Function at 0x140023980
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
mov byte [rsp + 0x10], dl
mov byte [rsp + 8], cl
push rdi
sub rsp, 0xc0
lea rdi, [rsp + 0x30]
mov ecx, 0x24
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0xd0]
call fcn.140027780
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0xd0]
movzx ecx, byte [rsp + 0x30]
cmp eax, ecx
jne 0x1400239c8
jmp 0x140023cb8
movzx eax, byte [rsp + 0x30]
test eax, eax
jne 0x140023a37
movzx eax, byte [rsp + 0xd8]
test eax, eax
jne 0x140023a37
lea rax, [0x1403213b8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140027e10]
mov edx, 0x2000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140322258], rax
cmp qword [0x140322258], 0
je 0x140023a2d
mov edx, reloc.WSOCK32.dll_ntohs
mov rcx, qword [0x140322258]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x140023a37
call fcn.1400276a0
jmp 0x140023cb8
mov dword [rsp + 0x34], 0
jmp 0x140023a4b
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x32
jge 0x140023aad
movzx eax, byte [rsp + 0xd8]
test eax, eax
jne 0x140023a6c
mov qword [rsp + 0xb0], 1
jmp 0x140023a78
mov qword [rsp + 0xb0], 0
movzx eax, byte [rsp + 0xd0]
mov r9, qword [rsp + 0xb0]
mov r8d, eax
mov edx, 0x417
mov ecx, dword [0x1403213b8]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x140023aad
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140023a41
mov byte [rsp + 0xa8], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0xa4], eax
movzx eax, byte [rsp + 0xd0]
test eax, eax
je 0x140023b2c
mov dword [rsp + 0x20], 1
mov r9d, 0x417
mov r8d, 0x417
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140023b2a
cmp qword [rsp + 0x58], 0
je 0x140023b25
mov byte [rsp + 0xa8], 1
call fcn.140027780
movzx eax, al
test eax, eax
jne 0x140023b25
movzx eax, byte [rsp + 0xd8]
test eax, eax
jne 0x140023b25
mov byte [rsp + 0xd0], 0
jmp 0x140023ac2
jmp 0x140023bac
jmp 0x140023b89
movzx eax, byte [rsp + 0xd8]
test eax, eax
je 0x140023b48
call fcn.140027780
movzx eax, al
test eax, eax
jne 0x140023b46
jmp 0x140023bac
jmp 0x140023b89
lea rdx, [rsp + 0x94]
mov rcx, qword [0x140322258]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x94], 0x103
je 0x140023b89
mov rcx, qword [0x140322258]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140322258], 0
call fcn.1400276a0
jmp 0x140023bac
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0xa4]
cmp eax, 0x1f4
jbe 0x140023b9f
jmp 0x140023bac
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140023ac2
movzx eax, byte [rsp + 0xd8]
test eax, eax
jne 0x140023c78
cmp qword [0x140321418], 0
je 0x140023bec
movzx eax, byte [rsp + 0x30]
and eax, 1
test eax, eax
jne 0x140023bec
lea r8, [0x140270758]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140322248], rax
jmp 0x140023c1a
cmp qword [0x140321418], 0
jne 0x140023c1a
movzx eax, byte [rsp + 0x30]
and eax, 1
test eax, eax
je 0x140023c1a
mov rcx, qword [0x140322248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140322248], 0
cmp qword [0x140321520], 0
je 0x140023c4a
movzx eax, byte [rsp + 0x30]
and eax, 2
test eax, eax
jne 0x140023c4a
lea r8, [0x140270770]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140322250], rax
jmp 0x140023c78
cmp qword [0x140321520], 0
jne 0x140023c78
movzx eax, byte [rsp + 0x30]
and eax, 2
test eax, eax
je 0x140023c78
mov rcx, qword [0x140322250]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140322250], 0
movzx eax, byte [rsp + 0xa8]
test eax, eax
je 0x140023cb8
mov dword [0x140319840], 0
mov qword [rsp + 0x20], 0
xorps xmm3, xmm3
xor r8d, r8d
mov edx, 0x10000
lea rcx, str.Warning:_The_keyboard_and_or_mouse_hook_could_not_be_activated__some_parts_of_the_script_will_not_function.
call fcn.140103a20
mov dword [0x140319840], 1
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.140134a00
add rsp, 0xc0
pop rdi
ret