Function at 0x140005b60
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1b0
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rdx, [0x140010e78]
lea rcx, [rsp + 0x70]
call fcn.1400079a0
lea rcx, [rsp + 0x70]
call fcn.140007970
nop
lea rdx, [0x140010e98]
lea rcx, [rsp + 0x90]
call fcn.1400079a0
lea rcx, [rsp + 0x90]
call fcn.140007970
nop
lea rdx, [0x140010eb8]
lea rcx, [rsp + 0xb0]
call fcn.1400079a0
lea rcx, [rsp + 0xb0]
call fcn.140007970
nop
lea rdx, [0x140010ed8]
lea rcx, [rsp + 0xd0]
call fcn.1400079a0
lea rcx, [rsp + 0xd0]
call fcn.140007970
nop
mov ecx, 1
call fcn.140002dd0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140002860]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, str.ONCE_HUMAN
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140005c9d
call fcn.140007640
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.140001900
mov qword [rsp + 0x50], rax
call fcn.140007640
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x38], rcx
call fcn.140007640
mov dword [rax + 0x10], 1
cmp qword [rsp + 0x30], 0
jne 0x140005cf0
call fcn.140007640
mov dword [rax + 0x10], 2
lea rdx, [0x140010f08]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rsp + 0x30], rax
call fcn.140007640
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call fcn.140001900
mov qword [rsp + 0x58], rax
call fcn.140007640
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x38], rcx
lea rcx, str.4889__________4885C97445488B__________4885D2
call fcn.140002510
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
add rax, 3
mov rcx, rax
call fcn.140009870
cdqe
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 7]
mov qword [rsp + 0x60], rax
call fcn.140007640
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x58], rcx
lea rcx, str.488B__________482BC148C1F8034885C074396666660F1F840000000000
call fcn.140002510
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
add rax, 3
mov rcx, rax
call fcn.140009870
cdqe
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + rax + 7]
mov qword [rsp + 0x68], rax
call fcn.140007640
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x50], rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x38], eax
call fcn.140007640
mov ecx, dword [rsp + 0x38]
mov dword [rax + 0x18], ecx
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x3c], eax
call fcn.140007640
mov ecx, dword [rsp + 0x3c]
mov dword [rax + 0x14], ecx
lea rdx, [0x140010f88]
lea rcx, [rsp + 0xf0]
call fcn.1400079a0
lea rcx, [rsp + 0xf0]
call fcn.140007970
nop
lea rdx, [0x140010fa8]
lea rcx, [rsp + 0x110]
call fcn.1400079a0
lea rcx, [rsp + 0x110]
call fcn.140007970
nop
lea rdx, [0x140010fc8]
lea rcx, [rsp + 0x130]
call fcn.1400079a0
lea rcx, [rsp + 0x130]
call fcn.140007970
nop
lea rdx, str.MOVIJZOUX980870___i_k_COLXZ_n
lea rcx, [rsp + 0x150]
call fcn.1400079a0
lea rcx, [rsp + 0x150]
call fcn.140007970
nop
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400046b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140004290]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x1c0]
call fcn.140005390
nop
mov edx, dword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x1c0]
call fcn.140005750
test eax, eax
jne 0x140005ea1
xor eax, eax
jmp 0x140005f00
lea rax, [rsp + 0x170]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x170]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140005ef9
lea rcx, [rsp + 0x170]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x170]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x140005eb5
mov eax, dword [rsp + 0x180]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14000c580
add rsp, 0x1b0
pop rdi
ret