Function at 0x14001a6f0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rbx, rdx
mov esi, ecx
call fcn.14001a1d0
test al, al
jne 0x14001a721
mov eax, 1
jmp 0x14001aa48
mov edi, 2
cmp qword [0x1400fa910], 0
jne 0x14001a79a
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
call fcn.140020370
test al, al
je 0x14001a767
lea rcx, [rsp + 0x38]
call fcn.140020430
test al, al
je 0x14001a767
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001a79a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14001a79a
cmp byte [0x1400fa94b], 0
jne 0x14001a788
mov ecx, edi
call fcn.1400682a0
mov rcx, rax
lea rdx, str.warning:_PresentMon_requires_elevated_privilege_in_order_to_query_processes_n____started_on_another_account__so_these_processes_wont_be_targetted_by_name_n____and_will_be_listed_as__error_.__Further__there_may_be_tracking_errors_n____near_process_termination__and_if_they_are_targetted_n_____terminate_on_proc_exit_wont_work._n
call fcn.1400076f0
jmp 0x14001a755
mov rdx, rbx
mov ecx, esi
call fcn.140020540
mov ecx, eax
call fcn.14006f9a8
nop
xor r9d, r9d
xor r8d, r8d
mov ebx, 1
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1400f9590], rax
cmp byte [0x1400fa94a], 0
je 0x14001a847
cmp byte [0x1400fa94f], 0
je 0x14001a7fe
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [0x1400f9590]
lea r8, [0x140019b00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400f95a8], rax
jmp 0x14001a847
mov r9d, dword [0x1400fa934]
mov r8d, dword [0x1400fa930]
mov edx, 0x80
mov rcx, qword [0x1400f9598]
call qword [sym.imp.USER32.dll_RegisterHotKey]
test eax, eax
jne 0x14001a847
mov ecx, edi
call fcn.1400682a0
mov rcx, rax
lea rdx, str.error:_failed_to_register_hotkey._n
call fcn.1400076f0
call fcn.14001a0e0
mov eax, 5
jmp 0x14001aa48
mov edx, ebx
lea rcx, [0x140019d90]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov rax, qword [0x1400fa920]
cmp eax, ebx
jne 0x14001a882
mov ecx, 0x18
call fcn.14005e58c
mov qword [rsp + 0x80], rax
xor edx, edx
mov rcx, rax
call fcn.140019490
mov r9, rax
jmp 0x14001a8a8
cmp eax, 2
jne 0x14001aa43
lea ecx, [rax + 0x16]
call fcn.14005e58c
mov qword [rsp + 0x80], rax
mov dl, 1
mov rcx, rax
call fcn.140019490
mov r9, rax
mov qword [0x1400f95b0], rax
test r9, r9
je 0x14001aa43
cmp dword [0x1400fa920], 2
jne 0x14001a996
mov rdx, qword [r9 + 8]
sub ebx, dword [rdx + 0x147cc]
movsxd rax, ebx
imul rcx, rax, 0x104
lea r8, [rdx + 0x145c4]
add r8, rcx
mov rax, qword [0x1400fa900]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [r8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r8 + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r8 + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r8 + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r8 + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r8 + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [r8 - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdi, 1
jne 0x14001a8f0
mov eax, dword [rax]
mov dword [r8], eax
mov rax, qword [r9 + 8]
xchg dword [rax + 0x147cc], ebx
mov rbx, qword [0x1400f95b0]
xor eax, eax
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001a98f
mov rcx, qword [rbx + 8]
mov rax, qword [rsp + 0x80]
xchg qword [rcx + 0x14578], rax
mov r9, qword [0x1400f95b0]
mov rcx, qword [0x1400fa92c]
test ecx, ecx
je 0x14001a9b2
mov rax, qword [r9 + 8]
mov dword [rax + 0x145c0], ecx
mov r9, qword [0x1400f95b0]
mov rdx, qword [0x1400fa928]
test edx, edx
je 0x14001a9c7
mov rax, qword [r9 + 8]
mov dword [rax + 0x145c0], edx
call fcn.140036b00
test al, al
jne 0x14001a9eb
xor edx, edx
lea rcx, [0x140019d90]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.14001a0e0
mov eax, 6
jmp 0x14001aa48
cmp byte [0x1400fa944], 0
je 0x14001aa08
movzx ecx, byte [0x1400f957d]
call fcn.140019ba0
mov byte [0x1400f957e], al
jmp 0x14001aa0f
mov byte [0x1400f957e], 0
cmp byte [0x1400fa94a], 0
jne 0x14001aa3f
mov r9, qword [0x1400fa930]
mov eax, 0xffffbfff
and r9, rax
mov edx, 0x312
mov r8d, 0x80
mov rcx, qword [0x1400f9598]
call qword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x14001aa48
mov eax, 9
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret