Function at 0x1401a3420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + 0xb0]
lea eax, [r8 - 0x401]
mov rsi, r9
mov rbx, rdx
mov rbp, rcx
cmp eax, 0x34
ja case.0x1401a346a.1026
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1a3e88]
add rcx, rdx
jmp rcx
mov qword [rbx + 0xc0], rdi
mov qword [rbx + 0xc8], rsi
test rdi, rdi
jne 0x1401a34b7
lea rcx, [sym.SystemInformer.exe_Ordinal_1266]
mov eax, 1
mov qword [rbx + 0xc0], rcx
jmp 0x1401a36b7
cmp dword ds:[rbx + 0x24c], 0
jg 0x1401a34c5
or dword [rbx + 0x40], 0xc00000
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
jmp 0x1401a36b7
mov rcx, rbx
call fcn.1401a5ba0
mov rcx, rbx
call fcn.1401a45e0
jmp 0x1401a34a9
mov rdx, rdi
mov rcx, rbx
call fcn.1401a4a60
movzx eax, al
jmp 0x1401a36b7
cmp esi, dword [rbx + 0xdc]
jae 0x1401a3565
mov rax, qword [rbx + 0xd0]
mov ecx, esi
mov rsi, qword [rax + rcx*8]
test rsi, rsi
je 0x1401a3565
mov edi, dword [rsi]
mov rdx, rsi
mov rcx, rbx
call fcn.1401a53a0
mov ecx, dword [rsi + 4]
xor edx, edx
mov rax, qword [rbx + 0xd0]
mov r8, rsi
mov qword [rax + rcx*8], rdx
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rbx
call fcn.1401a50a0
nop dword [rax]
test dil, 1
je 0x1401a354e
mov rcx, rbx
call fcn.1401a45e0
dec dword ds:[rbx + 0xe0]
mov edx, 1
mov eax, edx
jmp 0x1401a36b7
xor edx, edx
mov eax, edx
jmp 0x1401a36b7
mov r8, rdi
mov edx, esi
mov rcx, rbx
call fcn.1401a4c30
movzx eax, al
jmp 0x1401a36b7
mov r8d, dword [rdi + 4]
mov r9, rdi
mov edx, esi
mov rcx, rbx
call fcn.1401a4c80
movzx eax, al
jmp 0x1401a36b7
nop
cmp esi, dword [rbx + 0xf4]
jne case.0x1401a346a.1026
test esi, esi
je 0x1401a34b7
xor edx, edx
mov r9d, esi
mov r8d, edx
nop dword [rax]
mov rax, qword ds:[rbx + 0xe8]
lea rdx, [rdx + 4]
lea r8, [r8 + 8]
mov rcx, qword [r8 + rax - 8]
mov eax, dword [rcx + 4]
mov dword [rdx + rdi - 4], eax
sub r9, 1
jne 0x1401a35c0
mov eax, 1
jmp 0x1401a36b7
mov qword [rsp + 0x60], r14
test esi, esi
je 0x1401a369c
mov rcx, qword [0x1402c6140]
mov edx, 4
mov r14d, esi
lea r8, [r14*4]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov rbp, rax
test esi, esi
je 0x1401a3670
mov r8d, edx
nop word [rax + rax]
mov ecx, dword ds:[rdi + r8]
nop
cmp ecx, dword [rbx + 0xdc]
jae 0x1401a36ce
lfence
mov rax, qword [rbx + 0xd0]
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x1401a36ce
mov eax, dword [rax + 0x28]
inc edx
mov dword [r8 + rbp], eax
add r8, 4
cmp edx, esi
jb 0x1401a3630
mov rcx, qword ds:[rbx + 0x18]
mov r9, rbp
mov r8, r14
mov edx, 0x1212
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1402c6140]
xor edx, edx
mov r8, rbp
test eax, eax
je 0x1401a36dd
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rbx
call fcn.1401a5420
mov rcx, rbx
call fcn.1401a50a0
mov eax, 1
mov r14, qword [rsp + 0x60]
mov rcx, qword ds:[rsp + 0x58]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
lfence
mov rcx, qword [0x1402c6140]
mov r8, rbp
xor edx, edx
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
