Function at 0x1400bfa14
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13d, dword [rsp + 0xb0]
mov rdi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xc0]
mov r12d, r13d
and r13d, 0xf
xor r15d, r15d
and r12d, 0x1c0
mov rax, r9
mov rbx, r8
mov rsi, rdx
mov dword [rsp + 0xb0], r13d
mov r14, rdi
cmp rdi, r15
jne 0x1400bfaa3
cmp dword [rbp + 0x10], r15d
je 0x1400bfa89
cmp rdx, r15
je 0x1400bfa89
mov r14, qword [rdx + 0x20]
jmp 0x1400bfa9a
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r14, rax
mov rax, qword [rsp + 0x98]
cmp r14, r15
jne 0x1400bfaa3
mov dword [rbp + 0x10], r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r15d, eax
mov eax, 0xb4
cmp r15d, eax
cmovg r15d, eax
cmp r12b, 0x80
jne 0x1400bfca3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0xe0]
xor ebp, ebp
movsxd rdx, eax
mov dword [rsp + 0xb0], ebp
add rdx, 0x1f5
call fcn.14006170c
mov rbx, qword [rsp + 0xe0]
mov rcx, rbx
call fcn.14005915c
mov eax, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0x90]
lea rdi, [rbx + 0x3e8]
mov dword [rbx + 0x2dc], r15d
mov dword [rbx + 0x304], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0x98]
mov qword [rbx + 0x2e8], rdi
lea rsi, [rbx + 0x148]
movsxd rdi, r15d
mov dword [rsi], eax
mov rax, qword [rsp + 0xb8]
lea rcx, [rbx + 0x14c]
mov qword [rbx + 0x2f8], rax
mov eax, dword [rsp + 0xc8]
lea r8, [rdi + rdi]
mov dword [rbx + 0x124], eax
mov eax, dword [rsp + 0xd0]
mov byte [rbx + 0x3b0], pe_nt_image_headers64
mov dword [rbx + 0x128], eax
mov byte [rbx + 0x2f0], r13b
call fcn.14001d614
mov rax, qword [rsp + 0xd8]
mov r14, qword [rsp + 0x80]
mov word [rbx + rdi*2 + 0x14c], bp
mov qword [rbx + 0x3c0], rax
lea rax, [rsp + 0xb0]
lea r8, [0x1400bf5e8]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov edx, 0x20000
xor ecx, ecx
mov qword [rbx + 0x3b8], r14
mov qword [rbx + 0x3a8], rsi
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rsp + 0xb0]
mov dword [0x1401357b0], ecx
mov rsi, rax
cmp rax, rbp
je 0x1400bfc79
bt r12d, 8
mov rdi, rbp
jb 0x1400bfc1e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
lea rcx, [0x140136118]
mov qword [rbx + 0x3c8], rdi
mov qword [rsp + 0xe0], rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x1401357a0]
lea rcx, [0x140136118]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rbp
je 0x1400bfc79
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0xb0]
lea r8, str.__LastTID
mov rcx, r14
call fcn.140064948
lea rcx, [rsp + 0xe0]
call fcn.1400591f8
xor eax, eax
jmp 0x1400bff0c
xor r13d, r13d
mov rbx, r14
mov qword [rsp + 0x30], rbx
cmp r14, r13
jne 0x1400bfcc1
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rbx, rax
mov qword [rsp + 0x30], rax
cmp r12d, 0x40
je 0x1400bfcda
cmp rsi, r13
je 0x1400bfcda
cmp rdi, r13
jne 0x1400bfcda
mov rbx, qword [rsi + 0x20]
mov qword [rsp + 0x30], rbx
mov ecx, 0x3d8
call fcn.1400fb138
cmp rax, r13
je 0x1400bfcff
mov r8d, 0x2720
mov rdx, rbx
mov rcx, rax
call fcn.140001000
mov rdi, rax
jmp 0x1400bfd02
mov rdi, r13
mov eax, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0x90]
lea rcx, [rdi + 0x2e0]
mov dword [rdi + 0x304], eax
mov r13, rdi
mov dword [rdi + 0x2dc], r15d
call fcn.14006d65c
mov eax, dword [rsp + 0xb0]
mov r11d, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0x98]
mov byte [rdi + 0x2f0], al
mov rax, qword [rdi + 0x2e0]
mov qword [rdi + 0x2e8], rax
mov rax, qword [rsp + 0xb8]
movsxd rbx, r15d
mov qword [rdi + 0x2f8], rax
mov eax, dword [rsp + 0xc8]
lea rcx, [rdi + 0x14c]
mov dword [rdi + 0x124], eax
mov eax, dword [rsp + 0xd0]
lea r8, [rbx + rbx]
mov dword [rdi + 0x128], eax
mov dword [rdi + 0x148], r11d
call fcn.14001d614
xor eax, eax
mov rcx, rsi
mov word [rdi + rbx*2 + 0x14c], ax
call fcn.140059820
mov rcx, rdi
mov r15, rax
call fcn.140052b28
xor ebx, ebx
cmp rsi, rbx
je 0x1400bfdc9
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.USER32.dll_SetFocus]
mov rdx, qword [rbp + 0x18]
cmp rdx, rbx
je 0x1400bfdde
lea rcx, [rdi + 0x110]
call fcn.14006d65c
mov rax, qword [rsp + 0xd8]
mov byte [rdi + 0x109], bl
lea rbx, [rdi + 0x138]
mov qword [rbx], r14
mov r14, qword [rsp + 0x80]
mov qword [rdi + 0x3c0], rax
mov qword [rdi + 0x3b8], r14
xor r14d, r14d
mov byte [rdi + 0x108], r14b
cmp r12d, 0xc0
jne 0x1400bfe5f
mov qword [rdi + 0xc0], rsi
mov byte [rdi + 0x108], 1
cmp r15, r14
je 0x1400bfe5a
lea rcx, [0x140136118]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rsi + 0x1a8]
lea rcx, [0x140136118]
mov byte [rdi + 0x108], 9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, r14
jmp 0x1400bfe66
mov byte [rdi + 0x108], 0x10
cmp rsi, r14
je 0x1400bfe7a
cmp dword [rbp + 0x10], r14d
je 0x1400bfe7a
mov rax, qword [rsi + 0x20]
mov qword [rbx], rax
jmp 0x1400bfe7e
mov dword [rbp + 0x10], r14d
mov r8, qword [rsp + 0x30]
and dword [rbp + 0x14], 0xfffffff3
and dword [rbp + 0x10], 0xfffffff3
mov r9, rbp
xor edx, edx
mov rcx, r13
call fcn.14005c364
cmp r12d, 0x40
jne 0x1400bfeaa
xor edx, edx
mov rcx, r13
call fcn.1400e2194
jmp 0x1400bfed5
cmp r12d, 0xc0
jne 0x1400bfecd
mov rcx, qword [r13 + 0x20]
lea edx, [r12 + 0x50]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, r14d
jmp 0x1400bfedc
mov rcx, r13
call fcn.1400e2598
mov ebx, dword [r13 + 0x308]
cmp r15, r14
je 0x1400bfef6
xor r9d, r9d
mov edx, 0x451
mov rcx, r15
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rdi, r14
je 0x1400bff0a
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8 + 0x18]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret