Function at 0x14006a938
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
xor eax, eax
mov r13, rcx
lea rdx, [rsp + 0x58]
lea rcx, [r11 + 0x20]
xor ebp, ebp
mov rsi, r8
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.14005b4d4
lea r10d, [rbp + 2]
lea r11d, [rbp + 0x2b]
movsx r9d, al
mov rax, qword [rsp + 0x158]
mov dword [rsp + 0x68], r9d
movzx r8d, word [rax]
cmp r8w, 0x2a
je 0x14006a9bc
cmp r8w, 0x2d
je 0x14006a9bc
cmp r11w, r8w
jne 0x14006a9c7
add rax, r10
mov qword [rsp + 0x158], rax
lea rcx, [rsp + 0x158]
call fcn.140044ef4
lea rcx, [rsp + 0x148]
call fcn.140044ef4
mov r14, rbp
cmp r9d, ebp
je 0x14006a9fd
cmp rsi, rbp
je 0x14006a9fd
cmp byte [rsi + 0xb1], bpl
jne 0x14006a9fd
mov r14, qword [rsi + 0x20]
jmp 0x14006aa01
mov dword [rsp + 0x68], ebp
test byte [rsp + 0x68], r10b
mov rax, rbp
mov r15d, ebp
cmovne rax, r14
mov qword [rsp + 0x48], rax
cmp r8w, 0x2a
jne 0x14006ac63
mov ecx, 0x9f8
mov qword [rsp + 0x50], rbp
mov r12d, ebp
mov qword [rsp + 0x40], rbp
call fcn.1400b9688
mov edi, 0x271b
mov rbx, rax
cmp rax, rbp
je 0x14006aa74
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov r8d, edi
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call fcn.14005b128
mov rbx, rax
jmp 0x14006aa77
mov rbx, rbp
mov ecx, 0xe8
call fcn.1400b9688
mov rbp, rax
test rax, rax
je 0x14006aaa5
mov rdx, r13
mov rcx, rax
call fcn.140012330
mov rdx, r13
mov rcx, rbp
call fcn.140012aa0
mov qword [rbp + 0x40], rbx
jmp 0x14006aaa7
xor ebp, ebp
mov eax, dword [rsp + 0x160]
mov r15, qword [rsp + 0x158]
xor r8d, r8d
mov rcx, rbp
mov rdx, r15
mov byte [rbp + 0xd1], 3
mov dword [rbp + 0x24], eax
call fcn.14005c144
mov rax, qword [rsp + 0x148]
mov dl, 1
mov rcx, rbx
mov qword [rbx + 0x218], rax
mov qword [rbx + 0xe0], r14
mov qword [rbx + 0x208], rbp
call fcn.140068b84
lea rcx, [rsp + 0x80]
mov rdx, r15
call fcn.140058920
lea rdx, [rsp + 0x80]
mov rcx, r15
call fcn.14005c890
lea rcx, [rbx + 0xb8]
mov rdx, rax
call fcn.1400589a0
lea rcx, [rsp + 0x80]
call fcn.140044f24
xor r14d, r14d
cmp r15, r14
je 0x14006ab51
cmp byte [rbx + 0xb1], r14b
je 0x14006ab5a
lea rcx, [rbx + 0xf0]
mov rdx, r15
call fcn.1400589a0
cmp byte [rbx + 0xb1], r14b
jne 0x14006ab73
cmp byte [rbx + 0xe9], r14b
jne 0x14006ab73
cmp byte [rbx + 0xea], r14b
je 0x14006ab78
mov edi, 0x271d
jmp 0x14006ab78
mov edi, 0x271c
mov rcx, rbx
call fcn.140001160
mov qword [rsp + 0x50], rsi
mov rcx, qword [rsp + 0x50]
call fcn.1400451f0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, r14
je 0x14006abb9
mov rax, qword [rsp + 0x50]
cmp byte [rax + 0xb1], r14b
je 0x14006abb9
mov eax, 2
cmp dword [r13 + 0x20], eax
cmovle r12d, eax
mov r8, qword [rsp + 0x48]
lea r9, [rsp + 0x58]
mov edx, edi
mov rcx, rbx
call fcn.140047a90
mov rdx, qword [rbx + 0x20]
lea r9, str.0x_I64X
lea r8, str.__LastWinID
mov rcx, r13
call fcn.14004ec8c
xor edx, edx
mov rcx, rbx
call fcn.1400ab508
lea rcx, [0x1400f2c58]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1400f2c58]
mov qword [rbp + 0x40], r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rcx, rbp
call fcn.140038fd4
lea rcx, [rbp + 0x70]
call fcn.140044f24
mov rcx, rbp
call fcn.1400b949c
mov r11, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r11 + 0x18]
mov r11, qword [rsp + 0x40]
cmp r11, r14
je 0x14006b018
mov rcx, qword [rsp + 0x40]
mov r8d, r12d
mov edx, 0x451
or r8, 1
xor r9d, r9d
jmp 0x14006ae49
cmp r8w, 0x2d
jne 0x14006ae54
mov ecx, 0x9f8
call fcn.1400b9688
mov edi, 0x271b
mov rbx, rax
cmp rax, rbp
je 0x14006acb5
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov r8d, edi
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call fcn.14005b128
mov rbx, rax
jmp 0x14006acb8
mov rbx, rbp
mov ecx, 0xe8
call fcn.1400b9688
mov rbp, rax
test rax, rax
je 0x14006ace6
mov rdx, r13
mov rcx, rax
call fcn.140012330
mov rdx, r13
mov rcx, rbp
call fcn.140012aa0
mov qword [rbp + 0x40], rbx
jmp 0x14006ace8
xor ebp, ebp
mov eax, dword [rsp + 0x160]
mov r12, qword [rsp + 0x158]
xor r8d, r8d
mov rcx, rbp
mov rdx, r12
mov byte [rbp + 0xd1], 3
mov dword [rbp + 0x24], eax
call fcn.14005c144
mov rax, qword [rsp + 0x148]
mov dl, 1
mov rcx, rbx
mov qword [rbx + 0x218], rax
mov qword [rbx + 0xe0], r14
mov qword [rbx + 0x208], rbp
call fcn.140068b84
mov r11, qword [rbx + 0x208]
lea rcx, [rsp + 0x78]
mov rdx, r12
mov qword [rbx + 0x200], r11
call fcn.140058920
lea rdx, [rsp + 0x78]
mov rcx, r12
call fcn.14005c890
lea rcx, [rbx + 0xb8]
mov rdx, rax
call fcn.1400589a0
lea rcx, [rsp + 0x78]
call fcn.140044f24
mov rdx, qword [rsp + 0x70]
xor r14d, r14d
cmp rdx, r14
je 0x14006ad90
lea rcx, [rbx + 0xb8]
call fcn.140058a38
cmp r12, r14
je 0x14006adad
cmp byte [rbx + 0xb1], r14b
je 0x14006adb6
lea rcx, [rbx + 0xf0]
mov rdx, r12
call fcn.1400589a0
cmp byte [rbx + 0xb1], r14b
jne 0x14006adcf
cmp byte [rbx + 0xe9], r14b
jne 0x14006adcf
cmp byte [rbx + 0xea], r14b
je 0x14006add4
mov edi, 0x271d
jmp 0x14006add4
mov edi, 0x271c
mov rcx, rbx
call fcn.140001160
mov byte [rbx + 0xb0], 1
mov qword [rbx + 0x70], rsi
cmp rsi, r14
je 0x14006ae0c
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rsi + 0x150]
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rsp + 0x48]
lea r9, [rsp + 0x58]
mov edx, edi
mov rcx, rbx
call fcn.140047a90
mov rdx, qword [rbx + 0x20]
lea r9, str.0x_I64X
lea r8, str.__LastWinID
mov rcx, r13
call fcn.14004ec8c
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14006b018
mov rax, qword [rsp + 0x158]
cmp r11w, word [rax - 2]
cmove rsi, rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rbp
mov rcx, qword [rsp + 0x48]
call fcn.1400451f0
lea rcx, [0x1400f2808]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0xa0], rax
movsxd rax, dword [rsp + 0x160]
mov qword [rsp + 0xa8], 4
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xc8], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11, [rsp + 0xc8]
lea r9, [rsp + 0x90]
lea r8, [0x14006a458]
mov qword [rsp + 0x28], r11
mov edx, 0x400000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp rax, rbp
je 0x14006af9b
mov ebx, 0x270f
mov rcx, qword [rsp + 0xa8]
cmp rcx, rbp
je 0x14006af76
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x14006af5c
mov rax, qword [rsp + 0xa8]
cmp rax, rbp
je 0x14006af9b
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rsp + 0xa8]
cmp r11, rbp
jne 0x14006af83
lea rcx, [0x1400f2808]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, rbp
je 0x14006afb6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
cmp rax, rbp
je 0x14006afe4
mov rax, qword [rsp + 0xe0]
cmp rax, rbp
je 0x14006afe4
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x451
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [rsp + 0xc8]
lea r8, str.__LastTID
mov rcx, r13
call fcn.14004ed18
mov rdx, qword [rsp + 0xc0]
lea r9, str.0x_I64X
lea r8, str.__LastWinID
mov rcx, r13
call fcn.14004ec8c
mov eax, r15d
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret