Function at 0x140081574
Capabilities:
Create thread
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor eax, eax
mov r12, rcx
xor r13d, r13d
mov dword [r11 - 0x70], r13d
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
lea rcx, [r11 + 0x20]
lea rdx, [r11 - 0x70]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov rsi, r8
call fcn.14007fcd4
movsx r10d, al
mov rax, qword [rsp + 0xf8]
movzx r8d, word [rax]
mov dword [rsp + 0x78], r10d
cmp r8w, r13w
je 0x1400815e7
mov r9w, word [rax + 2]
jmp 0x1400815ea
mov r9d, r13d
mov ebx, 0x2b
lea r11d, [rbx - 0x29]
cmp r8w, 0x2a
je 0x140081607
cmp r8w, 0x2d
je 0x140081607
cmp bx, r8w
jne 0x140081612
add rax, r11
mov qword [rsp + 0xf8], rax
cmp r8w, word [rax]
jne 0x140081629
add rax, r11
cmp r8w, word [rax]
je 0x140081618
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0xf8]
call fcn.14005b154
lea rcx, [rsp + 0xe8]
call fcn.14005b154
mov r15, r13
cmp r10d, r13d
je 0x14008165f
cmp rsi, r13
je 0x14008165f
cmp byte [rsi + 0x121], r13b
jne 0x14008165f
mov r15, qword [rsi + 0x20]
jmp 0x140081664
mov dword [rsp + 0x78], r13d
test byte [rsp + 0x78], r11b
mov rax, r13
mov r14d, r13d
cmovne rax, r15
mov qword [rsp + 0x58], rax
cmp r8w, 0x2a
jne 0x1400818f7
mov ecx, 0xa98
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
call fcn.140102d68
mov ebp, 0x271b
mov rbx, rax
cmp rax, r13
je 0x1400816d4
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.1400731d8
mov rbx, rax
jmp 0x1400816d7
mov rbx, r13
mov ecx, 0xf0
call fcn.140102d68
mov r13, rax
xor eax, eax
cmp r13, rax
je 0x140081707
mov rdx, r12
mov rcx, r13
call fcn.140017cdc
mov rdx, r12
mov rcx, r13
call fcn.1400186bc
mov qword [r13 + 0x40], rbx
jmp 0x14008170a
mov r13, rax
mov eax, dword [rsp + 0x100]
mov rdi, qword [rsp + 0xf8]
xor r8d, r8d
mov rcx, r13
mov rdx, rdi
mov byte [r13 + 0xd9], 3
mov dword [r13 + 0x24], eax
call fcn.140073ccc
mov rax, qword [rsp + 0xe8]
mov edx, 1
mov rcx, rbx
mov qword [rbx + 0x2a0], rax
mov qword [rbx + 0x150], r15
mov qword [rbx + 0x290], r13
call fcn.14007fe3c
lea rcx, [rsp + 0x88]
mov rdx, rdi
call fcn.1400702b0
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.14007443c
lea rcx, [rbx + 0x128]
mov rdx, rax
call fcn.14007034c
lea rcx, [rsp + 0x88]
call fcn.14005b104
xor r15d, r15d
cmp rdi, r15
je 0x1400817b9
cmp byte [rbx + 0x121], r15b
je 0x1400817c9
lea rcx, [rbx + 0x160]
mov rdx, rdi
call fcn.14007034c
cmp byte [rbx + 0x121], r15b
je 0x1400817c9
mov edi, 0x271c
jmp 0x1400817ea
cmp byte [rbx + 0x15a], r15b
je 0x1400817d9
mov edi, 0x271d
jmp 0x1400817ea
cmp byte [rbx + 0x159], r15b
mov edi, 0x271c
cmovne ebp, edi
mov edi, ebp
mov rcx, rbx
call fcn.140053e78
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x48]
call fcn.14005b77c
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, r15
je 0x14008182c
mov rax, qword [rsp + 0x48]
cmp byte [rax + 0x121], r15b
je 0x14008182c
mov eax, 2
cmp dword [r12 + 0x20], eax
cmovle r14d, eax
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x68]
mov edx, edi
mov rcx, rbx
call fcn.14005e3ac
mov rdx, qword [rbx + 0x20]
lea r9, [0x14011c730]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.1400668ec
xor edx, edx
mov rcx, rbx
call fcn.1400e91f0
lea rcx, [0x14013e190]
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x14013e190]
mov qword [r13 + 0x40], r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rcx, r13
call fcn.14004eaa8
lea rcx, [r13 + 0x70]
call fcn.14005b104
mov rcx, r13
call fcn.140102b7c
mov r11, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r11 + 0x18]
mov r11, qword [rsp + 0x50]
cmp r11, r15
je 0x1400818d4
mov rcx, qword [rsp + 0x50]
mov r8d, r14d
xor r9d, r9d
or r8, 1
mov edx, 0x451
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14d, dword [rsp + 0x48]
movsxd rax, r14d
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r8w, 0x2d
jne 0x140081b03
mov ecx, 0xa98
call fcn.140102d68
mov ebp, 0x271b
mov rbx, rax
cmp rax, r13
je 0x140081949
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.1400731d8
mov rbx, rax
jmp 0x14008194c
mov rbx, r13
mov ecx, 0xf0
call fcn.140102d68
mov rdi, rax
cmp rax, r13
je 0x14008197a
mov rdx, r12
mov rcx, rax
call fcn.140017cdc
mov rdx, r12
mov rcx, rdi
call fcn.1400186bc
mov qword [rdi + 0x40], rbx
jmp 0x14008197d
mov rdi, r13
mov eax, dword [rsp + 0x100]
mov r13, qword [rsp + 0xf8]
xor r8d, r8d
mov rcx, rdi
mov rdx, r13
mov byte [rdi + 0xd9], 3
mov dword [rdi + 0x24], eax
call fcn.140073ccc
mov rax, qword [rsp + 0xe8]
mov edx, 1
mov rcx, rbx
mov qword [rbx + 0x2a0], rax
mov qword [rbx + 0x150], r15
mov qword [rbx + 0x290], rdi
call fcn.14007fe3c
mov r11, qword [rbx + 0x290]
lea rcx, [rsp + 0x90]
mov rdx, r13
mov qword [rbx + 0x288], r11
call fcn.1400702b0
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.14007443c
lea rcx, [rbx + 0x128]
mov rdx, rax
call fcn.14007034c
lea rcx, [rsp + 0x90]
call fcn.14005b104
mov rdx, qword [rsp + 0x80]
xor r15d, r15d
cmp rdx, r15
je 0x140081a34
lea rcx, [rbx + 0x128]
call fcn.1400703e4
cmp r13, r15
je 0x140081a51
cmp byte [rbx + 0x121], r15b
je 0x140081a5a
lea rcx, [rbx + 0x160]
mov rdx, r13
call fcn.14007034c
cmp byte [rbx + 0x121], r15b
jne 0x140081a73
cmp byte [rbx + 0x159], r15b
jne 0x140081a73
cmp byte [rbx + 0x15a], r15b
je 0x140081a78
mov ebp, 0x271d
jmp 0x140081a78
mov ebp, 0x271c
mov rcx, rbx
call fcn.140053e78
mov qword [rbx + 0xd8], rsi
mov byte [rbx + 0x120], 1
cmp rsi, r15
je 0x140081abb
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rsi + 0x1c8]
lea rcx, [0x14013e190]
mov byte [rbx + 0x120], 9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x68]
mov edx, ebp
mov rcx, rbx
call fcn.14005e3ac
mov rdx, qword [rbx + 0x20]
lea r9, [0x14011c730]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.1400668ec
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400818d9
mov rax, qword [rsp + 0xf8]
mov ebp, r13d
cmp bx, word [rax - 2]
mov qword [rsp + 0x50], rax
mov rax, rsi
sete dil
cmp r9w, r8w
sete bpl
cmp dil, r13b
cmovne rax, r13
mov qword [rsp + 0x58], rax
cmp dil, r13b
jne 0x140081b59
cmp rsi, r13
jne 0x140081b59
xor edx, edx
mov rcx, r12
call fcn.14001b3a0
cmp qword [r12 + 0x40], r13
jne 0x140081b59
mov rax, 0xffffffff80070057
jmp 0x1400818dc
lea rcx, [rsp + 0x60]
mov edx, 0xa8
call fcn.1400633a8
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.14005b0b8
lea rax, [rsp + 0x40]
lea r8, [0x140080cfc]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov edx, 0x400000
xor ecx, ecx
lea rsi, [rbx + 0x78]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r13, rax
xor eax, eax
cmp r13, rax
je 0x140081cde
lea rdx, [rsp + 0x68]
lea r8d, [rax + 0x20]
mov rcx, rsi
mov qword [rsp + 0x60], rax
call fcn.1401036e0
mov rcx, qword [rsp + 0xe8]
mov rax, qword [rsp + 0x50]
mov qword [rbx], r12
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rax
xor eax, eax
movsxd rcx, ebp
or rcx, 4
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x20], rax
movsxd rax, dword [rsp + 0x100]
mov qword [rbx + 0x28], rax
mov eax, dword [rsp + 0x40]
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x48], r15
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.14005b77c
xor r15d, r15d
mov qword [rbx + 0x50], rax
cmp dil, r15b
jne 0x140081c4f
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x14013d7e8]
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, r15
cmp ebp, r15d
jne 0x140081c70
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rbx + 0x60], rax
mov rsi, r15
cmp ebp, r15d
jne 0x140081c91
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
mov qword [rbx + 0x68], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, r15d
jne 0x140081ce6
cmp rdi, r15
je 0x140081cc2
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rbx + 0x30]
mov qword [rbx + 0x70], 1
cmp rsi, r15
je 0x140081ce6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x140081ce6
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov edx, dword [rsp + 0x40]
lea r8, str.__LastTID
mov rcx, r12
call fcn.140066978
lea r9, [0x14011c730]
lea r8, str.__LastWinID
mov rdx, r14
mov rcx, r12
call fcn.1400668ec
lea rcx, [rsp + 0x60]
call fcn.14005b104
mov r14d, r15d
jmp 0x1400818d9