Function at 0x1400051a0
Capabilities:
Create thread
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [r11 - 0x748]
sub rsp, 0x820
mov rax, qword [0x140067010]
xor rax, rsp
mov qword [rbp + 0x700], rax
mov r9, qword [0x140067b00]
mov r12d, r8d
mov qword [r11 + 0x18], rbx
mov edi, edx
mov qword [r11 - 0x30], rsi
lea rbx, [0x140067b00]
mov r15d, ecx
test byte [r9 + 0x1c], 4
je 0x14000524d
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x104
call fcn.140034ac0
mov r9d, r15d
mov dword [rsp + 0x20], edi
lea r8, str.CheckNotification__dwNotifyCode__0x_x__dwParam__0x_x
mov edx, 0x104
lea rcx, [rbp - 0x40]
call fcn.140006460
mov r9, qword [0x140067b00]
cmp r9, rbx
je 0x14000524d
test byte [r9 + 0x1c], 4
je 0x14000524d
mov rcx, qword [r9 + 0x10]
lea rax, [rbp - 0x40]
mov edx, 0xa
mov qword [rsp + 0x20], rax
call fcn.140031fc0
mov r9, qword [0x140067b00]
xor r13d, r13d
lea eax, [r15 - 0x4b]
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x34], r13d
lea esi, [r13 + 2]
cmp eax, 0xaf
ja case.default.0x14000528e
lea rdx, [0x140000000]
mov qword [rsp + 0x810], r14
movzx eax, byte [rdx + rax + 0x6398]
mov ecx, dword [rdx + rax*4 + 0x6318]
add rcx, rdx
jmp rcx
mov edx, r13d
cmp edi, esi
jne 0x1400052b0
mov ecx, 1
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
call fcn.140031be0
jmp case.0x14000528e.76
cmp edi, 3
jne 0x1400052cc
mov ecx, r13d
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
call fcn.140031be0
jmp case.0x14000528e.76
test edi, edi
lea r9, [rsp + 0x34]
mov ecx, esi
lea r8, [rsp + 0x30]
sete dl
call fcn.140031be0
jmp case.0x14000528e.76
lea r9, [rsp + 0x34]
mov edx, edi
lea r8, [rsp + 0x30]
xor ecx, ecx
call fcn.140011da0
jmp case.0x14000528e.76
lea r9, [rsp + 0x34]
mov edx, edi
lea r8, [rsp + 0x30]
mov ecx, 1
call fcn.140011da0
jmp case.0x14000528e.76
mov dword [rsp + 0x30], 0x57
cmp dword [0x14006a98c], r13d
je case.0x14000528e.76
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
cmp dword [0x14006a988], r13d
mov qword [0x14006a980], rax
jne case.0x14000528e.76
mov qword [rsp + 0x28], r13
lea r8, [0x14002fae0]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor edx, edx
mov dword [0x14006a988], 1
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je case.0x14000528e.76
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp case.0x14000528e.76
mov dword [rsp + 0x30], 0x58
jmp case.0x14000528e.76
mov rax, qword [0x14006aee0]
dec rax
cmp rax, 0xfffffffffffffffd
ja case.0x14000528e.76
lea rax, [rsp + 0x38]
mov dword [rsp + 0x50], 0x60027
lea r9, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r8d, 4
mov dword [rsp + 0x38], 4
lea rdx, [rsp + 0x50]
mov ecx, 0x53545344
call fcn.1400064c0
test eax, eax
je case.0x14000528e.76
cmp dword [rsp + 0x38], 4
mov eax, r13d
cmovae eax, dword [rbp - 0x68]
bt eax, 0x10
jae case.0x14000528e.76
and eax, 1
test edi, edi
jne case.0x14000528e.76
mov dword [rsp + 0x30], 0x78
mov dword [rsp + 0x34], eax
jmp case.0x14000528e.76
call fcn.1400071c0
jmp case.0x14000528e.76
cmp edi, 0x80
mov ecx, r13d
setae cl
jae 0x140005432
mov edx, esi
jmp 0x140005443
lea edx, [rdi - 0x200]
cmp edi, 0x200
jae 0x140005443
lea edx, [rdi - 0x80]
mov r8d, r13d
cmp edi, 0x80
jae 0x140005456
test edi, edi
sete r8b
jmp 0x140005460
cmp edi, 0x200
setae r8b
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140013c10
jmp case.0x14000528e.76
cmp edi, 0x80
mov r14d, r13d
setae r14b
jb 0x1400054a1
lea esi, [rdi - 0x200]
cmp edi, 0x200
jae 0x140005499
lea esi, [rdi - 0x80]
cmp edi, 0x80
jae 0x1400054ab
test edi, edi
mov ebx, r13d
sete bl
jmp 0x1400054b7
cmp edi, 0x200
mov ebx, r13d
setae bl
lea rax, [rsp + 0x34]
mov r8d, ebx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, esi
mov ecx, r14d
call fcn.140015380
test eax, eax
jne case.0x14000528e.76
lea rax, [rsp + 0x34]
mov r8d, ebx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, esi
mov ecx, r14d
call fcn.140014510
jmp case.0x14000528e.76
cmp edi, 0x80
mov ecx, r13d
setae cl
jae 0x14000550e
mov edx, esi
jmp 0x14000551f
lea edx, [rdi - 0x200]
cmp edi, 0x200
jae 0x14000551f
lea edx, [rdi - 0x80]
mov r8d, r13d
cmp edi, 0x80
jae 0x140005532
test edi, edi
sete r8b
jmp 0x14000553c
cmp edi, 0x200
setae r8b
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400159a0
jmp case.0x14000528e.76
cmp dword [0x14006a960], r13d
je case.0x14000528e.76
lea rsi, str.Request_Hibernate_helper
cmp r9, rbx
je 0x140005588
test byte [r9 + 0x1c], 4
je 0x140005588
mov rcx, qword [r9 + 0x10]
mov edx, 0xb
mov qword [rsp + 0x20], rsi
call fcn.140031fc0
mov rcx, rsi
call fcn.140032cd0
mov ecx, 1
call fcn.140027360
jmp case.0x14000528e.76
lea rsi, str.Request_Hibernate
cmp r9, rbx
je 0x1400055c5
test byte [r9 + 0x1c], 4
je 0x1400055c5
mov rcx, qword [r9 + 0x10]
mov edx, 0xb
mov qword [rsp + 0x20], rsi
call fcn.140031fc0
mov rcx, rsi
call fcn.140032cd0
xor ecx, ecx
call fcn.140027360
test eax, eax
jne case.0x14000528e.76
call fcn.1400272c0
jmp case.0x14000528e.76
xor ecx, ecx
call fcn.140027430
jmp case.0x14000528e.76
call fcn.140021950
jmp case.0x14000528e.76
mov edx, r13d
cmp edi, esi
jne 0x140005608
mov ecx, r13d
jmp 0x140005619
cmp edi, 3
jne 0x140005612
lea ecx, [rdi - 2]
jmp 0x140005619
test edi, edi
mov ecx, esi
sete dl
lea rax, [rsp + 0x34]
mov r8d, 1
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14000af80
jmp case.0x14000528e.76
test edi, edi
lea rax, [rsp + 0x34]
mov r8d, r13d
mov qword [rsp + 0x20], rax
sete r8b
lea r9, [rsp + 0x30]
xor ecx, ecx
mov edx, 1
call fcn.14001f600
jmp case.0x14000528e.76
test edi, edi
lea rax, [rsp + 0x34]
mov r8d, r13d
mov qword [rsp + 0x20], rax
sete r8b
lea r9, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call fcn.14001f600
jmp case.0x14000528e.76
cmp edi, 0x80
jae 0x1400056b5
test edi, edi
lea rax, [rsp + 0x34]
mov r8d, r13d
mov qword [rsp + 0x20], rax
sete r8b
lea r9, [rsp + 0x30]
xor ecx, ecx
mov edx, esi
call fcn.14001f600
jmp case.0x14000528e.76
cmp edi, 0x100
jb 0x140005825
cmp dword [0x14006983c], r13d
lea r14d, [rdi - 0x100]
jne 0x1400056de
cmp dword [0x140069838], r13d
je case.0x14000528e.76
cmp dword [0x140067adc], r13d
je 0x1400056f3
mov dword [0x140067adc], r13d
call fcn.14000b8b0
cmp dword [0x140067ad0], r13d
jne 0x140005709
mov dword [rsp + 0x30], 0xc3
jmp case.0x14000528e.76
mov r8d, dword [0x1400693bc]
test r8d, r8d
jne 0x140005725
mov r9d, dword [0x1400693b8]
test r9d, r9d
je 0x1400057b2
xor edx, edx
lea rcx, [rbp + 0xd0]
mov r8d, 0x208
call fcn.140034ac0
mov r9d, dword [0x7ffe02d8]
lea r8, str.Session_dASUS_Exclusive_Lighting_Effect_Event
mov edx, 0x104
lea rcx, [rbp + 0xd0]
call fcn.140009eb0
lea r8, [rbp + 0xd0]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
mov rsi, rax
test rax, rax
je 0x1400057a4
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test ebx, ebx
je 0x1400057a4
mov dword [rsp + 0x30], 0xc3
mov dword [rsp + 0x34], 1
jmp case.0x14000528e.76
mov r8d, dword [0x1400693bc]
mov r9d, dword [0x1400693b8]
test r14d, r14d
mov dword [0x140067ad0], 1
mov ecx, 3
mov eax, r13d
cmovg eax, r14d
cmp eax, ecx
cmovl ecx, eax
cmp dword [0x140067978], r13d
mov dword [0x140067acc], ecx
je 0x14000594a
cmp dword [0x140067974], r13d
je 0x14000594a
cmp dword [0x140067ae8], r13d
je 0x14000594a
cmp dword [0x140067adc], r13d
je 0x140005943
test r8d, r8d
jne 0x140005943
test r9d, r9d
je 0x14000594a
lea edx, [r8 + 1]
jmp 0x14000594d
cmp dword [0x14006983c], r13d
lea r14d, [rdi - 0x80]
jne 0x14000583f
cmp dword [0x140069838], r13d
je case.0x14000528e.76
cmp dword [0x140067adc], r13d
je 0x140005854
mov dword [0x140067adc], r13d
call fcn.14000b8b0
cmp dword [0x140067ad0], r13d
je case.0x14000528e.76
mov edx, dword [0x1400693bc]
test edx, edx
jne 0x140005877
mov r8d, dword [0x1400693b8]
test r8d, r8d
je 0x1400058f2
xor edx, edx
lea rcx, [rbp + 0x2e0]
mov r8d, 0x208
call fcn.140034ac0
mov r9d, dword [0x7ffe02d8]
lea r8, str.Session_dASUS_Exclusive_Lighting_Effect_Event
mov edx, 0x104
lea rcx, [rbp + 0x2e0]
call fcn.140009eb0
lea r8, [rbp + 0x2e0]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
mov rsi, rax
test rax, rax
je 0x1400058e5
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test ebx, ebx
jne case.0x14000528e.76
mov edx, dword [0x1400693bc]
mov r8d, dword [0x1400693b8]
test r14d, r14d
mov dword [0x140067ad0], 1
mov ecx, 3
mov eax, r13d
cmovg eax, r14d
cmp eax, ecx
cmovl ecx, eax
cmp dword [0x140067978], r13d
mov dword [0x140067acc], ecx
je 0x14000594a
cmp dword [0x140067974], r13d
je 0x14000594a
cmp dword [0x140067ae8], r13d
je 0x14000594a
cmp dword [0x140067adc], r13d
je 0x140005943
test edx, edx
jne 0x140005943
test r8d, r8d
je 0x14000594a
mov edx, 1
jmp 0x14000594d
mov edx, r13d
mov r8d, 1
call fcn.1400201d0
cmp dword [0x140067ab4], 3
mov dword [0x140067a80], r13d
ja case.0x14000528e.76
mov edx, 0x100
mov dword [0x140067ab4], 0x100
lea rcx, str.PriorKeybdLightLevel
call fcn.140027c20
jmp case.0x14000528e.76
cmp dword [0x14006983c], r13d
jne 0x1400059a2
cmp dword [0x140069838], r13d
je case.0x14000528e.76
mov ebx, dword [0x140067a7c]
call fcn.14001ec00
mov ecx, ebx
call fcn.14001faa0
jmp case.0x14000528e.76
mov ecx, 1
xor edx, edx
mov r8d, ecx
call fcn.14001fd10
cmp dword [0x14006983c], r13d
jne case.0x14000528e.76
cmp dword [0x140069838], r13d
jne case.0x14000528e.76
cmp dword [0x140067aec], 1
jne case.0x14000528e.76
xor edx, edx
lea ecx, [rdx + 1]
call fcn.14001ec80
test eax, eax
je case.0x14000528e.76
cmp dword [0x140067ae8], r13d
jne 0x140005a77
mov eax, dword [0x140067960]
dec eax
test eax, 0xfffffffa
jne 0x140005a77
cmp dword [0x140069384], r13d
jne 0x140005a80
xor edx, edx
lea rcx, [rbp + 0x4f0]
mov r8d, 0x208
call fcn.140034ac0
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x3c], r13d
lea rdx, [rbp + 0x4f0]
mov ecx, 1
call fcn.14000fa60
test eax, eax
je 0x140005a77
cmp dword [rsp + 0x3c], r13d
je 0x140005a77
xor r9d, r9d
mov qword [rsp + 0x28], r13
xor r8d, r8d
mov dword [rsp + 0x20], r13d
mov edx, esi
lea ecx, [r9 + 0x16]
call fcn.14001c210
cmp dword [0x140069384], r13d
je 0x140005aa9
cmp dword [0x14006793c], 1
mov ecx, dword [0x140067938]
je 0x140005a95
mov ecx, dword [0x140067934]
cmp ecx, esi
je 0x140005aa9
test ecx, ecx
mov eax, r13d
cmove eax, esi
test eax, eax
je case.0x14000528e.76
call fcn.140011500
jmp case.0x14000528e.76
cmp dword [0x14006983c], r13d
jne 0x140005ac9
cmp dword [0x140069838], r13d
je case.0x14000528e.76
mov edx, 1
xor ecx, ecx
call fcn.14001ec80
test eax, eax
je case.0x14000528e.76
cmp dword [0x140067ad0], r13d
je 0x140005b23
cmp dword [0x140067978], r13d
je 0x140005b23
cmp dword [0x140067974], r13d
je 0x140005b23
cmp dword [0x140067ae8], r13d
je 0x140005b23
cmp dword [0x140067adc], r13d
je 0x140005b1c
cmp dword [0x1400693bc], r13d
jne 0x140005b1c
cmp dword [0x1400693b8], r13d
je 0x140005b23
mov edx, 1
jmp 0x140005b26
mov edx, r13d
mov ecx, dword [0x140067acc]
mov r8d, 1
call fcn.1400201d0
jmp case.0x14000528e.76
cmp edi, esi
jne 0x140005c4d
cmp dword [0x140069240], r13d
je 0x140005d6c
cmp dword [0x140069228], r13d
je 0x140005c03
mov rax, qword [0x14006aee0]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140005d6c
lea rax, [rsp + 0x40]
mov dword [rsp + 0x54], 0x60078
lea r9, [rbp - 0x64]
mov qword [rsp + 0x20], rax
mov r8d, 4
mov dword [rsp + 0x40], 4
lea rdx, [rsp + 0x54]
mov ecx, 0x53545344
call fcn.1400064c0
test eax, eax
je 0x140005d6c
cmp dword [rsp + 0x40], 4
mov eax, r13d
cmovae eax, dword [rbp - 0x64]
bt eax, 0x10
jae 0x140005d6c
movzx ebx, ax
mov ecx, ebx
call fcn.14000be70
mov edx, ebx
lea rcx, str.CameraShutter
call fcn.140027c20
cmp dword [0x14006922c], r13d
je 0x140005d6c
mov rcx, qword [0x14006ae00]
test rcx, rcx
je 0x140005d6c
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x140005d6c
cmp dword [0x14006921c], r13d
jne 0x140005d6c
xor ecx, ecx
call fcn.14000be70
xor edx, edx
lea rcx, str.CameraShutter
call fcn.140027c20
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x140069238]
mov qword [0x140069230], rax
test rcx, rcx
je 0x140005d25
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x140005d6c
cmp edi, 3
jne 0x140005d53
cmp dword [0x140069240], r13d
je 0x140005d6c
cmp dword [0x140069228], r13d
je 0x140005d08
mov rax, qword [0x14006aee0]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140005d6c
lea rax, [rsp + 0x44]
mov dword [rsp + 0x58], 0x60078
lea r9, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 1]
mov dword [rsp + 0x44], 4
lea rdx, [rsp + 0x58]
mov ecx, 0x53545344
call fcn.1400064c0
test eax, eax
je 0x140005d6c
cmp dword [rsp + 0x44], 4
mov eax, r13d
cmovae eax, dword [rbp - 0x60]
bt eax, 0x10
jae 0x140005d6c
movzx ebx, ax
mov ecx, ebx
call fcn.14000be70
mov edx, ebx
lea rcx, str.CameraShutter
call fcn.140027c20
cmp dword [0x14006922c], r13d
je 0x140005d6c
mov rcx, qword [0x14006ae00]
test rcx, rcx
je 0x140005d6c
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x140005d6c
cmp dword [0x14006921c], r13d
jne 0x140005d6c
mov ecx, 1
call fcn.14000be70
mov edx, 1
jmp 0x140005c19
mov qword [rsp + 0x28], r13
lea r8, [0x14000c180]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x140005d6c
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x140005d6c
test edi, edi
lea r9, [rsp + 0x34]
mov edx, r13d
lea r8, [rsp + 0x30]
sete dl
mov ecx, esi
call fcn.14000bec0
test r12d, r12d
je case.0x14000528e.76
mov edx, 1
mov qword [rbp - 0x70], r13
lea rcx, [rbp - 0x70]
call fcn.140027750
test eax, eax
je case.0x14000528e.76
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x4c]
lea rax, [rbp - 0x58]
mov dword [rbp - 0x5c], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.PhysicalKey
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140005dfc
mov eax, dword [rbp - 0x58]
test al, 1
jne 0x140005dfc
mov rcx, qword [rbp - 0x70]
lea rdx, str.PhysicalKey
or eax, 1
mov dword [rsp + 0x28], 4
mov dword [rbp - 0x54], eax
mov r9d, 4
lea rax, [rbp - 0x54]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp case.0x14000528e.76
cmp edi, esi
jne 0x140005e44
cmp qword [0x14006ade8], r13
je case.0x14000528e.76
xor edx, edx
lea rcx, str.ArrowKeySwitch
call fcn.140027c20
test eax, eax
je case.0x14000528e.76
mov rcx, qword [0x14006ade8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp case.0x14000528e.76
cmp edi, 3
jne 0x140005e7f
cmp qword [0x14006ade8], r13
je case.0x14000528e.76
lea edx, [rdi - 2]
lea rcx, str.ArrowKeySwitch
call fcn.140027c20
test eax, eax
je case.0x14000528e.76
mov rcx, qword [0x14006ade8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp case.0x14000528e.76
cmp qword [0x14006ade8], r13
je case.0x14000528e.76
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], r13d
call fcn.14002dd10
cmp dword [rsp + 0x48], r13d
lea rcx, str.ArrowKeySwitch
mov ebx, r13d
sete bl
mov edx, ebx
call fcn.140027c20
test eax, eax
je 0x140005ec5
mov rcx, qword [0x14006ade8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
test edi, edi
jne case.0x14000528e.76
mov dword [rsp + 0x30], 0x4b
mov dword [rsp + 0x34], ebx
jmp case.0x14000528e.76
cmp dword [0x14006a72c], r13d
je case.0x14000528e.76
call fcn.14002dfe0
test eax, eax
lea rcx, str.FnSwitch
mov esi, r13d
sete sil
mov edx, esi
call fcn.140027c20
mov ecx, esi
call fcn.14002dde0
movdqa xmm0, xmmword [0x14005e050]
mov ecx, dword [0x14006a72c]
mov dword [0x1400679f0], esi
mov qword [rsp + 0x70], 0xffffffffffffffff
mov qword [rsp + 0x78], 0xffffffffffffffff
mov qword [rbp - 0x80], 0xffffffffffffffff
mov qword [rbp - 0x78], 0xffffffffffffffff
movdqu xmmword [rsp + 0x60], xmm0
test ecx, ecx
je 0x140005f5a
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x64], esi
test ecx, ecx
lea r8, [rsp + 0x60]
mov edx, r13d
sete dl
xor r9d, r9d
call fcn.140007850
mov r14d, dword [0x7ffe02d8]
cmp r14d, 0xffffffff
je 0x140005fcb
mov edx, dword [0x14006b2a0]
mov ebx, r13d
test edx, edx
je 0x140005fcb
lea r13, [0x140000000]
mov eax, ebx
lea rcx, [rax*8 + 0x6b220]
mov rax, qword [rcx + r13]
cmp dword [rax], r14d
jne 0x140005fc2
cmp qword [rax + 8], 0
je 0x140005fc2
mov dword [rax + 0x20], esi
mov rcx, qword [rcx + r13]
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov edx, dword [0x14006b2a0]
inc ebx
cmp ebx, edx
jb 0x140005f91
xor r13d, r13d
test edi, edi
jne case.0x14000528e.76
mov dword [rsp + 0x30], 0x4e
mov dword [rsp + 0x34], esi
jmp case.0x14000528e.76
mov rax, qword [0x14006aee0]
dec rax
cmp rax, 0xfffffffffffffffd
ja case.0x14000528e.76
lea rax, [rsp + 0x4c]
mov dword [rsp + 0x5c], 0x10
lea r9, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r8d, 4
mov dword [rsp + 0x4c], 4
lea rdx, [rsp + 0x5c]
mov ecx, 0x474f4457
call fcn.1400064c0
test eax, eax
je case.0x14000528e.76
cmp dword [rsp + 0x4c], 4
mov ecx, r13d
cmovae ecx, dword [rbp - 0x50]
mov edx, ecx
mov eax, ecx
and edx, 0x7fff
and eax, 0x8000
cmove edx, ecx
lea eax, [rdx - 3]
cmp eax, 0x129
ja 0x140006071
imul eax, edx, 0x3e8
mov dword [0x14006a9c4], 1
mov dword [0x140067a14], eax
mov rax, qword [0x14006acf8]
test rax, rax
je 0x1400060c8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [0x14006ad08]
test rcx, rcx
je 0x1400060b1
mov edx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x14006ad08]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14006ad08], r13
mov rcx, qword [0x14006acf8]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, r13
mov qword [0x14006acf8], rax
cmp dword [0x14006a9c4], r13d
je case.0x14000528e.76
test rax, rax
jne case.0x14000528e.76
xor r9d, r9d
lea edx, [rax + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [0x14006acf8], rax
test rax, rax
je case.0x14000528e.76
cmp qword [0x14006ad08], r13
jne case.0x14000528e.76
mov qword [rsp + 0x28], r13
lea r8, [0x140031ec0]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x14006ad08], rax
jmp case.0x14000528e.76
xor edx, edx
lea rcx, str.NKeyRollover
call fcn.140027c20
test eax, eax
je case.0x14000528e.76
jmp 0x140006164
mov edx, 1
lea rcx, str.NKeyRollover
call fcn.140027c20
test eax, eax
je case.0x14000528e.76
mov dword [rsp + 0x34], 1
mov rcx, qword [0x14006ade0]
mov dword [rsp + 0x30], 0xab
test rcx, rcx
je case.0x14000528e.76
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp case.0x14000528e.76
call fcn.14000e9f0
jmp case.0x14000528e.76
mov dword [rsp + 0x30], 0xc9
mov r14, qword [rsp + 0x810]
cmp dword [0x140069c68], 0
mov rsi, qword [rsp + 0x818]
mov rbx, qword [rsp + 0x860]
jne 0x1400061ba
cmp r15d, 0x35
jne 0x1400062cb
mov ecx, dword [0x1400679b4]
cmp ecx, 2
jne 0x1400061d9
call fcn.140031460
mov ecx, r13d
cmp eax, 0xffffffff
sete cl
mov dword [0x1400679b4], ecx
cmp ecx, 1
jne 0x1400062cb
cmp r15d, 0x35
jne 0x14000629f
cmp dword [0x140067974], 0
mov eax, dword [0x1400691a8]
je 0x14000626d
test eax, eax
je 0x14000625d
mov rcx, qword [0x140069e98]
test rcx, rcx
je 0x140006216
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
jmp 0x14000629f
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea r8, [0x140022810]
mov qword [0x140069e98], rax
xor edx, edx
mov dword [rsp + 0x20], r13d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14000629f
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x14000629f
mov ecx, dword [0x7ffe02d8]
cmp ecx, 0xffffffff
je 0x14000629f
xor edx, edx
jmp 0x140006294
test eax, eax
je 0x140006283
mov rcx, qword [0x140069e98]
test rcx, rcx
je 0x140006283
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov ecx, dword [0x7ffe02d8]
cmp ecx, 0xffffffff
je 0x14000629f
mov edx, 2
xor r9d, r9d
xor r8d, r8d
call fcn.140030410
cmp dword [0x140069c68], 0
je 0x1400062cb
mov rax, qword [0x14006a9c8]
test rax, rax
je 0x1400062cb
mov edx, dword [0x14006a9c0]
test edx, edx
je 0x1400062cb
mov r8, r15
xor r9d, r9d
mov ecx, 0xffff
call rax
mov eax, dword [rsp + 0x34]
mov r8d, edi
mov r9d, dword [rsp + 0x30]
mov edx, r15d
mov qword [rsp + 0x28], r13
mov ecx, 0x81
mov dword [rsp + 0x20], eax
call fcn.14001c210
mov edx, r12d
mov ecx, r15d
call fcn.14000ae40
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.140032e60
add rsp, 0x820
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret