Function at 0x140079ca8
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Create thread
Resume thread
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14b, byte [rsp + 0xd8]
mov r13d, ecx
mov rcx, rdx
mov al, r14b
and r14b, 0xf
mov ebp, r9d
and al, 0xc0
mov r15, r8
mov rdi, rdx
mov byte [rsp + 0x40], al
mov byte [rsp + 0xd8], r14b
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r10, eax
mov rcx, r15
lea rsi, [r10 + r10 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea r12, [rcx + rcx + 2]
lea rcx, [rsp + 0x48]
lea rdx, [r12 + rsi + 0x40]
call fcn.140061f7c
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
mov qword [rsp + 0x60], rbx
call fcn.140059884
lea r11, [0x1401377b0]
lea r8, [0x14005f8d4]
mov qword [rsp + 0x28], r11
mov r9, rbx
mov edx, 0x20000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140079d7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, 1
mov ebx, eax
test eax, eax
cmove ebx, ebp
jmp 0x14007a1b8
mov eax, dword [rsp + 0xd0]
mov dword [rbx + 0x20], ebp
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0x24], eax
mov qword [rbx + 0x18], r15
lea rcx, [rbx + 0x40]
lea rax, [rbx + rsi + 0x40]
mov qword [rbx], 2
mov dword [rbx + 8], r13d
mov byte [rbx + 0x28], r14b
mov ebp, 1
mov r8, rsi
mov rdx, rdi
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x10], rcx
mov dword [rbx + 0x34], ebp
call fcn.14001d8e0
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, r15
call fcn.14001d8e0
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rsp + 0x58]
mov rdi, rax
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r14, str.32770
xor esi, esi
xor r12d, r12d
mov qword [rsp + 0x50], r14
cmp r13d, 2
jne 0x140079e3e
xor r14d, r14d
lea r15, [0x140121eb0]
lea r12, [0x140121ea0]
mov qword [rsp + 0x50], r14
movzx eax, word [0x140138194]
mov ecx, 4
xor dil, dil
mov dword [rsp + 0x44], esi
test cl, al
jne 0x140079e74
or ax, cx
lea edx, [rcx - 2]
lea rcx, str.SeDebugPrivilege
xor r8d, r8d
mov dil, bpl
mov word [0x140138194], ax
call fcn.14001c2f4
mov r13d, 0xa
sub r13d, ebp
js 0x140079ebc
mov rdx, r15
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x140079ebc
test r12, r12
je 0x140079eac
mov rdx, r12
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x140079ebc
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x140079e7a
mov r13d, 0xa
test rsi, rsi
jne 0x140079f2e
sub r13d, ebp
js 0x140079f04
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x140079f2e
test r12, r12
je 0x140079ef7
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x140079f2e
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x140079ec7
test rsi, rsi
jne 0x140079f2e
and qword [rsp + 0x38], rsi
and qword [rsp + 0x30], rsi
and dword [rsp + 0x28], esi
and dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.1400df71c
mov rsi, rax
mov r14d, 0x5a
mov r13d, r14d
test rsi, rsi
jne 0x140079fcb
mov rbx, qword [rsp + 0x50]
sub r13d, ebp
js 0x140079f87
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x140079f87
test r12, r12
je 0x140079f77
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x140079f87
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x140079f45
mov rbx, qword [rsp + 0x60]
jmp 0x140079fc6
sub r14d, ebp
js 0x140079fcb
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x140079fcb
test r12, r12
je 0x140079fbe
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x140079fcb
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x140079f8e
mov r13d, dword [rsp + 0xb0]
mov r14, qword [rsp + 0xc0]
xor r15d, r15d
cmp r13d, 2
jne 0x140079ff5
cmp rsi, r15
je 0x140079ff5
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowTextW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
cmp r13d, ebp
jne 0x14007a017
cmp rsi, r15
je 0x14007a017
mov rcx, qword [0x140136a30]
cmp rcx, r15
je 0x14007a017
mov qword [rcx], rsi
cmp byte [rsp + 0x40], 0x80
je 0x14007a100
cmp r13d, ebp
jne 0x14007a030
cmp rsi, r15
je 0x14007a100
cmp r13d, 2
jne 0x14007a090
mov ebx, dword [rsp + 0xd0]
cmp ebx, r15d
jg 0x14007a07b
cmp dil, r15b
je 0x14007a066
mov eax, 0xfffb
lea edx, [r13 + 2]
lea rcx, str.SeDebugPrivilege
and word [0x140138194], ax
xor r8d, r8d
call fcn.14001c2f4
mov ebx, r15d
jmp 0x14007a1b8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r12d
cmp eax, ebx
jge 0x14007a086
mov al, byte [0x14013424f]
cmp al, r15b
jg 0x14007a06e
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
jmp 0x14007a0fb
mov al, byte [0x14013424f]
cmp al, r15b
jle 0x14007a0e5
mov ebp, dword [rsp + 0xd0]
cmp ebp, r15d
jle 0x14007a0b8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r12d
cmp eax, ebp
jge 0x14007a1dc
mov rcx, qword [rsp + 0x50]
mov rdx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
cmp rax, r15
je 0x14007a0e5
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11b, byte [0x14013424f]
cmp r11b, r15b
jg 0x14007a0a2
mov eax, dword [rbx + 0x34]
mov dword [rsp + 0x44], eax
mov rax, qword [0x140136a30]
cmp rax, r15
je 0x14007a0fb
mov qword [rax], r15
mov rbx, qword [rsp + 0x48]
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec qword [rbx]
cmp qword [rbx], r15
mov dword [rbx + 0x30], r15d
cmovg rbx, r15
lea rcx, [0x140138118]
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rsi, r15
je 0x14007a177
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
mov ebx, 0x111
lea r8d, [r9 + 2]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov edx, ebx
lea r8d, [r9 + 7]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rbx, qword [rsp + 0x58]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x44]
cmp dil, r15b
je 0x14007a1b8
xor r8d, r8d
mov eax, 0xfffb
lea rcx, str.SeDebugPrivilege
and word [0x140138194], ax
lea edx, [r8 + 4]
call fcn.14001c2f4
lea rcx, [rsp + 0x48]
call fcn.140059920
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, byte [rsp + 0xd8]
jmp 0x14007a0e8