Function at 0x140041510
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov rdi, rcx
xor r13d, r13d
test rcx, rcx
jne 0x140041546
mov eax, 0x80070057
jmp 0x1400417e8
mov ecx, dword [rcx + 8]
test ecx, ecx
je 0x14004155d
sub ecx, 1
je 0x140041557
cmp ecx, 1
jne 0x14004153c
cmp qword [rdi], 0x40
jmp 0x140041561
cmp qword [rdi], 0x50
jne 0x14004153c
mov r14b, r13b
mov qword [rbp + 0x7f], r13
mov qword [rbp + 0x77], r13
mov r12b, r13b
mov r15b, r13b
mov qword [rbp + 0x6f], r13
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x14004159c
nop dword [rax + rax]
cmp eax, 0x80010106
je 0x14004159f
jmp 0x14004174d
mov r14b, 1
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
call fcn.140018de0
mov ebx, eax
test eax, eax
js 0x14004174d
lea r8, [rdi + 0x10]
mov rdx, qword [rbp + 0x7f]
lea rcx, [0x140064350]
call qword [sym.imp.ole32.dll_CoMarshalInterThreadInterfaceInStream]
mov ebx, eax
test eax, eax
js 0x14004174d
call qword [sym.imp.mso40uiWin32Client.dll_Ordinal_3935]
mov r8, rax
mov rcx, qword [rax]
mov rax, qword [rcx]
lea rdx, [rbp + 0x77]
mov rcx, r8
call qword [case.0x140044c3e.0]
neg eax
sbb rcx, rcx
and rcx, qword [rbp + 0x77]
mov qword [rbp + 0x77], rcx
mov ebx, 1
je 0x14004162d
mov rax, qword [rcx]
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, ebx
xor edx, edx
mov rax, qword [rax + 0x50]
call qword [case.0x140044c3e.0]
mov r12b, bl
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14004164f
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x14004164f
xor edx, edx
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.USER32.dll_EnableWindow]
mov r15b, bl
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
mov r9, rdi
lea r8, [0x140041800]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x14004168e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14004174d
mov qword [rbp + 0x6f], rsi
mov dword [rsp + 0x20], 0x4ff
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp + 0x6f]
mov ecx, ebx
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1813]
cmp eax, 0xffffffff
je 0x14004172c
cmp eax, ebx
jne 0x1400416fb
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rbp - 0x21]
call sub.VCRUNTIME140.dll_memset
jmp 0x1400416d8
cmp dword [rbp - 0x19], 0x12
je 0x1400416f4
lea rcx, [rbp - 0x21]
call qword [sym.imp.USER32.dll_DispatchMessageW]
nop
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x21]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1400416c7
jmp 0x140041692
mov ebx, 0x8000ffff
jmp 0x140041740
test eax, eax
jne 0x1400416f4
mov dword [rbp + 0x67], r13d
lea rdx, [rbp + 0x67]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x6f], r13
test ebx, ebx
je 0x140041675
mov ebx, dword [rbp + 0x67]
jmp 0x14004174d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x6f], r13
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140041767
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140044c3e.0]
mov qword [rdi + 0x10], r13
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140041781
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140044c3e.0]
mov qword [rbp + 0x7f], r13
test r15b, r15b
je 0x140041796
mov edx, 1
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.USER32.dll_EnableWindow]
nop
test r12b, r12b
je 0x1400417c0
mov rcx, qword [rbp + 0x77]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rax, qword [rax + 0x58]
call qword [case.0x140044c3e.0]
nop
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x1400417da
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140044c3e.0]
mov qword [rbp + 0x77], r13
test r14b, r14b
je 0x1400417e6
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov eax, ebx
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret