Function at 0x140097b60
Capabilities:
Create process on windows
Create thread
Lock the desktop

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x120]
sub rsp, reloc.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_544
mov rax, qword [0x140379a08]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r14, r8
mov esi, edx
mov rdi, rcx
mov r10d, 0x1f7
cmp edx, r10d
ja 0x140098217
je 0x14009820d
lea eax, [rdx - 0x191]
cmp eax, 0x30
ja case.0x140097bcc.406
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x984cc]
mov ecx, dword [rdx + rax*4 + 0x98464]
add rcx, rdx
jmp rcx
xor r9d, r9d
xor edx, edx
mov r8d, 0x2001
lea rcx, [0x1401a9a00]
call qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
nop dword [rax + rax]
jmp case.0x140097bcc.406
mov rcx, qword [rdi - 0x30]
call qword [case.0x1402586e7.2]
nop dword [rax + rax]
mov ecx, reloc.SHELL32.dll_SHRestricted
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
lea rcx, [rdi - 0x38]
call fcn.1401a5864
mov rcx, rdi
call fcn.1400a16a0
mov rcx, qword [0x14037b638]
call qword [sym.imp.SHELL32.dll_Ordinal_54]
nop dword [rax + rax]
jmp case.0x140097bcc.406
xor r14d, r14d
cmp byte [rdi + 0x172], r14b
jne case.0x140097bcc.406
lea rcx, [rdi - 0x38]
cmp byte [rbp + 0x170], r14b
je 0x140097c66
call fcn.1401abac8
jmp case.0x140097bcc.406
mov eax, dword [0x14037dbc8]
neg eax
sbb edx, edx
add edx, 3
call fcn.1400420f8
cmp dword [0x14037dbc8], r14d
sete byte [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.1401962dc
jmp case.0x140097bcc.406
lea rcx, [rdi - 0x38]
call fcn.1401a8a98
jmp case.0x140097bcc.406
lea rcx, [rdi - 0x38]
call fcn.1401acf7c
jmp case.0x140097bcc.406
xor r14d, r14d
cmp byte [rdi + 0x172], r14b
jne case.0x140097bcc.406
lea rcx, [rdi - 0x38]
lea r8d, [r14 + 1]
mov rdx, r10
call fcn.14000afb0
jmp case.0x140097bcc.406
xor r14d, r14d
cmp byte [rdi + 0x172], r14b
jne case.0x140097bcc.406
lea rcx, [rdi - 0x38]
xor r8d, r8d
xor edx, edx
call fcn.1401ac93c
jmp case.0x140097bcc.406
xor r14d, r14d
cmp byte [rdi + 0x172], r14b
jne case.0x140097bcc.406
lea rdx, str.WindowArrangementContextMenu
lea rcx, [rbp - 0x40]
call fcn.1400644e8
lea rax, [0x1402eff48]
mov qword [rbp - 0x40], rax
lea edx, [r14 + 1]
lea rcx, [rbp - 0x40]
call fcn.1401a7720
nop
lea rcx, [rbp - 0x40]
call fcn.1401a8908
lea rcx, [rdi - 0x38]
xor r8d, r8d
xor edx, edx
call fcn.1401ace5c
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.14004c750
nop
lea rcx, [rbp - 0x40]
call fcn.140197498
jmp case.0x140097bcc.406
mov ecx, 2
xor r8d, r8d
xor edx, edx
call fcn.1401fb644
jmp case.0x140097bcc.406
mov r8, qword [rdi - 0x30]
mov dl, 1
mov ecx, 1
jmp 0x140097d6b
test byte [0x14037dc80], 1
je 0x140097db0
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x140307820]
lea rcx, [0x1403787c0]
call fcn.1400429a0
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
xor edx, edx
mov rax, qword [rax + 0x1a0]
call qword [case.0x14006c37f.0]
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x248]
call qword [case.0x14006c37f.0]
test byte [0x14037dc80], 1
je case.0x140097bcc.406
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x140307800]
lea rcx, [0x1403787c0]
call fcn.1400429a0
jmp case.0x140097bcc.406
mov dword [rsp + 0x50], Ordinal_113
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x54]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x54], 0x200
lea rax, str._SystemRoot__system32_taskmgr.exe
mov qword [rsp + 0x68], rax
mov dword [rbp - 0x80], 1
lea rax, [0x14030d544]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
call fcn.140197c68
jmp case.0x140097bcc.406
xor r14d, r14d
mov ebx, r14d
lea rdx, str.WindowArrangementContextMenu
lea rcx, [rbp - 0x40]
call fcn.1400644e8
lea rax, [0x1402eff48]
mov qword [rbp - 0x40], rax
lea edx, [r14 + 1]
lea rcx, [rbp - 0x40]
call fcn.1401a7720
nop
mov rcx, rdi
call fcn.1401979f0
test eax, eax
je 0x140097fd3
lea rcx, [rdi - 0x38]
mov ebx, 0x193
cmp esi, ebx
jne 0x140097ec4
mov edx, 0x217
jmp 0x140097ed5
mov edx, 0x21a
lea eax, [rdx - 2]
cmp esi, 0x194
cmove edx, eax
call fcn.1401a6c3c
mov qword [rsp + 0x20], 1
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
mov rcx, rdi
call fcn.140042b90
cmp esi, ebx
jne 0x140097f3c
call qword [0x14039e7d0]
nop dword [rax + rax]
mov rcx, rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_CascadeWindows]
nop dword [rax + rax]
test ax, ax
je 0x140097f2a
mov ebx, r14d
jmp 0x140097f31
call fcn.14002154c
mov ebx, eax
lea rcx, [rbp - 0x40]
call fcn.140197a20
jmp 0x140097f99
mov ebx, r14d
cmp esi, 0x194
setne bl
call qword [0x14039e7d0]
nop dword [rax + rax]
mov rcx, rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_TileWindows]
nop dword [rax + rax]
test ax, ax
je 0x140097f7a
mov ebx, r14d
jmp 0x140097f81
call fcn.14002154c
mov ebx, eax
lea rcx, [rbp - 0x40]
cmp esi, 0x194
jne 0x140097f94
call fcn.1401a8a14
jmp 0x140097f99
call fcn.1401a7278
mov dword [rdi + 0xbc], r14d
xor r9d, r9d
lea edx, [r9 + 0x12]
mov r8d, 0x1f4
mov rcx, qword [rdi - 0x30]
call qword [0x14039e748]
nop dword [rax + rax]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
mov rcx, rdi
call fcn.140042b90
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.14004c750
nop
jmp 0x140097d53
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rdx, r9
mov rax, qword [rax + 0x1a8]
call qword [case.0x14006c37f.0]
jmp case.0x140097bcc.406
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1c0]
jmp 0x1400983bc
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1d0]
jmp 0x1400983bc
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1d8]
jmp 0x1400983bc
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1e8]
jmp 0x1400983bc
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1e0]
jmp 0x1400983bc
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1c8]
jmp 0x1400983bc
mov edx, esi
call fcn.1401a9f94
jmp case.0x140097bcc.406
xor r8d, r8d
lea rdx, str.TaskbarAppsVisibleInTabletMode
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.140056248
xor r14d, r14d
mov ebx, r14d
test eax, eax
sete bl
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 4]
lea r8, str.TaskbarAppsVisibleInTabletMode
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call fcn.14018f1f4
test eax, eax
jle 0x1400980f6
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x140098118
mov edx, 0x1656
lea r8, str.pcshell_shellexplorer_tray.cpp
mov r9d, eax
mov rcx, qword [rbp + 0x148]
call fcn.14009d7ec
jmp case.0x140097bcc.406
xor r9d, r9d
mov edx, 0x5ca
lea r8d, [r9 + 1]
mov rcx, qword [rdi - 0x30]
call qword [case.0x14004551b.0]
nop dword [rax + rax]
mov byte [rsp + 0x40], r14b
mov byte [rsp + 0x41], bl
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x41]
call fcn.1401964fc
jmp case.0x140097bcc.406
xor r8d, r8d
lea rdx, str.TaskbarAutoHideInTabletMode
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.140056248
xor r14d, r14d
mov ecx, r14d
test eax, eax
sete cl
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 4]
lea r8, str.TaskbarAutoHideInTabletMode
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call fcn.14018f1f4
test eax, eax
jle 0x1400981b4
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1400981c0
mov edx, 0x1660
jmp 0x1400980fd
xor r9d, r9d
mov edx, 0x5ca
lea r8d, [r9 + 0xa]
mov rcx, qword [rdi - 0x30]
call qword [case.0x14004551b.0]
nop dword [rax + rax]
jmp case.0x140097bcc.406
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1f0]
jmp 0x1400983bc
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1f8]
jmp 0x1400983bc
mov ecx, 4
jmp 0x140097d66
cmp esi, 0x291
ja 0x14009836f
cmp esi, 0x290
jae 0x140098365
cmp esi, 0x1fa
je 0x14009832a
cmp esi, 0x205
je 0x1400982ae
cmp esi, 0x206
je 0x14009828b
cmp esi, 0x207
je 0x140098278
lea eax, [rdx - 0x270]
cmp eax, 4
jbe 0x14009826a
cmp esi, 0x280
jne case.0x140097bcc.406
add rcx, 0xffffffffffffffc8
call fcn.1400ace7c
jmp case.0x140097bcc.406
add rcx, 0xffffffffffffffc8
mov edx, 0x1f
call fcn.1401aba08
jmp case.0x140097bcc.406
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5b4
mov rcx, qword [0x14037b640]
call qword [0x14039e600]
nop dword [rax + rax]
jmp case.0x140097bcc.406
mov al, byte [0x14037dc83]
test al, 4
je 0x14009830c
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x140307a70]
lea rcx, [0x1403787c0]
call fcn.1400429a0
mov al, byte [0x14037dc83]
test al, 4
je 0x14009830c
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x140307978]
lea rcx, [0x1403787c0]
call fcn.1400429a0
call fcn.1401a8c08
test eax, eax
je case.0x140097bcc.406
call qword [sym.imp.USER32.dll_LockWorkStation]
nop dword [rax + rax]
jmp case.0x140097bcc.406
mov rcx, qword [rcx - 0x30]
call qword [case.0x1402586e7.2]
nop dword [rax + rax]
mov ecx, reloc.SHELL32.dll_SHRestricted
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
lea rcx, [rdi - 0x38]
call fcn.1401a5864
mov r9d, r14d
lea rcx, [rdi - 0x38]
call fcn.1401a98e4
jmp case.0x140097bcc.406
call fcn.1400acd48
jmp case.0x140097bcc.406
sub esi, 0x1388
je 0x14009840f
sub esi, 1
je 0x1400983d7
sub esi, 0x8ca7
je 0x1400983c4
sub esi, 0x35
je 0x1400983ab
cmp esi, 0x21
jne case.0x140097bcc.406
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Ordinal_91]
nop dword [rax + rax]
jmp case.0x140097bcc.406
mov rcx, qword [rcx + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1b0]
call qword [case.0x14006c37f.0]
jmp case.0x140097bcc.406
mov rcx, qword [rcx + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1b8]
jmp 0x1400983bc
mov ecx, 3
call qword [sym.imp.SHLWAPI.dll_Ordinal_413]
nop dword [rax + rax]
xor r14d, r14d
test rax, rax
je case.0x140097bcc.406
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r14 + 0xd]
or edx, 0xffffffff
xor ecx, ecx
call qword [0x14039e178]
nop dword [rax + rax]
jmp case.0x140097bcc.406
mov rcx, qword [rcx - 0x30]
call qword [case.0x1402586e7.2]
nop dword [rax + rax]
mov ecx, reloc.SHELL32.dll_SHRestricted
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
mov rcx, qword [0x14037b638]
call qword [sym.imp.SHELL32.dll_Ordinal_254]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1400a2260
add rsp, reloc.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_544
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret