Function at 0x1401a2320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, qword [rsp + 0xb0]
lea eax, [r8 - 0x401]
mov rdi, r9
mov rbx, rdx
mov rbp, rcx
cmp eax, 0x32
ja case.0x1401a236a.1026
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1a2c7c]
add rcx, rdx
jmp rcx
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0xc0], rdi
test rsi, rsi
jne 0x1401a23b7
lea rcx, [sym.SystemInformer.exe_PhIsExecutingInWow64]
mov eax, 1
mov qword [rbx + 0xb8], rcx
jmp 0x1401a25b7
cmp dword ds:[rbx + 0x244], 0
jg 0x1401a23c5
or dword [rbx + 0x40], 0xc00000
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
jmp 0x1401a25b7
mov rcx, rbx
call fcn.1401a49a0
mov rcx, rbx
call fcn.1401a33e0
jmp 0x1401a23a9
mov rdx, rsi
mov rcx, rbx
call fcn.1401a3860
movzx eax, al
jmp 0x1401a25b7
cmp edi, dword [rbx + 0xd4]
jae 0x1401a2465
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov rsi, qword [rax + rcx*8]
test rsi, rsi
je 0x1401a2465
mov edi, dword [rsi]
mov rdx, rsi
mov rcx, rbx
call fcn.1401a41a0
mov ecx, dword [rsi + 4]
xor edx, edx
mov rax, qword [rbx + 0xc8]
mov r8, rsi
mov qword [rax + rcx*8], rdx
mov rcx, qword [0x1402cba10]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rbx
call fcn.1401a3ea0
nop dword [rax]
test dil, 1
je 0x1401a244e
mov rcx, rbx
call fcn.1401a33e0
dec dword ds:[rbx + 0xd8]
mov edx, 1
mov eax, edx
jmp 0x1401a25b7
xor edx, edx
mov eax, edx
jmp 0x1401a25b7
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.1401a3a30
movzx eax, al
jmp 0x1401a25b7
mov r8d, dword [rsi + 4]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.1401a3a80
movzx eax, al
jmp 0x1401a25b7
nop
cmp edi, dword [rbx + 0xec]
jne case.0x1401a236a.1026
test edi, edi
je 0x1401a23b7
xor edx, edx
mov r9d, edi
mov r8d, edx
nop dword [rax]
mov rax, qword ds:[rbx + 0xe0]
lea rdx, [rdx + 4]
lea r8, [r8 + 8]
mov rcx, qword [rax + r8 - 8]
mov eax, dword [rcx + 4]
mov dword [rsi + rdx - 4], eax
sub r9, 1
jne 0x1401a24c0
mov eax, 1
jmp 0x1401a25b7
mov qword [rsp + 0x60], r14
test edi, edi
je 0x1401a259c
mov rcx, qword [0x1402cba10]
mov edx, 4
mov r14d, edi
lea r8, [r14*4]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov rbp, rax
test edi, edi
je 0x1401a2570
mov r8d, edx
nop word [rax + rax]
mov ecx, dword ds:[rsi + r8]
nop
cmp ecx, dword [rbx + 0xd4]
jae 0x1401a25ce
lfence
mov rax, qword [rbx + 0xc8]
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x1401a25ce
mov eax, dword [rax + 0x28]
inc edx
mov dword [r8 + rbp], eax
add r8, 4
cmp edx, edi
jb 0x1401a2530
mov rcx, qword ds:[rbx + 0x18]
mov r9, rbp
mov r8, r14
mov edx, 0x1212
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1402cba10]
xor edx, edx
mov r8, rbp
test eax, eax
je 0x1401a25dd
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rbx
call fcn.1401a4220
mov rcx, rbx
call fcn.1401a3ea0
mov eax, 1
mov r14, qword [rsp + 0x60]
mov rcx, qword ds:[rsp + 0x58]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
lfence
mov rcx, qword [0x1402cba10]
mov r8, rbp
xor edx, edx
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
jmp 0x1401a25b2
mov qword [rbx + 0x58], rsi
mov eax, 1
jmp 0x1401a25b7
test rdi, rdi
je 0x1401a2603
mov eax, dword [rbx + 0x130]
mov dword [r9], eax
test rsi, rsi
je 0x1401a23b7
mov eax, dword [rbx + 0x134]
mov dword [rsi], eax
mov eax, 1
jmp 0x1401a25b7
test esi, esi
je 0x1401a2645
nop
cmp edi, dword [rbx + 0xd4]
jae case.0x1401a236a.1026
lfence
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
jne 0x1401a2649
xor eax, eax
jmp 0x1401a25b7
xor edx, edx
mov edi, edx
mov rcx, rbx
mov dword [rbx + 0x130], edi
mov dword [rbx + 0x134], esi
call fcn.1401a4300
mov rax, qword [rbx + 0xb8]
lea rcx, [sym.SystemInformer.exe_PhIsExecutingInWow64]
cmp rax, rcx
je 0x1401a23b7
mov rcx, qword [rbx + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbx]
mov edx, 0xa
call qword [case.0x14013dbaa.0]
mov eax, 1
jmp 0x1401a25b7
mov eax, dword [rbx + 0x40]
neg rdi
sbb ecx, ecx
btr eax, 0xa
and ecx, 0x400
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a25b7
mov edx, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401a5840
movzx eax, al
jmp 0x1401a25b7
mov r8d, esi
mov edx, edi
mov rcx, rbx
call fcn.1401a6ca0
mov eax, 1
jmp 0x1401a25b7
test dword [rbx + 0x40], 0x400000
jne case.0x1401a236a.1026
mov rax, qword ds:[rbx + 0x128]
mov eax, dword [rax]
jmp 0x1401a25b7
mov rax, qword [rbx + 0x128]
cmp edi, dword [rax]
jae case.0x1401a236a.1026
lfence
mov rcx, qword [rbx + 0x128]
mov edx, edi
mov rax, qword [rcx + 8]
mov rax, qword [rax + rdx*8]
jmp 0x1401a25b7
mov r8d, dword ds:[rsi + 0x10]
lea r9, [rsi + 0x18]
mov rdx, qword [rsi + 8]
mov rcx, rbx
call fcn.1401a48c0
movzx eax, al
jmp 0x1401a25b7
test rdi, rdi
mov rdx, rsi
mov rcx, rbx
setne r8b
call fcn.1401a4c20
mov eax, 1
jmp 0x1401a25b7
mov eax, dword [rbx + 0xd0]
dec eax
jmp 0x1401a25b7
inc edi
cmp dword [rbx + 0xd0], edi
jae 0x1401a23b7
mov dword [rbx + 0xd0], edi
cmp dword [rbx + 0xd4], edi
jae 0x1401a23b7
mov rcx, rbx
call fcn.1401a3dc0
mov eax, 1
jmp 0x1401a25b7
test byte [rsi], 1
je case.0x1401a236a.1026
mov edx, dword [rsi + 0x2c]
mov r8d, edx
lea rax, [rsp + 0x38]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401a5020
test al, al
je case.0x1401a236a.1026
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rbp
jmp 0x1401a23b1
mov r8d, esi
mov edx, edi
jmp 0x1401a27bf
mov rax, qword [rbx + 0x10]
jmp 0x1401a25b7
mov rax, qword [rbx + 0x18]
jmp 0x1401a25b7
mov rax, qword [rbx + 0x38]
jmp 0x1401a25b7
xor edx, edx
lea rax, [rsp + 0x30]
cmp r8d, 0x41d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov r8d, esi
sete dl
mov qword [rsp + 0x20], rax
mov r9d, edx
mov rcx, rbx
mov edx, edi
call fcn.1401a5380
mov r8d, dword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov edx, dword [rsp + 0x38]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401a5020
nop dword [rax]
test al, al
je 0x1401a23b7
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbp
jmp 0x1401a23b1
mov eax, dword ds:[rbx + 0xd8]
jmp 0x1401a25b7
test rdi, rdi
mov edx, 1
mov eax, 0xffffffff
cmove edx, eax
add edx, dword [rbx + 0x244]
mov dword [rbx + 0x244], edx
cmp edx, 1
jne 0x1401a2947
test dword [rbx + 0x40], 0x400000
je 0x1401a28bb
mov rcx, rbx
call fcn.1401a49a0
test dword [rbx + 0x40], 0x800000
je 0x1401a28cc
mov rcx, rbx
call fcn.1401a33e0
test dword [rbx + 0x40], 0x1000000
je 0x1401a2910
mov rdi, qword [rbx]
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx edx, ax
mov rcx, rdi
shr eax, 0x10
cwde
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov r8, qword [rsp + 0x38]
mov rcx, rbx
mov edx, dword [rsp + 0x38]
shr r8, 0x20
call fcn.1401a58e0
and dword ds:[rbx + 0x40], 0xfe3fffff
mov rdx, qword [rbx + 0x248]
test rdx, rdx
je 0x1401a2947
mov rcx, qword [rbx]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRgn]
mov rcx, qword [rbx + 0x248]
call qword [sym.imp.GDI32.dll_DeleteObject]
xor edx, edx
mov qword [rbx + 0x248], rdx
movsxd rax, dword [rbx + 0x244]
jmp 0x1401a25b7
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rsi], xmm0
mov eax, dword [rbx + 0x70]
mov dword [rsi + 0x10], eax
mov eax, dword [rbx + 0x74]
mov dword [rsi + 0x14], eax
test byte [rbx + 0x40], 4
je 0x1401a2971
mov edx, dword [rbx + 0x78]
jmp 0x1401a2973
xor edx, edx
mov dword [rsi + 0x18], edx
mov eax, dword [rbx + 0x7c]
mov dword [rsi + 0x1c], eax
mov eax, dword [rbx + 0x80]
mov dword [rsi + 0x20], eax
mov eax, dword [rbx + 0x84]
mov dword [rsi + 0x24], eax
mov eax, dword [rbx + 0x88]
mov dword [rsi + 0x28], eax
mov eax, dword [rbx + 0x90]
mov dword [rsi + 0x2c], eax
mov eax, dword [rbx + 0xf0]
mov dword [rsi + 0x30], eax
mov eax, 1
jmp 0x1401a25b7
mov rax, qword [rbx + 0xf8]
jmp 0x1401a25b7
mov rax, qword [rbx + 0x100]
jmp 0x1401a25b7
mov qword [rbx + 0x98], rsi
mov eax, 1
jmp 0x1401a25b7
mov eax, dword [rsi + 0x2c]
mov dword [rbx + 0xa4], eax
mov eax, 1
jmp 0x1401a25b7
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.1401a5560
mov eax, 1
jmp 0x1401a25b7
mov eax, edi
and edi, esi
not eax
and eax, dword [rbx + 0x4c]
or eax, edi
mov dword [rbx + 0x4c], eax
mov eax, 1
jmp 0x1401a25b7
nop
test rsi, rsi
je 0x1401a2a3f
mov rax, qword [rbx + 0xb8]
lea rcx, [sym.SystemInformer.exe_PhIsExecutingInWow64]
xor edx, edx
cmp rax, rcx
cmovne rdx, rax
mov qword [rsi], rdx
nop
test rdi, rdi
je 0x1401a23b7
mov rax, qword [rbx + 0xc0]
mov qword [r9], rax
mov eax, 1
jmp 0x1401a25b7
mov rdx, rsi
mov rcx, rbx
call fcn.1401a5100
mov eax, 1
jmp 0x1401a25b7
mov eax, dword [rbx + 0x40]
shr eax, 4
and eax, 1
add eax, dword [rbx + 0xec]
jmp 0x1401a25b7
cmp edi, dword [rbx + 0xd4]
jae case.0x1401a236a.1026
lfence
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov r8, qword [rax + rcx*8]
test r8, r8
je case.0x1401a236a.1026
mov eax, dword [r8]
test al, 1
je case.0x1401a236a.1026
test al, 4
je 0x1401a2ad3
mov rdx, qword [rbx + 0x10]
mov r9d, esi
mov rcx, rbx
call fcn.1401a45c0
mov eax, 1
jmp 0x1401a25b7
mov rdx, qword ds:[rbx + 0x18]
mov r9d, esi
mov rcx, rbx
call fcn.1401a45c0
mov eax, 1
jmp 0x1401a25b7
movups xmm0, xmmword ds:[rsi]
mov eax, 1
movups xmmword [rbx + 0x250], xmm0
jmp 0x1401a25b7
mov eax, dword [rbx + 0x40]
test edi, edi
je 0x1401a2b25
bts eax, 0x1b
mov dword [rbx + 0x74], edi
mov dword [rbx + 0x40], eax
mov eax, 1
jmp 0x1401a25b7
btr eax, 0x1b
mov rcx, rbx
mov dword [rbx + 0x40], eax
call fcn.1401a3100
mov eax, 1
jmp 0x1401a25b7
mov eax, dword [rbx + 0x40]
shr eax, 0x16
not eax
and eax, 1
jmp 0x1401a25b7
mov eax, dword [rbx + 0x40]
neg rdi
sbb ecx, ecx
btr eax, 0x1e
and ecx, 0x40000000
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a25b7
mov rax, rdi
mov qword [rbx + 0x270], rdi
neg rax
mov eax, dword [rbx + 0x40]
sbb ecx, ecx
btr eax, 0x1f
and ecx, 0x80000000
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a25b7
mov eax, dword ds:[r9]
mov dword [rbx + 0x2b8], eax
mov rax, qword [r9 + 8]
mov qword [rbx + 0x2c0], rax
mov rax, qword [r9 + 0x10]
mov qword [rbx + 0x2c8], rax
mov eax, 1
jmp 0x1401a25b7
mov edx, esi
mov rcx, rbx
call fcn.1401a5840
movzx eax, al
jmp 0x1401a25b7
mov eax, dword [rbx + 0x40]
shr eax, 4
and eax, 1
add eax, dword [rbx + 0xec]
cmp edi, eax
jae case.0x1401a236a.1026
lfence
mov eax, dword [rbx + 0x40]
mov r8, rsi
shr eax, 4
and eax, 1
sub edi, eax
mov rax, qword [rbx + 0xe0]
mov rcx, qword [rax + rdi*8]
mov edx, dword [rcx + 4]
mov rcx, rbx
call fcn.1401a3a30
movzx eax, al
jmp 0x1401a25b7
xor edx, edx
test edi, edi
je 0x1401a23b7
mov r8d, edx
nop dword [rax + rax]
mov eax, dword ds:[rsi + r8]
nop
cmp eax, dword [rbx + 0xd4]
jae case.0x1401a236a.1026
lfence
mov ecx, eax
inc edx
mov rax, qword [rbx + 0xc8]
mov rcx, qword [rax + rcx*8]
mov eax, dword [rcx]
and eax, 1
mov dword [rsi + r8], eax
add r8, 4
cmp edx, edi
jb 0x1401a2c30
mov eax, 1
jmp 0x1401a25b7