Function at 0x1400b5aa4
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xe8]
xor r13d, r13d
mov rdi, r8
mov rsi, rdx
cmp rax, r13
je 0x1400b5ae6
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
jmp 0x1400b5aeb
mov qword [rsp + 0x30], r13
mov r15d, dword [rsp + 0xb0]
mov rbx, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xc0]
mov ebp, r15d
and r15d, 0xf
mov r14, rbx
and ebp, 0x1c0
cmp rbx, r13
jne 0x1400b5b45
cmp dword [r12 + 0x10], r13d
je 0x1400b5b2a
cmp rdx, r13
je 0x1400b5b2a
mov r14, qword [rdx + 0x20]
jmp 0x1400b5b3b
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r9, qword [rsp + 0x98]
mov r14, rax
cmp r14, r13
jne 0x1400b5b45
mov dword [r12 + 0x10], r13d
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13d, eax
mov eax, 0xb4
cmp r13d, eax
cmovg r13d, eax
mov dword [rsp + 0xb0], r13d
cmp bpl, 0x80
jne 0x1400b5d68
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0xe8]
xor r12d, r12d
movsxd rdx, eax
mov dword [rsp + 0xb0], r12d
add rdx, 0x201
call fcn.140063694
mov rbx, qword [rsp + 0xe8]
mov rcx, rbx
call fcn.14005b0b8
mov eax, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0x90]
lea rdi, [rbx + 0x400]
mov dword [rbx + 0x2f4], r13d
mov dword [rbx + 0x31c], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0x98]
mov qword [rbx + 0x300], rdi
lea rsi, [rbx + 0x160]
movsxd rdi, r13d
mov dword [rsi], eax
mov rax, qword [rsp + 0xb8]
lea rcx, [rbx + 0x164]
mov qword [rbx + 0x310], rax
mov eax, dword [rsp + 0xc8]
lea r8, [rdi + rdi]
mov dword [rbx + 0x13c], eax
mov eax, dword [rsp + 0xd0]
mov byte [rbx + 0x3c8], 0xf0
mov dword [rbx + 0x140], eax
mov rax, qword [rsp + 0x30]
mov byte [rbx + 0x308], r15b
mov qword [rbx + 0x68], rax
call fcn.14001d78c
mov rax, qword [rsp + 0xd8]
mov r14, qword [rsp + 0x80]
mov word [rbx + rdi*2 + 0x164], r12w
mov qword [rbx + 0x3d8], rax
lea rax, [rsp + 0xb0]
lea r8, [0x1400b568c]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov edx, 0x20000
xor ecx, ecx
mov qword [rbx + 0x3d0], r14
mov qword [rbx + 0x3c0], rsi
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rsp + 0xb0]
mov dword [0x14013d7f8], ecx
mov rsi, rax
cmp rax, r12
je 0x1400b5d3e
shr ebp, 8
mov rdi, r12
not ebp
and ebp, 1
je 0x1400b5cde
lea edx, [r12 + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
lea rcx, [0x14013e190]
mov qword [rbx + 0x3e0], rdi
mov qword [rsp + 0xe8], r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x14013d7e8]
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, r12d
je 0x1400b5d3e
cmp rdi, r12
je 0x1400b5d3e
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0xb0]
lea r8, str.__LastTID
mov rcx, r14
call fcn.140066978
lea rcx, [rsp + 0xe8]
call fcn.14005b104
xor eax, eax
jmp 0x1400b5ffe
xor r13d, r13d
cmp rsi, r13
je 0x1400b5d7b
cmp dword [rsi + 0x1d0], r13d
cmovne rsi, r13
mov rdi, r14
mov qword [rsp + 0xe0], r14
cmp r14, r13
jne 0x1400b5d9c
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdi, rax
mov qword [rsp + 0xe0], rax
cmp ebp, 0x40
je 0x1400b5db7
cmp rsi, r13
je 0x1400b5db7
cmp rbx, r13
jne 0x1400b5db7
mov rdi, qword [rsi + 0x20]
mov qword [rsp + 0xe0], rdi
mov ecx, 0x3f0
call fcn.140102d68
cmp rax, r13
je 0x1400b5ddc
mov r8d, 0x2720
mov rdx, rdi
mov rcx, rax
call fcn.140001000
mov rdi, rax
jmp 0x1400b5ddf
mov rdi, r13
mov eax, dword [rsp + 0xb0]
mov rdx, qword [rsp + 0x90]
lea rcx, [rdi + 0x2f8]
mov dword [rdi + 0x2f4], eax
mov eax, dword [rsp + 0xa0]
mov r13, rdi
mov dword [rdi + 0x31c], eax
call fcn.14007034c
mov rax, qword [rdi + 0x2f8]
mov r11d, dword [rsp + 0xa8]
movsxd rbx, dword [rsp + 0xb0]
mov rdx, qword [rsp + 0x98]
mov qword [rdi + 0x300], rax
mov rax, qword [rsp + 0xb8]
lea r8, [rbx + rbx]
mov qword [rdi + 0x310], rax
mov eax, dword [rsp + 0xc8]
lea rcx, [rdi + 0x164]
mov dword [rdi + 0x13c], eax
mov eax, dword [rsp + 0xd0]
mov dword [rdi + 0x160], r11d
mov dword [rdi + 0x140], eax
mov rax, qword [rsp + 0x30]
mov byte [rdi + 0x308], r15b
mov qword [rdi + 0x68], rax
call fcn.14001d78c
xor eax, eax
mov rcx, rsi
mov word [rdi + rbx*2 + 0x164], ax
call fcn.14005b77c
mov rcx, rdi
mov r15, rax
call fcn.140053e78
xor ebx, ebx
cmp rsi, rbx
je 0x1400b5eb4
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.USER32.dll_SetFocus]
mov rdx, qword [r12 + 0x18]
cmp rdx, rbx
je 0x1400b5eca
lea rcx, [rdi + 0x128]
call fcn.14007034c
mov rax, qword [rsp + 0xd8]
mov byte [rdi + 0x121], bl
lea rbx, [rdi + 0x150]
mov qword [rbx], r14
mov r14, qword [rsp + 0x80]
mov qword [rdi + 0x3d8], rax
mov qword [rdi + 0x3d0], r14
xor r14d, r14d
mov byte [rdi + 0x120], r14b
cmp ebp, 0xc0
jne 0x1400b5f4a
mov qword [rdi + 0xd8], rsi
mov byte [rdi + 0x120], 1
cmp r15, r14
je 0x1400b5f45
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rsi + 0x1c8]
lea rcx, [0x14013e190]
mov byte [rdi + 0x120], 9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, r14
jmp 0x1400b5f51
mov byte [rdi + 0x120], 0x10
cmp rsi, r14
je 0x1400b5f66
cmp dword [r12 + 0x10], r14d
je 0x1400b5f66
mov rax, qword [rsi + 0x20]
mov qword [rbx], rax
jmp 0x1400b5f6b
mov dword [r12 + 0x10], r14d
mov r8, qword [rsp + 0xe0]
and dword [r12 + 0x14], 0xfffffff3
and dword [r12 + 0x10], 0xfffffff3
mov r9, r12
xor edx, edx
mov rcx, r13
call fcn.14005e3ac
cmp ebp, 0x40
jne 0x1400b5f9d
xor edx, edx
mov rcx, r13
call fcn.1400e91f0
jmp 0x1400b5fc7
cmp ebp, 0xc0
jne 0x1400b5fbd
mov rcx, qword [r13 + 0x20]
lea edx, [rbp + 0x50]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, r14d
jmp 0x1400b5fce
xor edx, edx
mov rcx, r13
call fcn.1400e95f4
mov ebx, dword [r13 + 0x320]
cmp r15, r14
je 0x1400b5fe8
xor r9d, r9d
mov edx, 0x451
mov rcx, r15
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rdi, r14
je 0x1400b5ffc
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8 + 0x18]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret