Function at 0x14007c0a0
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Create thread
Resume thread
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14b, byte [rsp + 0xd8]
mov r13d, ecx
mov rcx, rdx
mov al, r14b
and r14b, 0xf
mov ebp, r9d
and al, 0xc0
mov r15, r8
mov rdi, rdx
mov byte [rsp + 0x40], al
mov byte [rsp + 0xd8], r14b
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r10, eax
mov rcx, r15
lea rsi, [r10 + r10 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea r12, [rcx + rcx + 2]
lea rcx, [rsp + 0x48]
lea rdx, [r12 + rsi + 0x40]
call fcn.1400633a8
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
mov qword [rsp + 0x60], rbx
call fcn.14005b0b8
lea r11, [0x14013d7f8]
lea r8, [0x1400612cc]
mov qword [rsp + 0x28], r11
mov r9, rbx
mov edx, 0x20000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14007c175
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, 1
mov ebx, eax
test eax, eax
cmove ebx, ebp
jmp 0x14007c5b0
mov eax, dword [rsp + 0xd0]
mov dword [rbx + 0x20], ebp
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0x24], eax
mov qword [rbx + 0x18], r15
lea rcx, [rbx + 0x40]
lea rax, [rbx + rsi + 0x40]
mov qword [rbx], 2
mov dword [rbx + 8], r13d
mov byte [rbx + 0x28], r14b
mov ebp, 1
mov r8, rsi
mov rdx, rdi
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x10], rcx
mov dword [rbx + 0x34], ebp
call fcn.14001d78c
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, r15
call fcn.14001d78c
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rsp + 0x58]
mov rdi, rax
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r14, str.32770
xor esi, esi
xor r12d, r12d
mov qword [rsp + 0x50], r14
cmp r13d, 2
jne 0x14007c236
xor r14d, r14d
lea r15, [0x1401271e0]
lea r12, [0x1401271d0]
mov qword [rsp + 0x50], r14
movzx eax, word [0x14013e20c]
mov ecx, 4
xor dil, dil
mov dword [rsp + 0x44], esi
test cl, al
jne 0x14007c26c
or ax, cx
lea edx, [rcx - 2]
lea rcx, str.SeDebugPrivilege
xor r8d, r8d
mov dil, bpl
mov word [0x14013e20c], ax
call fcn.14001c2cc
mov r13d, 0xa
sub r13d, ebp
js 0x14007c2b4
mov rdx, r15
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007c2b4
test r12, r12
je 0x14007c2a4
mov rdx, r12
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007c2b4
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14007c272
mov r13d, 0xa
test rsi, rsi
jne 0x14007c326
sub r13d, ebp
js 0x14007c2fc
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007c326
test r12, r12
je 0x14007c2ef
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007c326
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14007c2bf
test rsi, rsi
jne 0x14007c326
and qword [rsp + 0x38], rsi
and qword [rsp + 0x30], rsi
and dword [rsp + 0x28], esi
and dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.1400e3d60
mov rsi, rax
mov r14d, 0x5a
mov r13d, r14d
test rsi, rsi
jne 0x14007c3c3
mov rbx, qword [rsp + 0x50]
sub r13d, ebp
js 0x14007c37f
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007c37f
test r12, r12
je 0x14007c36f
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007c37f
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14007c33d
mov rbx, qword [rsp + 0x60]
jmp 0x14007c3be
sub r14d, ebp
js 0x14007c3c3
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007c3c3
test r12, r12
je 0x14007c3b6
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007c3c3
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14007c386
mov r13d, dword [rsp + 0xb0]
mov r14, qword [rsp + 0xc0]
xor r15d, r15d
cmp r13d, 2
jne 0x14007c3ed
cmp rsi, r15
je 0x14007c3ed
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowTextW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
cmp r13d, ebp
jne 0x14007c40f
cmp rsi, r15
je 0x14007c40f
mov rcx, qword [0x14013ca30]
cmp rcx, r15
je 0x14007c40f
mov qword [rcx], rsi
cmp byte [rsp + 0x40], 0x80
je 0x14007c4f8
cmp r13d, ebp
jne 0x14007c428
cmp rsi, r15
je 0x14007c4f8
cmp r13d, 2
jne 0x14007c488
mov ebx, dword [rsp + 0xd0]
cmp ebx, r15d
jg 0x14007c473
cmp dil, r15b
je 0x14007c45e
mov eax, 0xfffb
lea edx, [r13 + 2]
lea rcx, str.SeDebugPrivilege
and word [0x14013e20c], ax
xor r8d, r8d
call fcn.14001c2cc
mov ebx, r15d
jmp 0x14007c5b0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r12d
cmp eax, ebx
jge 0x14007c47e
mov al, byte [0x14013a24f]
cmp al, r15b
jg 0x14007c466
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
jmp 0x14007c4f3
mov al, byte [0x14013a24f]
cmp al, r15b
jle 0x14007c4dd
mov ebp, dword [rsp + 0xd0]
cmp ebp, r15d
jle 0x14007c4b0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r12d
cmp eax, ebp
jge 0x14007c5d4
mov rcx, qword [rsp + 0x50]
mov rdx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
cmp rax, r15
je 0x14007c4dd
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11b, byte [0x14013a24f]
cmp r11b, r15b
jg 0x14007c49a
mov eax, dword [rbx + 0x34]
mov dword [rsp + 0x44], eax
mov rax, qword [0x14013ca30]
cmp rax, r15
je 0x14007c4f3
mov qword [rax], r15
mov rbx, qword [rsp + 0x48]
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec qword [rbx]
cmp qword [rbx], r15
mov dword [rbx + 0x30], r15d
cmovg rbx, r15
lea rcx, [0x14013e190]
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rsi, r15
je 0x14007c56f
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
mov ebx, 0x111
lea r8d, [r9 + 2]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov edx, ebx
lea r8d, [r9 + 7]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rbx, qword [rsp + 0x58]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x44]
cmp dil, r15b
je 0x14007c5b0
xor r8d, r8d
mov eax, 0xfffb
lea rcx, str.SeDebugPrivilege
and word [0x14013e20c], ax
lea edx, [r8 + 4]
call fcn.14001c2cc
lea rcx, [rsp + 0x48]
call fcn.14005b104
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, byte [rsp + 0xd8]
jmp 0x14007c4e0