Function at 0x140086760
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rbx, r8
mov r12, rcx
xor r14d, r14d
mov dword [rsp + 0x48], r14d
xor eax, eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x48]
lea rcx, [r11 + 0x20]
call fcn.140074430
movsx r11d, al
mov dword [rsp + 0x58], r11d
mov rax, qword [rsp + 0x148]
movzx r10d, word [rax]
cmp r10w, 0x2a
je 0x1400867ef
cmp r10w, 0x2d
je 0x1400867ef
mov ecx, 0x2b
cmp cx, r10w
jne 0x1400867fb
add rax, 2
mov qword [rsp + 0x148], rax
lea rcx, [rsp + 0x148]
call fcn.14005b560
lea rcx, [rsp + 0x138]
call fcn.14005b560
mov r13, r14
test r11d, r11d
je 0x140086831
test rbx, rbx
je 0x140086831
cmp byte [rbx + 0xa1], r13b
jne 0x140086831
mov r13, qword [rbx + 0x20]
jmp 0x140086836
mov dword [rsp + 0x58], r14d
test byte [rsp + 0x58], 2
mov r15, r14
cmovne r15, r13
cmp r10w, 0x2a
jne 0x140086ade
mov ecx, 0x9e8
call fcn.1400cf938
mov rdi, rax
mov esi, 0x271b
test rax, rax
je 0x140086894
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdx, rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, esi
mov rcx, rdi
call fcn.140074070
mov rdi, rax
jmp 0x140086897
mov rdi, r14
mov qword [rsp + 0x68], rdi
mov ecx, 0xd0
call fcn.1400cf938
mov rbp, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400868d0
mov rdx, r12
mov rcx, rax
call fcn.14002a68c
nop
mov rdx, r12
mov rcx, rbp
call fcn.14002af60
mov qword [rbp + 0x40], rdi
jmp 0x1400868d3
mov rbp, r14
mov qword [rsp + 0x40], rbp
mov byte [rbp + 0xb9], 3
mov eax, dword [rsp + 0x150]
mov dword [rbp + 0x24], eax
xor r8d, r8d
mov r14, qword [rsp + 0x148]
mov rdx, r14
mov rcx, rbp
call fcn.140075040
mov qword [rdi + 0xd0], r13
mov qword [rdi + 0x1f8], rbp
mov rax, qword [rsp + 0x138]
mov qword [rdi + 0x208], rax
mov dl, 1
mov rcx, rdi
call fcn.1400847f0
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.140071240
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140075820
mov rdx, rax
lea rcx, [rdi + 0xa8]
call fcn.140071360
lea rcx, [rsp + 0x70]
call fcn.14005b520
test r14, r14
je 0x140086976
cmp byte [rdi + 0xa1], 0
je 0x140086976
lea rcx, [rdi + 0xe0]
mov rdx, r14
call fcn.140071360
cmp byte [rdi + 0xa1], 0
jne 0x140086998
cmp byte [rdi + 0xd9], 0
jne 0x140086998
cmp byte [rdi + 0xda], 0
je 0x14008699d
mov esi, 0x271d
jmp 0x14008699d
mov esi, 0x271c
mov rcx, rdi
call fcn.14010868c
test rbx, rbx
je 0x1400869ca
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rbx + 0x140]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r9, [rsp + 0x48]
mov r8, r15
mov edx, esi
mov rcx, rdi
call fcn.14005dd90
lea r9, str.0x_I64X
lea r8, str.__LastWinID
mov rdx, qword [rdi + 0x20]
mov rcx, r12
call fcn.140065de0
xor edx, edx
mov rcx, rdi
call fcn.140070a00
mov esi, eax
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r13d, r13d
mov qword [rbp + 0x40], r13
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov qword [rsp + 0x40], rbp
xor edx, edx
mov rcx, rbp
call fcn.140045e0c
nop
lea rcx, [rbp + 0x58]
call fcn.14005b520
mov rcx, rbp
call fcn.1400cf984
mov qword [rsp + 0x40], r13
mov rax, qword [rdi]
lea edx, [r13 + 1]
mov rcx, rdi
call qword [rax + 0x18]
mov qword [rsp + 0x68], r13
test rbx, rbx
je 0x140086ad7
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rbx + 0x140]
dec eax
test eax, eax
jle 0x140086a90
cmp byte [rbx + 0xa1], r13b
je 0x140086a90
cmp dword [r12 + 0x20], 2
jg 0x140086a90
mov dil, 1
jmp 0x140086a93
xor dil, dil
mov dword [rbx + 0x140], eax
cmp byte [rbx + 0xa1], 0x81
je 0x140086ab7
xor r9d, r9d
xor r8d, r8d
mov edx, 0x43d
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.dll_PostMessageW]
test dil, dil
je 0x140086ac3
mov byte [0x1401958af], 0xff
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x140086e2a
mov eax, esi
jmp 0x140086e2a
cmp r10w, 0x2d
jne 0x140086cc7
mov ecx, 0x9e8
call fcn.1400cf938
mov rdi, rax
mov esi, 0x271b
test rax, rax
je 0x140086b30
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdx, rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, esi
mov rcx, rdi
call fcn.140074070
mov rdi, rax
jmp 0x140086b33
mov rdi, r14
mov ecx, 0xd0
call fcn.1400cf938
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140086b58
mov r8, rdi
mov rdx, r12
mov rcx, rax
call fcn.140046620
mov r14, rax
mov byte [r14 + 0xb9], 3
mov eax, dword [rsp + 0x150]
mov dword [r14 + 0x24], eax
xor r8d, r8d
mov rbp, qword [rsp + 0x148]
mov rdx, rbp
mov rcx, r14
call fcn.140075040
mov qword [rdi + 0xd0], r13
mov qword [rdi + 0x1f8], r14
mov rax, qword [rsp + 0x138]
mov qword [rdi + 0x208], rax
mov dl, 1
mov rcx, rdi
call fcn.1400847f0
mov r11, qword [rdi + 0x1f8]
mov qword [rdi + 0x1f0], r11
mov rdx, rbp
lea rcx, [rsp + 0x78]
call fcn.140071240
lea rdx, [rsp + 0x78]
mov rcx, rbp
call fcn.140075820
mov rdx, rax
lea rcx, [rdi + 0xa8]
call fcn.140071360
lea rcx, [rsp + 0x78]
call fcn.14005b520
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140086bff
lea rcx, [rdi + 0xa8]
call fcn.140071480
test rbp, rbp
je 0x140086c1c
cmp byte [rdi + 0xa1], 0
je 0x140086c1c
lea rcx, [rdi + 0xe0]
mov rdx, rbp
call fcn.140071360
cmp byte [rdi + 0xa1], 0
jne 0x140086c3e
cmp byte [rdi + 0xd9], 0
jne 0x140086c3e
cmp byte [rdi + 0xda], 0
je 0x140086c43
mov esi, 0x271d
jmp 0x140086c43
mov esi, 0x271c
mov rcx, rdi
call fcn.14010868c
mov byte [rdi + 0xa0], 1
mov qword [rdi + 0x70], rbx
test rbx, rbx
je 0x140086c7b
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rbx + 0x140]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r9, [rsp + 0x48]
mov r8, r15
mov edx, esi
mov rcx, rdi
call fcn.14005dd90
lea r9, str.0x_I64X
lea r8, str.__LastWinID
mov rdx, qword [rdi + 0x20]
mov rcx, r12
call fcn.140065de0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r13d, r13d
mov eax, r13d
jmp 0x140086e2a
mov qword [rsp + 0x80], r12
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 4
mov qword [rsp + 0xa0], r14
movsxd rax, dword [rsp + 0x150]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], r14
lea rax, [rsp + 0x48]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xd0], r14
lea rcx, [0x14019cae8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11, [rsp + 0xb8]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x10000
lea r9, [rsp + 0x80]
lea r8, [0x140086220]
mov edx, 0x400000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140086dd8
mov ebx, 0x270f
nop dword [rax + rax]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140086daa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x140086d90
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x140086dd8
nop word [rax + rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rsp + 0x98]
test r11, r11
jne 0x140086dc0
lea rcx, [0x14019cae8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x140086df3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.__LastTID
mov edx, dword [rsp + 0xb8]
mov rcx, r12
call fcn.140065eb0
mov rdx, qword [rsp + 0xb0]
lea r9, str.0x_I64X
lea r8, str.__LastWinID
mov rcx, r12
call fcn.140065de0
mov eax, r14d
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret