Function at 0x14019d5c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, qword [rsp + 0xb0]
lea eax, [r8 - 0x401]
mov rdi, r9
mov rbx, rdx
mov rbp, rcx
cmp eax, 0x31
ja case.0x14019d60a.1026
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x19dea0]
add rcx, rdx
jmp rcx
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0xc0], rdi
test rsi, rsi
jne 0x14019d653
lea rcx, [sym.SystemInformer.exe_QiIsExecutingInWow64]
mov qword [rbx + 0xb8], rcx
lea eax, [rsi + 1]
jmp 0x14019d840
cmp dword [rbx + 0x244], 0
jg 0x14019d65d
or dword [rbx + 0x40], 0xc00000
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
jmp 0x14019d840
mov rcx, rbx
call fcn.14019fbc0
mov rcx, rbx
call fcn.14019e600
jmp 0x14019d645
mov rdx, rsi
mov rcx, rbx
call fcn.14019ea80
movzx eax, al
jmp 0x14019d840
cmp edi, dword [rbx + 0xd4]
jae 0x14019d6f7
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov rsi, qword [rax + rcx*8]
test rsi, rsi
je 0x14019d6f7
mov edi, dword [rsi]
mov rdx, rsi
mov rcx, rbx
call fcn.14019f3c0
mov ecx, dword [rsi + 4]
xor edx, edx
mov rax, qword [rbx + 0xc8]
mov r8, rsi
mov qword [rax + rcx*8], rdx
mov rcx, qword [0x1402c5110]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rbx
call fcn.14019f0c0
test dil, 1
je 0x14019d6e5
mov rcx, rbx
call fcn.14019e600
dec dword [rbx + 0xd8]
mov edx, 1
mov eax, edx
jmp 0x14019d840
xor edx, edx
mov eax, edx
jmp 0x14019d840
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.14019ec50
movzx eax, al
jmp 0x14019d840
mov r8d, dword [rsi + 4]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.14019eca0
movzx eax, al
jmp 0x14019d840
cmp edi, dword [rbx + 0xec]
jne case.0x14019d60a.1026
nop
test edi, edi
je 0x14019d653
xor edx, edx
mov r9d, edi
mov r8d, edx
mov rax, qword [rbx + 0xe0]
lea rdx, [rdx + 4]
lea r8, [r8 + 8]
mov rcx, qword [r8 + rax - 8]
mov eax, dword [rcx + 4]
mov dword [rdx + rsi - 4], eax
sub r9, 1
jne 0x14019d750
lea eax, [r9 + 1]
jmp 0x14019d840
mov qword ss:[rsp + 0x60], r14
test edi, edi
je 0x14019d826
mov rcx, qword [0x1402c5110]
mov edx, 4
mov r14d, edi
lea r8, [r14*4]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov rbp, rax
test edi, edi
je 0x14019d7f6
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rsi + r8]
cmp ecx, dword [rbx + 0xd4]
jae 0x14019d856
lfence
mov rax, qword [rbx + 0xc8]
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x14019d856
mov eax, dword [rax + 0x28]
inc edx
mov dword [r8 + rbp], eax
add r8, 4
cmp edx, edi
jb 0x14019d7c0
mov rcx, qword [rbx + 0x18]
mov r9, rbp
mov r8, r14
mov edx, 0x1212
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1402c5110]
xor edx, edx
mov r8, rbp
test eax, eax
je 0x14019d865
nop dword [rax + rax]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rbx
call fcn.14019f440
mov rcx, rbx
call fcn.14019f0c0
mov eax, 1
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
lfence
mov rcx, qword [0x1402c5110]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
jmp 0x14019d83b
mov qword [rbx + 0x58], rsi
mov eax, 1
jmp 0x14019d840
test rdi, rdi
je 0x14019d888
mov eax, dword [rbx + 0x130]
mov dword [r9], eax
test rsi, rsi
je 0x14019d653
mov eax, dword ds:[rbx + 0x134]
mov dword [rsi], eax
mov eax, 1
jmp 0x14019d840
test esi, esi
je 0x14019d8cc
cmp edi, dword [rbx + 0xd4]
jae case.0x14019d60a.1026
lfence
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
jne 0x14019d8d0
xor eax, eax
jmp 0x14019d840
xor edx, edx
mov edi, edx
mov rcx, rbx
mov dword [rbx + 0x130], edi
mov dword [rbx + 0x134], esi
call fcn.14019f520
mov rax, qword [rbx + 0xb8]
lea rcx, [sym.SystemInformer.exe_QiIsExecutingInWow64]
cmp rax, rcx
je 0x14019d653
mov rcx, qword [rbx + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbx]
lea edx, [r9 + 0xa]
call qword [case.0x14013b5a0.0]
mov eax, 1
jmp 0x14019d840
mov eax, dword [rbx + 0x40]
neg rdi
sbb ecx, ecx
btr eax, 0xa
and ecx, 0x400
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x14019d840
mov edx, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401a0bc0
movzx eax, al
jmp 0x14019d840
mov r8d, esi
mov edx, edi
mov rcx, rbx
call fcn.1401a1fe0
mov eax, 1
jmp 0x14019d840
test dword [rbx + 0x40], 0x400000
jne case.0x14019d60a.1026
mov rax, qword [rbx + 0x128]
mov eax, dword [rax]
jmp 0x14019d840
mov rax, qword [rbx + 0x128]
cmp edi, dword [rax]
jae case.0x14019d60a.1026
lfence
mov rcx, qword [rbx + 0x128]
mov edx, edi
mov rax, qword [rcx + 8]
mov rax, qword [rax + rdx*8]
jmp 0x14019d840
mov r8d, dword [rsi + 0x10]
lea r9, [rsi + 0x18]
mov rdx, qword [rsi + 8]
mov rcx, rbx
call fcn.14019fae0
movzx eax, al
jmp 0x14019d840
test rdi, rdi
mov rdx, rsi
mov rcx, rbx
setne r8b
call fcn.14019fe40
mov eax, 1
jmp 0x14019d840
mov eax, dword [rbx + 0xd0]
dec eax
jmp 0x14019d840
inc edi
cmp dword [rbx + 0xd0], edi
jae 0x14019d653
mov dword [rbx + 0xd0], edi
cmp dword [rbx + 0xd4], edi
jae 0x14019d653
mov rcx, rbx
call fcn.14019efe0
mov eax, 1
jmp 0x14019d840
test byte [rsi], 1
je case.0x14019d60a.1026
mov edx, dword [rsi + 0x2c]
mov r8d, edx
lea rax, [rsp + 0x38]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401a0240
test al, al
je case.0x14019d60a.1026
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rbp
jmp 0x14019d64d
mov r8d, esi
mov edx, edi
jmp 0x14019da3f
mov rax, qword [rbx + 0x10]
jmp 0x14019d840
mov rax, qword [rbx + 0x18]
jmp 0x14019d840
mov rax, qword [rbx + 0x38]
jmp 0x14019d840
xor edx, edx
lea rax, [rsp + 0x30]
cmp r8d, 0x41d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov r8d, esi
sete dl
mov qword [rsp + 0x20], rax
mov r9d, edx
mov rcx, rbx
mov edx, edi
call fcn.1401a05a0
mov r8d, dword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov edx, dword [rsp + 0x38]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401a0240
nop dword [rax]
test al, al
je 0x14019d653
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbp
jmp 0x14019d64d
mov eax, dword ds:[rbx + 0xd8]
jmp 0x14019d840
test rdi, rdi
mov edx, 1
mov eax, 0xffffffff
cmove edx, eax
add edx, dword [rbx + 0x244]
mov dword [rbx + 0x244], edx
cmp edx, 1
jne 0x14019dbc7
test dword [rbx + 0x40], 0x400000
je 0x14019db3b
mov rcx, rbx
call fcn.14019fbc0
test dword [rbx + 0x40], 0x800000
je 0x14019db4c
mov rcx, rbx
call fcn.14019e600
test dword [rbx + 0x40], 0x1000000
je 0x14019db90
mov rdi, qword [rbx]
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx edx, ax
mov rcx, rdi
shr eax, 0x10
cwde
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov r8, qword [rsp + 0x38]
mov rcx, rbx
mov edx, dword [rsp + 0x38]
shr r8, 0x20
call fcn.1401a0c60
and dword ds:[rbx + 0x40], 0xfe3fffff
mov rdx, qword [rbx + 0x248]
test rdx, rdx
je 0x14019dbc7
mov rcx, qword [rbx]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRgn]
mov rcx, qword [rbx + 0x248]
call qword [sym.imp.GDI32.dll_DeleteObject]
xor edx, edx
mov qword [rbx + 0x248], rdx
movsxd rax, dword [rbx + 0x244]
jmp 0x14019d840
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rsi], xmm0
mov eax, dword [rbx + 0x70]
mov dword [rsi + 0x10], eax
mov eax, dword [rbx + 0x74]
mov dword [rsi + 0x14], eax
test byte [rbx + 0x40], 4
je 0x14019dbf1
mov edx, dword [rbx + 0x78]
jmp 0x14019dbf3
xor edx, edx
mov dword [rsi + 0x18], edx
mov eax, dword [rbx + 0x7c]
mov dword [rsi + 0x1c], eax
mov eax, dword [rbx + 0x80]
mov dword [rsi + 0x20], eax
mov eax, dword [rbx + 0x84]
mov dword [rsi + 0x24], eax
mov eax, dword [rbx + 0x88]
mov dword [rsi + 0x28], eax
mov eax, dword [rbx + 0x90]
mov dword [rsi + 0x2c], eax
mov eax, dword [rbx + 0xf0]
mov dword [rsi + 0x30], eax
mov eax, 1
jmp 0x14019d840
mov rax, qword [rbx + 0xf8]
jmp 0x14019d840
mov rax, qword [rbx + 0x100]
jmp 0x14019d840
mov qword [rbx + 0x98], rsi
mov eax, 1
jmp 0x14019d840
mov eax, dword [rsi + 0x2c]
mov dword [rbx + 0xa4], eax
mov eax, 1
jmp 0x14019d840
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.1401a0780
mov eax, 1
jmp 0x14019d840
mov eax, edi
and edi, esi
not eax
and eax, dword [rbx + 0x4c]
or eax, edi
mov dword [rbx + 0x4c], eax
mov eax, 1
jmp 0x14019d840
nop
test rsi, rsi
je 0x14019dcbf
mov rax, qword [rbx + 0xb8]
lea rcx, [sym.SystemInformer.exe_QiIsExecutingInWow64]
xor edx, edx
cmp rax, rcx
cmovne rdx, rax
mov qword [rsi], rdx
nop
test rdi, rdi
je 0x14019d653
mov rax, qword [rbx + 0xc0]
mov qword [r9], rax
mov eax, 1
jmp 0x14019d840
mov rdx, rsi
mov rcx, rbx
call fcn.1401a0320
mov eax, 1
jmp 0x14019d840
mov eax, dword [rbx + 0x40]
shr eax, 4
and eax, 1
add eax, dword [rbx + 0xec]
jmp 0x14019d840
cmp edi, dword [rbx + 0xd4]
jae case.0x14019d60a.1026
lfence
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov r8, qword [rax + rcx*8]
test r8, r8
je case.0x14019d60a.1026
mov eax, dword [r8]
test al, 1
je case.0x14019d60a.1026
test al, 4
je 0x14019dd53
mov rdx, qword [rbx + 0x10]
mov r9d, esi
mov rcx, rbx
call fcn.14019f7e0
mov eax, 1
jmp 0x14019d840
mov rdx, qword ds:[rbx + 0x18]
mov r9d, esi
mov rcx, rbx
call fcn.14019f7e0
mov eax, 1
jmp 0x14019d840
movups xmm0, xmmword ds:[rsi]
mov eax, 1
movups xmmword [rbx + 0x250], xmm0
jmp 0x14019d840
mov eax, dword [rbx + 0x40]
test edi, edi
je 0x14019dda5
bts eax, 0x1b
mov dword [rbx + 0x74], edi
mov dword [rbx + 0x40], eax
mov eax, 1
jmp 0x14019d840
btr eax, 0x1b
mov rcx, rbx
mov dword [rbx + 0x40], eax
call fcn.14019e320
mov eax, 1
jmp 0x14019d840
mov eax, dword [rbx + 0x40]
shr eax, 0x16
not eax
and eax, 1
jmp 0x14019d840
mov eax, dword [rbx + 0x40]
neg rdi
sbb ecx, ecx
btr eax, 0x1e
and ecx, 0x40000000
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x14019d840
mov rax, rdi
mov qword [rbx + 0x270], rdi
neg rax
mov eax, dword [rbx + 0x40]
sbb ecx, ecx
btr eax, 0x1f
and ecx, 0x80000000
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x14019d840
mov eax, dword ds:[r9]
mov dword [rbx + 0x2b8], eax
mov rax, qword [r9 + 8]
mov qword [rbx + 0x2c0], rax
mov rax, qword [r9 + 0x10]
mov qword [rbx + 0x2c8], rax
mov eax, 1
jmp 0x14019d840
mov edx, esi
mov rcx, rbx
call fcn.1401a0bc0
movzx eax, al
jmp 0x14019d840
mov eax, dword [rbx + 0x40]
shr eax, 4
and eax, 1
add eax, dword [rbx + 0xec]
cmp edi, eax
jae case.0x14019d60a.1026
lfence
mov eax, dword [rbx + 0x40]
mov r8, rsi
shr eax, 4
and eax, 1
sub edi, eax
mov rax, qword [rbx + 0xe0]
mov rcx, qword [rax + rdi*8]
mov edx, dword [rcx + 4]
mov rcx, rbx
call fcn.14019ec50
movzx eax, al
jmp 0x14019d840