Function at 0x1400b7210
Capabilities:
Check for unmoving mouse cursor
Check if file exists
Create process on windows
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xbd0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rsp + 0xbc0], rax
mov rsi, rdx
mov rdi, rcx
mov r8, qword [rcx + 0x6c8]
mov rdx, qword [rdx]
cmp r8, rdx
je 0x1400b729f
cmp qword [rcx + 0x4a8], rdx
je 0x1400b729f
xor r12b, r12b
mov byte [rsp + 0x40], r12b
xor ebx, ebx
cmp qword [rcx + 0x628], rdx
je 0x1400b728b
cmp qword [rcx + 0x560], rdx
je 0x1400b728b
xor r15b, r15b
xor r14d, r14d
mov r13d, r14d
jmp 0x1400b7298
mov r15b, 1
lea r13, [rcx + 0x610]
xor r14d, r14d
mov eax, 0x548
jmp 0x1400b72bd
mov r12b, 1
mov byte [rsp + 0x40], r12b
movzx ebx, r12b
xor r15b, r15b
lea r13, [rcx + 0x6b0]
mov eax, 0x490
xor r14d, r14d
add rcx, rax
mov qword [rsp + 0x48], rcx
mov eax, dword [rsi + 0x10]
cmp eax, 0xfffffcb7
ja 0x1400b814a
je 0x1400b809a
add eax, 0xfffff82f
cmp eax, 0x50
ja case.0x1400b7302.2004
lea r9, [0x140000000]
movzx eax, byte [r9 + rax + 0xb9b4c]
mov ecx, dword [r9 + rax*4 + 0xb9b18]
add rcx, r9
jmp rcx
test r13, r13
je case.0x1400b7302.2004
test byte [rsi + 0x28], 3
je 0x1400b734c
movzx edx, byte [rsi + 0x28]
and dl, 1
mov r9, qword [rsi + 0x38]
mov r8, qword [rsi + 0x18]
mov rcx, qword [rdi + 0x890]
call fcn.140103ed0
mov byte [0x1402a3ac0], 1
mov byte [rdi + 0x97990], 1
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.USER32.dll_InvalidateRect]
test byte [rsi + 0x28], 0x63
je 0x1400b7364
mov rax, qword [rdi + 0x890]
mov rcx, qword [rax + 0x40]
mov byte [rcx + 0x100], 1
mov eax, dword [rsi + 0x28]
test al, 8
je 0x1400b7398
cmp byte [0x1402a3ac0], 0
je case.0x1400b7302.2004
mov r9d, dword [rsi + 0x6c]
mov r8d, dword [rsi + 0x68]
mov rdx, qword [rsi + 0x60]
mov rcx, r13
call fcn.1400fb640
mov byte [0x1402a3ac0], 0
jmp case.0x1400b7302.2004
test al, 3
jne case.0x1400b7302.2004
mov byte [0x1402a3ac0], 0
jmp case.0x1400b7302.2004
test r12b, r12b
je 0x1400b73ba
mov rbx, qword [rdi + 0x6f0]
jmp 0x1400b7422
test r15b, r15b
je 0x1400b73c8
mov rbx, qword [rdi + 0x650]
jmp 0x1400b7422
cmp rdx, qword [rdi + 0x768]
jne 0x1400b73da
lea rcx, [rdi + 0x750]
jmp 0x1400b73ee
cmp rdx, qword [rdi + 0x808]
jne case.0x1400b7302.2004
lea rcx, [rdi + 0x7f0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x935
call fcn.14000f5d0
mov rbx, rax
call fcn.1400417e0
mov rdx, rbx
mov rcx, rax
call fcn.14001f000
mov rbx, rax
test rax, rax
je case.0x1400b7302.2004
call fcn.1400417e0
mov r14d, dword [rsi + 0x10]
cmp r14d, 0x7d3
sete sil
call fcn.14000cdd0
cmp byte [rax + 0x815], 0
je 0x1400b7492
cmp byte [rax + 0xde], 0
je 0x1400b7492
cmp byte [rax + 0xdf], 0
jne 0x1400b7492
cmp r14d, 0x7d3
je 0x1400b7492
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87e
mov rcx, qword [rdi + 0x890]
call fcn.14000f5d0
cmp rax, 1
je 0x1400b7492
cmp byte [rbx + 0x101], 0
je 0x1400b7492
movzx esi, sil
mov r15d, 1
cmp byte [rbx + 0x48], 0
cmovne esi, r15d
movzx edx, sil
mov rcx, rbx
call fcn.140020ed0
jmp case.0x1400b7302.2004
cmp rdx, r8
jne 0x1400b74ac
xor edx, edx
jmp 0x1400b74ba
cmp rdx, qword [rdi + 0x628]
jne 0x1400b74c2
mov edx, 1
mov rcx, rdi
call fcn.14008f780
xor r9d, r9d
mov r8, qword [rsi + 0x18]
mov edx, 0x876
mov rcx, qword [rdi + 0x890]
call fcn.14000f5d0
mov rbx, rax
mov eax, dword [rsi + 0x70]
cmp eax, dword [0x14021a558]
jne 0x1400b7563
mov r8d, dword [rsi + 0x24]
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rdi + 0x890]
call fcn.1400fd9d0
cmp qword [rdi + 0x982e8], 0
je 0x1400b7536
movsxd rbx, ebx
xor r9d, r9d
mov r8, rbx
mov edx, 0x8b6
mov rcx, qword [rdi + 0x890]
call fcn.14000f5d0
test rax, rax
setne r8b
mov rdx, rbx
mov rcx, qword [rdi + 0x982e8]
call fcn.140041c70
mov ecx, 0x610
mov r8d, 0x6b0
test r12b, r12b
cmovne r8d, ecx
add r8, rdi
lea rcx, [rdi + 0x470]
mov rdx, qword [rdi + 0x890]
call fcn.14010dfb0
jmp case.0x1400b7302.2004
cmp eax, dword [0x14021a554]
jne case.0x1400b7302.2004
cmp dword [rsi + 0x24], 0
jne case.0x1400b7302.2004
mov edx, ebx
mov rcx, qword [rdi + 0x890]
call fcn.1400fdef0
test al, al
jne case.0x1400b7302.2004
mov edx, ebx
mov rcx, rdi
call fcn.1400a4730
jmp case.0x1400b7302.2004
cmp rdx, r8
jne 0x1400b75a7
xor edx, edx
jmp 0x1400b75b5
cmp rdx, qword [rdi + 0x628]
jne 0x1400b75bd
mov edx, 1
mov rcx, rdi
call fcn.14008f780
mov eax, dword [0x14021a554]
cmp dword [rsi + 0x70], eax
jne case.0x1400b7302.2004
cmp dword [rsi + 0x24], 0
jne case.0x1400b7302.2004
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [0x140209168]
call fcn.140070440
mov rbx, rax
mov edx, dword [rax]
mov rcx, qword [rdi + 0x978d8]
call qword [sym.imp.USER32.dll_GetSubMenu]
test rax, rax
je case.0x1400b7302.2004
mov edx, dword [rbx + 4]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetSubMenu]
test rax, rax
je case.0x1400b7302.2004
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r14
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9d, dword [rsp + 0x54]
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_TrackPopupMenu]
jmp case.0x1400b7302.2004
cmp rdx, r8
je 0x1400b765f
cmp rdx, qword [rdi + 0x628]
jne 0x1400b8dc3
mov rbx, qword [rsi + 0x60]
cmp byte [rdi + 0x97991], 0
jne 0x1400b7676
xor edx, edx
mov rcx, rdi
call fcn.14007a680
cmp qword [rdi + 0x982e8], 0
je 0x1400b8dc3
xor r9d, r9d
mov r8, rbx
mov edx, 0x8b6
mov rcx, qword [rdi + 0x890]
call fcn.14000f5d0
test rax, rax
setne r8b
mov rdx, rbx
mov rcx, qword [rdi + 0x982e8]
call fcn.140041c70
jmp 0x1400b8dc3
cmp byte [rdi + 0x97940], 0
jne case.0x1400b7302.2004
cmp byte [rdi + 0x97941], 0
jne case.0x1400b7302.2004
call fcn.14000cdd0
mov rbx, rax
cmp byte [rax + 0xe2], 0
je 0x1400b76ed
movzx edx, word [rsi + 0x20]
mov rcx, rdi
call fcn.1400893e0
mov edx, 0x1e0
mov r14d, 0x328
test r12b, r12b
cmovne r14d, edx
add r14, rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa0a
mov rcx, qword [rdi + 0x890]
call fcn.14000f5d0
cmp rax, 1
setg dil
lea rcx, [rbx + 0x320]
call fcn.1400b71d0
test al, al
je 0x1400b7748
test dil, dil
jne 0x1400b7748
lea r8, [rbx + 0x320]
mov edx, dword [rsi + 0x20]
mov rcx, r14
call fcn.140012650
mov edx, dword [rsi + 0x20]
mov rcx, r14
call fcn.140014750
jmp case.0x1400b7302.2004
test r13, r13
je case.0x1400b7302.2004
cmp dword [rsi + 0x24], 2
jne 0x1400b7c3f
call fcn.14000cdd0
mov r15, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x98], InitCommonControls
mov qword [rsp + 0x90], r14
mov byte [rsp + 0x80], 0
mov rsi, qword [rsi + 0x18]
mov qword [rsp + 0x50], rsi
cmp rsi, 0xffffffffffffffff
jne 0x1400b77d2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7d8
mov rcx, qword [rdi + 0x890]
call fcn.14000f5d0
mov rsi, rax
mov qword [rsp + 0x50], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
cmp byte [r15 + 0xef], r8b
je 0x1400b7812
mov edx, 0x7d6
call fcn.14000f5d0
lea rbx, [rax + 1]
mov rcx, rbx
call fcn.140167f6c
mov rdi, rax
mov r9, rax
mov r8, rbx
mov edx, 0x886
mov rcx, r13
call fcn.14000f5d0
jmp 0x1400b7861
mov edx, 0x7eb
call fcn.14000f5d0
mov rbx, rax
lea rcx, [rax + 1]
call fcn.140167f6c
mov rdi, rax
mov r9, rax
mov r8, rbx
mov edx, 0x7eb
mov rcx, r13
call fcn.14000f5d0
mov rcx, r13
call fcn.140097b20
mov r8, rax
xor r9d, r9d
mov edx, 0x877
mov rcx, r13
call fcn.14000f5d0
sub rsi, rax
mov qword [rsp + 0x50], rsi
or r12, 0xffffffffffffffff
cmp byte [rdi], 0
jne 0x1400b786f
mov r8, r14
jmp 0x1400b787c
mov r8, r12
inc r8
cmp byte [rdi + r8], 0
jne 0x1400b7872
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.140006ca0
mov rcx, rdi
call fcn.140167f64
mov edi, r12d
movzx eax, byte [r15 + 0xed]
cmp byte [r15 + 0xee], al
jne 0x1400b79df
mov ebx, esi
test esi, esi
js 0x1400b7c2d
movsxd rcx, esi
lea r8, [rcx - 1]
mov r9, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x90]
mov r10, qword [rsp + 0x80]
cmp rdx, rcx
jbe 0x1400b79d2
lea rax, [rsp + 0x80]
cmp r9, 0x10
cmovae rax, r10
movzx r11d, byte [r15 + 0xed]
cmp byte [rax + rcx], r11b
jne 0x1400b7923
cmp r11b, 0x22
jne 0x1400b7941
test rcx, rcx
jle 0x1400b7941
cmp rdx, r8
jbe 0x1400b7934
lea rax, [rsp + 0x80]
cmp r9, 0x10
cmovae rax, r10
cmp byte [r8 + rax], 0x5c
jne 0x1400b7941
dec ebx
dec r8
sub rcx, 1
js 0x1400b7c2d
jmp 0x1400b78d5
lea rcx, str.invalid_string_position
call fcn.14014587c
int3
mov r12d, ebx
cmp ebx, 0xffffffff
je 0x1400b7c2d
mov rdi, rsi
cmp rsi, rdx
jae 0x1400b7c2d
cmp rdx, rdi
jbe 0x1400b79c5
lea rax, [rsp + 0x80]
cmp r9, 0x10
cmovae rax, r10
movzx ecx, byte [r15 + 0xee]
cmp byte [rdi + rax], cl
jne 0x1400b79b0
cmp cl, 0x22
jne 0x1400b7bb0
test rdi, rdi
je 0x1400b7bb0
lea rcx, [rdi - 1]
cmp rdx, rcx
jbe 0x1400b79b8
lea rax, [rsp + 0x80]
cmp r9, 0x10
cmovae rax, r10
cmp byte [rcx + rax], 0x5c
jne 0x1400b7bb0
inc rdi
cmp rdi, rdx
jmp 0x1400b7953
lea rcx, str.invalid_string_position
call fcn.14014587c
int3
lea rcx, str.invalid_string_position
call fcn.14014587c
int3
lea rcx, str.invalid_string_position
call fcn.14014587c
int3
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe0], r14
mov ecx, InitCommonControls
call fcn.140167f20
test rax, rax
jne 0x1400b7a25
call fcn.14018acfc
int3
mov qword [rsp + 0xc0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0xc0]
mov rax, qword [rsp + 0xc0]
mov qword [rax], rcx
mov esi, r14d
mov dword [rsp + 0x58], r14d
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x1400b7b72
mov rbx, r14
mov r15, qword [rsp + 0xe0]
cmp rax, rbx
jbe 0x1400b7b65
lea rcx, [rsp + 0x80]
mov r8, qword [rsp + 0x98]
cmp r8, 0x10
mov r9, qword [rsp + 0x80]
cmovae rcx, r9
mov rdx, qword [rsp + 0x48]
movzx eax, byte [rdx + 0xed]
cmp byte [rcx + rbx], al
jne 0x1400b7ac0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xc0]
call fcn.1400b9ba0
mov r15, qword [rsp + 0xe0]
jmp 0x1400b7b3d
cmp qword [rsp + 0x90], rbx
jbe 0x1400b7b58
lea rcx, [rsp + 0x80]
cmp r8, 0x10
cmovae rcx, r9
movzx eax, byte [rdx + 0xee]
cmp byte [rcx + rbx], al
jne 0x1400b7b3d
test r15, r15
je 0x1400b7b3d
lea rcx, [rsp + 0xc0]
call fcn.1400b9c80
mov edx, dword [rax]
sub r15, 1
mov qword [rsp + 0xe0], r15
mov rax, qword [rsp + 0xd8]
cmove rax, r14
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0x50]
cmp rdx, rcx
ja 0x1400b7b3d
cmp rbx, rcx
jb 0x1400b7b3d
cmp r12d, 0xffffffff
je 0x1400b7b38
cmp edx, r12d
jbe 0x1400b7b3d
mov r12d, edx
mov edi, esi
inc esi
mov dword [rsp + 0x58], esi
mov ebx, esi
mov rax, qword [rsp + 0x90]
cmp rax, rbx
ja 0x1400b7a73
jmp 0x1400b7b72
lea rcx, str.invalid_string_position
call fcn.14014587c
int3
lea rcx, str.invalid_string_position
call fcn.14014587c
nop
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xc0]
call fcn.1400b70c0
nop
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, qword [rsp + 0xc0]
call fcn.140032620
mov qword [rsp + 0xc0], r14
mov r15, qword [rsp + 0x48]
cmp edi, 0xffffffff
je 0x1400b7c2d
cmp r12d, 0xffffffff
je 0x1400b7c2d
mov rcx, r13
cmp byte [r15 + 0xef], 0
je 0x1400b7be2
movsxd r8, edi
xor r9d, r9d
mov edx, 0x85d
call fcn.14000f5d0
lea eax, [r12 + 1]
movsxd r8, eax
jmp 0x1400b7c1c
call fcn.140097b20
mov r8, rax
xor r9d, r9d
mov edx, 0x877
mov rcx, r13
call fcn.14000f5d0
mov rbx, rax
movsxd r8, edi
add r8, rax
xor r9d, r9d
mov edx, 0x85d
mov rcx, r13
call fcn.14000f5d0
movsxd r8, r12d
inc r8
add r8, rbx
xor r9d, r9d
mov edx, 0x7ea
mov rcx, r13
call fcn.14000f5d0
nop
lea rcx, [rsp + 0x80]
call fcn.140003760
jmp case.0x1400b7302.2004
xor r9d, r9d
mov r8, qword [rsi + 0x18]
mov edx, 0x9ca
mov rcx, r13
call fcn.14000f5d0
bt rax, 8
jae case.0x1400b7302.2004
mov r8, qword [rsi + 0x18]
mov r9, r8
mov edx, 0x870
mov rcx, r13
call fcn.14000f5d0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x202
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, qword [rsi + 0x18]
mov edx, 0x9cc
mov r8d, 8
mov rcx, r13
call fcn.14000f5d0
mov rbx, rax
mov r9, qword [rsi + 0x18]
mov edx, 0x9cd
mov r8d, 8
mov rcx, r13
call fcn.14000f5d0
mov r9, rax
mov r8, rbx
lea rdx, [rsp + 0xc0]
mov rcx, r13
call fcn.1400fc1e0
nop
lea r8, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae r8, qword [rsp + 0xc0]
mov rax, qword [rdi]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
mov rcx, qword [rax + 0x18]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0xc0]
call fcn.1400037f0
jmp case.0x1400b7302.2004
test r13, r13
je case.0x1400b7302.2004
call fcn.14000cdd0
mov rbx, rax
test byte [rsi + 0x90], 4
je 0x1400b7d44
xor edx, edx
mov rcx, rdi
call fcn.14007a680
cmp byte [rbx + 8], 0
jne case.0x1400b7302.2004
mov rcx, qword [rdi + 0x890]
mov rax, qword [rcx + 0x18]
cmp qword [rsi], rax
je 0x1400b7e2e
cmp byte [rbx + 0xe7], 0
je case.0x1400b7302.2004
mov rax, qword [rcx + 0x38]
cmp rax, qword [r13 + 0x38]
je case.0x1400b7302.2004
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rsp + 0x3c0]
call fcn.1400fbf60
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], r14
mov word [rsp + 0xa0], r14w
cmp word [rsp + 0x3c0], 0
je 0x1400b7deb
lea rax, [rsp + 0x3c0]
or r14, 0xffffffffffffffff
nop word [rax + rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x1400b7de0
mov r8, r14
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0xa0]
call fcn.140006f10
nop
lea rcx, [rdi + 0x470]
lea r8, [rsp + 0xa0]
mov rdx, r13
call fcn.14010e350
nop
lea rcx, [rsp + 0xa0]
call fcn.1400037f0
jmp case.0x1400b7302.2004
mov rcx, rdi
call fcn.14007bb30
cmp byte [rbx + 0xe9], 0
je 0x1400b7e5c
mov rax, qword [rdi + 0x890]
mov qword [rsp + 0x48], rax
movzx edx, byte [rbx + 0xea]
lea rcx, [rsp + 0x48]
call fcn.14013c340
cmp byte [rbx + 0xe3], 0
je 0x1400b7e9b
cmp byte [rbx + 0xe8], 0
je 0x1400b7e77
mov byte [rbx + 0xe8], 0
jmp 0x1400b7e9b
mov ecx, 0x610
mov r8d, 0x6b0
test r12b, r12b
cmovne r8d, ecx
add r8, rdi
lea rcx, [rdi + 0x470]
mov rdx, r13
call fcn.14010dfb0
mov rcx, rdi
call fcn.140091250
mov rcx, qword [rdi + 0x982f0]
test rcx, rcx
je 0x1400b7ece
cmp byte [rcx + 0x88], 0
jne 0x1400b7ece
mov rax, qword [rcx]
call qword [rax + 0x58]
test al, al
je 0x1400b7ece
mov rcx, qword [rdi + 0x982f0]
call fcn.14005fbc0
mov ecx, 0x328
mov edx, 0x1e0
test r12b, r12b
cmovne ecx, edx
add rcx, rdi
xor edx, edx
call fcn.140014750
jmp case.0x1400b7302.2004
test r13, r13
je case.0x1400b7302.2004
mov ecx, 0x610
mov r8d, 0x6b0
test r12b, r12b
cmovne r8d, ecx
add r8, rdi
lea rcx, [rdi + 0x470]
mov rdx, r13
call fcn.14010dfb0
jmp case.0x1400b7302.2004
xor r9d, r9d
xor r8d, r8d
mov edx, 0x859
mov rcx, qword [rdi + 0x890]
call fcn.14000f5d0
mov dword [rsp + 0x20], eax
mov r9, qword [rsi + 0x58]
mov r8, qword [rsi + 0x50]
mov edx, dword [rsi + 0x48]
lea rcx, [rsp + 0xc0]
call fcn.140104940
nop
lea rcx, [rdi + 0x97928]
mov rdx, rax
call fcn.14009be50
nop
lea rcx, [rsp + 0xc0]
call fcn.140097520
jmp case.0x1400b7302.2004
test r13, r13
je case.0x1400b7302.2004
lea rcx, [rdi + 0x6b0]
call fcn.1400fe800
lea rcx, [rdi + 0x610]
call fcn.1400fe800
cmp byte [rdi + 0x6fd], 0
je 0x1400b7fb2
lea rcx, [rdi + 0x6b0]
call fcn.1400fe8e0
mov byte [rdi + 0x6fd], 0
cmp byte [rdi + 0x65d], 0
je 0x1400b7fce
lea rcx, [rdi + 0x610]
call fcn.1400fe8e0
mov byte [rdi + 0x65d], 0
mov rcx, r13
call fcn.140103f10
cmp byte [rdi + 0x979a4], 0
jne 0x1400b7fe8
cmp byte [rdi + 0x979a5], 0
je 0x1400b7ff3
mov rdx, qword [rsi]
mov rcx, rdi
call fcn.14007ef00
call fcn.14000cdd0
cmp byte [rdi + 0x97990], 0
je 0x1400b8007
cmp byte [rax + 8], 0
je 0x1400b8011
cmp qword [rsi + 0x50], 0x62b
jne 0x1400b8022
xor edx, edx
mov rcx, rdi
call fcn.14007a680
mov byte [rdi + 0x97990], 0
mov rcx, qword [rdi + 0x982e8]
test rcx, rcx
je case.0x1400b7302.2004
cmp byte [rcx + 0x88], 0
jne case.0x1400b7302.2004
mov rax, qword [rcx]
call qword [rax + 0x58]
test al, al
je case.0x1400b7302.2004
mov rcx, qword [rdi + 0x982e8]
cmp byte [rcx + 0xf0], 0
jne case.0x1400b7302.2004
xor edx, edx
call fcn.140042a80
mov rcx, qword [rdi + 0x982e8]
call fcn.1400424d0
jmp case.0x1400b7302.2004
mov ecx, 0x328
mov edx, 0x1e0
test r12b, r12b
cmovne ecx, edx
add rcx, rdi
mov rdx, qword [rsi + 0x18]
call fcn.1400119b0
jmp case.0x1400b7302.2004
mov ebx, 0xbd0
mov ecx, 0xb98
cmp qword [rdi + 0xbe8], rdx
cmovne ebx, ecx
cmp dword [rsi + 0x1c], 0
jne 0x1400b80e8
mov eax, dword [rsi + 0x28]
mov dword [rsp + 0x50], eax
mov eax, dword [rsi + 0x34]
mov dword [rsp + 0x54], eax
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + rdi + 0x18]
call qword [sym.imp.USER32.dll_ClientToScreen]
lea rcx, [rdi + 0x9d8]
mov rdx, qword [rsp + 0x50]
call fcn.14011f9e0
jmp 0x1400b8dc3
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x100]
call fcn.140187ea0
mov dword [rsp + 0x100], 0x70
mov dword [rsp + InitCommonControls4], 0x10
mov r8d, dword [rsi + 0x18]
lea r9, [rsp + 0x100]
mov edx, 0x41c
mov rcx, qword [rbx + rdi + 0x18]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rsi
xor r8d, r8d
lea edx, [r8 + 0x4e]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1400b7302.2004
cmp eax, 0xfffffdd0
ja 0x1400b8a17
cmp eax, 0xfffffdcf
jae 0x1400b8423
cmp eax, 0xfffffcc1
je 0x1400b8407
cmp eax, 0xfffffdcb
je 0x1400b8265
cmp eax, 0xfffffdcc
je 0x1400b81e1
cmp eax, 0xfffffdcd
je 0x1400b8265
cmp eax, 0xfffffdce
jne case.0x1400b7302.2004
movsxd rdx, dword [rsi + 0x18]
call fcn.140041720
mov rsi, rax
call fcn.1400417e0
movzx ebx, bl
xor ebx, 1
cmp byte [rsi + 0x48], 0
je 0x1400b81be
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call fcn.14007a000
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call fcn.1400b10a0
test al, al
je case.0x1400b7302.2004
mov rcx, rdi
call fcn.14007c010
jmp case.0x1400b7302.2004
call fcn.14000cdd0
movzx ebx, byte [rax + 0x86a]
cmp byte [rax + 0x869], 0
je 0x1400b8207
lea rcx, [rdi + 0x97808]
xor r8d, r8d
xor edx, edx
call fcn.1401101e0
test bl, bl
je case.0x1400b7302.2004
mov rcx, qword [rdi + 0x982e8]
test rcx, rcx
je case.0x1400b7302.2004
cmp byte [rcx + 0x88], 0
jne case.0x1400b7302.2004
mov rax, qword [rcx]
call qword [rax + 0x58]
test al, al
je case.0x1400b7302.2004
mov rcx, qword [rdi + 0x982e8]
call fcn.140041ea0
mov rcx, qword [rdi + 0x982e8]
call fcn.140042900
mov rax, qword [rdi + 0x982e8]
mov byte [rax + 0xf0], 0
jmp case.0x1400b7302.2004
call fcn.14000cdd0
movzx ecx, byte [rax + 0x86a]
mov byte [rsp + 0x40], cl
cmp byte [rax + 0x869], 0
je 0x1400b8348
test r12b, r12b
je 0x1400b8290
lea r14, [rdi + 0x490]
jmp 0x1400b82a0
test r15b, r15b
je 0x1400b8348
lea r14, [rdi + 0x548]
test r14, r14
je 0x1400b8348
movsxd rdx, dword [rsi + 0x18]
mov rcx, r14
call fcn.140041720
mov qword [rsp + 0x48], rax
call fcn.1400417e0
mov rbx, qword [rdi + 0x6f0]
mov rax, qword [rdi + 0x650]
mov qword [rsp + 0x58], rax
movsxd r8, dword [rsi + 0x18]
lea r9, [rsp + 0x68]
mov edx, 0x130a
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x50], ecx
mov ecx, dword [rsp + 0x74]
mov dword [rsp + 0x54], ecx
lea rdx, [rsp + 0x50]
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [rsp + 0x48]
cmp rax, rbx
je 0x1400b8337
cmp rax, qword [rsp + 0x58]
je 0x1400b8337
lea rcx, [rdi + 0x97808]
mov r9, qword [r14 + 0xb0]
mov r8, rax
mov rdx, qword [rsp + 0x50]
call fcn.140016430
jmp 0x1400b8348
lea rcx, [rdi + 0x97808]
xor r8d, r8d
xor edx, edx
call fcn.1401101e0
cmp byte [rsp + 0x40], 0
je case.0x1400b7302.2004
mov rcx, qword [rdi + 0x982e8]
test rcx, rcx
je case.0x1400b7302.2004
cmp byte [rcx + 0x88], 0
jne case.0x1400b7302.2004
mov rax, qword [rcx]
call qword [rax + 0x58]
test al, al
je case.0x1400b7302.2004
test r12b, r12b
je 0x1400b838c
lea rcx, [rdi + 0x490]
jmp 0x1400b839c
test r15b, r15b
je case.0x1400b7302.2004
lea rcx, [rdi + 0x548]
test rcx, rcx
je case.0x1400b7302.2004
movsxd rdx, dword [rsi + 0x18]
call fcn.140041720
mov rbx, rax
call fcn.1400417e0
cmp rbx, qword [rdi + 0x6f0]
je 0x1400b83dc
cmp rbx, qword [rdi + 0x650]
je 0x1400b83dc
mov r8, r13
mov rdx, rbx
mov rcx, qword [rdi + 0x982e8]
call fcn.140042980
jmp 0x1400b83e8
mov rcx, qword [rdi + 0x982e8]
call fcn.140041ea0
mov rcx, qword [rdi + 0x982e8]
call fcn.140042900
mov rax, qword [rdi + 0x982e8]
mov byte [rax + 0xf0], 1
jmp case.0x1400b7302.2004
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1400b7302.2004
mov r12, qword [rsi + 8]
mov qword [rsp + 0x58], r12
mov ecx, SHCreateDirectory
call qword [sym.imp.USER32.dll_GetKeyState]
movsx r13d, ax
shr r13d, 0x1f
and r13b, 1
cmp dword [rsi + 0x10], 0xfffffdcf
jne 0x1400b8a00
mov rbx, qword [r12 + 0x70]
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rsi, rax
mov rcx, qword [rdi + 0x890]
cmp rax, qword [rcx + 0x18]
jne 0x1400b8676
cmp qword [rdi + 0x990], 0
jne 0x1400b8644
movups xmm0, xmmword [0x140208ce8]
movaps xmmword [rsp + 0xc0], xmm0
movups xmm1, xmmword [0x140208cf8]
movaps xmmword [rsp + 0xd0], xmm1
mov eax, dword [0x140208d08]
mov dword [rsp + 0xe0], eax
movzx eax, word [0x140208d0c]
mov word [rsp + 0xe4], ax
xor eax, eax
mov qword [rsp + 0xe6], rax
mov qword [rsp + 0xee], rax
mov qword [rsp + 0xf6], rax
mov word [rsp + 0xfe], ax
movups xmm0, xmmword [0x140208d10]
movaps xmmword [rsp + 0x170], xmm0
movups xmm1, xmmword [0x140208d20]
movaps xmmword [rsp + 0x180], xmm1
movsd xmm0, qword [0x140208d30]
movsd qword [rsp + 0x190], xmm0
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
xor r9d, r9d
lea r8, [rsp + 0xc0]
mov edx, 0x2711
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [rsp + 0x170]
mov edx, 0x2712
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
mov rax, qword [rdi]
lea rcx, [rdi + 0x988]
mov r9, qword [rdi + 0x978d8]
lea r8, [rsp + 0x68]
mov rdx, qword [rax + 0x18]
call fcn.14002dc20
lea rcx, [rdi + 0x478]
mov rdx, qword [rdi + 0x990]
call fcn.14006e210
nop
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x1400b8644
mov r15, qword [rsp + 0x70]
cmp rsi, r15
je 0x1400b8606
nop
mov rcx, rsi
call fcn.140046f20
add rsi, 0x48
cmp rsi, r15
jne 0x1400b85f0
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
sub rcx, rsi
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 2
mov r8, rdx
shr r8, 0x3f
add r8, rdx
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.14005e8d0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x30], r14
mov rax, qword [rdi + 0x988]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9d, dword [rsp + 0x54]
mov r8d, ebx
xor edx, edx
mov rcx, qword [rdi + 0x990]
call qword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x1400b8a00
mov rax, qword [rdi + 0x608]
cmp rsi, qword [rax + 0x18]
je 0x1400b89f0
mov rax, qword [rdi + 0x898]
cmp rsi, qword [rax + 0x18]
je 0x1400b89f0
mov rax, qword [rdi]
lea rdx, [rsp + 0x68]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_GetWindowRect]
cmp ebx, dword [rsp + 0x68]
jl 0x1400b86ca
cmp ebx, dword [rsp + 0x70]
jg 0x1400b86ca
mov eax, dword [rsp + 0x54]
cmp eax, dword [rsp + 0x6c]
jl 0x1400b86ca
cmp eax, dword [rsp + 0x74]
jle 0x1400b8dc3
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], r14
mov word [rsp + 0xa0], r14w
mov r15d, 1
mov r8d, r15d
lea rdx, [0x1401e1d0c]
lea rcx, [rsp + 0xa0]
call fcn.140006f10
nop
mov rax, qword [rdi + 0x890]
mov rdx, qword [rax + 0x40]
add rdx, 0xb0
cmp qword [rdx + 0x18], 8
jb 0x1400b8731
mov rdx, qword [rdx]
cmp word [rdx], 0
jne 0x1400b873c
mov r12, r14
jmp 0x1400b874b
or r12, 0xffffffffffffffff
inc r12
cmp word [rdx + r12*2], 0
jne 0x1400b8740
mov r8, r12
lea rcx, [rsp + 0xa0]
call fcn.140006a00
mov r8, r15
lea rdx, [0x1401e1d0c]
lea rcx, [rsp + 0xa0]
call fcn.140006a00
mov qword [rsp + 0x80], 2
lea rax, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rax, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rax
mov eax, dword [rsp + 0xb0]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x88], eax
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
mov r12, rax
mov r8d, 0x104
lea rdx, [rsp + 0x1b0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [0x140203870]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400b898d
mov rcx, qword [rdi]
cmp r12, qword [rcx + 0x18]
je 0x1400b898d
mov rcx, qword [rdi + 0x600]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rdx, eax
mov rcx, qword [rsp + 0x48]
call fcn.140041720
mov qword [rsp + 0x48], rax
call fcn.1400417e0
movzx ebx, byte [rsp + 0x40]
xor ebx, 1
mov rax, qword [rsp + 0x48]
cmp byte [rax + 0x48], 0
je 0x1400b8922
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], r14
mov word [rsp + 0xc0], r14w
mov qword [rsp + 0x180], r14
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x188], 7
mov qword [rsp + 0x180], r14
mov word [rsp + 0x170], r14w
mov rax, qword [rdi]
lea rcx, [rdi + 0x478]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
lea rdx, str.Move_to_new_Notepad_Instance
mov qword [rsp + 0x20], rdx
lea r9, str.Document_is_modified__save_it_then_try_again.
mov r8, qword [rax + 0x18]
lea rdx, str.CannotMoveDoc
call fcn.140070e40
nop
mov qword [rsp + 0x188], 7
mov qword [rsp + 0x180], r14
mov word [rsp + 0x170], r14w
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], r14
mov word [rsp + 0xc0], r14w
jmp 0x1400b89a6
mov r9, rsi
xor r8d, r8d
mov edx, 0x416
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi]
lea r9, [rsp + 0x80]
mov r8, qword [rax + 8]
mov edx, 0x4a
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
test r13b, r13b
jne 0x1400b89a6
mov r8d, ebx
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1400b10a0
mov rcx, rdi
call fcn.140089ed0
test al, al
je 0x1400b89a6
mov rax, qword [rdi]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400b89a6
neg r13b
sbb edx, edx
add edx, 2
mov r9d, dword [rsp + 0x54]
mov r8d, ebx
mov rcx, rdi
call fcn.14007f450
nop
mov r8, qword [rsp + 0xb8]
cmp r8, 8
jb 0x1400b89cc
inc r8
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0xa0]
call fcn.140007680
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], r14
mov word [rsp + 0xa0], r14w
mov r12, qword [rsp + 0x58]
jmp 0x1400b8a06
neg r13b
sbb edx, edx
add edx, 2
mov rcx, rdi
call fcn.14007f280
mov r15d, 1
mov qword [r12 + 0x70], 0
mov eax, r15d
jmp 0x1400b9ae8
cmp eax, 0xfffffdd9
je 0x1400b9a4f
cmp eax, 0xfffffdee
je 0x1400b97d6
cmp eax, 0xfffffffb
je 0x1400b8cdd
cmp eax, 0xfffffffd
je 0x1400b8b83
cmp eax, 0xfffffffe
jne case.0x1400b7302.2004
cmp rdx, qword [rdi + 0xb48]
jne 0x1400b8adc
cmp qword [rsi + 0x18], 5
jne case.0x1400b7302.2004
xor r9d, r9d
xor r8d, r8d
mov edx, 0x88b
mov rcx, qword [rdi + 0x890]
call fcn.14000f5d0
test rax, rax
setne r14b
xor r14, 1
xor r9d, r9d
mov r8, r14
mov edx, 0x88a
mov rcx, qword [rdi + 0x890]
call fcn.14000f5d0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x88b
mov rcx, qword [rdi + 0x890]
call fcn.14000f5d0
lea rcx, [0x140203170]
lea rdx, [0x140203178]
test rax, rax
cmovne rdx, rcx
lea rcx, [rdi + 0xb30]
mov r8d, 5
call fcn.140110e00
jmp case.0x1400b7302.2004
cmp rdx, qword [rdi + 0x4a8]
jne 0x1400b8b2a
cmp dword [rdi + 0x982fc], 1
jne 0x1400b8b2a
call fcn.14000cdd0
cmp byte [rax + 0x815], 0
je 0x1400b8b1b
cmp byte [rax + 0xde], 0
je 0x1400b8b1b
cmp byte [rax + 0xdf], 0
jne 0x1400b8b1b
call fcn.1400417e0
mov rcx, rax
call fcn.14001d3d0
xor edx, edx
mov rcx, rdi
call fcn.14008f780
jmp case.0x1400b7302.2004
cmp rdx, qword [rdi + 0x560]
jne case.0x1400b7302.2004
cmp dword [rdi + 0x982fc], 0
jne case.0x1400b7302.2004
call fcn.14000cdd0
cmp byte [rax + 0x815], 0
je 0x1400b8b71
cmp byte [rax + 0xde], 0
je 0x1400b8b71
cmp byte [rax + 0xdf], 0
jne 0x1400b8b71
call fcn.1400417e0
mov rcx, rax
call fcn.14001d3d0
mov edx, 1
mov rcx, rdi
call fcn.14008f780
jmp case.0x1400b7302.2004
cmp rdx, qword [rdi + 0xb48]
jne case.0x1400b7302.2004
mov rax, qword [rsi + 0x18]
cmp rax, 2
jne 0x1400b8bf2
mov rax, qword [rdi + 0x1b20]
lea rcx, [rdi + 0x1b20]
call qword [rax + 0x68]
test al, al
sete bl
movzx edx, byte [rdi + 0x484]
lea rcx, [rdi + 0x1b20]
call fcn.1400ac6d0
test bl, bl
je case.0x1400b7302.2004
lea rcx, [rdi + 0x478]
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.GoToLine
mov rdx, qword [rdi + 0x1b38]
call fcn.14006d4d0
jmp case.0x1400b7302.2004
cmp rax, 1
jne 0x1400b8c0a
mov edx, 0xac11
mov rcx, rdi
call fcn.1400a4840
jmp case.0x1400b7302.2004
test rax, rax
jne 0x1400b8c5c
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edx, 5
mov rcx, qword [rdi + 0x978d8]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r14
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9d, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_TrackPopupMenu]
jmp case.0x1400b7302.2004
cmp rax, 3
jne case.0x1400b7302.2004
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rcx, [0x140208df0]
call fcn.140070440
mov rbx, rax
mov edx, dword [rax]
mov rcx, qword [rdi + 0x978d8]
call qword [sym.imp.USER32.dll_GetSubMenu]
test rax, rax
je 0x1400b8dc3
mov edx, dword [rbx + 4]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
test rax, rax
je 0x1400b8dc3
mov rax, qword [rdi]
mov qword [rsp + 0x30], r14
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9d, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.USER32.dll_TrackPopupMenu]
jmp case.0x1400b7302.2004
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsi]
cmp rax, qword [rdi + 0x4a8]
jne 0x1400b8d03
xor edx, edx
mov rcx, rdi
call fcn.14008f780
jmp 0x1400b8f37
cmp rax, qword [rdi + 0x560]
jne 0x1400b8d22
mov r15d, 1
mov edx, r15d
mov rcx, rdi
call fcn.14008f780
jmp 0x1400b8f3d
cmp rax, qword [rdi + 0xb48]
jne 0x1400b8dcd
mov rax, qword [rsi + 0x18]
test rax, rax
jne 0x1400b8d5e
lea edx, [rax + 5]
mov rcx, qword [rdi + 0x978d8]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r14
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x28], rcx
mov rcx, rax
jmp 0x1400b8dac
cmp rax, 3
jne 0x1400b8dc3
lea rcx, [0x140208df0]
call fcn.140070440
mov rbx, rax
mov edx, dword [rax]
mov rcx, qword [rdi + 0x978d8]
call qword [sym.imp.USER32.dll_GetSubMenu]
test rax, rax
je 0x1400b8dc3
mov edx, dword [rbx + 4]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
test rax, rax
je 0x1400b8dc3
mov rax, qword [rdi]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
xor edx, edx
mov r8d, dword [rsp + 0x58]
mov r9d, dword [rsp + 0x5c]
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, 1
jmp 0x1400b9ae8
mov rcx, qword [rdi + 0x982c0]
test rcx, rcx
je 0x1400b8dc3
cmp rax, qword [rcx + 0x18]
jne 0x1400b8dc3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1032
mov rcx, qword [rcx + 0xb0]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jle 0x1400b8f37
cmp qword [rdi + 0x9b8], 0
jne 0x1400b8f24
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
xor r9d, r9d
lea r8, str.Close_Selected_files
mov edx, 0xa9ed
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, str.Close_others_files
mov edx, 0xa9ee
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
mov rax, qword [rdi]
lea rcx, [rdi + 0x9b0]
xor r9d, r9d
lea r8, [rsp + 0x68]
mov rdx, qword [rax + 0x18]
call fcn.14002dc20
lea rcx, [rdi + 0x478]
mov rdx, qword [rdi + 0x9b8]
call fcn.14006e0a0
nop
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400b8f24
mov rsi, qword [rsp + 0x70]
cmp rbx, rsi
je 0x1400b8ee6
nop
mov rcx, rbx
call fcn.140046f20
add rbx, 0x48
cmp rbx, rsi
jne 0x1400b8ed0
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
sub rcx, rbx
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 2
mov r8, rdx
shr r8, 0x3f
add r8, rdx
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14005e8d0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov rax, qword [rdi + 0x9b0]
mov rcx, qword [rdi + 0x9b8]
jmp 0x1400b8da2
mov r15d, 1
cmp qword [rdi + 0x968], 0
jne 0x1400b95f4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
xor r9d, r9d
lea r8, [0x1401e25d8]
mov edx, 0xa02b
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, str.Close_All_BUT_This
mov edx, 0xa02d
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140208e88]
mov edx, 0xa031
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140208eb8]
mov edx, 0xa03a
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140208ee8]
mov edx, 0xa040
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140202a78]
mov edx, 0xa02e
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140208f10]
mov edx, 0xa030
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140208f28]
mov edx, 0xa039
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140208f38]
mov edx, 0xa038
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, str.Reload
mov edx, 0xa036
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, str.Print
mov edx, 0xa032
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140208f60]
mov edx, 0xa03b
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, str.Open_Containing_Folder_in_cmd
mov edx, 0xa03c
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140208fe8]
mov edx, 0xa03f
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, str.Read_Only
mov edx, 0xa42c
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140209030]
mov edx, 0xa431
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, str.Full_File_Path_to_Clipboard
mov edx, 0xa42d
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, str.Filename_to_Clipboard
mov edx, 0xa42e
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x1402090c8]
mov edx, 0xa42f
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140208ce8]
mov edx, 0x2711
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140208d10]
mov edx, 0x2712
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140209108]
mov edx, 0x2713
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
xor r9d, r9d
lea r8, [0x140209138]
mov edx, 0x2714
lea rcx, [rsp + 0x100]
call fcn.14002d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140051ef0
nop
lea rcx, [rsp + 0x100]
call fcn.140046f20
mov rax, qword [rdi]
lea rcx, [rdi + 0x960]
xor r9d, r9d
lea r8, [rsp + 0x68]
mov rdx, qword [rax + 0x18]
call fcn.14002dc20
lea rcx, [rdi + 0x478]
mov rdx, qword [rdi + 0x968]
call fcn.14006e0a0
nop
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400b95f4
mov rsi, qword [rsp + 0x70]
cmp rbx, rsi
je 0x1400b95b6
nop dword [rax]
mov rcx, rbx
call fcn.140046f20
add rbx, 0x48
cmp rbx, rsi
jne 0x1400b95a0
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
sub rcx, rbx
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 2
mov r8, rdx
shr r8, 0x3f
add r8, rdx
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.14005e8d0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
xor r8d, r8d
mov edx, 0xa02e
mov rcx, qword [rdi + 0x978d8]
call qword [sym.imp.USER32.dll_GetMenuState]
shr eax, 1
not al
test al, 1
mov esi, 3
mov r8d, esi
cmovne r8d, r14d
mov edx, 0xa02e
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov rax, qword [rdi + 0x890]
mov r13, qword [rax + 0x40]
movzx eax, byte [r13 + 0x54]
neg al
sbb r8d, r8d
and r8d, 8
mov edx, 0xa42c
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_CheckMenuItem]
movzx ebx, byte [r13 + 0xac]
test bl, bl
jne 0x1400b9671
cmp byte [r13 + 0x110], bl
jne 0x1400b9671
mov al, 1
jmp 0x1400b9673
xor al, al
mov r8d, esi
test al, al
cmovne r8d, r14d
mov edx, 0xa42c
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov r8d, esi
test bl, bl
cmovne r8d, r14d
mov edx, 0xa431
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_EnableMenuItem]
lea r12, [r13 + 0xb0]
cmp qword [r12 + 0x18], 8
jb 0x1400b96be
mov rcx, qword [r12]
jmp 0x1400b96c1
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, esi
test eax, eax
cmovne ebx, r14d
mov r8d, ebx
mov edx, 0xa038
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov r8d, ebx
mov edx, 0xa03b
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov r8d, ebx
mov edx, 0xa03c
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_EnableMenuItem]
cmp qword [r12 + 0x18], 8
jb 0x1400b971a
mov r12, qword [r12]
mov rcx, r12
call fcn.14002b2c0
mov r8d, esi
test al, al
cmovne r8d, r14d
mov edx, 0xa03f
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_EnableMenuItem]
movzx r12d, byte [r13 + 0x48]
mov ebx, dword [r13 + 0xa0]
test r12b, r12b
jne 0x1400b9757
cmp ebx, 2
je 0x1400b9757
mov al, 1
jmp 0x1400b9759
xor al, al
mov r8d, esi
test al, al
cmovne r8d, r14d
mov edx, 0x2713
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_EnableMenuItem]
test r12b, r12b
jne 0x1400b9782
cmp ebx, 2
je 0x1400b9782
mov al, 1
jmp 0x1400b9784
xor al, al
test al, al
cmovne esi, r14d
mov r8d, esi
mov edx, 0x2714
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov qword [rsp + 0x30], r14
mov rax, qword [rdi + 0x960]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9d, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov rcx, qword [rdi + 0x968]
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, r15d
jmp 0x1400b9ae8
mov qword [rsi + 0xc0], r14
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rdi]
lea rdx, [rsp + 0x48]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rdi]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_RealChildWindowFromPoint]
mov rbx, rax
mov word [0x1402a3ad0], r14w
lea rdx, [0x1401d3618]
lea rcx, [rsp + 0x80]
call fcn.140002770
nop
movsxd rcx, dword [rsi + 8]
cmp rbx, qword [rdi + 0xbb0]
jne 0x1400b98a5
lea rdx, [rsp + 0x80]
call fcn.140105280
cmp qword [rsp + 0x90], 0x50
jb 0x1400b9865
lea rcx, [rsp + 0x80]
call fcn.1400037f0
xor eax, eax
jmp 0x1400b9ae8
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rcx, [rsi + 0x20]
mov edx, 0x50
call fcn.14018fc10
nop
lea rcx, [rsp + 0x80]
call fcn.1400037f0
mov eax, 1
jmp 0x1400b9ae8
cmp rbx, qword [rdi + 0x4a8]
jne 0x1400b996a
mov rdx, rcx
lea rcx, [rdi + 0x490]
call fcn.140041720
mov rbx, rax
call fcn.1400417e0
lea rdx, [rbx + 0xb0]
cmp qword [rdx + 0x18], 8
jb 0x1400b98da
mov rdx, qword [rdx]
cmp word [rdx], 0
je 0x1400b98ef
or r14, 0xffffffffffffffff
inc r14
cmp word [rdx + r14*2], 0
jne 0x1400b98e4
mov r8, r14
lea rcx, [rsp + 0x80]
call fcn.140006f10
cmp qword [rsp + 0x90], 0x400
jb 0x1400b9921
lea rcx, [rsp + 0x80]
call fcn.1400037f0
xor eax, eax
jmp 0x1400b9ae8
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
mov edx, 0x400
lea rbx, [0x1402a3ad0]
mov rcx, rbx
call fcn.14018fc10
mov qword [rsi + 0x18], rbx
lea rcx, [rsp + 0x80]
call fcn.1400037f0
mov eax, 1
jmp 0x1400b9ae8
cmp rbx, qword [rdi + 0x560]
jne 0x1400b9a36
mov rdx, rcx
lea rcx, [rdi + 0x548]
call fcn.140041720
mov rbx, rax
call fcn.1400417e0
lea rdx, [rbx + 0xb0]
cmp qword [rdx + 0x18], 8
jb 0x1400b999f
mov rdx, qword [rdx]
cmp word [rdx], 0
je 0x1400b99bb
or r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp word [rdx + r14*2], 0
jne 0x1400b99b0
mov r8, r14
lea rcx, [rsp + 0x80]
call fcn.140006f10
cmp qword [rsp + 0x90], 0x400
jb 0x1400b99ed
lea rcx, [rsp + 0x80]
call fcn.1400037f0
xor eax, eax
jmp 0x1400b9ae8
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
mov edx, 0x400
lea rbx, [0x1402a3ad0]
mov rcx, rbx
call fcn.14018fc10
mov qword [rsi + 0x18], rbx
lea rcx, [rsp + 0x80]
call fcn.1400037f0
mov eax, 1
jmp 0x1400b9ae8
lea rcx, [rsp + 0x80]
call fcn.1400037f0
xor eax, eax
jmp 0x1400b9ae8
cmp rdx, qword [rdi + 0x4a8]
je 0x1400b9a6b
cmp rdx, qword [rdi + 0x560]
jne case.0x1400b7302.2004
mov r14d, 1
mov rdx, qword [rdi + 0x890]
lea rcx, [rdi + 0x97808]
call fcn.140016590
mov edx, r14d
mov rcx, rdi
call fcn.14008f780
mov rcx, qword [rdi + 0x600]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rdx, eax
mov rcx, qword [rdi + 0x600]
call fcn.140041720
test rax, rax
je 0x1400b9ad5
mov byte [rdi + 0x97991], 1
mov r8d, r14d
mov rdx, rax
mov rcx, rdi
call fcn.14007a000
mov byte [rdi + 0x97991], 0
xor r8d, r8d
xor edx, edx
lea rcx, [rdi + 0x97808]
call fcn.1401101e0
xor eax, eax
mov rcx, qword [rsp + 0xbc0]
xor rcx, rsp
call fcn.140168660
lea r11, [rsp + 0xbd0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret