Function at 0x1400d3e30
Capabilities:
Create thread
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor eax, eax
mov r12, rcx
xor r13d, r13d
mov dword [r11 - 0x70], r13d
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
lea rcx, [r11 + 0x20]
lea rdx, [r11 - 0x70]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov rsi, r8
call fcn.14007da38
movsx r10d, al
mov rax, qword [rsp + 0xf8]
movzx r8d, word [rax]
mov dword [rsp + 0x78], r10d
cmp r8w, r13w
je 0x1400d3ea3
mov r9w, word [rax + 2]
jmp 0x1400d3ea6
mov r9d, r13d
mov ebx, 0x2b
lea r11d, [rbx - 0x29]
cmp r8w, 0x2a
je 0x1400d3ec3
cmp r8w, 0x2d
je 0x1400d3ec3
cmp bx, r8w
jne 0x1400d3ece
add rax, r11
mov qword [rsp + 0xf8], rax
cmp r8w, word [rax]
jne 0x1400d3ee5
add rax, r11
cmp r8w, word [rax]
je 0x1400d3ed4
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0xf8]
call fcn.1400598f0
lea rcx, [rsp + 0xe8]
call fcn.1400598f0
mov r15, r13
cmp r10d, r13d
je 0x1400d3f1b
cmp rsi, r13
je 0x1400d3f1b
cmp byte [rsi + 0x111], r13b
jne 0x1400d3f1b
mov r15, qword [rsi + 0x20]
jmp 0x1400d3f20
mov dword [rsp + 0x78], r13d
test byte [rsp + 0x78], r11b
mov rax, r13
mov r14d, r13d
cmovne rax, r15
mov qword [rsp + 0x58], rax
cmp r8w, 0x2a
jne 0x1400d41b3
mov ecx, 0xa80
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
call fcn.1400fded8
mov ebp, 0x271b
mov rbx, rax
cmp rax, r13
je 0x1400d3f90
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.1400711b0
mov rbx, rax
jmp 0x1400d3f93
mov rbx, r13
mov ecx, pe_nt_image_headers64
call fcn.1400fded8
mov r13, rax
xor eax, eax
cmp r13, rax
je 0x1400d3fc3
mov rdx, r12
mov rcx, r13
call fcn.140017c98
mov rdx, r12
mov rcx, r13
call fcn.140018678
mov qword [r13 + 0x40], rbx
jmp 0x1400d3fc6
mov r13, rax
mov eax, dword [rsp + 0x100]
mov rdi, qword [rsp + 0xf8]
xor r8d, r8d
mov rcx, r13
mov rdx, rdi
mov byte [r13 + 0xd9], 3
mov dword [r13 + 0x24], eax
call fcn.140071a2c
mov rax, qword [rsp + 0xe8]
mov edx, 1
mov rcx, rbx
mov qword [rbx + 0x288], rax
mov qword [rbx + 0x140], r15
mov qword [rbx + 0x278], r13
call fcn.1400d30f8
lea rcx, [rsp + 0x88]
mov rdx, rdi
call fcn.14006e2a8
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.14007219c
lea rcx, [rbx + 0x118]
mov rdx, rax
call fcn.14006e344
lea rcx, [rsp + 0x88]
call fcn.140059920
xor r15d, r15d
cmp rdi, r15
je 0x1400d4075
cmp byte [rbx + 0x111], r15b
je 0x1400d4085
lea rcx, [rbx + 0x150]
mov rdx, rdi
call fcn.14006e344
cmp byte [rbx + 0x111], r15b
je 0x1400d4085
mov edi, 0x271c
jmp 0x1400d40a6
cmp byte [rbx + 0x14a], r15b
je 0x1400d4095
mov edi, 0x271d
jmp 0x1400d40a6
cmp byte [rbx + 0x149], r15b
mov edi, 0x271c
cmovne ebp, edi
mov edi, ebp
mov rcx, rbx
call fcn.1400fef80
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x48]
call fcn.140059ef8
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, r15
je 0x1400d40e8
mov rax, qword [rsp + 0x48]
cmp byte [rax + 0x111], r15b
je 0x1400d40e8
mov eax, 2
cmp dword [r12 + 0x20], eax
cmovle r14d, eax
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x68]
mov edx, edi
mov rcx, rbx
call fcn.14005ca3c
mov rdx, qword [rbx + 0x20]
lea r9, [0x1401176e0]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.1400654b8
xor edx, edx
mov rcx, rbx
call fcn.1400e4838
lea rcx, [0x140138118]
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140138118]
mov qword [r13 + 0x40], r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rcx, r13
call fcn.14004dac4
lea rcx, [r13 + 0x70]
call fcn.140059920
mov rcx, r13
call fcn.1400fdcec
mov r11, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r11 + 0x18]
mov r11, qword [rsp + 0x50]
cmp r11, r15
je 0x1400d4190
mov rcx, qword [rsp + 0x50]
mov r8d, r14d
xor r9d, r9d
or r8, 1
mov edx, 0x451
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14d, dword [rsp + 0x48]
movsxd rax, r14d
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r8w, 0x2d
jne 0x1400d43bf
mov ecx, 0xa80
call fcn.1400fded8
mov ebp, 0x271b
mov rbx, rax
cmp rax, r13
je 0x1400d4205
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.1400711b0
mov rbx, rax
jmp 0x1400d4208
mov rbx, r13
mov ecx, pe_nt_image_headers64
call fcn.1400fded8
mov rdi, rax
cmp rax, r13
je 0x1400d4236
mov rdx, r12
mov rcx, rax
call fcn.140017c98
mov rdx, r12
mov rcx, rdi
call fcn.140018678
mov qword [rdi + 0x40], rbx
jmp 0x1400d4239
mov rdi, r13
mov eax, dword [rsp + 0x100]
mov r13, qword [rsp + 0xf8]
xor r8d, r8d
mov rcx, rdi
mov rdx, r13
mov byte [rdi + 0xd9], 3
mov dword [rdi + 0x24], eax
call fcn.140071a2c
mov rax, qword [rsp + 0xe8]
mov edx, 1
mov rcx, rbx
mov qword [rbx + 0x288], rax
mov qword [rbx + 0x140], r15
mov qword [rbx + 0x278], rdi
call fcn.1400d30f8
mov r11, qword [rbx + 0x278]
lea rcx, [rsp + 0x90]
mov rdx, r13
mov qword [rbx + 0x270], r11
call fcn.14006e2a8
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.14007219c
lea rcx, [rbx + 0x118]
mov rdx, rax
call fcn.14006e344
lea rcx, [rsp + 0x90]
call fcn.140059920
mov rdx, qword [rsp + 0x80]
xor r15d, r15d
cmp rdx, r15
je 0x1400d42f0
lea rcx, [rbx + 0x118]
call fcn.14006e3dc
cmp r13, r15
je 0x1400d430d
cmp byte [rbx + 0x111], r15b
je 0x1400d4316
lea rcx, [rbx + 0x150]
mov rdx, r13
call fcn.14006e344
cmp byte [rbx + 0x111], r15b
jne 0x1400d432f
cmp byte [rbx + 0x149], r15b
jne 0x1400d432f
cmp byte [rbx + 0x14a], r15b
je 0x1400d4334
mov ebp, 0x271d
jmp 0x1400d4334
mov ebp, 0x271c
mov rcx, rbx
call fcn.1400fef80
mov qword [rbx + 0xc8], rsi
mov byte [rbx + 0x110], 1
cmp rsi, r15
je 0x1400d4377
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rsi + 0x1b0]
lea rcx, [0x140138118]
mov byte [rbx + 0x110], 9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x68]
mov edx, ebp
mov rcx, rbx
call fcn.14005ca3c
mov rdx, qword [rbx + 0x20]
lea r9, [0x1401176e0]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.1400654b8
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400d4195
mov rax, qword [rsp + 0xf8]
mov ebp, r13d
cmp bx, word [rax - 2]
mov qword [rsp + 0x50], rax
mov rax, rsi
sete dil
cmp r9w, r8w
sete bpl
cmp dil, r13b
cmovne rax, r13
mov qword [rsp + 0x58], rax
cmp dil, r13b
jne 0x1400d4415
cmp rsi, r13
jne 0x1400d4415
xor edx, edx
mov rcx, r12
call fcn.14001b3c8
cmp qword [r12 + 0x40], r13
jne 0x1400d4415
mov rax, 0xffffffff80070057
jmp 0x1400d4198
lea rcx, [rsp + 0x60]
mov edx, 0xa8
call fcn.140061f7c
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.140059884
lea rax, [rsp + 0x40]
lea r8, [0x1400d38f4]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov edx, 0x400000
xor ecx, ecx
lea rsi, [rbx + 0x78]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r13, rax
xor eax, eax
cmp r13, rax
je 0x1400d459a
lea rdx, [rsp + 0x68]
lea r8d, [rax + 0x20]
mov rcx, rsi
mov qword [rsp + 0x60], rax
call fcn.1400fe850
mov rcx, qword [rsp + 0xe8]
mov rax, qword [rsp + 0x50]
mov qword [rbx], r12
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rax
xor eax, eax
movsxd rcx, ebp
or rcx, 4
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x20], rax
movsxd rax, dword [rsp + 0x100]
mov qword [rbx + 0x28], rax
mov eax, dword [rsp + 0x40]
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x48], r15
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140059ef8
xor r15d, r15d
mov qword [rbx + 0x50], rax
cmp dil, r15b
jne 0x1400d450b
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x1401377a0]
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, r15
cmp ebp, r15d
jne 0x1400d452c
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rbx + 0x60], rax
mov rsi, r15
cmp ebp, r15d
jne 0x1400d454d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
mov qword [rbx + 0x68], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, r15d
jne 0x1400d45a2
cmp rdi, r15
je 0x1400d457e
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rbx + 0x30]
mov qword [rbx + 0x70], 1
cmp rsi, r15
je 0x1400d45a2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400d45a2
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov edx, dword [rsp + 0x40]
lea r8, str.__LastTID
mov rcx, r12
call fcn.140065544
lea r9, [0x1401176e0]
lea r8, str.__LastWinID
mov rdx, r14
mov rcx, r12
call fcn.1400654b8
lea rcx, [rsp + 0x60]
call fcn.140059920
mov r14d, r15d
jmp 0x1400d4195