Function at 0x140004270
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x14002b010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebp, ecx
mov r14, rdx
lea rcx, [0x1400260d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.StartMenu:_hooking_Explorer
mov r15, rax
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
cmp ebp, 2
jne 0x140004333
movzx edx, word [0x14002de28]
test dx, dx
jne 0x1400042f6
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
movzx eax, al
shr ecx, 8
movzx edx, cl
shl ax, 8
or dx, ax
mov word [0x14002de28], dx
mov eax, 0x602
cmp dx, ax
jb 0x140004333
test dx, dx
jne 0x140004324
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
movzx eax, al
shr ecx, 8
movzx edx, cl
shl ax, 8
or dx, ax
mov word [0x14002de28], dx
mov eax, 0x603
cmp dx, ax
ja 0x140004333
mov dil, 1
jmp 0x140004336
xor dil, dil
xor ebx, ebx
mov esi, ebx
nop word [rax + rax]
test dil, dil
je 0x140004360
xor edx, edx
lea rcx, str.ApplicationManager_DesktopShellWindow
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
sete dil
test rax, rax
je 0x140004385
xor r9d, r9d
lea r8, str.Progman
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
jne 0x1400043b0
lea eax, [rbp - 2]
cmp eax, 1
ja 0x14000453c
lea rdx, str.StartMenu:_cant_find_Progman__retrying
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x78
jl 0x140004340
jmp 0x14000453c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140004464
mov r9d, 0x104
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rax
xor sil, sil
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x14000443b
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
lea rdx, str.explorer.exe
call fcn.14000e480
test eax, eax
jne 0x140004420
mov sil, 1
jmp 0x14000444f
lea r8, [rsp + 0x30]
lea rdx, str.StartMenu:_found_wrong_process__s
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
jmp 0x14000444f
lea rdx, str.StartMenu:_failed_to_get_process_name
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
jne 0x140004480
xor al, al
jmp 0x14000453e
mov r8d, dword [rsp + 0x20]
lea rdx, str.StartMenu:_failed_to_open_process__d
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
nop dword [rax]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.StartMenuDLL.dll_struct_HWND______ptr64___cdecl_FindTaskBar_unsigned_long_int_]
test rax, rax
jne 0x1400044bd
lea eax, [rbp - 2]
cmp eax, 1
ja 0x14000445d
lea rdx, str.StartMenu:_cant_find_taskbar__retrying
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x140004480
test ebp, ebp
jne 0x1400044d1
xor edx, edx
lea ecx, [rbp - 1]
call qword [sym.imp.StartMenuDLL.dll_struct_HWND______ptr64___cdecl_ToggleStartMenu_int__bool_]
mov qword [r14], rax
jmp 0x14000453c
mov rcx, qword [sym.imp.StartMenuDLL.dll_struct_HWND______ptr64___ptr64_g_TaskBar]
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rdx, qword [sym.imp.StartMenuDLL.dll_long_long___int64____cdecl_HookInject_int__unsigned_long_long_unsigned___int64___long_long___int64__]
mov r8, r15
mov r9d, eax
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x14002de20], rax
test rax, rax
jne 0x140004524
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.StartMenu:_hook_failed:_0x_08X
lea rcx, str.SoftwareOpenShellStartMenuSettingsLogStartup_LOCALAPPDATA_OpenShellStartupLog.txt
call qword [sym.imp.StartMenuDLL.dll_void___cdecl_DllLogToFile_wchar_t_const____ptr64__wchar_t_const____ptr64_]
mov rcx, qword [sym.imp.StartMenuDLL.dll_struct_HWND______ptr64___ptr64_g_TaskBar]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140007f60
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret