Function at 0x14001b140
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, rdx
mov esi, ecx
call fcn.14001ac20
test al, al
jne 0x14001b173
mov eax, 1
jmp 0x14001b4a7
xor ebx, ebx
cmp qword [0x1400dd000], rbx
jne 0x14001b1fa
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x50]
call fcn.140020490
test al, al
je 0x14001b1b2
lea rcx, [rsp + 0x50]
call fcn.140020550
test al, al
je 0x14001b1b2
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001b1b0
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
jmp 0x14001b1fa
cmp byte [0x1400dd037], 0
jne 0x14001b1e8
mov ecx, 2
call fcn.1400539a0
mov rcx, rax
lea rdx, str.warning:_PresentMon_requires_elevated_privilege_in_order_to_query_processes_n____started_on_another_account__so_these_processes_wont_be_targetted_by_name_n____and_will_be_listed_as__error_.__Further__there_may_be_tracking_errors_n____near_process_termination__and_if_they_are_targetted_n_____terminate_on_proc_exit_wont_work._n
call fcn.1400094c0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001b1e6
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
jmp 0x14001b1fa
mov rdx, rdi
mov ecx, esi
call fcn.140020660
mov ecx, eax
call fcn.14005b0a0
nop
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1400dbd18], rax
cmp byte [0x1400dd036], 0
je 0x14001b299
cmp byte [0x1400dd03b], 0
je 0x14001b24f
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
lea r9, [0x1400dbd18]
lea r8, [0x14001a560]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400dbd28], rax
jmp 0x14001b299
mov r9d, dword [0x1400dd020]
mov r8d, dword [0x1400dd01c]
mov edx, 0x80
mov rcx, qword [0x1400dbd20]
call qword [sym.imp.USER32.dll_RegisterHotKey]
test eax, eax
jne 0x14001b299
lea ecx, [rax + 2]
call fcn.1400539a0
mov rcx, rax
lea rdx, str.error:_failed_to_register_hotkey._n
call fcn.1400094c0
call fcn.14001ab30
mov eax, 5
jmp 0x14001b4a7
mov edx, 1
lea rcx, [0x14001a7e0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rdx, str.FrameView
mov rcx, qword [0x1400dd008]
call fcn.140094f70
mov ecx, 0x18
test eax, eax
jne 0x14001b33e
call fcn.14004b6fc
mov rdi, rax
mov qword [rsp + 0xa8], rax
mov qword [rax], rbx
mov qword [rax + 8], rbx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rsp + 0x38]
mov qword [rdi + 0x10], rcx
cmp ebx, 0x1e
je 0x14001b31e
lea rdx, str.GlobalFVToolSharedMemory
mov rcx, rdi
call fcn.14001a390
test eax, eax
je 0x14001b31c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x1e
jbe 0x14001b2f5
jmp 0x14001b397
mov dword [rsp + 0xa0], 1
lea rdx, [0x1400ce688]
lea rcx, [rsp + 0xa0]
call fcn.140052430
nop
call fcn.14004b6fc
mov rdi, rax
mov qword [rsp + 0xa0], rax
mov qword [rax], rbx
mov qword [rax + 8], rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x10], rax
cmp ebx, 0x1e
je 0x14001b487
lea rdx, str.GlobalFVSDKSharedMemory
mov rcx, rdi
call fcn.14001a390
test eax, eax
je 0x14001b397
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x1e
jbe 0x14001b36c
mov qword [0x1400dbd30], rdi
test rdi, rdi
jne 0x14001b3ab
lea eax, [rdi + 9]
jmp 0x14001b4a7
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001b3d1
mov rcx, qword [rdi + 8]
mov rax, qword [rsp + 0x30]
xchg qword [rcx + 0x13e78], rax
mov rdx, qword [0x1400dd018]
test edx, edx
je 0x14001b3ed
mov rax, qword [0x1400dbd30]
mov rcx, qword [rax + 8]
mov dword [rcx + 0x13ec0], edx
mov r8, qword [0x1400dd014]
test r8d, r8d
je 0x14001b40b
mov rax, qword [0x1400dbd30]
mov rdx, qword [rax + 8]
mov dword [rdx + 0x13ec0], r8d
call fcn.14002f280
test al, al
jne 0x14001b42f
xor edx, edx
lea rcx, [0x14001a7e0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.14001ab30
mov eax, 6
jmp 0x14001b4a7
cmp byte [0x1400dd030], 0
je 0x14001b44c
movzx ecx, byte [0x1400db95b]
call fcn.14001a600
mov byte [0x1400db95c], al
jmp 0x14001b453
mov byte [0x1400db95c], 0
cmp byte [0x1400dd036], 0
jne 0x14001b483
mov r9d, dword [0x1400dd01c]
mov eax, 0xffffbfff
and r9, rax
mov edx, 0x312
mov r8d, 0x80
mov rcx, qword [0x1400dbd20]
call qword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
jmp 0x14001b4a7
mov dword [rsp + 0xa8], 1
lea rdx, [0x1400ce688]
lea rcx, [rsp + 0xa8]
call fcn.140052430
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret