Function at 0x1400c2818
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13d, dword [rsp + 0xb0]
mov rdi, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xc0]
mov ebp, r13d
and r13d, 0xf
xor r15d, r15d
and ebp, 0x1c0
mov rax, r9
mov rbx, r8
mov rsi, rdx
mov dword [rsp + 0xb0], r13d
mov r14, rdi
cmp rdi, r15
jne 0x1400c28a8
cmp dword [r12 + 0x10], r15d
je 0x1400c288d
cmp rdx, r15
je 0x1400c288d
mov r14, qword [rdx + 0x20]
jmp 0x1400c289e
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r14, rax
mov rax, qword [rsp + 0x98]
cmp r14, r15
jne 0x1400c28a8
mov dword [r12 + 0x10], r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r15d, eax
mov eax, 0xb4
cmp r15d, eax
cmovg r15d, eax
cmp bpl, 0x80
jne 0x1400c2aba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0xe0]
xor r12d, r12d
movsxd rdx, eax
mov dword [rsp + 0xb0], r12d
add rdx, 0x1f9
call fcn.140062268
mov rbx, qword [rsp + 0xe0]
mov rcx, rbx
call fcn.140059884
mov eax, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0x90]
lea rdi, [rbx + 0x3f0]
mov dword [rbx + 0x2e4], r15d
mov dword [rbx + 0x30c], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0x98]
mov qword [rbx + 0x2f0], rdi
lea rsi, [rbx + 0x150]
movsxd rdi, r15d
mov dword [rsi], eax
mov rax, qword [rsp + 0xb8]
lea rcx, [rbx + 0x154]
mov qword [rbx + 0x300], rax
mov eax, dword [rsp + 0xc8]
lea r8, [rdi + rdi]
mov dword [rbx + 0x12c], eax
mov eax, dword [rsp + 0xd0]
mov byte [rbx + 0x3b8], pe_nt_image_headers64
mov dword [rbx + 0x130], eax
mov byte [rbx + 0x2f8], r13b
call fcn.14001d8e0
mov rax, qword [rsp + 0xd8]
mov r14, qword [rsp + 0x80]
mov word [rbx + rdi*2 + 0x154], r12w
mov qword [rbx + 0x3c8], rax
lea rax, [rsp + 0xb0]
lea r8, [0x1400c2408]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov edx, 0x20000
xor ecx, ecx
mov qword [rbx + 0x3c0], r14
mov qword [rbx + 0x3b0], rsi
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rsp + 0xb0]
mov dword [0x1401377b0], ecx
mov rsi, rax
cmp rax, r12
je 0x1400c2a90
shr ebp, 8
mov rdi, r12
not ebp
and ebp, 1
je 0x1400c2a30
lea edx, [r12 + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
lea rcx, [0x140138118]
mov qword [rbx + 0x3d0], rdi
mov qword [rsp + 0xe0], r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x1401377a0]
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, r12d
je 0x1400c2a90
cmp rdi, r12
je 0x1400c2a90
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0xb0]
lea r8, str.__LastTID
mov rcx, r14
call fcn.140065544
lea rcx, [rsp + 0xe0]
call fcn.140059920
xor eax, eax
jmp 0x1400c2d24
xor r13d, r13d
mov rbx, r14
mov qword [rsp + 0x30], rbx
cmp r14, r13
jne 0x1400c2ad8
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rbx, rax
mov qword [rsp + 0x30], rax
cmp ebp, 0x40
je 0x1400c2af0
cmp rsi, r13
je 0x1400c2af0
cmp rdi, r13
jne 0x1400c2af0
mov rbx, qword [rsi + 0x20]
mov qword [rsp + 0x30], rbx
mov ecx, 0x3e0
call fcn.1400fded8
cmp rax, r13
je 0x1400c2b15
mov r8d, 0x2720
mov rdx, rbx
mov rcx, rax
call fcn.140001000
mov rdi, rax
jmp 0x1400c2b18
mov rdi, r13
mov eax, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0x90]
lea rcx, [rdi + 0x2e8]
mov dword [rdi + 0x30c], eax
mov r13, rdi
mov dword [rdi + 0x2e4], r15d
call fcn.14006e344
mov eax, dword [rsp + 0xb0]
mov r11d, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0x98]
mov byte [rdi + 0x2f8], al
mov rax, qword [rdi + 0x2e8]
mov qword [rdi + 0x2f0], rax
mov rax, qword [rsp + 0xb8]
movsxd rbx, r15d
mov qword [rdi + 0x300], rax
mov eax, dword [rsp + 0xc8]
lea rcx, [rdi + 0x154]
mov dword [rdi + 0x12c], eax
mov eax, dword [rsp + 0xd0]
lea r8, [rbx + rbx]
mov dword [rdi + 0x130], eax
mov dword [rdi + 0x150], r11d
call fcn.14001d8e0
xor eax, eax
mov rcx, rsi
mov word [rdi + rbx*2 + 0x154], ax
call fcn.140059ef8
mov rcx, rdi
mov r15, rax
call fcn.1400fef80
xor ebx, ebx
cmp rsi, rbx
je 0x1400c2bdf
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.USER32.dll_SetFocus]
mov rdx, qword [r12 + 0x18]
cmp rdx, rbx
je 0x1400c2bf5
lea rcx, [rdi + 0x118]
call fcn.14006e344
mov rax, qword [rsp + 0xd8]
mov byte [rdi + 0x111], bl
lea rbx, [rdi + 0x140]
mov qword [rbx], r14
mov r14, qword [rsp + 0x80]
mov qword [rdi + 0x3c8], rax
mov qword [rdi + 0x3c0], r14
xor r14d, r14d
mov byte [rdi + 0x110], r14b
cmp ebp, 0xc0
jne 0x1400c2c75
mov qword [rdi + 0xc8], rsi
mov byte [rdi + 0x110], 1
cmp r15, r14
je 0x1400c2c70
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rsi + 0x1b0]
lea rcx, [0x140138118]
mov byte [rdi + 0x110], 9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, r14
jmp 0x1400c2c7c
mov byte [rdi + 0x110], 0x10
cmp rsi, r14
je 0x1400c2c91
cmp dword [r12 + 0x10], r14d
je 0x1400c2c91
mov rax, qword [rsi + 0x20]
mov qword [rbx], rax
jmp 0x1400c2c96
mov dword [r12 + 0x10], r14d
mov r8, qword [rsp + 0x30]
and dword [r12 + 0x14], 0xfffffff3
and dword [r12 + 0x10], 0xfffffff3
mov r9, r12
xor edx, edx
mov rcx, r13
call fcn.14005ca3c
cmp ebp, 0x40
jne 0x1400c2cc5
xor edx, edx
mov rcx, r13
call fcn.1400e4838
jmp 0x1400c2ced
cmp ebp, 0xc0
jne 0x1400c2ce5
mov rcx, qword [r13 + 0x20]
lea edx, [rbp + 0x50]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, r14d
jmp 0x1400c2cf4
mov rcx, r13
call fcn.1400e4c3c
mov ebx, dword [r13 + 0x310]
cmp r15, r14
je 0x1400c2d0e
xor r9d, r9d
mov edx, 0x451
mov rcx, r15
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rdi, r14
je 0x1400c2d22
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8 + 0x18]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret