Function at 0x140016560
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
test rcx, rcx
je 0x14001685d
cmp word [rcx + 0x214], 2
jb 0x140016845
mov qword [rsp + 0x80], rbp
mov rbp, qword [rcx + 0x25c]
test rbp, rbp
je 0x14001683d
mov qword [rsp + 0x78], rbx
movzx ebx, byte [rbp + 1]
mov rcx, qword [0x140067b00]
lea rax, [0x140067b00]
cmp rcx, rax
je 0x1400165ea
test byte [rcx + 0x1c], 4
je 0x1400165ea
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
movzx eax, bl
mov dword [rsp + 0x28], eax
lea rax, str.Receive_custom_HID_event
mov qword [rsp + 0x20], rax
call fcn.140032050
cmp bl, 0xcf
jbe 0x1400165f8
cmp bl, 0xf9
jne 0x140016838
cmp bl, 0x4e
jne 0x14001660a
cmp dword [0x14006a728], 0
jne 0x140016838
movzx ecx, byte [0x1400691fd]
test cl, cl
je 0x140016667
mov rax, qword [0x14006aee0]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140016660
movzx eax, cl
lea r9, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
lea rdx, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x100021
mov r8d, 8
mov qword [rsp + 0x20], rax
mov ecx, 0x53564544
mov dword [rsp + 0x30], 4
call fcn.1400064c0
mov byte [0x1400691fd], 0
test bl, bl
je 0x140016838
mov qword [rsp + 0x50], r14
lea rcx, [0x140000000]
xor r14d, r14d
mov qword [rsp + 0x58], rdi
mov eax, r14d
nop word [rax + rax]
cmp bl, byte [rax + rcx + 0x56164]
je 0x1400167af
inc rax
cmp rax, 5
jl 0x140016690
mov rax, r14
nop dword [rax]
cmp bl, byte [rax + rcx + 0x56158]
je 0x140016768
inc rax
cmp rax, 9
jl 0x1400166b0
mov byte [0x1400691fd], bl
cmp bl, 0x85
jne 0x14001682e
cmp word [rsi + 0x214], 3
jb 0x14001682e
cmp dword [0x140069240], r14d
movzx edi, byte [rbp + 2]
je 0x14001682e
cmp dword [0x14006921c], r14d
je 0x14001682e
cmp dil, 1
je 0x140016711
cmp dil, 0x10
jne 0x14001682e
mov ecx, 4
call fcn.14003fd84
mov rbx, rax
test rax, rax
je 0x14001682e
mov eax, r14d
mov qword [rsp + 0x28], r14
cmp dil, 1
mov dword [rsp + 0x20], r14d
mov r9, rbx
lea r8, [0x14000c090]
sete al
xor edx, edx
xor ecx, ecx
mov dword [rbx], eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x140016826
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x14001682e
cmp bl, 0x2a
jne 0x14001679b
mov edi, 0x2a
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor r8d, r8d
mov edx, edi
lea ecx, [rdi + 0x5b]
call fcn.14001c210
lea edx, [rdi - 0x29]
mov ecx, edi
call fcn.14000ae40
jmp 0x1400166cc
movzx edi, bl
mov edx, 1
mov ecx, edi
call fcn.14000ae40
jmp 0x1400166cc
mov rax, qword [0x14006aee0]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400167fa
movzx eax, bl
lea r9, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
lea rdx, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x100021
mov r8d, 8
mov qword [rsp + 0x20], rax
mov ecx, 0x53564544
mov dword [rsp + 0x30], 4
call fcn.1400064c0
cmp bl, 0x10
jne 0x14001680e
mov edx, 1
lea ecx, [rdx + 0x1f]
call fcn.14000ae40
jmp 0x14001682e
cmp bl, 0x20
jne 0x1400166cc
mov edx, 1
lea ecx, [rdx + 0x1e]
call fcn.14000ae40
jmp 0x14001682e
mov rcx, rbx
call fcn.14003fd8c
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140032e60
add rsp, 0x60
pop rsi
ret
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140032e60
add rsp, 0x60
pop rsi
ret