Function at 0x180010a00
Capabilities:
Create thread
Enumerate gui resources
Link many functions at runtime

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, qword [0x1800760c0]
xor rax, rsp
mov qword [rbp + 0x150], rax
test edx, edx
je 0x180011490
cmp edx, 1
je 0x180010a3a
mov eax, 1
jmp 0x180011473
mov qword [rsp + 0x2a0], rbx
mov qword [rsp + 0x2a8], rdi
movaps xmmword [rsp + 0x270], xmm6
movaps xmmword [rsp + 0x260], xmm7
call fcn.18000d910
call fcn.180008280
call fcn.180008280
mov qword [0x1800b9b28], rax
call fcn.180008280
movsd xmm7, qword [0x180069608]
lea rdi, [0x180079a40]
movsd xmm6, qword [0x180069590]
xor esi, esi
mov ebx, esi
mov qword [0x1800b9ba8], rax
nop word [rax + rax]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm7
subsd xmm0, xmm6
call fcn.1800547bc
xorps xmm1, xmm1
inc ebx
cvtsd2ss xmm1, xmm0
movss dword [rdi], xmm1
add rdi, 4
cmp ebx, 0x10000
jl 0x180010aa0
movaps xmm7, xmmword [rsp + 0x260]
movsd xmm0, qword [0x180069728]
mov qword [rsp + 0x2b0], r14
mov qword [rsp + 0x280], r15
call fcn.1800547bc
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
xorps xmm0, xmm0
movss dword [0x180079a40], xmm1
call fcn.1800547bc
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm6
movss dword [0x180099a3c], xmm1
call fcn.1800547bc
xorps xmm1, xmm1
mov qword [rbp + 0x30], rsi
cvtsd2ss xmm1, xmm0
lea rdx, [rbp + 0x30]
lea rcx, [0x180028360]
movss dword [0x1800b9a3c], xmm1
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbp + 0x30]
movaps xmm6, xmmword [rsp + 0x270]
test rcx, rcx
je 0x18001148c
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x40], eax
test eax, eax
je 0x18001148c
mov qword [rsp + 0x28], rsi
lea r9, [rbp + 0x40]
lea r8, [0x18000c0a0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18001148c
mov qword [rsp + 0x28], rsi
lea r9, [rbp + 0x40]
lea r8, [0x18000c170]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18001148c
movabs rax, 0xe0a8d0b1587c1030
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movabs r15, 0x8486e282074e6367
mov rax, qword [rsp + 0x30]
movabs r14, 0xcb72d73b4da38ccc
mov qword [rsp + 0x50], rax
movabs rax, 0xcb72d73b4da3e0a0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rbp + 0x58], rax
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
lea rcx, [rsp + 0x60]
movabs rax, 0xb6b5aec5692b1328
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0xcb72d73b21cfe8e2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rbp + 0x68], rax
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rdi, rdi
je 0x18001148c
test rax, rax
je 0x18001148c
movabs rax, 0x848696e162220614
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x70], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x78], rax
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180079a20], rax
lea rdx, [rsp + 0x70]
movabs rax, 0x84e28ce7540f3030
mov rcx, rdi
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp + 0x88], rax
xorps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rsp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
inc qword [0x180079a20]
lea rdx, [rbp - 0x80]
mov qword [0x1800b9b18], rax
mov rcx, rbx
movabs rax, 0xc6f683f554220410
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0xcb72a44928c5eab9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x90], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x80]
mov qword [rbp + 0x98], rax
xorps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rbp - 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9b40], rax
movabs rdi, 0xcb72d73b4da38caa
movabs rax, 0xe1f283f6681c0f00
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x30], rax
mov rcx, rbx
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xa0], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x70]
mov qword [rbp + 0xa8], rax
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp - 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9ad8], rax
lea rdx, [rbp - 0x60]
movabs rax, 0x848684e568080f00
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xb0], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rbp + 0xb8], rax
xorps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp - 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9a78], rax
lea rdx, [rbp - 0x50]
movabs rax, 0x84868be568080f00
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xc0], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x50]
mov qword [rbp + 0xc8], rax
xorps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9a98], rax
lea rdx, [rbp - 0x40]
movabs rax, 0x84f084e568080f00
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp + 0xd8], rax
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp - 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9b58], rax
lea rdx, [rbp - 0x30]
movabs rax, 0xe5cb96ee72030f00
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x30], rax
movabs rax, 0xcb72d75d35cafeb8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xe0], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rbp + 0xe8], rax
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp - 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9b98], rax
lea rdx, [rbp - 0x20]
movabs rax, 0xb0f48dee680d0f00
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0xf0], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp + 0xf8], rax
xorps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9af8], rax
lea rdx, [rbp - 0x10]
movabs rax, 0xc2e78af26b0f0f00
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x10], rax
movabs rax, 0xcb72d73b4dc0e2b9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 8], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x100], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x10]
mov qword [rbp + 0x108], rax
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp - 0x10], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9ab0], rax
lea rdx, [rbp]
movabs rax, 0xc9ee96f2620a0f00
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp], rax
movabs rax, 0xcb72d73b4dc8ffad
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 8], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x110], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp]
mov qword [rbp + 0x118], rax
xorps xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rbp], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9b08], rax
movabs rax, 0xe5cb8af1721e0f00
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x10], rax
movabs rax, 0xcb72d73b35cafeb8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x18], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x120], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x128], rax
xorps xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rbp + 0x10], xmm0
lea rdx, [rbp + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9a48], rax
lea rdx, [rbp + 0x20]
movabs rax, 0xf0e7aff2681e0f00
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x20], rax
movabs rax, 0xcb72d73b4ddbe5be
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x130], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x138], rax
xorps xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rbp + 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9b68], rax
lea rdx, [rsp + 0x40]
movabs rax, 0xc7f483e76b0d0f00
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0xcb72d73b3fcce0a3
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x140], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rbp + 0x148], rax
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800b9b30], rax
call fcn.18002c1e0
call fcn.18002b440
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18002b970
lea rdx, [0x18000d490]
lea rcx, [0x180079a20]
call fcn.18002aa20
lea rdx, [0x18000d740]
lea rcx, [0x1800b9b18]
call fcn.18002aa20
lea rdx, [0x18000c240]
lea rcx, [0x1800b9b40]
call fcn.18002aa20
lea rdx, [0x18000c9b0]
lea rcx, [0x1800b9ad8]
call fcn.18002aa20
lea rdx, [0x18000c860]
lea rcx, [0x1800b9a78]
call fcn.18002aa20
lea rdx, [0x18000c6b0]
lea rcx, [0x1800b9a98]
call fcn.18002aa20
lea rdx, [0x18000c610]
lea rcx, [0x1800b9b58]
call fcn.18002aa20
lea rdx, [0x18000d460]
lea rcx, [0x1800b9b98]
call fcn.18002aa20
lea rdx, [0x18000c6e0]
lea rcx, [0x1800b9af8]
call fcn.18002aa20
lea rdx, [0x18000c8e0]
lea rcx, [0x1800b9ab0]
call fcn.18002aa20
lea rdx, [0x18000c870]
lea rcx, [0x1800b9b08]
call fcn.18002aa20
lea rdx, [0x18000c980]
lea rcx, [0x1800b9a48]
call fcn.18002aa20
lea rdx, [0x18000c9a0]
lea rcx, [0x1800b9b68]
call fcn.18002aa20
lea rdx, [0x18000c8b0]
lea rcx, [0x1800b9b30]
call fcn.18002aa20
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x180010890]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.18002b4c0
test eax, eax
sete sil
mov eax, esi
mov r14, qword [rsp + 0x2b0]
mov r15, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.18002e950
add rsp, 0x288
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x180011453
mov rcx, qword [0x1800b9aa0]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, qword [0x1800b9a68]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.18002b440
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18002b970
lea rdx, [0x18000d490]
lea rcx, [0x180079a20]
call fcn.18002b0a0
lea rdx, [0x18000d740]
lea rcx, [0x1800b9b18]
call fcn.18002b0a0
lea rdx, [0x18000c240]
lea rcx, [0x1800b9b40]
call fcn.18002b0a0
lea rdx, [0x18000c9b0]
lea rcx, [0x1800b9ad8]
call fcn.18002b0a0
lea rdx, [0x18000c860]
lea rcx, [0x1800b9a78]
call fcn.18002b0a0
lea rdx, [0x18000c6b0]
lea rcx, [0x1800b9a98]
call fcn.18002b0a0
lea rdx, [0x18000c610]
lea rcx, [0x1800b9b58]
call fcn.18002b0a0
lea rdx, [0x18000d460]
lea rcx, [0x1800b9b98]
call fcn.18002b0a0
lea rdx, [0x18000c6e0]
lea rcx, [0x1800b9af8]
call fcn.18002b0a0
lea rdx, [0x18000c8e0]
lea rcx, [0x1800b9ab0]
call fcn.18002b0a0
lea rdx, [0x18000c870]
lea rcx, [0x1800b9b08]
call fcn.18002b0a0
lea rdx, [0x18000c980]
lea rcx, [0x1800b9a48]
call fcn.18002b0a0
lea rdx, [0x18000c9a0]
lea rcx, [0x1800b9b68]
call fcn.18002b0a0
lea rdx, [0x18000c8b0]
lea rcx, [0x1800b9b30]
call fcn.18002b0a0
call fcn.18002b4c0
xor esi, esi
test eax, eax
sete sil
mov eax, esi
jmp 0x180011473