Function at 0x1401a0f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, qword [rsp + 0xb0]
lea eax, [r8 - 0x401]
mov rdi, r9
mov rbx, rdx
mov rbp, rcx
cmp eax, 0x32
ja case.0x1401a0fca.1026
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1a18dc]
add rcx, rdx
jmp rcx
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0xc0], rdi
test rsi, rsi
jne 0x1401a1017
lea rcx, [sym.SystemInformer.exe_PhIsExecutingInWow64]
mov eax, 1
mov qword [rbx + 0xb8], rcx
jmp 0x1401a1217
cmp dword ds:[rbx + 0x244], 0
jg 0x1401a1025
or dword [rbx + 0x40], 0xc00000
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
jmp 0x1401a1217
mov rcx, rbx
call fcn.1401a3600
mov rcx, rbx
call fcn.1401a2040
jmp 0x1401a1009
mov rdx, rsi
mov rcx, rbx
call fcn.1401a24c0
movzx eax, al
jmp 0x1401a1217
cmp edi, dword [rbx + 0xd4]
jae 0x1401a10c5
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov rsi, qword [rax + rcx*8]
test rsi, rsi
je 0x1401a10c5
mov edi, dword [rsi]
mov rdx, rsi
mov rcx, rbx
call fcn.1401a2e00
mov ecx, dword [rsi + 4]
xor edx, edx
mov rax, qword [rbx + 0xc8]
mov r8, rsi
mov qword [rax + rcx*8], rdx
mov rcx, qword [0x1402caad0]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rbx
call fcn.1401a2b00
nop dword [rax]
test dil, 1
je 0x1401a10ae
mov rcx, rbx
call fcn.1401a2040
dec dword ds:[rbx + 0xd8]
mov edx, 1
mov eax, edx
jmp 0x1401a1217
xor edx, edx
mov eax, edx
jmp 0x1401a1217
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.1401a2690
movzx eax, al
jmp 0x1401a1217
mov r8d, dword [rsi + 4]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.1401a26e0
movzx eax, al
jmp 0x1401a1217
nop
cmp edi, dword [rbx + 0xec]
jne case.0x1401a0fca.1026
test edi, edi
je 0x1401a1017
xor edx, edx
mov r9d, edi
mov r8d, edx
nop dword [rax]
mov rax, qword ds:[rbx + 0xe0]
lea rdx, [rdx + 4]
lea r8, [r8 + 8]
mov rcx, qword [rax + r8 - 8]
mov eax, dword [rcx + 4]
mov dword [rsi + rdx - 4], eax
sub r9, 1
jne 0x1401a1120
mov eax, 1
jmp 0x1401a1217
mov qword [rsp + 0x60], r14
test edi, edi
je 0x1401a11fc
mov rcx, qword [0x1402caad0]
mov edx, 4
mov r14d, edi
lea r8, [r14*4]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov rbp, rax
test edi, edi
je 0x1401a11d0
mov r8d, edx
nop word [rax + rax]
mov ecx, dword ds:[rsi + r8]
nop
cmp ecx, dword [rbx + 0xd4]
jae 0x1401a122e
lfence
mov rax, qword [rbx + 0xc8]
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x1401a122e
mov eax, dword [rax + 0x28]
inc edx
mov dword [r8 + rbp], eax
add r8, 4
cmp edx, edi
jb 0x1401a1190
mov rcx, qword ds:[rbx + 0x18]
mov r9, rbp
mov r8, r14
mov edx, 0x1212
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1402caad0]
xor edx, edx
mov r8, rbp
test eax, eax
je 0x1401a123d
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rbx
call fcn.1401a2e80
mov rcx, rbx
call fcn.1401a2b00
mov eax, 1
mov r14, qword [rsp + 0x60]
mov rcx, qword ds:[rsp + 0x58]
xor rcx, rsp
call fcn.1401e4160
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
lfence
mov rcx, qword [0x1402caad0]
mov r8, rbp
xor edx, edx
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
jmp 0x1401a1212
mov qword [rbx + 0x58], rsi
mov eax, 1
jmp 0x1401a1217
test rdi, rdi
je 0x1401a1263
mov eax, dword [rbx + 0x130]
mov dword [r9], eax
test rsi, rsi
je 0x1401a1017
mov eax, dword [rbx + 0x134]
mov dword [rsi], eax
mov eax, 1
jmp 0x1401a1217
test esi, esi
je 0x1401a12a5
nop
cmp edi, dword [rbx + 0xd4]
jae case.0x1401a0fca.1026
lfence
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
jne 0x1401a12a9
xor eax, eax
jmp 0x1401a1217
xor edx, edx
mov edi, edx
mov rcx, rbx
mov dword [rbx + 0x130], edi
mov dword [rbx + 0x134], esi
call fcn.1401a2f60
mov rax, qword [rbx + 0xb8]
lea rcx, [sym.SystemInformer.exe_PhIsExecutingInWow64]
cmp rax, rcx
je 0x1401a1017
mov rcx, qword [rbx + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbx]
mov edx, 0xa
call qword [case.0x14013d64a.0]
mov eax, 1
jmp 0x1401a1217
mov eax, dword [rbx + 0x40]
neg rdi
sbb ecx, ecx
btr eax, 0xa
and ecx, 0x400
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a1217
mov edx, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401a44a0
movzx eax, al
jmp 0x1401a1217
mov r8d, esi
mov edx, edi
mov rcx, rbx
call fcn.1401a5900
mov eax, 1
jmp 0x1401a1217
test dword [rbx + 0x40], 0x400000
jne case.0x1401a0fca.1026
mov rax, qword ds:[rbx + 0x128]
mov eax, dword [rax]
jmp 0x1401a1217
mov rax, qword [rbx + 0x128]
cmp edi, dword [rax]
jae case.0x1401a0fca.1026
lfence
mov rcx, qword [rbx + 0x128]
mov edx, edi
mov rax, qword [rcx + 8]
mov rax, qword [rax + rdx*8]
jmp 0x1401a1217
mov r8d, dword ds:[rsi + 0x10]
lea r9, [rsi + 0x18]
mov rdx, qword [rsi + 8]
mov rcx, rbx
call fcn.1401a3520
movzx eax, al
jmp 0x1401a1217
test rdi, rdi
mov rdx, rsi
mov rcx, rbx
setne r8b
call fcn.1401a3880
mov eax, 1
jmp 0x1401a1217
mov eax, dword [rbx + 0xd0]
dec eax
jmp 0x1401a1217
inc edi
cmp dword [rbx + 0xd0], edi
jae 0x1401a1017
mov dword [rbx + 0xd0], edi
cmp dword [rbx + 0xd4], edi
jae 0x1401a1017
mov rcx, rbx
call fcn.1401a2a20
mov eax, 1
jmp 0x1401a1217
test byte [rsi], 1
je case.0x1401a0fca.1026
mov edx, dword [rsi + 0x2c]
mov r8d, edx
lea rax, [rsp + 0x38]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401a3c80
test al, al
je case.0x1401a0fca.1026
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rbp
jmp 0x1401a1011
mov r8d, esi
mov edx, edi
jmp 0x1401a141f
mov rax, qword [rbx + 0x10]
jmp 0x1401a1217
mov rax, qword [rbx + 0x18]
jmp 0x1401a1217
mov rax, qword [rbx + 0x38]
jmp 0x1401a1217
xor edx, edx
lea rax, [rsp + 0x30]
cmp r8d, 0x41d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov r8d, esi
sete dl
mov qword [rsp + 0x20], rax
mov r9d, edx
mov rcx, rbx
mov edx, edi
call fcn.1401a3fe0
mov r8d, dword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov edx, dword [rsp + 0x38]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401a3c80
nop dword [rax]
test al, al
je 0x1401a1017
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbp
jmp 0x1401a1011
mov eax, dword ds:[rbx + 0xd8]
jmp 0x1401a1217
test rdi, rdi
mov edx, 1
mov eax, 0xffffffff
cmove edx, eax
add edx, dword [rbx + 0x244]
mov dword [rbx + 0x244], edx
cmp edx, 1
jne 0x1401a15a7
test dword [rbx + 0x40], 0x400000
je 0x1401a151b
mov rcx, rbx
call fcn.1401a3600
test dword [rbx + 0x40], 0x800000
je 0x1401a152c
mov rcx, rbx
call fcn.1401a2040
test dword [rbx + 0x40], 0x1000000
je 0x1401a1570
mov rdi, qword [rbx]
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx edx, ax
mov rcx, rdi
shr eax, 0x10
cwde
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov r8, qword [rsp + 0x38]
mov rcx, rbx
mov edx, dword [rsp + 0x38]
shr r8, 0x20
call fcn.1401a4540
and dword ds:[rbx + 0x40], 0xfe3fffff
mov rdx, qword [rbx + 0x248]
test rdx, rdx
je 0x1401a15a7
mov rcx, qword [rbx]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRgn]
mov rcx, qword [rbx + 0x248]
call qword [sym.imp.GDI32.dll_DeleteObject]
xor edx, edx
mov qword [rbx + 0x248], rdx
movsxd rax, dword [rbx + 0x244]
jmp 0x1401a1217
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rsi], xmm0
mov eax, dword [rbx + 0x70]
mov dword [rsi + 0x10], eax
mov eax, dword [rbx + 0x74]
mov dword [rsi + 0x14], eax
test byte [rbx + 0x40], 4
je 0x1401a15d1
mov edx, dword [rbx + 0x78]
jmp 0x1401a15d3
xor edx, edx
mov dword [rsi + 0x18], edx
mov eax, dword [rbx + 0x7c]
mov dword [rsi + 0x1c], eax
mov eax, dword [rbx + 0x80]
mov dword [rsi + 0x20], eax
mov eax, dword [rbx + 0x84]
mov dword [rsi + 0x24], eax
mov eax, dword [rbx + 0x88]
mov dword [rsi + 0x28], eax
mov eax, dword [rbx + 0x90]
mov dword [rsi + 0x2c], eax
mov eax, dword [rbx + 0xf0]
mov dword [rsi + 0x30], eax
mov eax, 1
jmp 0x1401a1217
mov rax, qword [rbx + 0xf8]
jmp 0x1401a1217
mov rax, qword [rbx + 0x100]
jmp 0x1401a1217
mov qword [rbx + 0x98], rsi
mov eax, 1
jmp 0x1401a1217
mov eax, dword [rsi + 0x2c]
mov dword [rbx + 0xa4], eax
mov eax, 1
jmp 0x1401a1217
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.1401a41c0
mov eax, 1
jmp 0x1401a1217
mov eax, edi
and edi, esi
not eax
and eax, dword [rbx + 0x4c]
or eax, edi
mov dword [rbx + 0x4c], eax
mov eax, 1
jmp 0x1401a1217
nop
test rsi, rsi
je 0x1401a169f
mov rax, qword [rbx + 0xb8]
lea rcx, [sym.SystemInformer.exe_PhIsExecutingInWow64]
xor edx, edx
cmp rax, rcx
cmovne rdx, rax
mov qword [rsi], rdx
nop
test rdi, rdi
je 0x1401a1017
mov rax, qword [rbx + 0xc0]
mov qword [r9], rax
mov eax, 1
jmp 0x1401a1217
mov rdx, rsi
mov rcx, rbx
call fcn.1401a3d60
mov eax, 1
jmp 0x1401a1217
mov eax, dword [rbx + 0x40]
shr eax, 4
and eax, 1
add eax, dword [rbx + 0xec]
jmp 0x1401a1217
cmp edi, dword [rbx + 0xd4]
jae case.0x1401a0fca.1026
lfence
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov r8, qword [rax + rcx*8]
test r8, r8
je case.0x1401a0fca.1026
mov eax, dword [r8]
test al, 1
je case.0x1401a0fca.1026
test al, 4
je 0x1401a1733
mov rdx, qword [rbx + 0x10]
mov r9d, esi
mov rcx, rbx
call fcn.1401a3220
mov eax, 1
jmp 0x1401a1217
mov rdx, qword ds:[rbx + 0x18]
mov r9d, esi
mov rcx, rbx
call fcn.1401a3220
mov eax, 1
jmp 0x1401a1217
movups xmm0, xmmword ds:[rsi]
mov eax, 1
movups xmmword [rbx + 0x250], xmm0
jmp 0x1401a1217
mov eax, dword [rbx + 0x40]
test edi, edi
je 0x1401a1785
bts eax, 0x1b
mov dword [rbx + 0x74], edi
mov dword [rbx + 0x40], eax
mov eax, 1
jmp 0x1401a1217
btr eax, 0x1b
mov rcx, rbx
mov dword [rbx + 0x40], eax
call fcn.1401a1d60
mov eax, 1
jmp 0x1401a1217
mov eax, dword [rbx + 0x40]
shr eax, 0x16
not eax
and eax, 1
jmp 0x1401a1217
mov eax, dword [rbx + 0x40]
neg rdi
sbb ecx, ecx
btr eax, 0x1e
and ecx, 0x40000000
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a1217
mov rax, rdi
mov qword [rbx + 0x270], rdi
neg rax
mov eax, dword [rbx + 0x40]
sbb ecx, ecx
btr eax, 0x1f
and ecx, 0x80000000
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a1217
mov eax, dword ds:[r9]
mov dword [rbx + 0x2b8], eax
mov rax, qword [r9 + 8]
mov qword [rbx + 0x2c0], rax
mov rax, qword [r9 + 0x10]
mov qword [rbx + 0x2c8], rax
mov eax, 1
jmp 0x1401a1217
mov edx, esi
mov rcx, rbx
call fcn.1401a44a0
movzx eax, al
jmp 0x1401a1217
mov eax, dword [rbx + 0x40]
shr eax, 4
and eax, 1
add eax, dword [rbx + 0xec]
cmp edi, eax
jae case.0x1401a0fca.1026
lfence
mov eax, dword [rbx + 0x40]
mov r8, rsi
shr eax, 4
and eax, 1
sub edi, eax
mov rax, qword [rbx + 0xe0]
mov rcx, qword [rax + rdi*8]
mov edx, dword [rcx + 4]
mov rcx, rbx
call fcn.1401a2690
movzx eax, al
jmp 0x1401a1217
xor edx, edx
test edi, edi
je 0x1401a1017
mov r8d, edx
nop dword [rax + rax]
mov eax, dword ds:[rsi + r8]
nop
cmp eax, dword [rbx + 0xd4]
jae case.0x1401a0fca.1026
lfence
mov ecx, eax
inc edx
mov rax, qword [rbx + 0xc8]
mov rcx, qword [rax + rcx*8]
mov eax, dword [rcx]
and eax, 1
mov dword [rsi + r8], eax
add r8, 4
cmp edx, edi
jb 0x1401a1890
mov eax, 1
jmp 0x1401a1217