Function at 0x140002510
Capabilities:
Create thread
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r14d, r14d
mov dword [rbp - 0x49], r14d
lea rdx, str.Kairun_Safe_Notify__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002e40
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rdi, rax
lea rdx, str.Kairun_Safe_Notification
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, 0xffffffec
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
bts rax, 0x13
mov r8, rax
mov edx, 0xffffffec
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov r9d, 2
mov r8b, 0xc8
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movabs rsi, 0x4e94914f0000
movabs r14, 0x7fffffffc46535ff
movabs r13, 0x7fffffffffffffff
movabs r12, 0xb2f4fc0794908cf3
movabs r15, 0x431bde82d7b634db
nop
lea rdx, [0x140005648]
lea rcx, str.Windows.UI.Core.CoreWindow
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140002703
lea rcx, [rbp - 0x49]
call fcn.1400018d0
mov rax, qword [rbp - 0x49]
cmp rax, r14
lea rbx, [rax + 0x3b9aca00]
jl 0x140002620
mov rbx, r13
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rdi, 0x989680
jne 0x140002641
imul rax, rcx, 0x64
jmp 0x1400026b0
cmp rdi, 0x16e3600
jne 0x140002695
mov rax, r12
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdi, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r12
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, rdi
jmp 0x1400026b0
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
cmp rax, rbx
jge 0x1400025e0
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jle 0x1400026d5
mov edx, 0x5265c00
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140002620
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400026f7
inc edx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140002620
lea rdx, [rbp + 7]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rax, str.KairunSafeNotify.dll
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], 0x14
call fcn.140003ae4
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
lea r8, [rbp - 0x19]
mov edx, eax
lea rcx, [rbp - 0x41]
call fcn.1400019b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
xor r14d, r14d
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], r14w
mov dword [rbp - 0x49], 0xb
mov edx, 0x104
mov r9d, edx
lea rcx, [rbp - 0x69]
call fcn.1400035d0
mov esi, dword [rbp - 0x59]
lea rdx, [rbp - 0x69]
cmp qword [rbp - 0x51], 7
cmova rdx, qword [rbp - 0x69]
mov ecx, esi
call fcn.140003b54
mov rbx, rax
mov qword [rbp - 0x19], rax
mov ecx, eax
mov r8, qword [rbp - 0x59]
cmp rcx, r8
ja 0x1400027b7
mov qword [rbp - 0x59], rcx
lea rax, [rbp - 0x69]
cmp qword [rbp - 0x51], 7
cmova rax, qword [rbp - 0x69]
mov word [rax + rcx*2], r14w
jmp 0x140002807
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp - 0x51]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x1400027fb
mov qword [rbp - 0x59], rcx
lea r9, [rbp - 0x69]
cmp rdi, 7
cmova r9, qword [rbp - 0x69]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x1400027f0
movzx eax, r14w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r14w
jmp 0x140002807
mov r9, rdx
lea rcx, [rbp - 0x69]
call fcn.1400035d0
cmp ebx, esi
jae 0x140002774
mov eax, dword [rbp - 0x15]
mov dword [rbp - 0x19], eax
lea rcx, [0x140008078]
mov qword [rbp - 0x11], rcx
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 0x49], 7
test eax, eax
jne 0x140002a97
lea r8, [rbp - 0x41]
lea rdx, [rbp - 0x69]
lea rcx, [rbp + 0xf]
call fcn.140001ef0
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 7
jbe 0x14000288d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002888
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002888
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003cac
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], r14w
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x1400028e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003cac
movdqa xmm0, xmmword [0x1400057b0]
movdqu xmmword [rbp - 0x31], xmm0
mov word [rbp - 0x41], r14w
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x19]
call fcn.140002ab0
lea rdi, [rbp - 0x19]
cmp qword [rbp - 1], 7
cmova rdi, qword [rbp - 0x19]
mov r8d, dword [rbp + 7]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400029c3
cmp rax, 0xffffffffffffffff
je 0x1400029ba
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
mov r9, 0xffffffffffffffff
nop
lea r9, [r9 + 1]
cmp word [rdi + r9*2], 0
jne 0x140002960
lea r9, [r9*2 + 2]
mov qword [rsp + 0x20], r14
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x1400029ba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 1]
cmp rdx, 7
jbe 0x140002a06
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a01
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003cac
lea rdx, [0x140005690]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002e40
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 7
jbe 0x140002a68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003cac
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140003c50
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, [rbp - 0x19]
call fcn.1400024b0
int3