Function at 0x1400a42f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x3e0], rbx
mov rdi, rdx
mov r15, rcx
movzx ebx, byte [rsp + 0x410]
movzx r13d, bl
and r13b, 0xc0
and bl, 0xf
mov byte [rsp + 0x410], bl
mov rbp, qword [rsp + 0x420]
xor r12d, r12d
cmp dword [rbp + 0x10], r12d
je 0x1400a435e
test rdx, rdx
je 0x1400a435e
mov r14, qword [rdx + 0x20]
test r14, r14
jne 0x1400a4365
jmp 0x1400a4361
mov r14, r12
mov dword [rbp + 0x10], r12d
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov eax, 0xb4
cmp esi, eax
cmovg esi, eax
mov dword [rsp + 0x420], esi
cmp r13b, 0x80
jne 0x1400a44c6
lea rbp, [0x14019cae8]
mov qword [rsp + 0x420], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov dword [rsp + 0x50], r12d
xor edx, edx
mov r8d, 0x34c
lea rcx, [rsp + 0x54]
call fcn.14010c6c0
mov dword [rsp + 0x2c4], esi
mov eax, dword [rsp + 0x400]
mov dword [rsp + 0x2ec], eax
mov edi, dword [rsp + 0x408]
mov dword [rsp + 0x130], edi
mov byte [rsp + 0x2d8], bl
mov rdx, qword [rsp + 0x3f0]
mov qword [rsp + 0x2d0], rdx
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x2e0], rax
movsxd rbx, esi
lea r8, [rbx + rbx]
mov rdx, qword [rsp + 0x3f8]
lea rcx, [rsp + 0x134]
call fcn.14010cd30
mov word [rsp + rbx*2 + 0x134], r12w
lea rax, [0x14019c678]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
lea r9, [rsp + 0x50]
lea r8, [0x1400a3a20]
mov edx, 0x20000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
je 0x1400a44a0
mov ebx, 0x270f
cmp dword [rsp + 0x130], edi
jne 0x1400a4497
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x1400a4464
cmp dword [rsp + 0x130], edi
jne 0x1400a4497
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x130], edi
je 0x1400a4483
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.__LastTID
mov edx, dword [0x14019c678]
mov rcx, r15
call fcn.140065eb0
nop
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x1400a4714
mov r15, r14
test r14, r14
jne 0x1400a44d7
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r15, rax
cmp r13b, 0x40
je 0x1400a44ed
test rdi, rdi
je 0x1400a44ed
mov rax, qword [rdi + 0x20]
test rax, rax
cmovne r15, rax
mov qword [rsp + 0x30], r12
mov ecx, 0x348
call fcn.1400cf938
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400a451c
mov r8d, 0x2720
mov rdx, r15
mov rcx, rax
call fcn.1400185b0
mov rsi, rax
jmp 0x1400a451f
mov rsi, r12
mov eax, dword [rsp + 0x420]
mov dword [rsi + 0x274], eax
mov eax, dword [rsp + 0x400]
mov dword [rsi + 0x29c], eax
mov rdx, qword [rsp + 0x3f0]
lea rcx, [rsi + 0x278]
call fcn.140071360
mov r11d, dword [rsp + 0x408]
mov dword [rsi + 0xe0], r11d
mov al, byte [rsp + 0x410]
mov byte [rsi + 0x288], al
mov rax, qword [rsi + 0x278]
mov qword [rsi + 0x280], rax
mov rax, qword [rsp + 0x418]
mov qword [rsi + 0x290], rax
movsxd rbx, dword [rsp + 0x420]
lea r8, [rbx + rbx]
lea rcx, [rsi + 0xe4]
mov rdx, qword [rsp + 0x3f8]
call fcn.14010cd30
mov word [rsi + rbx*2 + 0xe4], r12w
test rdi, rdi
je 0x1400a45d4
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rdi + 0x140]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call fcn.14010868c
test rdi, rdi
je 0x1400a45eb
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.USER32.dll_SetFocus]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x1400a4600
lea rcx, [rsi + 0xa8]
call fcn.140071360
mov byte [rsi + 0xa1], 0
mov qword [rsi + 0xd0], r14
mov byte [rsi + 0xa0], 0
cmp r13b, 0xc0
jne 0x1400a464d
mov qword [rsi + 0x70], rdi
test rdi, rdi
je 0x1400a4644
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rdi + 0x140]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsi + 0xa0], 1
jmp 0x1400a4654
mov byte [rsi + 0xa0], 0x10
test rdi, rdi
je 0x1400a466c
cmp dword [rbp + 0x10], 0
je 0x1400a466c
mov rax, qword [rdi + 0x20]
mov qword [rsi + 0xd0], rax
jmp 0x1400a4670
mov dword [rbp + 0x10], r12d
and dword [rbp + 0x14], 0xfffffff3
and dword [rbp + 0x10], 0xfffffff3
mov r9, rbp
mov r8, r15
xor edx, edx
mov rcx, rsi
call fcn.14005dd90
cmp r13b, 0x40
jne 0x1400a46a1
xor edx, edx
mov rcx, rsi
call fcn.140070a00
mov r12d, dword [rsi + 0x2a0]
jmp 0x1400a46cd
cmp r13b, 0xc0
jne 0x1400a46be
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400a46cd
mov rcx, rsi
call fcn.140070c00
mov r12d, dword [rsi + 0x2a0]
test rdi, rdi
je 0x1400a4711
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [rdi + 0x140]
cmp byte [rdi + 0xa1], 0x81
je 0x1400a4703
xor r9d, r9d
xor r8d, r8d
mov edx, 0x43d
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.USER32.dll_PostMessageW]
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov eax, r12d
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret