Function at 0x140027970
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x140043008]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea r8, str.ListaryHookHost64Mutex
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x140027cd7
mov qword [rsp + 0xb0], rdi
lea r8, str.ListaryHookHost64Mutex
mov qword [rsp + 0x90], r15
lea edx, [rax + 1]
xor ecx, ecx
mov qword [rsp + 0xc0], rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
xor ecx, ecx
mov qword [rsp + 0x30], rax
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140027a40
lea rdx, str.ChangeWindowMessageFilter
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140027a37
mov edx, 1
lea ecx, [rdx + 0x11]
call rbx
mov edx, 1
lea ecx, [rdx + 0x49]
call rbx
mov ecx, dword [0x140044df0]
mov edx, 1
call rbx
mov edx, 1
mov ecx, 0x807f
call rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0xd0], rsi
lea r8, str.ListaryX_MainSharedMemory
xor edx, edx
mov qword [rsp + 0x98], r14
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov r15, rax
test rax, rax
je 0x140027cd0
xor r14d, r14d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x140027cd0
mov ebx, dword [rax]
test rbx, rbx
je 0x140027cd0
mov qword [rsp + 0xc8], rbp
lea rcx, [rsp + 0x68]
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r13
call fcn.140027630
cmp qword [rsp + 0x78], r14
je 0x140027c2e
cmp qword [rsp + 0x80], 8
lea rcx, [rsp + 0x68]
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140027c2e
lea rdx, str.InstallHook
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateHookHelper
mov rcx, rdi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RemoveHook
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r12, r12
je 0x140027c2e
test rbp, rbp
je 0x140027c2e
test rax, rax
je 0x140027c2e
call r12
test eax, eax
je 0x140027c2e
call rbp
mov rbp, rax
test rax, rax
je 0x140027c2e
lea rdx, str.HookShellWindow
mov dword [rsi + 8], ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140027b7d
call rax
mov edx, dword [0x140044df0]
mov r9, rbp
mov r8d, 0x838a
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0x3e8
call qword [sym.imp.USER32.dll_SetTimer]
xor r9d, r9d
lea rcx, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140027c03
nop
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140027bd6
lea ecx, [rax + 1]
call qword [sym.imp.USER32.dll_PostQuitMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140027bc0
call r13
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x140027c34
mov r14d, 1
mov rdx, qword [rsp + 0x80]
mov r13, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x140027c8d
mov rcx, qword [rsp + 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027c88
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027cf1
call fcn.14002858c
mov eax, r14d
mov r14, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xb0]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140028530
add rsp, 0xb8
ret
mov eax, 1
jmp 0x140027c90
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140028530
add rsp, 0xb8
ret
call fcn.14002e95c
int3