jmp 0x1401a36b2
mov qword [rbx + 0x58], rdi
mov eax, 1
jmp 0x1401a36b7
test rsi, rsi
je 0x1401a3703
mov eax, dword [rbx + 0x138]
mov dword [r9], eax
test rdi, rdi
je 0x1401a34b7
mov eax, dword [rbx + 0x13c]
mov dword [rdi], eax
mov eax, 1
jmp 0x1401a36b7
nop dword [rax + rax]
cmp esi, dword [rbx + 0x138]
jne 0x1401a3734
cmp edi, dword [rbx + 0x13c]
je 0x1401a34b7
test edi, edi
je 0x1401a3765
nop dword [rax + rax]
cmp esi, dword [rbx + 0xdc]
jae case.0x1401a346a.1026
lfence
mov rax, qword [rbx + 0xd0]
mov ecx, esi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
jne 0x1401a3769
xor eax, eax
jmp 0x1401a36b7
xor edx, edx
mov esi, edx
mov rcx, rbx
mov dword [rbx + 0x138], esi
mov dword [rbx + 0x13c], edi
call fcn.1401a5500
mov rax, qword [rbx + 0xc0]
lea rcx, [sym.SystemInformer.exe_Ordinal_1266]
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x3c], edi
cmp rax, rcx
je 0x1401a34b7
mov rcx, qword [rbx + 0xc8]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov rcx, qword [rbx]
mov edx, 0xa
call qword [case.0x14013f76a.0]
mov eax, 1
jmp 0x1401a36b7
mov eax, dword [rbx + 0x40]
neg rsi
sbb ecx, ecx
btr eax, 0xa
and ecx, 0x400
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a36b7
mov edx, dword [rdi + 0x2c]
mov rcx, rbx
call fcn.1401a6a40
movzx eax, al
jmp 0x1401a36b7
mov r8d, edi
mov edx, esi
mov rcx, rbx
call fcn.1401a7ea0
mov eax, 1
jmp 0x1401a36b7
test dword ds:[rbx + 0x40], 0x400000
jne case.0x1401a346a.1026
mov rax, qword [rbx + 0x130]
mov eax, dword [rax]
jmp 0x1401a36b7
mov rax, qword ds:[rbx + 0x130]
cmp esi, dword [rax]
jae case.0x1401a346a.1026
lfence
mov rcx, qword [rbx + 0x130]
mov edx, esi
mov rax, qword [rcx + 8]
mov rax, qword [rax + rdx*8]
jmp 0x1401a36b7
mov r8d, dword [rdi + 0x10]
lea r9, [rdi + 0x18]
mov rdx, qword [rdi + 8]
mov rcx, rbx
call fcn.1401a5ac0
movzx eax, al
jmp 0x1401a36b7
test rsi, rsi
mov rdx, rdi
mov rcx, rbx
setne r8b
call fcn.1401a5e20
mov eax, 1
jmp 0x1401a36b7
mov eax, dword [rbx + 0xd8]
dec eax
jmp 0x1401a36b7
inc esi
cmp dword [rbx + 0xd8], esi
jae 0x1401a34b7
mov dword [rbx + 0xd8], esi
cmp dword [rbx + 0xdc], esi
jae 0x1401a34b7
mov rcx, rbx
call fcn.1401a4fc0
mov eax, 1
jmp 0x1401a36b7
test byte [rdi], 1
je case.0x1401a346a.1026
mov edx, dword [rdi + 0x2c]
mov r8d, edx
lea rax, [rsp + 0x38]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401a6220
test al, al
je case.0x1401a346a.1026
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rbp
jmp 0x1401a34b1
mov r8d, edi
mov edx, esi
jmp 0x1401a38ff
mov rax, qword [rbx + 0x10]
jmp 0x1401a36b7
mov rax, qword [rbx + 0x18]
jmp 0x1401a36b7
mov rax, qword [rbx + 0x38]
jmp 0x1401a36b7
xor edx, edx
lea rax, [rsp + 0x30]
cmp r8d, 0x41d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov r8d, edi
sete dl
mov qword [rsp + 0x20], rax
mov r9d, edx
mov rcx, rbx
mov edx, esi
call fcn.1401a6580
mov r8d, dword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov edx, dword [rsp + 0x38]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401a6220
nop dword [rax]
test al, al
je 0x1401a34b7
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbp
jmp 0x1401a34b1
mov eax, dword ds:[rbx + 0xe0]
jmp 0x1401a36b7
test rsi, rsi
mov edx, 1
mov rax, 0xffffffffffffffff
cmove edx, eax
add edx, dword [rbx + 0x24c]
mov dword [rbx + 0x24c], edx
cmp edx, 1
jne 0x1401a3a90
test dword [rbx + 0x40], 0x400000
je 0x1401a39fd
mov rcx, rbx
call fcn.1401a5ba0
test dword [rbx + 0x40], 0x800000
je 0x1401a3a0e
mov rcx, rbx
call fcn.1401a45e0
test dword [rbx + 0x40], 0x1000000
je 0x1401a3a5b
mov rdi, qword ds:[rbx]
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx edx, ax
mov rcx, rdi
shr eax, 0x10
cwde
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov r8, qword [rsp + 0x38]
mov rcx, rbx
mov edx, dword [rsp + 0x38]
shr r8, 0x20
call fcn.1401a6ae0
and dword [rbx + 0x40], 0xfe3fffff
mov rdx, qword [rbx + 0x250]
test rdx, rdx
je 0x1401a3a90
mov rcx, qword [rbx]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRgn]
mov rcx, qword [rbx + 0x250]
call qword [sym.imp.GDI32.dll_DeleteObject]
xor edx, edx
mov qword [rbx + 0x250], rdx
movsxd rax, dword [rbx + 0x24c]
jmp 0x1401a36b7
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rdi], xmm0
mov eax, dword [rbx + 0x70]
mov dword [rdi + 0x10], eax
mov eax, dword [rbx + 0x74]
mov dword [rdi + 0x14], eax
test byte [rbx + 0x40], 4
je 0x1401a3aba
mov edx, dword [rbx + 0x78]
jmp 0x1401a3abc
xor edx, edx
mov dword [rdi + 0x18], edx
mov eax, dword [rbx + 0x7c]
mov dword [rdi + 0x1c], eax
mov eax, dword [rbx + 0x80]
mov dword [rdi + 0x20], eax
mov eax, dword [rbx + 0x84]
mov dword [rdi + 0x24], eax
mov eax, dword [rbx + 0x88]
mov dword [rdi + 0x28], eax
mov eax, dword [rbx + 0x90]
mov dword [rdi + 0x2c], eax
mov eax, dword [rbx + 0xf8]
mov dword [rdi + 0x30], eax
mov eax, 1
jmp 0x1401a36b7
mov rax, qword [rbx + 0x100]
jmp 0x1401a36b7
mov rax, qword [rbx + 0x108]
jmp 0x1401a36b7
mov qword [rbx + 0x98], rdi
mov eax, 1
jmp 0x1401a36b7
mov eax, dword [rdi + 0x2c]
mov dword [rbx + 0xa4], eax
mov eax, 1
jmp 0x1401a36b7
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.1401a6760
mov eax, 1
jmp 0x1401a36b7
mov eax, esi
and edi, esi
not eax
and eax, dword [rbx + 0x4c]
or eax, edi
mov dword [rbx + 0x4c], eax
mov eax, 1
jmp 0x1401a36b7
test rdi, rdi
je 0x1401a3b87
mov rax, qword [rbx + 0xc0]
lea rcx, [sym.SystemInformer.exe_Ordinal_1266]
xor edx, edx
cmp rax, rcx
cmovne rdx, rax
mov qword [rdi], rdx
test rsi, rsi
je 0x1401a34b7
mov rax, qword ds:[rbx + 0xc8]
mov qword [r9], rax
mov eax, 1
jmp 0x1401a36b7
mov rdx, rdi
mov rcx, rbx
call fcn.1401a6300
mov eax, 1
jmp 0x1401a36b7
mov eax, dword [rbx + 0x40]
shr eax, 4
and eax, 1
add eax, dword [rbx + 0xf4]
jmp 0x1401a36b7
cmp esi, dword [rbx + 0xdc]
jae case.0x1401a346a.1026
lfence
mov rax, qword [rbx + 0xd0]
mov ecx, esi
mov r8, qword [rax + rcx*8]
test r8, r8
je case.0x1401a346a.1026
mov eax, dword [r8]
test al, 1
je case.0x1401a346a.1026
nop
test al, 4
je 0x1401a3c1d
mov rdx, qword [rbx + 0x10]
mov r9d, edi
mov rcx, rbx
call fcn.1401a57c0
mov eax, 1
jmp 0x1401a36b7
mov rdx, qword [rbx + 0x18]
mov r9d, edi
mov rcx, rbx
call fcn.1401a57c0
mov eax, 1
jmp 0x1401a36b7
movups xmm0, xmmword [rdi]
mov eax, 1
movups xmmword [rbx + 0x258], xmm0
jmp 0x1401a36b7
mov eax, dword [rbx + 0x40]
test esi, esi
je 0x1401a3c65
bts eax, 0x1b
mov dword [rbx + 0x74], esi
mov dword [rbx + 0x40], eax
mov eax, 1
jmp 0x1401a36b7
btr eax, 0x1b
mov rcx, rbx
mov dword [rbx + 0x40], eax
call fcn.1401a4300
mov eax, 1
jmp 0x1401a36b7
mov eax, dword [rbx + 0x40]
shr eax, 0x16
not eax
and eax, 1
jmp 0x1401a36b7
mov eax, dword [rbx + 0x40]
neg rsi
sbb ecx, ecx
btr eax, 0x1e
and ecx, 0x40000000
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a36b7
mov rax, rsi
mov qword [rbx + 0x278], rsi
neg rax
mov eax, dword [rbx + 0x40]
sbb ecx, ecx
btr eax, 0x1f
and ecx, 0x80000000
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a36b7
mov eax, dword ds:[r9]
mov dword [rbx + 0x2d0], eax
mov rax, qword [r9 + 8]
mov qword [rbx + 0x2d8], rax
mov rax, qword [r9 + 0x10]
mov qword [rbx + 0x2e0], rax
mov eax, 1
jmp 0x1401a36b7
mov edx, edi
mov rcx, rbx
call fcn.1401a6a40
movzx eax, al
jmp 0x1401a36b7
mov eax, dword [rbx + 0x40]
shr eax, 4
and eax, 1
add eax, dword [rbx + 0xf4]
cmp esi, eax
jae case.0x1401a346a.1026
lfence
mov eax, dword [rbx + 0x40]
mov r8, rdi
shr eax, 4
and eax, 1
sub esi, eax
mov rax, qword [rbx + 0xe8]
mov rcx, qword [rax + rsi*8]
mov edx, dword [rcx + 4]
mov rcx, rbx
call fcn.1401a4c30
movzx eax, al
jmp 0x1401a36b7
xor edx, edx
test esi, esi
je 0x1401a34b7
mov r8d, edx
nop dword [rax + rax]
mov eax, dword ds:[rdi + r8]
nop
cmp eax, dword [rbx + 0xdc]
jae case.0x1401a346a.1026
lfence
mov ecx, eax
inc edx
mov rax, qword [rbx + 0xd0]
mov rcx, qword [rax + rcx*8]
mov eax, dword [rcx]
and eax, 1
mov dword [rdi + r8], eax
add r8, 4
cmp edx, esi
jb 0x1401a3d70
mov eax, 1
jmp 0x1401a36b7
xor edx, edx
test dword [rbx + 0x40], 0x400000
jne 0x1401a3df8
mov rax, qword [rbx + 0x130]
mov r8d, dword [rax]
test r8d, r8d
je 0x1401a3df8
mov rcx, qword [rax + 8]
nop word [rax + rax]
mov rax, qword [rcx]
lea rcx, [rcx + 8]
test byte [rax], 2
lea eax, [rdx + 1]
cmove eax, edx
mov edx, eax
sub r8, 1
jne 0x1401a3de0
mov eax, edx
jmp 0x1401a36b7
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetFocus]
mov qword [rbx + 0x98], rdi
xor r9d, r9d
mov eax, dword [rdi + 0x2c]
mov r8d, 0x41d
mov dword [rbx + 0xa4], eax
mov rdx, rbx
mov rax, 0xffffffffffffffff
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1401a3420
mov r9d, dword [rdi + 0x2c]
mov r8d, 0x41c
mov rdx, rbx
mov qword [rsp + 0x20], r9
mov rcx, rbp
call fcn.1401a3420
mov edx, dword [rdi + 0x2c]
mov rcx, rbx
call fcn.1401a6a40
mov r9d, dword [rdi + 0x2c]
mov r8d, 0x418
mov rdx, rbx
mov qword [rsp + 0x20], r9
mov rcx, rbp
call fcn.1401a3420
mov eax, 1
jmp 0x1401a36b7