Function at 0x1400d1870
Capabilities:
Create thread
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor eax, eax
mov r12, rcx
xor edi, edi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x7c], eax
lea rcx, [r11 + 0x20]
lea rdx, [r11 - 0x68]
mov rsi, r8
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
call fcn.14007c78c
movsx r10d, al
mov rax, qword [rsp + 0xf8]
movzx r8d, word [rax]
mov dword [rsp + 0x80], r10d
cmp r8w, di
je 0x1400d18e5
mov r9w, word [rax + 2]
jmp 0x1400d18e8
mov r9d, edi
mov ebx, 0x2b
lea r11d, [rbx - 0x29]
cmp r8w, 0x2a
je 0x1400d1905
cmp r8w, 0x2d
je 0x1400d1905
cmp bx, r8w
jne 0x1400d1910
add rax, r11
mov qword [rsp + 0xf8], rax
cmp r8w, word [rax]
jne 0x1400d1927
add rax, r11
cmp r8w, word [rax]
je 0x1400d1916
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0xf8]
call fcn.1400591c8
lea rcx, [rsp + 0xe8]
call fcn.1400591c8
mov r15, rdi
cmp r10d, edi
je 0x1400d195d
cmp rsi, rdi
je 0x1400d195d
cmp byte [rsi + 0x109], dil
jne 0x1400d195d
mov r15, qword [rsi + 0x20]
jmp 0x1400d1964
mov dword [rsp + 0x80], edi
test byte [rsp + 0x80], r11b
mov rax, rdi
mov r14d, edi
cmovne rax, r15
mov qword [rsp + 0x58], rax
cmp r8w, 0x2a
jne 0x1400d1bde
mov ecx, 0xa78
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x60], rdi
call fcn.1400fb138
mov ebp, 0x271b
mov rbx, rax
cmp rax, rdi
je 0x1400d19d7
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.1400704c8
mov rbx, rax
jmp 0x1400d19da
mov rbx, rdi
mov ecx, pe_nt_image_headers64
call fcn.1400fb138
mov r13, rax
cmp rax, rdi
je 0x1400d1a08
mov rdx, r12
mov rcx, rax
call fcn.1400179e8
mov rdx, r12
mov rcx, r13
call fcn.1400183c8
mov qword [r13 + 0x40], rbx
jmp 0x1400d1a0b
mov r13, rdi
mov eax, dword [rsp + 0x100]
mov rdi, qword [rsp + 0xf8]
xor r8d, r8d
mov rcx, r13
mov rdx, rdi
mov byte [r13 + 0xd9], 3
mov dword [r13 + 0x24], eax
call fcn.140070d44
mov rax, qword [rsp + 0xe8]
mov edx, 1
mov rcx, rbx
mov qword [rbx + 0x280], rax
mov qword [rbx + 0x138], r15
mov qword [rbx + 0x270], r13
call fcn.1400d0b78
lea rcx, [rsp + 0x90]
mov rdx, rdi
call fcn.14006d5dc
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.1400714b4
lea rcx, [rbx + 0x110]
mov rdx, rax
call fcn.14006d65c
lea rcx, [rsp + 0x90]
call fcn.1400591f8
xor r15d, r15d
cmp rdi, r15
je 0x1400d1aba
cmp byte [rbx + 0x109], r15b
je 0x1400d1aca
lea rcx, [rbx + 0x148]
mov rdx, rdi
call fcn.14006d65c
cmp byte [rbx + 0x109], r15b
je 0x1400d1aca
mov edi, 0x271c
jmp 0x1400d1aeb
cmp byte [rbx + 0x142], r15b
je 0x1400d1ada
mov edi, 0x271d
jmp 0x1400d1aeb
cmp byte [rbx + 0x141], r15b
mov edi, 0x271c
cmovne ebp, edi
mov edi, ebp
mov rcx, rbx
call fcn.140052b28
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x48]
call fcn.140059820
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp rax, r15
je 0x1400d1b2d
mov rax, qword [rsp + 0x48]
cmp byte [rax + 0x109], r15b
je 0x1400d1b2d
mov eax, 2
cmp dword [r12 + 0x20], eax
cmovle r14d, eax
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x70]
mov edx, edi
mov rcx, rbx
call fcn.14005c364
mov rdx, qword [rbx + 0x20]
lea r9, [0x1401156d0]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.1400648bc
xor edx, edx
mov rcx, rbx
call fcn.1400e2194
lea rcx, [0x140136118]
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140136118]
mov qword [r13 + 0x40], r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rcx, r13
call fcn.14004d5e0
lea rcx, [r13 + 0x70]
call fcn.1400591f8
mov rcx, r13
call fcn.1400faf4c
mov r11, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r11 + 0x18]
mov r11, qword [rsp + 0x60]
cmp r11, r15
je 0x1400d1fb2
mov rcx, qword [rsp + 0x60]
mov r8d, r14d
xor r9d, r9d
or r8, 1
mov edx, 0x451
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400d1fb2
cmp r8w, 0x2d
jne 0x1400d1dec
mov ecx, 0xa78
call fcn.1400fb138
mov ebp, 0x271b
mov rbx, rax
cmp rax, rdi
je 0x1400d1c30
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.1400704c8
mov rbx, rax
jmp 0x1400d1c33
mov rbx, rdi
mov ecx, pe_nt_image_headers64
call fcn.1400fb138
mov rdi, rax
xor eax, eax
cmp rdi, rax
je 0x1400d1c63
mov rdx, r12
mov rcx, rdi
call fcn.1400179e8
mov rdx, r12
mov rcx, rdi
call fcn.1400183c8
mov qword [rdi + 0x40], rbx
jmp 0x1400d1c66
mov rdi, rax
mov eax, dword [rsp + 0x100]
mov r13, qword [rsp + 0xf8]
xor r8d, r8d
mov rcx, rdi
mov rdx, r13
mov byte [rdi + 0xd9], 3
mov dword [rdi + 0x24], eax
call fcn.140070d44
mov rax, qword [rsp + 0xe8]
mov edx, 1
mov rcx, rbx
mov qword [rbx + 0x280], rax
mov qword [rbx + 0x138], r15
mov qword [rbx + 0x270], rdi
call fcn.1400d0b78
mov r11, qword [rbx + 0x270]
lea rcx, [rsp + 0x98]
mov rdx, r13
mov qword [rbx + 0x268], r11
call fcn.14006d5dc
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.1400714b4
lea rcx, [rbx + 0x110]
mov rdx, rax
call fcn.14006d65c
lea rcx, [rsp + 0x98]
call fcn.1400591f8
mov rdx, qword [rsp + 0x88]
xor r15d, r15d
cmp rdx, r15
je 0x1400d1d1d
lea rcx, [rbx + 0x110]
call fcn.14006d6f4
cmp r13, r15
je 0x1400d1d3a
cmp byte [rbx + 0x109], r15b
je 0x1400d1d43
lea rcx, [rbx + 0x148]
mov rdx, r13
call fcn.14006d65c
cmp byte [rbx + 0x109], r15b
jne 0x1400d1d5c
cmp byte [rbx + 0x141], r15b
jne 0x1400d1d5c
cmp byte [rbx + 0x142], r15b
je 0x1400d1d61
mov ebp, 0x271d
jmp 0x1400d1d61
mov ebp, 0x271c
mov rcx, rbx
call fcn.140052b28
mov qword [rbx + 0xc0], rsi
mov byte [rbx + 0x108], 1
cmp rsi, r15
je 0x1400d1da4
lea rcx, [0x140136118]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rsi + 0x1a8]
lea rcx, [0x140136118]
mov byte [rbx + 0x108], 9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x70]
mov edx, ebp
mov rcx, rbx
call fcn.14005c364
mov rdx, qword [rbx + 0x20]
lea r9, [0x1401156d0]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.1400648bc
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400d1fb7
mov r13, qword [rsp + 0xf8]
mov rax, rsi
cmp bx, word [r13 - 2]
sete dil
cmp r9w, r8w
sete byte [rsp + 0x40]
xor ebp, ebp
cmp dil, bpl
cmovne rax, rbp
mov qword [rsp + 0x58], rax
cmp dil, bpl
jne 0x1400d1e3e
cmp rsi, rbp
jne 0x1400d1e3e
xor edx, edx
mov rcx, r12
call fcn.14001b0fc
cmp qword [r12 + 0x40], rbp
jne 0x1400d1e3e
mov rax, 0xffffffff80070057
jmp 0x1400d1fba
lea rcx, [rsp + 0x68]
mov edx, 0xa0
call fcn.140061420
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.14005915c
lea rax, [rsp + 0x50]
lea r8, [0x1400d1374]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov edx, 0x400000
xor ecx, ecx
lea r14, [rbx + 0x70]
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
je 0x1400d1f77
lea rdx, [rsp + 0x70]
mov rcx, r14
mov r8d, 0x20
mov qword [rsp + 0x68], rbp
call fcn.1400fbab0
mov rcx, qword [rsp + 0xe8]
movsxd rax, dword [rsp + 0x100]
mov qword [rbx], r12
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 4
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x28], rax
mov eax, dword [rsp + 0x50]
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x48], r15
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140059820
mov qword [rbx + 0x50], rax
cmp dil, bpl
jne 0x1400d1f26
lea rcx, [0x140136118]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x1401357a0]
lea rcx, [0x140136118]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, rbp
cmp byte [rsp + 0x40], bpl
jne 0x1400d1f47
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rbx + 0x60], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rbp
je 0x1400d1f73
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rbx + 0x30]
mov edx, dword [rsp + 0x50]
lea r8, str.__LastTID
mov rcx, r12
call fcn.140064948
lea r9, [0x1401156d0]
lea r8, str.__LastWinID
mov rdx, rbp
mov rcx, r12
call fcn.1400648bc
and dword [rsp + 0x48], 0
lea rcx, [rsp + 0x68]
call fcn.1400591f8
mov r14d, dword [rsp + 0x48]
movsxd rax, r14d
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret