Function at 0x140006130
Capabilities:
Create thread
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x310
mov rax, qword [0x14000f028]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
movups xmmword [rsp + 0x100], xmm0
movups xmmword [rsp + 0x110], xmm0
movss dword [rsp + 0xe0], xmm0
xor ebx, ebx
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xf0], rbx
lea ecx, [rbx + 0x18]
call fcn.140008550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf8], rbx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x118], 8
movss xmm0, dword [0x14000bec0]
movss dword [rsp + 0xe0], xmm0
mov r8, rax
lea edx, [rbx + 0x10]
lea rcx, [rsp + 0xf8]
call fcn.140004da0
nop
mov r15d, ebx
xor r14b, r14b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], rax
mov edx, 0x3e8
lea rcx, [rsp + 0xb8]
call fcn.140008250
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1a8], xmm0
movups xmmword [rsp + 0x1b8], xmm0
mov qword [rsp + 0x1c8], rax
lea r12, [rdi + 0xb0]
lea r13, [rdi + 0x130]
lea rsi, [rdi + 0xf0]
lea rcx, [rdi + 8]
mov qword [rsp + 0x178], r12
mov qword [rsp + 0x180], r13
mov rbx, qword [rsp + 0xc8]
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], rcx
mov qword [rsp + 0x1a0], rax
mov rax, qword [rcx]
call qword [rax]
mov qword [rsp + 0x150], rax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov qword [rsp + 0x158], rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov qword [rsp + 0x160], rax
mov rax, qword [r13]
mov rcx, r13
call qword [rax]
mov qword [rsp + 0x168], rax
mov rax, qword [r12]
mov rcx, r12
call qword [rax]
mov qword [rsp + 0x170], rax
jmp 0x140006302
lea rsi, [rdi + 0xf0]
jmp 0x14000630c
lea rsi, [rdi + 0xf0]
movabs rbx, 0x100000001b3
lea rcx, [rsp + 0x150]
call fcn.140006ee0
mov rax, qword [rsp + 0x1a0]
lea rcx, [rdi + 8]
cmp rax, rcx
jne 0x14000637b
cmp byte [rsp + 0xc0], 0
je 0x140006342
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x140006369
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 8]
nop
lea rcx, [rsp + 0xe0]
call fcn.1400043e0
jmp 0x14000692a
cmp rax, rsi
jne 0x140006472
mov rsi, qword [rsp + 0x1a8]
cmp byte [rsp + 0xc0], 0
je 0x1400063c4
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
test eax, eax
je 0x140006957
xor edx, edx
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [rsp + 0xc0], 0
test rsi, rsi
je 0x14000641a
mov dword [rsp + 0xb0], 0
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [rsp + 0xb0]
test ebx, ebx
je 0x14000641a
mov rcx, rsi
call fcn.140006a10
movzx esi, al
cmp ebx, r15d
jne 0x140006405
cmp al, r14b
je 0x14000641a
movzx r8d, sil
mov edx, ebx
mov rcx, rdi
call fcn.140006ae0
mov r15d, ebx
movzx r14d, sil
mov eax, dword [rsp + 0xc4]
imul rcx, rax, 0xffffffffffffd8f0
mov qword [rsp + 0xb0], rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
je 0x140006979
mov byte [rsp + 0xc0], 1
jmp 0x1400062fb
cmp rax, qword [rsp + 0xc8]
jne 0x140006528
cmp byte [rsp + 0xc0], 0
je 0x1400064b8
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
test eax, eax
je 0x14000699b
xor edx, edx
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [rsp + 0xc0], 0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
je 0x1400062f2
mov dword [rsp + 0xb0], 0
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [rsp + 0xb0]
test ebx, ebx
je 0x1400062fb
mov rcx, rsi
call fcn.140006a10
movzx esi, al
cmp ebx, r15d
jne 0x14000650e
cmp al, r14b
je 0x1400062fb
movzx r8d, sil
mov edx, ebx
mov rcx, rdi
call fcn.140006ae0
mov r15d, ebx
movzx r14d, sil
jmp 0x1400062fb
cmp rax, r13
jne 0x1400065c1
cmp byte [rsp + 0xc0], 0
je 0x140006569
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
test eax, eax
je 0x1400069bd
xor edx, edx
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [rsp + 0xc0], 0
mov eax, dword [rsp + 0xc4]
imul rcx, rax, 0xffffffffffffd8f0
mov qword [rsp + 0xb0], rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
je 0x1400069e5
mov byte [rsp + 0xc0], 1
jmp 0x14000630c
cmp rax, r12
jne 0x14000630c
movups xmm0, xmmword [rsp + 0x1a8]
movups xmmword [rsp + 0x1d0], xmm0
movups xmm1, xmmword [rsp + 0x1b8]
movups xmmword [rsp + 0x1e0], xmm1
movsd xmm0, qword [rsp + 0x1c8]
movsd qword [rsp + 0x1f0], xmm0
cmp byte [rsp + 0x1cc], 0
je 0x140006790
lea r8, [rsp + 0x1d0]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xe0]
call fcn.140007450
cmp byte [rsp + 0x128], 0
je 0x14000630c
cmp qword [rsp + 0xf0], 1
jne 0x14000630c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
je 0x14000668c
mov rcx, rax
call fcn.140006a10
movzx ebx, al
mov dword [rsp + 0xb0], 0
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
movzx r8d, bl
mov edx, dword [rsp + 0xb0]
mov rcx, rdi
call fcn.140006ae0
cmp qword [rdi + 0xa0], 0
lea rsi, [rdi + 0xf0]
movabs rbx, 0x100000001b3
jne 0x14000630c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
jne 0x1400066fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.WindowTrackingAgent::startWindowHookThread:_CreateEvent
lea rdx, str._s_failed_with_0x_08X
lea rcx, [rsp + 0x200]
call fcn.140007f10
lea ecx, [rbx + 1]
lea rdx, [rsp + 0x200]
call fcn.140007c70
jmp 0x1400062fb
lea rax, [rdi + 0xa8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x140006d20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0xa0], rax
test rax, rax
jne 0x140006774
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.WindowTrackingAgent::startWindowHookThread:_CreateThread
lea rdx, str._s_failed_with_0x_08X
lea rcx, [rsp + 0x200]
call fcn.140007f10
mov ecx, 1
lea rdx, [rsp + 0x200]
call fcn.140007c70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400062fb
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400062fb
mov rax, qword [rsp + 0x1a8]
movzx edx, al
movabs rcx, 0xcbf29ce484222325
xor rdx, rcx
imul rdx, rbx
movzx ecx, byte [rsp + 0x1a9]
xor rdx, rcx
imul rdx, rbx
movzx ecx, byte [rsp + 0x1aa]
xor rdx, rcx
imul rdx, rbx
movzx ecx, byte [rsp + 0x1ab]
xor rdx, rcx
imul rdx, rbx
mov r8, qword [rsp + 0x110]
and r8, rdx
add r8, r8
mov r9, qword [rsp + 0xf8]
mov r11, qword [r9 + r8*8 + 8]
mov rcx, r11
mov r10, qword [rsp + 0xe8]
cmp r11, r10
je 0x140006820
mov rdx, qword [r9 + r8*8]
cmp eax, dword [r11 + 0x10]
je 0x140006822
nop
cmp rcx, rdx
je 0x140006820
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140006810
jmp 0x140006822
xor ecx, ecx
test rcx, rcx
je 0x14000630c
mov rax, qword [r9 + r8*8]
cmp r11, rcx
jne 0x14000684f
cmp rax, rcx
jne 0x140006844
mov qword [r9 + r8*8], r10
mov qword [r9 + r8*8 + 8], r10
jmp 0x14000685b
mov r10, qword [rcx + 8]
mov qword [r9 + r8*8 + 8], r10
jmp 0x14000685b
cmp rax, rcx
jne 0x14000685b
mov rax, qword [rcx]
mov qword [r9 + r8*8], rax
mov rdx, qword [rcx]
dec qword [rsp + 0xf0]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.14000858c
cmp qword [rsp + 0xf0], 0
jne 0x14000630c
cmp qword [rdi + 0xa0], 0
je 0x14000630c
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
mov ecx, dword [rdi + 0xa8]
call qword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
jne 0x1400068f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.WindowTrackingAgent::stopWindowHookThread:_PostThreadMessage
lea rdx, str._s_failed_with_0x_08X
lea rcx, [rsp + 0x200]
call fcn.140007f10
mov ecx, 1
lea rdx, [rsp + 0x200]
call fcn.140007c70
jmp 0x14000630c
mov edx, 0xffffffff
mov rcx, qword [rdi + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0xa0], 0
mov dword [rdi + 0xa8], 0
jmp 0x14000630c
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140008530
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, str.Timer::cancel:_CancelWaitableTimer_failed
lea rcx, [rsp + 0x38]
call fcn.140002790
lea rdx, [0x14000db48]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll__CxxThrowException
lea rdx, str.Timer::resume:_SetWaitableTimer_failed
lea rcx, [rsp + 0x50]
call fcn.140002790
lea rdx, [0x14000db48]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
lea rdx, str.Timer::cancel:_CancelWaitableTimer_failed
lea rcx, [rsp + 0x68]
call fcn.140002790
lea rdx, [0x14000db48]
lea rcx, [rsp + 0x68]
call sub.VCRUNTIME140.dll__CxxThrowException
lea rdx, str.Timer::cancel:_CancelWaitableTimer_failed
lea rcx, [rsp + 0x80]
call fcn.140002790
lea rdx, [0x14000db48]
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll__CxxThrowException
lea rdx, str.Timer::resume:_SetWaitableTimer_failed
lea rcx, [rsp + 0x98]
call fcn.140002790
lea rdx, [0x14000db48]
lea rcx, [rsp + 0x98]
call sub.VCRUNTIME140.dll__CxxThrowException
int3