9d, r9d
mov dword [rsp + 0x20], 0
lea r8, str._c__windir__system32_restore_rstrui.exe
lea rdx, [0x007fe2c0]
call fcn.0043f4d0
mov rcx, qword [0x00826970]
xor r9d, r9d
mov dword [rsp + 0x20], 0
lea r8, str._c__windir_Sysnative_rstrui.exe
lea rdx, [0x007fe2c0]
call fcn.0043f4d0
mov rcx, qword [0x00826970]
xor r9d, r9d
mov dword [rsp + 0x20], 0
lea r8, str._c_rstrui.exe
lea rdx, [0x007fe2c0]
call fcn.0043f4d0
jmp 0x425ce0
mov rcx, qword [0x00826970]
mov dword [rsp + 0x20], 0
xor r8d, r8d
mov r9d, 1
lea rdx, str._windir_System32_rstrui.exe
call fcn.0043f5c0
jmp 0x42721e
lea rcx, [0x008c7200]
mov rdx, r14
call fcn.0068bb48
mov rax, qword [0x00828c10]
mov rcx, qword [0x008d9350]
or dword [rax], 9
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x4263c8
call qword [rax + 0x90]
xor edi, edi
jmp 0x425338
lea rbx, [rsp + 0x90]
xor r8d, r8d
mov rcx, r14
mov rdx, rbx
call fcn.0079f8b0
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x2090], rax
mov qword [rsp + 0x20a0], rdx
lea rdx, str._windir__system32_restore_rstrui.exe
mov r8, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x2090]
jmp 0x4270f4
movzx eax, word [str._windir__system32_restore_rstrui.exe]
lea rbx, [rsp + 0x90]
mov word [rdx], ax
jmp 0x4270f4
mov rcx, qword [0x007e36f0]
call fcn.0042c990
mov rcx, qword [0x007e36f0]
mov ebp, dword [rax + 0x13c]
call fcn.0042c990
lea rdx, [0x007fdc00]
mov rcx, qword [0x00828ad0]
mov r8d, ebp
add r8, qword [rax + 0x860]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x426cc2
mov rcx, qword [0x00826910]
lea rdx, str.ERROR_in_redrawfield__:_hField_is_0_n
call fcn.0041db00
jmp 0x425ce0
mov rcx, qword [rsp + 0x90]
add rbx, 0x10
cmp rcx, rbx
je 0x4275b2
call fcn.007da050
mov rcx, rsi
call fcn.0067d310
lea rcx, [0x007fe2aa]
call fcn.007cd940
mov rcx, qword [rsp + 0x2090]
add r14, 0x10
mov rsi, rax
cmp rcx, r14
je 0x42759c
call fcn.007da050
jmp 0x42759c