Function at 0x180032fc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x228]
sub rsp, 0x328
mov r14, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
call fcn.1800317b0
nop
lea rcx, [r14 + 0xa0]
call fcn.1800317b0
nop
lea rcx, [r14 + 0x140]
call fcn.1800317b0
nop
lea rcx, [r14 + 0x1e0]
call fcn.1800317b0
nop
mov qword [r14 + 0x280], r13
mov qword [r14 + 0x288], r13
mov qword [0x1804d7c68], r14
call fcn.180254440
mov rdi, rax
lea rax, str._XInputHook__Entry
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x12
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov ebx, dword [rdi + 0x40]
cmp ebx, 2
setle r15b
lea rcx, [rdi + 0x88]
call fcn.180254940
movzx esi, al
cmp ebx, 2
jle 0x18003307c
test al, al
je 0x1800330ff
lea rcx, [rdi + 8]
cmp qword [rdi + 0x20], 0x10
jb 0x18003308b
mov rcx, qword [rdi + 8]
mov qword [rbp - 0x30], rcx
mov rax, qword [rdi + 0x18]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x20], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm1, qword [rbp - 0x80]
movsd qword [rbp + 0x90], xmm1
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x100]
call fcn.1802519e0
movzx r9d, sil
movzx r8d, r15b
lea rdx, [rbp + 0x100]
mov rcx, rdi
call fcn.180259810
mov qword [rbp], r14
lea rax, [rbp + 0x278]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], r14
lea rax, [rbp + 0x278]
mov qword [rbp + 0x18], rax
call fcn.180254440
mov rdi, rax
lea rax, str._XInputHook__Starting_hook_thread
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x21
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], r13
mov ebx, dword [rdi + 0x40]
cmp ebx, 2
setle r15b
lea rcx, [rdi + 0x88]
call fcn.180254940
movzx esi, al
cmp ebx, 2
jle 0x18003316a
test al, al
je 0x1800331ed
lea rcx, [rdi + 8]
cmp qword [rdi + 0x20], 0x10
jb 0x180033179
mov rcx, qword [rdi + 8]
mov qword [rbp - 0x10], rcx
mov rax, qword [rdi + 0x18]
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rbp - 0x78]
movaps xmmword [rbp + 0xa0], xmm0
movsd xmm1, qword [rbp - 0x68]
movsd qword [rbp + 0xb0], xmm1
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x160]
call fcn.1802519e0
movzx r9d, sil
movzx r8d, r15b
lea rdx, [rbp + 0x160]
mov rcx, rdi
call fcn.180259810
nop
mov ecx, 0x18
call fcn.18026a164
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800332ad
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov ecx, 0x20
call fcn.18026a164
test rax, rax
je 0x18003323a
mov dword [rax], 1
mov dword [rax + 4], 2
xor ecx, ecx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r13
mov dword [rax + 0x18], r13d
jmp 0x18003323d
mov rax, r13
mov qword [rdi + 0x10], rax
mov ecx, 0x10
call fcn.18026a164
test rax, rax
je 0x180033259
movups xmm0, xmmword [rbp]
movups xmmword [rax], xmm0
jmp 0x18003325c
mov rax, r13
mov qword [rbp + 0x280], rax
mov dword [rsp + 0x30], 2
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x180032ea0]
xor edx, edx
xor ecx, ecx
call fcn.18028d0dc
mov qword [rdi], rax
test rax, rax
je 0x180033610
mov qword [rbp + 0x280], r13
mov ebx, 2
and ebx, 0xfffffffd
mov dword [rsp + 0x30], ebx
jmp 0x1800332b4
mov rdi, r13
mov ebx, dword [rsp + 0x30]
mov qword [rbp + 0x288], rdi
or ebx, 1
mov dword [rsp + 0x30], ebx
mov qword [rbp + 0x288], r13
mov rsi, qword [r14 + 0x280]
mov qword [r14 + 0x280], rdi
mov r15d, 0xfffffffe
lea r12d, [r15 + 1]
test rsi, rsi
je 0x18003338a
mov qword [rsp + 0x38], rsi
cmp dword [rsi + 8], 0
je 0x180033342
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x180033303
call fcn.180020a70
cmp dword [rsi + 8], 0
je 0x18003361e
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsi + 8], eax
je 0x180033629
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x60], xmm0
xor edx, edx
lea rcx, [rbp + 0x60]
call fcn.180266cf4
test eax, eax
jne 0x180033634
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rsi], xmm0
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x180033373
mov eax, r15d
lock xadd dword [rcx + 4], eax
and eax, 0xfffffffe
cmp eax, 2
jne 0x18003336f
mov eax, r12d
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x18003336f
lea edx, [rax + 0x1f]
call fcn.18026a1a0
mov ebx, dword [rsp + 0x30]
cmp dword [rsi + 8], 0
jne 0x18003363f
mov edx, 0x18
mov rcx, rsi
call fcn.18026a1a0
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
mov ecx, 0x18
call fcn.18026a164
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180033447
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov ecx, 0x20
call fcn.18026a164
test rax, rax
je 0x1800333de
mov dword [rax], 1
mov dword [rax + 4], 2
xor ecx, ecx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r13
mov dword [rax + 0x18], r13d
jmp 0x1800333e1
mov rax, r13
mov qword [rsi + 0x10], rax
mov ecx, 0x10
call fcn.18026a164
test rax, rax
je 0x1800333fd
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rax], xmm0
jmp 0x180033400
mov rax, r13
mov qword [rsp + 0x60], rax
or ebx, 8
mov dword [rsp + 0x30], ebx
lea rdi, [rsi + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x180032ee0]
xor edx, edx
xor ecx, ecx
call fcn.18028d0dc
mov qword [rsi], rax
test rax, rax
je 0x180033645
mov qword [rsp + 0x60], r13
and ebx, 0xfffffff7
mov dword [rsp + 0x30], ebx
jmp 0x18003344a
mov rsi, r13
mov qword [rsp + 0x68], rsi
or ebx, 4
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x68], r13
mov rdi, qword [r14 + 0x288]
mov qword [r14 + 0x288], rsi
test rdi, rdi
je 0x180033512
mov qword [rsp + 0x38], rdi
cmp dword [rdi + 8], 0
je 0x1800334ca
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x18003348b
call fcn.180020a70
cmp dword [rdi + 8], 0
je 0x180033653
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rdi + 8], eax
je 0x18003365e
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x70], xmm0
xor edx, edx
lea rcx, [rbp + 0x70]
call fcn.180266cf4
test eax, eax
jne 0x180033669
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rdi], xmm0
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1800334fb
lock xadd dword [rcx + 4], r15d
and r15d, 0xfffffffe
cmp r15d, 2
jne 0x1800334f7
lock xadd dword [rcx], r12d
cmp r12d, 1
jne 0x1800334f7
lea edx, [r15 + 0x1e]
call fcn.18026a1a0
mov ebx, dword [rsp + 0x30]
cmp dword [rdi + 8], 0
jne 0x18003360a
mov edx, 0x18
mov rcx, rdi
call fcn.18026a1a0
and ebx, 0xfffffffb
mov dword [rsp + 0x30], ebx
call fcn.180254440
mov rdi, rax
lea rax, str._XInputHook__Hook_thread_started
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x20
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x50], r13
mov ebx, dword [rdi + 0x40]
cmp ebx, 2
setle r15b
lea rcx, [rdi + 0x88]
call fcn.180254940
movzx esi, al
cmp ebx, 2
jle 0x180033568
test al, al
je 0x1800335f3
lea rcx, [rdi + 8]
cmp qword [rdi + 0x20], 0x10
jb 0x180033577
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x50], rcx
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rbp - 0x60]
movaps xmmword [rbp + 0xc0], xmm0
movsd xmm1, qword [rbp - 0x50]
movsd qword [rbp + 0xd0], xmm1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x1c0]
call fcn.1802519e0
movzx r9d, sil
movzx r8d, r15b
lea rdx, [rbp + 0x1c0]
mov rcx, rdi
call fcn.180259810
nop
mov rax, r14
add rsp, 0x328
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18028cf18
nop
mov dword [rbx], r13d
mov ecx, 6
call fcn.1802673a8
nop
mov ecx, 1
call fcn.1802673a8
int3
mov ecx, 5
call fcn.1802673a8
int3
mov ecx, 2
call fcn.1802673a8
nop
call fcn.18028cf18
nop
mov dword [rdi], r13d
mov ecx, 6
call fcn.1802673a8
nop
mov ecx, 1
call fcn.1802673a8
int3
mov ecx, 5
call fcn.1802673a8
int3
mov ecx, 2
call fcn.1802673a8
int3