Function at 0x140096e90
Capabilities:
Create process on windows
Create thread
Lock the desktop

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x120]
sub rsp, reloc.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_544
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r14, r8
mov esi, edx
mov rdi, rcx
mov r10d, 0x1f7
cmp edx, r10d
ja 0x140097547
je 0x14009753d
lea eax, [rdx - 0x191]
cmp eax, 0x30
ja case.0x140096efc.406
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x977fc]
mov ecx, dword [rdx + rax*4 + 0x97794]
add rcx, rdx
jmp rcx
xor r9d, r9d
xor edx, edx
mov r8d, 0x2001
lea rcx, [0x1401b6a10]
call qword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
nop dword [rax + rax]
jmp case.0x140096efc.406
mov rcx, qword [rdi - 0x30]
call qword [case.0x140019929.1]
nop dword [rax + rax]
mov ecx, reloc.SHELL32.dll_SHRestricted
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
lea rcx, [rdi - 0x38]
call fcn.1401b2814
mov rcx, rdi
call fcn.1400a09e0
mov rcx, qword [0x140389688]
call qword [sym.imp.SHELL32.dll_Ordinal_54]
nop dword [rax + rax]
jmp case.0x140096efc.406
xor r14d, r14d
cmp byte [rdi + 0x172], r14b
jne case.0x140096efc.406
lea rcx, [rdi - 0x38]
cmp byte [rbp + 0x170], r14b
je 0x140096f96
call fcn.1401b8b44
jmp case.0x140096efc.406
mov eax, dword [0x14038bcc8]
neg eax
sbb edx, edx
add edx, 3
call fcn.140041448
cmp dword [0x14038bcc8], r14d
sete byte [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.1401a329c
jmp case.0x140096efc.406
lea rcx, [rdi - 0x38]
call fcn.1401b5aa8
jmp case.0x140096efc.406
lea rcx, [rdi - 0x38]
call fcn.1401b9ff8
jmp case.0x140096efc.406
xor r14d, r14d
cmp byte [rdi + 0x172], r14b
jne case.0x140096efc.406
lea rcx, [rdi - 0x38]
lea r8d, [r14 + 1]
mov rdx, r10
call fcn.14000ad80
jmp case.0x140096efc.406
xor r14d, r14d
cmp byte [rdi + 0x172], r14b
jne case.0x140096efc.406
lea rcx, [rdi - 0x38]
xor r8d, r8d
xor edx, edx
call fcn.1401b99b8
jmp case.0x140096efc.406
xor r14d, r14d
cmp byte [rdi + 0x172], r14b
jne case.0x140096efc.406
lea rdx, str.WindowArrangementContextMenu
lea rcx, [rbp - 0x40]
call fcn.14004c6a4
lea rax, [0x1402fcfd8]
mov qword [rbp - 0x40], rax
lea edx, [r14 + 1]
lea rcx, [rbp - 0x40]
call fcn.1401b4730
nop
lea rcx, [rbp - 0x40]
call fcn.1401b5918
lea rcx, [rdi - 0x38]
xor r8d, r8d
xor edx, edx
call fcn.1401b9ed8
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.14004ba30
nop
lea rcx, [rbp - 0x40]
call fcn.1401a444c
jmp case.0x140096efc.406
mov ecx, 2
xor r8d, r8d
xor edx, edx
call fcn.140207ea4
jmp case.0x140096efc.406
mov r8, qword [rdi - 0x30]
mov dl, 1
mov ecx, 1
jmp 0x14009709b
test byte [0x14038bd80], 1
je 0x1400970e0
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x140314910]
lea rcx, [0x140386800]
call fcn.140041cf0
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
xor edx, edx
mov rax, qword [rax + 0x1a0]
call qword [case.0x14006b68f.0]
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x248]
call qword [case.0x14006b68f.0]
test byte [0x14038bd80], 1
je case.0x140096efc.406
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x1403148f0]
lea rcx, [0x140386800]
call fcn.140041cf0
jmp case.0x140096efc.406
mov dword [rsp + 0x50], Ordinal_113
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x54]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x54], 0x200
lea rax, str._SystemRoot__system32_taskmgr.exe
mov qword [rsp + 0x68], rax
mov dword [rbp - 0x80], 1
lea rax, [0x14031ac74]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
call fcn.1401a4c18
jmp case.0x140096efc.406
xor r14d, r14d
mov ebx, r14d
lea rdx, str.WindowArrangementContextMenu
lea rcx, [rbp - 0x40]
call fcn.14004c6a4
lea rax, [0x1402fcfd8]
mov qword [rbp - 0x40], rax
lea edx, [r14 + 1]
lea rcx, [rbp - 0x40]
call fcn.1401b4730
nop
mov rcx, rdi
call fcn.1401a49a0
test eax, eax
je 0x140097303
lea rcx, [rdi - 0x38]
mov ebx, 0x193
cmp esi, ebx
jne 0x1400971f4
mov edx, 0x217
jmp 0x140097205
mov edx, 0x21a
lea eax, [rdx - 2]
cmp esi, 0x194
cmove edx, eax
call fcn.1401b3c4c
mov qword [rsp + 0x20], 1
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
mov rcx, rdi
call fcn.140041ee0
cmp esi, ebx
jne 0x14009726c
call qword [0x1403ad6e8]
nop dword [rax + rax]
mov rcx, rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_CascadeWindows]
nop dword [rax + rax]
test ax, ax
je 0x14009725a
mov ebx, r14d
jmp 0x140097261
call fcn.140020b4c
mov ebx, eax
lea rcx, [rbp - 0x40]
call fcn.1401a49d0
jmp 0x1400972c9
mov ebx, r14d
cmp esi, 0x194
setne bl
call qword [0x1403ad6e8]
nop dword [rax + rax]
mov rcx, rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_TileWindows]
nop dword [rax + rax]
test ax, ax
je 0x1400972aa
mov ebx, r14d
jmp 0x1400972b1
call fcn.140020b4c
mov ebx, eax
lea rcx, [rbp - 0x40]
cmp esi, 0x194
jne 0x1400972c4
call fcn.1401b5a24
jmp 0x1400972c9
call fcn.1401b4288
mov dword [rdi + 0xbc], r14d
xor r9d, r9d
lea edx, [r9 + 0x12]
mov r8d, 0x1f4
mov rcx, qword [rdi - 0x30]
call qword [0x1403ad698]
nop dword [rax + rax]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
mov rcx, rdi
call fcn.140041ee0
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.14004ba30
nop
jmp 0x140097083
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rdx, r9
mov rax, qword [rax + 0x1a8]
call qword [case.0x14006b68f.0]
jmp case.0x140096efc.406
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1c0]
jmp 0x1400976ec
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1d0]
jmp 0x1400976ec
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1d8]
jmp 0x1400976ec
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1e8]
jmp 0x1400976ec
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1e0]
jmp 0x1400976ec
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1c8]
jmp 0x1400976ec
mov edx, esi
call fcn.1401b6fa4
jmp case.0x140096efc.406
xor r8d, r8d
lea rdx, str.TaskbarAppsVisibleInTabletMode
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.1400555d8
xor r14d, r14d
mov ebx, r14d
test eax, eax
sete bl
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 4]
lea r8, str.TaskbarAppsVisibleInTabletMode
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call fcn.14019c1d4
test eax, eax
jle 0x140097426
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x140097448
mov edx, 0x1658
lea r8, str.pcshell_shellexplorer_tray.cpp
mov r9d, eax
mov rcx, qword [rbp + 0x148]
call fcn.14009cb2c
jmp case.0x140096efc.406
xor r9d, r9d
mov edx, 0x5ca
lea r8d, [r9 + 1]
mov rcx, qword [rdi - 0x30]
call qword [case.0x14004486b.0]
nop dword [rax + rax]
mov byte [rsp + 0x40], r14b
mov byte [rsp + 0x41], bl
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x41]
call fcn.1401a34bc
jmp case.0x140096efc.406
xor r8d, r8d
lea rdx, str.TaskbarAutoHideInTabletMode
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.1400555d8
xor r14d, r14d
mov ecx, r14d
test eax, eax
sete cl
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 4]
lea r8, str.TaskbarAutoHideInTabletMode
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call fcn.14019c1d4
test eax, eax
jle 0x1400974e4
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1400974f0
mov edx, 0x1662
jmp 0x14009742d
xor r9d, r9d
mov edx, 0x5ca
lea r8d, [r9 + 0xa]
mov rcx, qword [rdi - 0x30]
call qword [case.0x14004486b.0]
nop dword [rax + rax]
jmp case.0x140096efc.406
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1f0]
jmp 0x1400976ec
mov rcx, qword [rdi + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1f8]
jmp 0x1400976ec
mov ecx, 4
jmp 0x140097096
cmp esi, 0x291
ja 0x14009769f
cmp esi, 0x290
jae 0x140097695
cmp esi, 0x1fa
je 0x14009765a
cmp esi, 0x205
je 0x1400975de
cmp esi, 0x206
je 0x1400975bb
cmp esi, 0x207
je 0x1400975a8
lea eax, [rdx - 0x270]
cmp eax, 4
jbe 0x14009759a
cmp esi, 0x280
jne case.0x140096efc.406
add rcx, 0xffffffffffffffc8
call fcn.1400ac1ec
jmp case.0x140096efc.406
add rcx, 0xffffffffffffffc8
mov edx, 0x1f
call fcn.1401b8a84
jmp case.0x140096efc.406
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5b4
mov rcx, qword [0x140389690]
call qword [0x1403ad7b0]
nop dword [rax + rax]
jmp case.0x140096efc.406
mov al, byte [0x14038bd83]
test al, 4
je 0x14009763c
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x140314b70]
lea rcx, [0x140386800]
call fcn.140041cf0
mov al, byte [0x14038bd83]
test al, 4
je 0x14009763c
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [0x140314a78]
lea rcx, [0x140386800]
call fcn.140041cf0
call fcn.1401b5c18
test eax, eax
je case.0x140096efc.406
call qword [sym.imp.USER32.dll_LockWorkStation]
nop dword [rax + rax]
jmp case.0x140096efc.406
mov rcx, qword [rcx - 0x30]
call qword [case.0x140019929.1]
nop dword [rax + rax]
mov ecx, reloc.SHELL32.dll_SHRestricted
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
lea rcx, [rdi - 0x38]
call fcn.1401b2814
mov r9d, r14d
lea rcx, [rdi - 0x38]
call fcn.1401b68f4
jmp case.0x140096efc.406
call fcn.1400ac0b8
jmp case.0x140096efc.406
sub esi, 0x1388
je 0x14009773f
sub esi, 1
je 0x140097707
sub esi, 0x8ca7
je 0x1400976f4
sub esi, 0x35
je 0x1400976db
cmp esi, 0x21
jne case.0x140096efc.406
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Ordinal_91]
nop dword [rax + rax]
jmp case.0x140096efc.406
mov rcx, qword [rcx + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1b0]
call qword [case.0x14006b68f.0]
jmp case.0x140096efc.406
mov rcx, qword [rcx + 0x2e8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x1b8]
jmp 0x1400976ec
mov ecx, 3
call qword [sym.imp.SHLWAPI.dll_Ordinal_413]
nop dword [rax + rax]
xor r14d, r14d
test rax, rax
je case.0x140096efc.406
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r14 + 0xd]
or edx, 0xffffffff
xor ecx, ecx
call qword [0x1403ad178]
nop dword [rax + rax]
jmp case.0x140096efc.406
mov rcx, qword [rcx - 0x30]
call qword [case.0x140019929.1]
nop dword [rax + rax]
mov ecx, reloc.SHELL32.dll_SHRestricted
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
mov rcx, qword [0x140389688]
call qword [sym.imp.SHELL32.dll_Ordinal_254]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1400a15a0
add rsp, reloc.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_Ordinal_544
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret