Function at 0x1400b5dd4
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xe8]
xor r13d, r13d
mov rdi, r8
mov rsi, rdx
cmp rax, r13
je 0x1400b5e16
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
jmp 0x1400b5e1b
mov qword [rsp + 0x30], r13
mov r15d, dword [rsp + 0xb0]
mov rbx, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xc0]
mov ebp, r15d
and r15d, 0xf
mov r14, rbx
and ebp, 0x1c0
cmp rbx, r13
jne 0x1400b5e75
cmp dword [r12 + 0x10], r13d
je 0x1400b5e5a
cmp rdx, r13
je 0x1400b5e5a
mov r14, qword [rdx + 0x20]
jmp 0x1400b5e6b
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r9, qword [rsp + 0x98]
mov r14, rax
cmp r14, r13
jne 0x1400b5e75
mov dword [r12 + 0x10], r13d
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13d, eax
mov eax, 0xb4
cmp r13d, eax
cmovg r13d, eax
mov dword [rsp + 0xb0], r13d
cmp bpl, 0x80
jne 0x1400b6098
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0xe8]
xor r12d, r12d
movsxd rdx, eax
mov dword [rsp + 0xb0], r12d
add rdx, 0x1f9
call fcn.140063314
mov rbx, qword [rsp + 0xe8]
mov rcx, rbx
call fcn.14005ae5c
mov eax, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0x90]
lea rdi, [rbx + 0x3f0]
mov dword [rbx + 0x2e4], r13d
mov dword [rbx + 0x30c], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0x98]
mov qword [rbx + 0x2f0], rdi
lea rsi, [rbx + 0x150]
movsxd rdi, r13d
mov dword [rsi], eax
mov rax, qword [rsp + 0xb8]
lea rcx, [rbx + 0x154]
mov qword [rbx + 0x300], rax
mov eax, dword [rsp + 0xc8]
lea r8, [rdi + rdi]
mov dword [rbx + 0x12c], eax
mov eax, dword [rsp + 0xd0]
mov byte [rbx + 0x3b8], 0xf0
mov dword [rbx + 0x130], eax
mov rax, qword [rsp + 0x30]
mov byte [rbx + 0x2f8], r15b
mov qword [rbx + 0x68], rax
call fcn.14001d7d8
mov rax, qword [rsp + 0xd8]
mov r14, qword [rsp + 0x80]
mov word [rbx + rdi*2 + 0x154], r12w
mov qword [rbx + 0x3c8], rax
lea rax, [rsp + 0xb0]
lea r8, [0x1400b59bc]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov edx, 0x20000
xor ecx, ecx
mov qword [rbx + 0x3c0], r14
mov qword [rbx + 0x3b0], rsi
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rsp + 0xb0]
mov dword [0x14013d7f8], ecx
mov rsi, rax
cmp rax, r12
je 0x1400b606e
shr ebp, 8
mov rdi, r12
not ebp
and ebp, 1
je 0x1400b600e
lea edx, [r12 + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
lea rcx, [0x14013e190]
mov qword [rbx + 0x3d0], rdi
mov qword [rsp + 0xe8], r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x14013d7e8]
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, r12d
je 0x1400b606e
cmp rdi, r12
je 0x1400b606e
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0xb0]
lea r8, str.__LastTID
mov rcx, r14
call fcn.140066648
lea rcx, [rsp + 0xe8]
call fcn.14005aef8
xor eax, eax
jmp 0x1400b632e
xor r13d, r13d
cmp rsi, r13
je 0x1400b60ab
cmp dword [rsi + 0x1c0], r13d
cmovne rsi, r13
mov rdi, r14
mov qword [rsp + 0xe0], r14
cmp r14, r13
jne 0x1400b60cc
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdi, rax
mov qword [rsp + 0xe0], rax
cmp ebp, 0x40
je 0x1400b60e7
cmp rsi, r13
je 0x1400b60e7
cmp rbx, r13
jne 0x1400b60e7
mov rdi, qword [rsi + 0x20]
mov qword [rsp + 0xe0], rdi
mov ecx, 0x3e0
call fcn.1401021d8
cmp rax, r13
je 0x1400b610c
mov r8d, 0x2720
mov rdx, rdi
mov rcx, rax
call fcn.140001000
mov rdi, rax
jmp 0x1400b610f
mov rdi, r13
mov eax, dword [rsp + 0xb0]
mov rdx, qword [rsp + 0x90]
lea rcx, [rdi + 0x2e8]
mov dword [rdi + 0x2e4], eax
mov eax, dword [rsp + 0xa0]
mov r13, rdi
mov dword [rdi + 0x30c], eax
call fcn.14006ffb0
mov rax, qword [rdi + 0x2e8]
mov r11d, dword [rsp + 0xa8]
movsxd rbx, dword [rsp + 0xb0]
mov rdx, qword [rsp + 0x98]
mov qword [rdi + 0x2f0], rax
mov rax, qword [rsp + 0xb8]
lea r8, [rbx + rbx]
mov qword [rdi + 0x300], rax
mov eax, dword [rsp + 0xc8]
lea rcx, [rdi + 0x154]
mov dword [rdi + 0x12c], eax
mov eax, dword [rsp + 0xd0]
mov dword [rdi + 0x150], r11d
mov dword [rdi + 0x130], eax
mov rax, qword [rsp + 0x30]
mov byte [rdi + 0x2f8], r15b
mov qword [rdi + 0x68], rax
call fcn.14001d7d8
xor eax, eax
mov rcx, rsi
mov word [rdi + rbx*2 + 0x154], ax
call fcn.14005b4d0
mov rcx, rdi
mov r15, rax
call fcn.1400e5aa8
xor ebx, ebx
cmp rsi, rbx
je 0x1400b61e4
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.USER32.dll_SetFocus]
mov rdx, qword [r12 + 0x18]
cmp rdx, rbx
je 0x1400b61fa
lea rcx, [rdi + 0x118]
call fcn.14006ffb0
mov rax, qword [rsp + 0xd8]
mov byte [rdi + 0x111], bl
lea rbx, [rdi + 0x140]
mov qword [rbx], r14
mov r14, qword [rsp + 0x80]
mov qword [rdi + 0x3c8], rax
mov qword [rdi + 0x3c0], r14
xor r14d, r14d
mov byte [rdi + 0x110], r14b
cmp ebp, 0xc0
jne 0x1400b627a
mov qword [rdi + 0xc8], rsi
mov byte [rdi + 0x110], 1
cmp r15, r14
je 0x1400b6275
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rsi + 0x1b8]
lea rcx, [0x14013e190]
mov byte [rdi + 0x110], 9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, r14
jmp 0x1400b6281
mov byte [rdi + 0x110], 0x10
cmp rsi, r14
je 0x1400b6296
cmp dword [r12 + 0x10], r14d
je 0x1400b6296
mov rax, qword [rsi + 0x20]
mov qword [rbx], rax
jmp 0x1400b629b
mov dword [r12 + 0x10], r14d
mov r8, qword [rsp + 0xe0]
and dword [r12 + 0x14], 0xfffffff3
and dword [r12 + 0x10], 0xfffffff3
mov r9, r12
xor edx, edx
mov rcx, r13
call fcn.14005e014
cmp ebp, 0x40
jne 0x1400b62cd
xor edx, edx
mov rcx, r13
call fcn.1400e8708
jmp 0x1400b62f7
cmp ebp, 0xc0
jne 0x1400b62ed
mov rcx, qword [r13 + 0x20]
lea edx, [rbp + 0x50]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, r14d
jmp 0x1400b62fe
xor edx, edx
mov rcx, r13
call fcn.1400e8b0c
mov ebx, dword [r13 + 0x310]
cmp r15, r14
je 0x1400b6318
xor r9d, r9d
mov edx, 0x451
mov rcx, r15
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rdi, r14
je 0x1400b632c
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8 + 0x18]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret