Function at 0x1400d1588
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
xor eax, eax
mov r12, rcx
lea rdx, [rsp + 0x58]
lea rcx, [r11 + 0x20]
xor r13d, r13d
mov rsi, r8
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.14007c6c8
lea r10d, [r13 + 2]
lea r11d, [r13 + 0x2b]
movsx r9d, al
mov rax, qword [rsp + 0x158]
mov dword [rsp + 0x68], r9d
movzx r8d, word [rax]
cmp r8w, 0x2a
je 0x1400d160e
cmp r8w, 0x2d
je 0x1400d160e
cmp r11w, r8w
jne 0x1400d1619
add rax, r10
mov qword [rsp + 0x158], rax
lea rcx, [rsp + 0x158]
call fcn.1400592c8
lea rcx, [rsp + 0x148]
call fcn.1400592c8
mov r15, r13
cmp r9d, r13d
je 0x1400d164f
cmp rsi, r13
je 0x1400d164f
cmp byte [rsi + 0x109], r13b
jne 0x1400d164f
mov r15, qword [rsi + 0x20]
jmp 0x1400d1654
mov dword [rsp + 0x68], r13d
test byte [rsp + 0x68], r10b
mov rax, r13
mov r14d, r13d
cmovne rax, r15
mov qword [rsp + 0x50], rax
cmp r8w, 0x2a
jne 0x1400d18e5
mov ecx, 0xa78
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
call fcn.1400fa958
mov ebp, 0x271b
mov rbx, rax
cmp rax, r13
je 0x1400d16c4
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.1400706f4
mov rbx, rax
jmp 0x1400d16c7
mov rbx, r13
mov ecx, 0xf0
call fcn.1400fa958
mov r13, rax
test rax, rax
je 0x1400d16f5
mov rdx, r12
mov rcx, rax
call fcn.1400179e4
mov rdx, r12
mov rcx, r13
call fcn.1400183c4
mov qword [r13 + 0x40], rbx
jmp 0x1400d16f8
xor r13d, r13d
mov eax, dword [rsp + 0x160]
mov rdi, qword [rsp + 0x158]
xor r8d, r8d
mov rcx, r13
mov rdx, rdi
mov byte [r13 + 0xd9], 3
mov dword [r13 + 0x24], eax
call fcn.140070f70
mov rax, qword [rsp + 0x148]
mov edx, 1
mov rcx, rbx
mov qword [rbx + 0x280], rax
mov qword [rbx + 0x138], r15
mov qword [rbx + 0x270], r13
call fcn.1400d0830
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.14006d808
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.1400716e0
lea rcx, [rbx + 0x110]
mov rdx, rax
call fcn.14006d888
lea rcx, [rsp + 0x80]
call fcn.1400592f8
xor r15d, r15d
cmp rdi, r15
je 0x1400d17a7
cmp byte [rbx + 0x109], r15b
je 0x1400d17b7
lea rcx, [rbx + 0x148]
mov rdx, rdi
call fcn.14006d888
cmp byte [rbx + 0x109], r15b
je 0x1400d17b7
mov edi, 0x271c
jmp 0x1400d17d8
cmp byte [rbx + 0x142], r15b
je 0x1400d17c7
mov edi, 0x271d
jmp 0x1400d17d8
cmp byte [rbx + 0x141], r15b
mov edi, 0x271c
cmovne ebp, edi
mov edi, ebp
mov rcx, rbx
call fcn.14005214c
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x48]
call fcn.140059968
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, r15
je 0x1400d181a
mov rax, qword [rsp + 0x48]
cmp byte [rax + 0x109], r15b
je 0x1400d181a
mov eax, 2
cmp dword [r12 + 0x20], eax
cmovle r14d, eax
mov r8, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov edx, edi
mov rcx, rbx
call fcn.14005c4ac
mov rdx, qword [rbx + 0x20]
lea r9, [0x1401146d0]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.140064b0c
xor edx, edx
mov rcx, rbx
call fcn.1400e1d90
lea rcx, [0x140135110]
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140135110]
mov qword [r13 + 0x40], r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rcx, r13
call fcn.14004d6f4
lea rcx, [r13 + 0x70]
call fcn.1400592f8
mov rcx, r13
call fcn.1400fa76c
mov r11, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r11 + 0x18]
mov r11, qword [rsp + 0x40]
cmp r11, r15
je 0x1400d18c2
mov rcx, qword [rsp + 0x40]
mov r8d, r14d
xor r9d, r9d
or r8, 1
mov edx, 0x451
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14d, dword [rsp + 0x48]
movsxd rax, r14d
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r8w, 0x2d
jne 0x1400d1ae5
mov ecx, 0xa78
call fcn.1400fa958
mov ebp, 0x271b
mov rbx, rax
cmp rax, r13
je 0x1400d1937
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.1400706f4
mov rbx, rax
jmp 0x1400d193a
mov rbx, r13
mov ecx, 0xf0
call fcn.1400fa958
mov rdi, rax
cmp rax, r13
je 0x1400d1968
mov rdx, r12
mov rcx, rax
call fcn.1400179e4
mov rdx, r12
mov rcx, rdi
call fcn.1400183c4
mov qword [rdi + 0x40], rbx
jmp 0x1400d196b
mov rdi, r13
mov eax, dword [rsp + 0x160]
mov r13, qword [rsp + 0x158]
xor r8d, r8d
mov rcx, rdi
mov rdx, r13
mov byte [rdi + 0xd9], 3
mov dword [rdi + 0x24], eax
call fcn.140070f70
mov rax, qword [rsp + 0x148]
mov edx, 1
mov rcx, rbx
mov qword [rbx + 0x280], rax
mov qword [rbx + 0x138], r15
mov qword [rbx + 0x270], rdi
call fcn.1400d0830
mov r11, qword [rbx + 0x270]
lea rcx, [rsp + 0x78]
mov rdx, r13
mov qword [rbx + 0x268], r11
call fcn.14006d808
lea rdx, [rsp + 0x78]
mov rcx, r13
call fcn.1400716e0
lea rcx, [rbx + 0x110]
mov rdx, rax
call fcn.14006d888
lea rcx, [rsp + 0x78]
call fcn.1400592f8
mov rdx, qword [rsp + 0x70]
xor r15d, r15d
cmp rdx, r15
je 0x1400d1a16
lea rcx, [rbx + 0x110]
call fcn.14006d920
cmp r13, r15
je 0x1400d1a33
cmp byte [rbx + 0x109], r15b
je 0x1400d1a3c
lea rcx, [rbx + 0x148]
mov rdx, r13
call fcn.14006d888
cmp byte [rbx + 0x109], r15b
jne 0x1400d1a55
cmp byte [rbx + 0x141], r15b
jne 0x1400d1a55
cmp byte [rbx + 0x142], r15b
je 0x1400d1a5a
mov ebp, 0x271d
jmp 0x1400d1a5a
mov ebp, 0x271c
mov rcx, rbx
call fcn.14005214c
mov qword [rbx + 0xc0], rsi
mov byte [rbx + 0x108], 1
cmp rsi, r15
je 0x1400d1a9d
lea rcx, [0x140135110]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rsi + 0x1a8]
lea rcx, [0x140135110]
mov byte [rbx + 0x108], 9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov edx, ebp
mov rcx, rbx
call fcn.14005c4ac
mov rdx, qword [rbx + 0x20]
lea r9, [0x1401146d0]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.140064b0c
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400d18c7
mov rax, qword [rsp + 0x158]
cmp r11w, word [rax - 2]
mov rax, rsi
sete bl
cmp bl, r13b
cmovne rax, r13
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], r13
mov rcx, qword [rsp + 0x50]
call fcn.140059968
mov qword [rsp + 0x40], rax
cmp bl, r13b
jne 0x1400d1b3f
cmp rsi, r13
jne 0x1400d1b3f
xor edx, edx
mov rcx, r12
call fcn.14001adf8
cmp qword [r12 + 0x40], r13
jne 0x1400d1b3f
mov rax, 0xffffffff80070057
jmp 0x1400d18ca
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x90], r12
lea rcx, [0x140134c58]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x158]
mov esi, r13d
mov qword [rsp + 0xa0], rax
movsxd rax, dword [rsp + 0x160]
mov qword [rsp + 0xa8], 4
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11, [rsp + 0xc8]
lea r9, [rsp + 0x90]
lea r8, [0x1400d102c]
mov qword [rsp + 0x28], r11
mov edx, 0x400000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp rax, r13
je 0x1400d1c66
mov esi, dword [rsp + 0xc8]
mov ebx, 0x270f
mov rcx, qword [rsp + 0xa8]
cmp rcx, r13
je 0x1400d1c41
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x1400d1c27
mov rax, qword [rsp + 0xa8]
cmp rax, r13
je 0x1400d1c66
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rsp + 0xa8]
cmp r11, r13
jne 0x1400d1c4e
lea rcx, [0x140134c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, r13
je 0x1400d1c81
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
cmp rax, r13
je 0x1400d1caf
mov rax, qword [rsp + 0xe0]
cmp rax, r13
je 0x1400d1caf
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x451
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, str.__LastTID
mov edx, esi
mov rcx, r12
call fcn.140064b98
mov rdx, qword [rsp + 0xc0]
lea r9, [0x1401146d0]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.140064b0c
jmp 0x1400d18c7