Function at 0x14007e860
Capabilities:
Create thread
Get common file path
Get session user name
Identify system language via api

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x12d8]
mov eax, 0x13d8
call fcn.1400e75f0
sub rsp, rax
mov qword [rbp + 0x140], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi + 0x16b0], rax
mov rcx, rsi
call fcn.14008bd60
xor r13d, r13d
mov dword [rbp + 0x1328], r13d
xor edx, edx
lea rcx, [rbp + 0x1c0]
call fcn.1400ca730
nop
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x1c0]
call fcn.1400ca8a0
test eax, eax
je 0x14007e916
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1328]
lea r8, [rbp + 0x1328]
lea rdx, str.UseSetProcessDPIAware
lea rcx, [rbp + 0x1c8]
call fcn.1400e16b0
lea rcx, [rbp + 0x1c8]
call fcn.1400e1160
cmp dword [rbp + 0x1328], 1
jne 0x14007e94b
mov rcx, qword [rsi + 0x16b0]
test rcx, rcx
je 0x14007e94b
lea rdx, str.SetProcessDPIAware
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007e94b
call rax
mov dword [rbp - 0x40], 8
mov dword [rbp - 0x3c], 0xff
lea rcx, [rbp - 0x40]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, rsi
call fcn.14007fc70
mov dword [rsp + 0x20], r13d
mov r15d, 1
mov r9d, r15d
lea r8, str.SoftwareSynapticsSynTPEnhZoneConfig
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x190]
call fcn.1400ca7a0
nop
mov dword [rbp - 0x50], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x54]
lea rdx, str.IsUsingZoneFlags
lea rcx, [rbp + 0x198]
call fcn.1400e16b0
cmp dword [rbp - 0x54], 0
jne 0x14007e9df
mov rcx, rsi
call fcn.14008aeb0
xor r9d, r9d
mov r8d, r15d
lea rdx, str.IsUsingZoneFlags
lea rcx, [rbp + 0x198]
call fcn.1400e1b10
lea rcx, [rbp + 0x198]
call fcn.1400e1160
lea r9, [0x140124f70]
lea r8, [0x140132220]
xor edx, edx
lea rcx, [rbp + 0x290]
call fcn.1400de860
mov rbx, rax
mov qword [rbp + 0x1338], rax
lea rcx, [0x140269e40]
or r12, 0xffffffffffffffff
cmp rcx, rax
je 0x14007ea30
mov r9, r12
xor r8d, r8d
mov rdx, rax
call fcn.1400075d0
nop
cmp qword [rbx + 0x18], 8
jb 0x14007ea3f
mov rcx, qword [rbx]
call fcn.1400e5d34
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r13
mov word [rbx], r13w
call fcn.1400b0f20
lea rax, vtable.CSynList_class_CRegistryKey_.0
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbp - 0x14], r15d
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
mov dword [rbp - 0x18], r13d
lea rax, vtable.CMultiLevelRegistryKey.0
mov qword [rbp - 0x30], rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x30]
call fcn.1400cadf0
test eax, eax
je 0x14007fbb0
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r15d
mov r9d, r15d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x30]
call fcn.1400cadf0
test eax, eax
je 0x14007fbb0
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xa8]
call fcn.1400ca7a0
nop
mov dword [rbp - 0x78], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x54]
lea rdx, str.IgnoreFirstTPOnOffOSDAfterSessionChange
lea rcx, [rbp + 0xb0]
call fcn.1400e16b0
mov eax, r13d
cmp dword [rsp + 0x54], eax
setne al
mov dword [rsi + 0x98c], eax
lea r8, [rsi + 0x990]
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.ChangeCursorIconDuringTPONOFF
lea rcx, [rbp + 0xb0]
call fcn.1400e16b0
cmp dword [rsi + 0x98c], 0
je 0x14007eb66
mov dword [rsi + 0x17bc], r13d
lea r8, [rsi + 0x7cc]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SwapLeftRightEdgePullZoneIfLanguageIsRTL
lea rcx, [rbp + 0xb0]
call fcn.1400e16b0
mov dword [rbp - 0x70], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x70]
lea r8, [rsp + 0x60]
lea rdx, str.AutoRotationFlag
lea rcx, [rbp - 0x30]
call fcn.1400cb0c0
mov eax, dword [rsp + 0x60]
mov dword [rsi + 0x964], eax
mov dword [rbp - 0x5c], 0x80
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x5c]
lea r8, [rsi + 0x20]
lea rdx, str.WM_TOUCHPADON_OEMOSD_String
lea rcx, [rbp - 0x30]
call fcn.1400cb1c0
mov dword [rsp + 0x68], 0x80
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x68]
lea r8, [rsi + 0xa0]
lea rdx, str.WM_TOUCHPADOFF_OEMOSD_String
lea rcx, [rbp - 0x30]
call fcn.1400cb1c0
mov dword [rbp - 0x64], 0x80
lea r8, [rsi + 0x120]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x64]
lea rdx, str.OEM_OSD_ProgramWindow
lea rcx, [rbp - 0x30]
call fcn.1400cb1c0
mov dword [rsp + 0x78], 0x80
lea r8, [rsi + 0x1a0]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x78]
lea rdx, str.OEM_OSD_ProgramFilePath
lea rcx, [rbp - 0x30]
call fcn.1400cb1c0
mov dword [rbp - 0x7c], 0x80
lea r8, [rsi + 0x3a8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x7c]
lea rdx, str.OEM_OSD_RegKeyPath
lea rcx, [rbp - 0x30]
call fcn.1400cb1c0
mov dword [rsp + 0x44], 0x80
lea r8, [rsi + 0x5b0]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
lea rdx, str.OEM_OSD_RegValueName
lea rcx, [rbp - 0x30]
call fcn.1400cb1c0
mov qword [rsp + 0x20], r13
lea r9, [rsi + 0x7b8]
lea r8, [rsi + 0x7b8]
lea rdx, str.OEM_OSD_Program_NotRunInInit
lea rcx, [rbp - 0x30]
call fcn.1400cb0c0
cmp dword [rsi + 0x7b8], 0
je 0x14007ecf2
mov dword [rsi + 0x17c0], r13d
lea r8, [rsi + 0x7bc]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SendMsgOffOnToOEMOSD_Feature
lea rcx, [rbp - 0x30]
call fcn.1400cb0c0
lea rcx, [rsi + 0x20]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [rsi + 0x7c0], eax
lea rcx, [rsi + 0xa0]
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [rsi + 0x7c4], eax
xor edx, edx
lea rcx, [rbp + 0x48]
call fcn.1400ca730
nop
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPCpl
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x48]
call fcn.1400ca8a0
test eax, eax
je 0x14007ed87
lea r8, [rsi + 0x1650]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.UIStyle
lea rcx, [rbp + 0x50]
call fcn.1400e16b0
mov dword [rbp + 0x1330], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1330]
lea r8, [rbp + 0x1330]
lea rdx, str.ScrollMethod
lea rcx, [rbp + 0xb0]
call fcn.1400e16b0
mov eax, dword [rbp + 0x1330]
mov dword [rsi + 0x165c], eax
lea r8, [rsi + 0x1660]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SynapticsScrollMethodSpeedFactor
lea rcx, [rbp + 0xb0]
call fcn.1400e16b0
lea r8, [rsi + 0x994]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.AdjustPointingSpeedBaseOnDesktopRes
lea rcx, [rbp + 0xb0]
call fcn.1400e16b0
xor ecx, ecx
call fcn.1400dd570
cmp eax, 9
jl 0x14007eeb0
lea rcx, str.DwmApi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi + 0x16a8], rax
test rax, rax
jne 0x14007ee37
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], r13
jmp 0x14007ee63
lea rdx, str.DwmIsCompositionEnabled
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x10], rax
lea rdx, str.DwmGetWindowAttribute
mov rcx, qword [rsi + 0x16a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0x18], rax
lea rdx, [rsi + 0x9e8]
mov rcx, qword [rsi + 0x9e0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp - 0x80], r13d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x14008a950]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [rsi + 0x9ec]
mov ecx, dword [rsi + 0x9e8]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea r8, [rsi + 0x176c]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.SynTPEnhExePriorityLevel
lea rcx, [rbp + 0xb0]
call fcn.1400e16b0
xor edx, edx
lea rcx, [rbp + 0x158]
call fcn.1400ca730
nop
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnhShortcutConfig
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x158]
call fcn.1400ca8a0
test eax, eax
je 0x14007ef48
mov eax, dword [rsi + 0x17b8]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, str.ShowForcePadDesktopShortcut
lea rcx, [rbp + 0x160]
call fcn.1400e16b0
mov eax, r13d
cmp dword [rsp + 0x50], eax
setne al
mov dword [rsi + 0x17b8], eax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsOEM
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x158]
call fcn.1400ca8a0
test eax, eax
je 0x14007efaf
mov eax, dword [rsi + 0x17b8]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x64]
lea rdx, str.ShowForcePadDesktopShortcut
lea rcx, [rbp + 0x160]
call fcn.1400e16b0
mov eax, r13d
cmp dword [rsp + 0x64], eax
setne al
mov dword [rsi + 0x17b8], eax
mov edx, 2
mov rcx, rsi
call fcn.14008b140
mov rcx, rsi
call fcn.14008c450
xor ecx, ecx
call fcn.1400dd570
cmp eax, 0xa
je 0x14007efdc
xor ecx, ecx
call fcn.1400dd570
cmp eax, 9
jne 0x14007efe3
xor ecx, ecx
call fcn.1400ee91c
mov rax, qword [rsi]
mov edx, 2
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1680], rax
test rax, rax
je 0x14007fb88
lea rbx, [rsi + 0x808]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test eax, eax
je 0x14007fb88
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
test eax, eax
je 0x14007fb88
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x7c]
lea rdx, str.DisplayRotationAngleFromSensorInfo
lea rcx, [rbp + 0xb0]
call fcn.1400e16b0
mov eax, dword [rsp + 0x7c]
mov dword [rsi + 0x95c], eax
mov rcx, rsi
call fcn.140083680
mov rcx, rsi
call fcn.140083a30
mov rax, qword [rbx]
mov r8d, r15d
xor edx, edx
mov rcx, rbx
call qword [rax + 0x48]
mov rax, qword [rbx]
xor r9d, r9d
mov r8, qword [rsi + 0x9e0]
lea rdx, str.SynTP
mov rcx, rbx
call qword [rax + 0x20]
test eax, eax
je 0x14007fb88
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
lea r14, [rsi + 0x1810]
mov rcx, r14
call fcn.140029fe0
test eax, eax
je 0x14007fb88
mov rcx, rsi
call fcn.14008c680
lea rcx, [rsi + 0xc28]
call fcn.140007ec0
test eax, eax
je 0x14007fb88
mov rax, qword [rsi]
mov edx, 3
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1688], rax
test rax, rax
je 0x14007fb88
mov rax, qword [rsi]
mov edx, r15d
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1698], rax
test rax, rax
je 0x14007fb88
mov rax, qword [rsi]
mov edx, 4
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x1690], rax
test rax, rax
je 0x14007fb88
mov rax, qword [rsi]
mov edx, 0xc
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x16b8], rax
test rax, rax
je 0x14007fb88
mov rax, qword [rsi]
mov edx, 0xd
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsi + 0x16a0], rax
test rax, rax
je 0x14007fb88
xor ecx, ecx
call fcn.1400dd570
cmp eax, 8
jne 0x14007f1e8
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x230]
call fcn.1400ca7a0
nop
mov dword [rbp + 0x1338], r15d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1338]
lea r8, [rbp + 0x1338]
lea rdx, str.XP64VideoOn
lea rcx, [rbp + 0x238]
call fcn.1400e16b0
mov eax, r13d
cmp dword [rbp + 0x1338], eax
setne al
mov dword [rsi + 0x1780], eax
lea rcx, [rbp + 0x230]
call fcn.1400ca840
call fcn.1400dc5d0
mov rdx, rax
mov rcx, qword [rsi + 0x1698]
call fcn.14000d520
mov rdx, qword [rsi + 0x1688]
mov rcx, qword [rsi + 0x1680]
call fcn.140042ab0
test eax, eax
je 0x14007fb88
mov eax, dword [rsi + 0x1650]
sub eax, 0x237c
cmp eax, 1
ja 0x14007f237
mov rcx, rsi
call fcn.140087640
test eax, eax
je 0x14007fb88
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rsi
lea r8, [0x14008a480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, r14
call fcn.14002bbb0
mov edx, r15d
mov rcx, rsi
call fcn.140087d20
cmp dword [rsi + 0x7ec], 0
je 0x14007f298
mov r8d, r15d
xor edx, edx
mov rcx, r14
call fcn.14002c520
test rax, rax
je 0x14007f298
test byte [rsi + 0x9b0], 1
je 0x14007f298
mov rcx, rsi
call fcn.1400887a0
lea rcx, [0x140271ff0]
call fcn.14008e680
test rax, rax
je 0x14007f2d8
test byte [rsi + 0x9b4], 1
je 0x14007f2d8
lea rcx, [0x140271ff0]
call fcn.14008e680
mov rcx, rax
call fcn.14008e560
mov dword [rsi + 0x7e0], eax
test eax, eax
je 0x14007f2d8
mov rcx, rsi
call fcn.140088820
mov rcx, rsi
call fcn.14008bf90
test eax, eax
jne 0x14007f301
lea r9, [0x14008be00]
mov edx, 0xfffe
lea r8d, [rax + 0x64]
mov rcx, qword [0x1402711c0]
call qword [sym.imp.USER32.dll_SetTimer]
lea rbx, [rsi + 0x16fc]
mov dword [rbx], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x48]
call fcn.1400ca8a0
test eax, eax
je 0x14007f39d
mov qword [rsp + 0x20], r13
mov r9, rbx
mov r8, rbx
lea rdx, str.MonitorScreenSaver
lea rcx, [rbp + 0x50]
call fcn.1400e16b0
test eax, eax
je 0x14007f39d
cmp dword [rbx], 0
je 0x14007f39d
xor edx, edx
lea rcx, str.SynTPEnhWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
lea rbx, [rsi + 0x1700]
mov rcx, rbx
call fcn.14007ddf0
mov rcx, rbx
call fcn.14007de70
call fcn.1400df0d0
test eax, eax
je 0x14007f39d
xor r9d, r9d
mov r8, rdi
xor edx, edx
lea rcx, str.SynSSHookRun.exe
call fcn.1400e06a0
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x260]
call fcn.1400ca7a0
nop
mov eax, dword [rsi + 0x1664]
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0x3c]
lea rdx, str.EnableLUA
lea rcx, [rbp + 0x268]
call fcn.1400e16b0
test eax, eax
je 0x14007f3f8
mov eax, dword [rsp + 0x3c]
mov dword [rsi + 0x1664], eax
mov dword [rsp + 0x20], r13d
mov r9d, r15d
lea r8, str.SoftwareSynapticsPersistentSynTPEnhScrybePopup
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x78]
call fcn.1400ca7a0
nop
mov dword [rbp + 0x1320], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0x1320]
lea rdx, str.FirstDelayDays
lea rcx, [rbp + 0x80]
call fcn.1400e16b0
test eax, eax
je 0x14007f452
cmp dword [rbp + 0x1320], 0xffffffff
je 0x14007f86b
mov rcx, rsi
call fcn.1400864d0
xor r9d, r9d
lea rcx, [rbp + 0x80]
test eax, eax
je 0x14007f47d
or r8d, 0xffffffff
lea rdx, str.FirstDelayDays
call fcn.1400e1b10
jmp 0x14007f86b
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x20]
lea rdx, str.FirstBootLow
call fcn.1400e16b0
test eax, eax
jne 0x14007f4ec
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x14007f4ec
xor r9d, r9d
mov r8d, dword [rbp - 0x48]
lea rdx, str.FirstBootLow
lea rcx, [rbp + 0x80]
call fcn.1400e1b10
xor r9d, r9d
mov r8d, dword [rbp - 0x44]
lea rdx, str.FirstBootHigh
lea rcx, [rbp + 0x80]
call fcn.1400e1b10
mov dword [rbp - 0x68], 0x400
mov qword [rsp + 0x28], r13
lea rax, str.0xFFFFFFFF_15_0xFFFFFFFF_1311_1312_1313
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x68]
lea r8, [rbp + 0xad0]
lea rdx, str.ScrybePopup
lea rcx, [rbp + 0x50]
call fcn.1400e17c0
lea r8, [rsi + 0x1788]
lea rdx, [0x1401276d8]
lea rcx, [rbp + 0xad0]
call fcn.1400deb50
mov rdi, qword [rsi + 0x1788]
add rdi, 0xc
call fcn.140004f70
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14007f564
mov ecx, 0x80004005
call fcn.140004f20
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15d, r13d
mov dword [rsp + 0x40], r13d
mov dword [rbp - 0x60], r13d
cmp rdi, qword [rsi + 0x1790]
je 0x14007f7d7
lea r14, [rdi + 4]
xor r8d, r8d
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, dword [rdi]
lea rcx, [rbp + 0x40]
call fcn.1400b1580
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14007f603
cmp dword [rbx + 0x10], 0
jl 0x14007f5f4
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007f5f4
call fcn.14000b840
mov r15, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14007f5e4
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r15 + 0x18]
mov qword [rsp + 0x30], rax
mov r15d, dword [rsp + 0x40]
jmp 0x14007f603
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000be20
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f61b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0x10], 0
jne 0x14007f651
mov r8, qword [rsi + 0x1790]
sub r8, r14
sar r8, 2
lea r8, [r8*4]
mov rdx, r14
mov rcx, rdi
call fcn.1400e61a0
add qword [rsi + 0x1790], 0xfffffffffffffffc
jmp 0x14007f65c
mov r15d, 1
mov dword [rsp + 0x40], r15d
add rdi, 4
add r14, 4
cmp rdi, qword [rsi + 0x1790]
jne 0x14007f593
test r15d, r15d
mov r13d, dword [rbp - 0x60]
je 0x14007f7d7
mov rdi, qword [rsi + 0x1788]
add rdi, 0xc
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
cmp ax, 9
je 0x14007f7e4
cmp rdi, qword [rsi + 0x1790]
je 0x14007f7d7
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov edx, dword [rdi]
lea rcx, [rbp + 0x28]
call fcn.1400b1580
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14007f71f
cmp dword [rbx + 0x10], 0
jl 0x14007f710
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007f710
call fcn.14000b840
mov r14, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14007f702
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rsp + 0x30], rax
xor r14d, r14d
jmp 0x14007f71f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000be20
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f737
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 0x409
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov edx, dword [rdi]
lea rcx, [rbp + 0x30]
call fcn.1400b1580
nop
mov rdx, qword [rax]
mov eax, r14d
test rdx, rdx
setne al
test eax, eax
je 0x14007f7cc
mov rax, qword [rsp + 0x30]
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14007f787
add rax, 2
test cx, cx
jne 0x14007f770
mov ebx, r14d
jmp 0x14007f78c
sbb ebx, ebx
or ebx, 1
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f7a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
mov eax, 1
cmovne r13d, eax
add rdi, 4
mov rbx, qword [rsp + 0x30]
cmp rdi, qword [rsi + 0x1790]
jne 0x14007f6b1
test r13d, r13d
je 0x14007f7d7
jmp 0x14007f7e4
mov ecx, 0x80004005
call fcn.140004f20
nop
mov rax, qword [rsi + 0x1788]
mov dword [rax], 0xffffffff
mov rax, qword [rsi + 0x1788]
mov r8d, dword [rax]
mov dword [rbp + 0x1320], r8d
xor r9d, r9d
lea rdx, str.FirstDelayDays
lea rcx, [rbp + 0x80]
call fcn.1400e1b10
xor r9d, r9d
lea r8d, [r9 + 3]
lea rdx, str.NextMsgIndex
lea rcx, [rbp + 0x80]
call fcn.1400e1b10
mov rax, qword [rsi + 0x1788]
xor r9d, r9d
mov r8d, dword [rax + 8]
lea rdx, str.RepeatTimes
lea rcx, [rbp + 0x80]
call fcn.1400e1b10
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14007f85b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15d, 1
xor r13d, r13d
lea r14, [rsi + 0x1810]
mov dword [rsp + 0x38], 0xdbba0
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x38]
lea rdx, str.ScrybePopupTimerTimeout
lea rcx, [rbp + 0x50]
call fcn.1400e16b0
cmp dword [rbp + 0x1320], 0xffffffff
je 0x14007f8b9
lea r9, [0x14008bf70]
mov r8d, dword [rsp + 0x38]
mov edx, 0xfffc
mov rcx, qword [0x1402711c0]
call qword [sym.imp.USER32.dll_SetTimer]
mov dword [rbp - 0x58], 0x101
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r9, [rbp + 0x8c0]
lea r8, str..pipe_s00781D6E_0417_44d2_8082_9257B2CA9E0A
mov edx, 0x200
lea rcx, [rbp + 0x4c0]
call fcn.1400e7b40
lea r9, [0x140124f70]
lea r8, [0x140132220]
xor edx, edx
lea rcx, [rbp + 0x210]
call fcn.1400de860
cmp qword [rax + 0x10], 0
setne bl
cmp qword [rbp + 0x228], 8
jb 0x14007f92a
mov rcx, qword [rbp + 0x210]
call fcn.1400e5d34
test bl, bl
je 0x14007f98e
lea r9, [0x140124f70]
lea r8, [0x140132220]
xor edx, edx
lea rcx, [rbp + 0x1f0]
call fcn.1400de860
cmp qword [rax + 0x18], 8
jb 0x14007f954
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4c0]
lea r8, str._s_s
mov edx, 0x200
lea rcx, [rbp + 0x4c0]
call fcn.1400e7b40
cmp qword [rbp + 0x208], 8
jb 0x14007f98e
mov rcx, qword [rbp + 0x1f0]
call fcn.1400e5d34
mov edx, 0x3d
lea rcx, [rbp + 0x4c0]
call fcn.140002990
mov qword [rsi + 0x17b0], rax
test rax, rax
je 0x14007f9b7
lea rdx, [rsi + 8]
mov rcx, rax
call fcn.140002740
xor eax, eax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], rax
mov dword [rbp + 0x138], eax
mov dword [rsp + 0x20], 0x4c
lea r9, [rbp + 0xf0]
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 4]
call sub.POWRPROF.dll_CallNtPowerInformation
cmp byte [rbp + 0x104], 0
je 0x14007fb1e
mov dword [rsi + 0x16f8], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x48]
call fcn.1400ca8a0
test eax, eax
je 0x14007fa79
mov qword [rsp + 0x20], r13
lea r9, [rsi + 0x16f8]
lea r8, [rsi + 0x16f8]
lea rdx, str.ConnectStandbyDisable
lea rcx, [rbp + 0x50]
call fcn.1400e16b0
cmp dword [rsi + 0x16f8], 0
jne 0x14007fb1e
mov edx, 0x104
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rbp + 0x2b0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14007faa3
movups xmm0, xmmword [str.Powrprof.dll]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x140135758]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x140135760]
mov dword [rcx + 0x18], eax
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14007fb1e
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007fb1e
lea rdx, [0x140082b30]
mov qword [rbp + 0xd8], rdx
mov qword [rbp + 0xe0], rsi
lea r8, [rbp + 0x188]
lea rdx, [rbp + 0xd8]
mov ecx, 2
call rax
call fcn.14005d230
cmp dword [rax + 4], 0
je 0x14007fb36
call fcn.14005d230
mov rcx, rax
call fcn.14007aae0
mov rcx, qword [rsi + 0x1690]
call fcn.140098970
xor ecx, ecx
call fcn.1400dd570
cmp eax, 0xb
je 0x14007fb5a
xor ecx, ecx
call fcn.1400dd570
cmp eax, 0xc
jne 0x14007fb62
mov rcx, r14
call fcn.14002be10
mov edx, r15d
mov rcx, rsi
call fcn.14008a090
mov esi, r15d
lea rcx, [rbp + 0x78]
call fcn.1400ca840
nop
lea rcx, [rbp + 0x260]
call fcn.1400ca840
jmp 0x14007fb8b
mov esi, r13d
lea rcx, [rbp + 0x158]
call fcn.1400ca840
nop
lea rcx, [rbp + 0x48]
call fcn.1400ca840
nop
lea rcx, [rbp + 0xa8]
call fcn.1400ca840
jmp 0x14007fbb3
mov esi, r13d
lea rax, vtable.CSynList_class_CRegistryKey_.0
mov qword [rbp - 0x30], rax
mov rbx, qword [rbp - 0x28]
test rbx, rbx
je 0x14007fc2a
test rbx, rbx
je 0x14007fc2a
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
test rcx, rcx
je 0x14007fbdf
mov qword [rcx + 8], rax
jmp 0x14007fbe3
mov qword [rbp - 0x28], rax
mov rcx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
test rcx, rcx
je 0x14007fbf6
mov qword [rcx + 0x10], rax
jmp 0x14007fbfa
mov qword [rbp - 0x20], rax
mov rdi, qword [rbx + 8]
cmp dword [rbp - 0x14], 0
je 0x14007fc17
mov rcx, qword [rbx]
test rcx, rcx
je 0x14007fc17
mov rax, qword [rcx]
mov edx, r15d
call qword [rax]
mov qword [rbx], r13
mov rcx, rbx
call fcn.1400e5d34
mov rbx, rdi
dec dword [rbp - 0x18]
test rdi, rdi
jne 0x14007fbc7
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
lea rcx, [rbp + 0x190]
call fcn.1400ca840
nop
lea rcx, [rbp + 0x1c0]
call fcn.1400ca840
mov eax, esi
add rsp, 0x13d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret