Function at 0x1400a3de0
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov edi, r9d
mov r13, r8
mov rbx, rdx
mov esi, ecx
lea rbp, [0x14019cae8]
mov qword [rsp + 0x50], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
movzx ecx, byte [rsp + 0x108]
movzx eax, cl
and al, 0xc0
mov byte [rsp + 0xf8], al
and cl, 0xf
mov byte [rsp + 0x108], cl
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x70], edi
mov r15d, dword [rsp + 0x100]
mov dword [rsp + 0x74], r15d
mov byte [rsp + 0x78], cl
mov dword [rsp + 0x7c], 1
xor r12d, r12d
mov qword [rsp + 0x80], r12
lea rax, [0x14019c678]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
lea r9, [rsp + 0x58]
lea r8, [0x1400a3ce0]
mov edx, 0x20000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400a3ec1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x1400a42ce
mov ebx, 0x270f
mov eax, dword [rsp + 0x7c]
test eax, eax
je 0x1400a3edb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x1400a3ec6
mov eax, dword [rsp + 0x7c]
test eax, eax
je 0x1400a3ef8
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11d, dword [rsp + 0x7c]
test r11d, r11d
jne 0x1400a3ee3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r14, str.32770
mov rdi, r12
mov rbp, r12
cmp esi, 2
jne 0x1400a3f21
lea r13, [0x1401525a8]
mov r14, r12
lea rbp, [0x140152598]
mov dword [rsp + 0xe8], r12d
xor bl, bl
mov byte [rsp + 0x100], bl
movzx eax, byte [0x14019c661]
test al, 4
jne 0x1400a3f60
mov bl, 1
mov byte [rsp + 0x100], bl
or al, 4
mov byte [0x14019c661], al
mov edx, 2
lea rcx, str.SeDebugPrivilege
call fcn.14002e788
nop
mov esi, 0xa
sub esi, 1
js 0x1400a3fa7
mov rdx, r13
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
jne 0x1400a3fa7
test rbp, rbp
je 0x1400a3f97
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
jne 0x1400a3fa7
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rdi, rdi
je 0x1400a3f65
mov esi, 0xa
test rdi, rdi
jne 0x1400a401a
sub esi, 1
js 0x1400a3ff3
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
jne 0x1400a401a
test rbp, rbp
je 0x1400a3fe1
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
jne 0x1400a401a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rdi, rdi
je 0x1400a3fb1
jmp 0x1400a401a
test rdi, rdi
jne 0x1400a401a
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.140081880
mov rdi, rax
mov r12d, 0x5a
mov esi, r12d
test rdi, rdi
jne 0x1400a406a
sub esi, 1
js 0x1400a406a
mov rdx, r13
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
jne 0x1400a406a
test rbp, rbp
je 0x1400a405a
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
jne 0x1400a406a
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rdi, rdi
je 0x1400a4028
test rdi, rdi
jne 0x1400a40b1
nop
sub r12d, 1
js 0x1400a40b1
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
jne 0x1400a40b1
test rbp, rbp
je 0x1400a40a1
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
jne 0x1400a40b1
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rdi, rdi
je 0x1400a4070
mov ebp, dword [rsp + 0xe0]
cmp ebp, 2
jne 0x1400a40d8
test rdi, rdi
je 0x1400a40e2
mov r12, qword [rsp + 0xf0]
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1400a40ea
mov r12, qword [rsp + 0xf0]
jmp 0x1400a40ea
mov r12, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
cmp ebp, 1
jne 0x1400a410b
test rdi, rdi
je 0x1400a410b
mov rax, qword [0x14019bd28]
test rax, rax
je 0x1400a410b
mov qword [rax], rdi
cmp byte [rsp + 0xf8], 0x80
je 0x1400a421e
cmp ebp, 1
jne 0x1400a4129
test rdi, rdi
je 0x1400a421e
jmp 0x1400a4195
cmp ebp, 2
jne 0x1400a4195
test r15d, r15d
jg 0x1400a4162
test bl, bl
je 0x1400a414e
and byte [0x14019c661], 0xfb
lea edx, [rbp + 2]
lea rcx, str.SeDebugPrivilege
call fcn.14002e788
nop
lea rcx, [0x14019cae8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x1400a42ce
movzx eax, byte [0x1401958af]
test al, al
jle 0x1400a4188
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, r15d
jge 0x1400a4188
movzx eax, byte [0x1401958af]
test al, al
jg 0x1400a4170
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
jmp 0x1400a421e
movzx eax, byte [0x1401958af]
test al, al
jle 0x1400a41f1
test r15d, r15d
jle 0x1400a41b2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, r15d
jge 0x1400a41e0
mov rdx, r12
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
je 0x1400a41f1
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx r11d, byte [0x1401958af]
test r11b, r11b
jle 0x1400a41f1
jmp 0x1400a41a0
movzx eax, byte [rsp + 0x108]
mov dword [rsp + 0xe8], eax
jmp 0x1400a420b
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x1400a4202
mov ecx, dword [rax]
jmp 0x1400a4204
xor ecx, ecx
mov dword [rsp + 0xe8], ecx
mov rax, qword [0x14019bd28]
test rax, rax
je 0x1400a421e
mov qword [rax], 0
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x1400a4231
mov dword [rax], 0xffffffff
test rdi, rdi
je 0x1400a427c
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
mov edx, 0x111
lea r8d, [r9 + 2]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov edx, 0x111
lea r8d, [r9 + 7]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call qword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0xe8]
cmp byte [rsp + 0x100], 0
je 0x1400a42bf
and byte [0x14019c661], 0xfb
mov edx, 4
lea rcx, str.SeDebugPrivilege
call fcn.14002e788
nop
lea rcx, [0x14019cae8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret