Function at 0x1401a1840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, qword [rsp + 0xb0]
lea eax, [r8 - 0x401]
mov rdi, r9
mov rbx, rdx
mov rbp, rcx
cmp eax, 0x32
ja case.0x1401a188a.1026
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1a219c]
add rcx, rdx
jmp rcx
mov qword [rbx + 0xb8], rsi
mov qword [rbx + 0xc0], rdi
test rsi, rsi
jne 0x1401a18d7
lea rcx, [sym.SystemInformer.exe_PhIsExecutingInWow64]
mov eax, 1
mov qword [rbx + 0xb8], rcx
jmp 0x1401a1ad7
cmp dword ds:[rbx + 0x244], 0
jg 0x1401a18e5
or dword [rbx + 0x40], 0xc00000
mov rcx, qword [rbx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov eax, 1
jmp 0x1401a1ad7
mov rcx, rbx
call fcn.1401a3ec0
mov rcx, rbx
call fcn.1401a2900
jmp 0x1401a18c9
mov rdx, rsi
mov rcx, rbx
call fcn.1401a2d80
movzx eax, al
jmp 0x1401a1ad7
cmp edi, dword [rbx + 0xd4]
jae 0x1401a1985
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov rsi, qword [rax + rcx*8]
test rsi, rsi
je 0x1401a1985
mov edi, dword [rsi]
mov rdx, rsi
mov rcx, rbx
call fcn.1401a36c0
mov ecx, dword [rsi + 4]
xor edx, edx
mov rax, qword [rbx + 0xc8]
mov r8, rsi
mov qword [rax + rcx*8], rdx
mov rcx, qword [0x1402caaf0]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rbx
call fcn.1401a33c0
nop dword [rax]
test dil, 1
je 0x1401a196e
mov rcx, rbx
call fcn.1401a2900
dec dword ds:[rbx + 0xd8]
mov edx, 1
mov eax, edx
jmp 0x1401a1ad7
xor edx, edx
mov eax, edx
jmp 0x1401a1ad7
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.1401a2f50
movzx eax, al
jmp 0x1401a1ad7
mov r8d, dword [rsi + 4]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.1401a2fa0
movzx eax, al
jmp 0x1401a1ad7
nop
cmp edi, dword [rbx + 0xec]
jne case.0x1401a188a.1026
test edi, edi
je 0x1401a18d7
xor edx, edx
mov r9d, edi
mov r8d, edx
nop dword [rax]
mov rax, qword ds:[rbx + 0xe0]
lea rdx, [rdx + 4]
lea r8, [r8 + 8]
mov rcx, qword [rax + r8 - 8]
mov eax, dword [rcx + 4]
mov dword [rsi + rdx - 4], eax
sub r9, 1
jne 0x1401a19e0
mov eax, 1
jmp 0x1401a1ad7
mov qword [rsp + 0x60], r14
test edi, edi
je 0x1401a1abc
mov rcx, qword [0x1402caaf0]
mov edx, 4
mov r14d, edi
lea r8, [r14*4]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov rbp, rax
test edi, edi
je 0x1401a1a90
mov r8d, edx
nop word [rax + rax]
mov ecx, dword ds:[rsi + r8]
nop
cmp ecx, dword [rbx + 0xd4]
jae 0x1401a1aee
lfence
mov rax, qword [rbx + 0xc8]
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x1401a1aee
mov eax, dword [rax + 0x28]
inc edx
mov dword [r8 + rbp], eax
add r8, 4
cmp edx, edi
jb 0x1401a1a50
mov rcx, qword ds:[rbx + 0x18]
mov r9, rbp
mov r8, r14
mov edx, 0x1212
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1402caaf0]
xor edx, edx
mov r8, rbp
test eax, eax
je 0x1401a1afd
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rbx
call fcn.1401a3740
mov rcx, rbx
call fcn.1401a33c0
mov eax, 1
mov r14, qword [rsp + 0x60]
mov rcx, qword ds:[rsp + 0x58]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
lfence
mov rcx, qword [0x1402caaf0]
mov r8, rbp
xor edx, edx
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
jmp 0x1401a1ad2
mov qword [rbx + 0x58], rsi
mov eax, 1
jmp 0x1401a1ad7
test rdi, rdi
je 0x1401a1b23
mov eax, dword [rbx + 0x130]
mov dword [r9], eax
test rsi, rsi
je 0x1401a18d7
mov eax, dword [rbx + 0x134]
mov dword [rsi], eax
mov eax, 1
jmp 0x1401a1ad7
test esi, esi
je 0x1401a1b65
nop
cmp edi, dword [rbx + 0xd4]
jae case.0x1401a188a.1026
lfence
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
jne 0x1401a1b69
xor eax, eax
jmp 0x1401a1ad7
xor edx, edx
mov edi, edx
mov rcx, rbx
mov dword [rbx + 0x130], edi
mov dword [rbx + 0x134], esi
call fcn.1401a3820
mov rax, qword [rbx + 0xb8]
lea rcx, [sym.SystemInformer.exe_PhIsExecutingInWow64]
cmp rax, rcx
je 0x1401a18d7
mov rcx, qword [rbx + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbx]
mov edx, 0xa
call qword [case.0x14013d84a.0]
mov eax, 1
jmp 0x1401a1ad7
mov eax, dword [rbx + 0x40]
neg rdi
sbb ecx, ecx
btr eax, 0xa
and ecx, 0x400
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a1ad7
mov edx, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401a4d60
movzx eax, al
jmp 0x1401a1ad7
mov r8d, esi
mov edx, edi
mov rcx, rbx
call fcn.1401a61c0
mov eax, 1
jmp 0x1401a1ad7
test dword [rbx + 0x40], 0x400000
jne case.0x1401a188a.1026
mov rax, qword ds:[rbx + 0x128]
mov eax, dword [rax]
jmp 0x1401a1ad7
mov rax, qword [rbx + 0x128]
cmp edi, dword [rax]
jae case.0x1401a188a.1026
lfence
mov rcx, qword [rbx + 0x128]
mov edx, edi
mov rax, qword [rcx + 8]
mov rax, qword [rax + rdx*8]
jmp 0x1401a1ad7
mov r8d, dword ds:[rsi + 0x10]
lea r9, [rsi + 0x18]
mov rdx, qword [rsi + 8]
mov rcx, rbx
call fcn.1401a3de0
movzx eax, al
jmp 0x1401a1ad7
test rdi, rdi
mov rdx, rsi
mov rcx, rbx
setne r8b
call fcn.1401a4140
mov eax, 1
jmp 0x1401a1ad7
mov eax, dword [rbx + 0xd0]
dec eax
jmp 0x1401a1ad7
inc edi
cmp dword [rbx + 0xd0], edi
jae 0x1401a18d7
mov dword [rbx + 0xd0], edi
cmp dword [rbx + 0xd4], edi
jae 0x1401a18d7
mov rcx, rbx
call fcn.1401a32e0
mov eax, 1
jmp 0x1401a1ad7
test byte [rsi], 1
je case.0x1401a188a.1026
mov edx, dword [rsi + 0x2c]
mov r8d, edx
lea rax, [rsp + 0x38]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401a4540
test al, al
je case.0x1401a188a.1026
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rbp
jmp 0x1401a18d1
mov r8d, esi
mov edx, edi
jmp 0x1401a1cdf
mov rax, qword [rbx + 0x10]
jmp 0x1401a1ad7
mov rax, qword [rbx + 0x18]
jmp 0x1401a1ad7
mov rax, qword [rbx + 0x38]
jmp 0x1401a1ad7
xor edx, edx
lea rax, [rsp + 0x30]
cmp r8d, 0x41d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov r8d, esi
sete dl
mov qword [rsp + 0x20], rax
mov r9d, edx
mov rcx, rbx
mov edx, edi
call fcn.1401a48a0
mov r8d, dword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov edx, dword [rsp + 0x38]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401a4540
nop dword [rax]
test al, al
je 0x1401a18d7
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbp
jmp 0x1401a18d1
mov eax, dword ds:[rbx + 0xd8]
jmp 0x1401a1ad7
test rdi, rdi
mov edx, 1
mov eax, 0xffffffff
cmove edx, eax
add edx, dword [rbx + 0x244]
mov dword [rbx + 0x244], edx
cmp edx, 1
jne 0x1401a1e67
test dword [rbx + 0x40], 0x400000
je 0x1401a1ddb
mov rcx, rbx
call fcn.1401a3ec0
test dword [rbx + 0x40], 0x800000
je 0x1401a1dec
mov rcx, rbx
call fcn.1401a2900
test dword [rbx + 0x40], 0x1000000
je 0x1401a1e30
mov rdi, qword [rbx]
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx edx, ax
mov rcx, rdi
shr eax, 0x10
cwde
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov r8, qword [rsp + 0x38]
mov rcx, rbx
mov edx, dword [rsp + 0x38]
shr r8, 0x20
call fcn.1401a4e00
and dword ds:[rbx + 0x40], 0xfe3fffff
mov rdx, qword [rbx + 0x248]
test rdx, rdx
je 0x1401a1e67
mov rcx, qword [rbx]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRgn]
mov rcx, qword [rbx + 0x248]
call qword [sym.imp.GDI32.dll_DeleteObject]
xor edx, edx
mov qword [rbx + 0x248], rdx
movsxd rax, dword [rbx + 0x244]
jmp 0x1401a1ad7
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rsi], xmm0
mov eax, dword [rbx + 0x70]
mov dword [rsi + 0x10], eax
mov eax, dword [rbx + 0x74]
mov dword [rsi + 0x14], eax
test byte [rbx + 0x40], 4
je 0x1401a1e91
mov edx, dword [rbx + 0x78]
jmp 0x1401a1e93
xor edx, edx
mov dword [rsi + 0x18], edx
mov eax, dword [rbx + 0x7c]
mov dword [rsi + 0x1c], eax
mov eax, dword [rbx + 0x80]
mov dword [rsi + 0x20], eax
mov eax, dword [rbx + 0x84]
mov dword [rsi + 0x24], eax
mov eax, dword [rbx + 0x88]
mov dword [rsi + 0x28], eax
mov eax, dword [rbx + 0x90]
mov dword [rsi + 0x2c], eax
mov eax, dword [rbx + 0xf0]
mov dword [rsi + 0x30], eax
mov eax, 1
jmp 0x1401a1ad7
mov rax, qword [rbx + 0xf8]
jmp 0x1401a1ad7
mov rax, qword [rbx + 0x100]
jmp 0x1401a1ad7
mov qword [rbx + 0x98], rsi
mov eax, 1
jmp 0x1401a1ad7
mov eax, dword [rsi + 0x2c]
mov dword [rbx + 0xa4], eax
mov eax, 1
jmp 0x1401a1ad7
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.1401a4a80
mov eax, 1
jmp 0x1401a1ad7
mov eax, edi
and edi, esi
not eax
and eax, dword [rbx + 0x4c]
or eax, edi
mov dword [rbx + 0x4c], eax
mov eax, 1
jmp 0x1401a1ad7
nop
test rsi, rsi
je 0x1401a1f5f
mov rax, qword [rbx + 0xb8]
lea rcx, [sym.SystemInformer.exe_PhIsExecutingInWow64]
xor edx, edx
cmp rax, rcx
cmovne rdx, rax
mov qword [rsi], rdx
nop
test rdi, rdi
je 0x1401a18d7
mov rax, qword [rbx + 0xc0]
mov qword [r9], rax
mov eax, 1
jmp 0x1401a1ad7
mov rdx, rsi
mov rcx, rbx
call fcn.1401a4620
mov eax, 1
jmp 0x1401a1ad7
mov eax, dword [rbx + 0x40]
shr eax, 4
and eax, 1
add eax, dword [rbx + 0xec]
jmp 0x1401a1ad7
cmp edi, dword [rbx + 0xd4]
jae case.0x1401a188a.1026
lfence
mov rax, qword [rbx + 0xc8]
mov ecx, edi
mov r8, qword [rax + rcx*8]
test r8, r8
je case.0x1401a188a.1026
mov eax, dword [r8]
test al, 1
je case.0x1401a188a.1026
test al, 4
je 0x1401a1ff3
mov rdx, qword [rbx + 0x10]
mov r9d, esi
mov rcx, rbx
call fcn.1401a3ae0
mov eax, 1
jmp 0x1401a1ad7
mov rdx, qword ds:[rbx + 0x18]
mov r9d, esi
mov rcx, rbx
call fcn.1401a3ae0
mov eax, 1
jmp 0x1401a1ad7
movups xmm0, xmmword ds:[rsi]
mov eax, 1
movups xmmword [rbx + 0x250], xmm0
jmp 0x1401a1ad7
mov eax, dword [rbx + 0x40]
test edi, edi
je 0x1401a2045
bts eax, 0x1b
mov dword [rbx + 0x74], edi
mov dword [rbx + 0x40], eax
mov eax, 1
jmp 0x1401a1ad7
btr eax, 0x1b
mov rcx, rbx
mov dword [rbx + 0x40], eax
call fcn.1401a2620
mov eax, 1
jmp 0x1401a1ad7
mov eax, dword [rbx + 0x40]
shr eax, 0x16
not eax
and eax, 1
jmp 0x1401a1ad7
mov eax, dword [rbx + 0x40]
neg rdi
sbb ecx, ecx
btr eax, 0x1e
and ecx, 0x40000000
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a1ad7
mov rax, rdi
mov qword [rbx + 0x270], rdi
neg rax
mov eax, dword [rbx + 0x40]
sbb ecx, ecx
btr eax, 0x1f
and ecx, 0x80000000
or ecx, eax
mov eax, 1
mov dword [rbx + 0x40], ecx
jmp 0x1401a1ad7
mov eax, dword ds:[r9]
mov dword [rbx + 0x2b8], eax
mov rax, qword [r9 + 8]
mov qword [rbx + 0x2c0], rax
mov rax, qword [r9 + 0x10]
mov qword [rbx + 0x2c8], rax
mov eax, 1
jmp 0x1401a1ad7
mov edx, esi
mov rcx, rbx
call fcn.1401a4d60
movzx eax, al
jmp 0x1401a1ad7
mov eax, dword [rbx + 0x40]
shr eax, 4
and eax, 1
add eax, dword [rbx + 0xec]
cmp edi, eax
jae case.0x1401a188a.1026
lfence
mov eax, dword [rbx + 0x40]
mov r8, rsi
shr eax, 4
and eax, 1
sub edi, eax
mov rax, qword [rbx + 0xe0]
mov rcx, qword [rax + rdi*8]
mov edx, dword [rcx + 4]
mov rcx, rbx
call fcn.1401a2f50
movzx eax, al
jmp 0x1401a1ad7
xor edx, edx
test edi, edi
je 0x1401a18d7
mov r8d, edx
nop dword [rax + rax]
mov eax, dword ds:[rsi + r8]
nop
cmp eax, dword [rbx + 0xd4]
jae case.0x1401a188a.1026
lfence
mov ecx, eax
inc edx
mov rax, qword [rbx + 0xc8]
mov rcx, qword [rax + rcx*8]
mov eax, dword [rcx]
and eax, 1
mov dword [rsi + r8], eax
add r8, 4
cmp edx, edi
jb 0x1401a2150
mov eax, 1
jmp 0x1401a1ad7