Function at 0x14008c8f4
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
xor eax, eax
mov r14, rcx
lea rdx, [rsp + 0x58]
lea rcx, [r11 + 0x20]
xor r12d, r12d
mov rbp, r8
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.14006d2dc
lea r10d, [r12 + 2]
lea r11d, [r12 + 0x2b]
movsx r9d, al
mov rax, qword [rsp + 0x158]
mov dword [rsp + 0x68], r9d
movzx r8d, word [rax]
cmp r8w, 0x2a
je 0x14008c97c
cmp r8w, 0x2d
je 0x14008c97c
cmp r11w, r8w
jne 0x14008c987
add rax, r10
mov qword [rsp + 0x158], rax
lea rcx, [rsp + 0x158]
call fcn.14004ea3c
lea rcx, [rsp + 0x148]
call fcn.14004ea3c
mov r15, r12
cmp r9d, r12d
je 0x14008c9bd
cmp rbp, r12
je 0x14008c9bd
cmp byte [rbp + 0xb1], r12b
jne 0x14008c9bd
mov r15, qword [rbp + 0x20]
jmp 0x14008c9c2
mov dword [rsp + 0x68], r12d
test byte [rsp + 0x68], r10b
mov rax, r12
mov r13d, r12d
cmovne rax, r15
mov qword [rsp + 0x50], rax
cmp r8w, 0x2a
jne 0x14008cc54
mov ecx, 0xa00
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
call fcn.1400ccba8
mov esi, 0x271b
mov rbx, rax
cmp rax, r12
je 0x14008ca32
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.140063098
mov rbx, rax
jmp 0x14008ca35
mov rbx, r12
mov ecx, 0xf0
call fcn.1400ccba8
mov r12, rax
test rax, rax
je 0x14008ca64
mov rdx, r14
mov rcx, rax
call fcn.140015138
mov rdx, r14
mov rcx, r12
call fcn.1400158b0
mov qword [r12 + 0x40], rbx
jmp 0x14008ca67
xor r12d, r12d
mov eax, dword [rsp + 0x160]
mov rdi, qword [rsp + 0x158]
xor r8d, r8d
mov rcx, r12
mov rdx, rdi
mov byte [r12 + 0xd9], 3
mov dword [r12 + 0x24], eax
call fcn.1400636ec
mov rax, qword [rsp + 0x148]
mov dl, 1
mov rcx, rbx
mov qword [rbx + 0x220], rax
mov qword [rbx + 0xe0], r15
mov qword [rbx + 0x210], r12
call fcn.14008b0b4
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.14006016c
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.140063e5c
lea rcx, [rbx + 0xb8]
mov rdx, rax
call fcn.1400601ec
lea rcx, [rsp + 0x80]
call fcn.14004ea6c
xor r15d, r15d
cmp rdi, r15
je 0x14008cb15
cmp byte [rbx + 0xb1], r15b
je 0x14008cb25
lea rcx, [rbx + 0xf0]
mov rdx, rdi
call fcn.1400601ec
cmp byte [rbx + 0xb1], r15b
je 0x14008cb25
mov edi, 0x271c
jmp 0x14008cb46
cmp byte [rbx + 0xea], r15b
je 0x14008cb35
mov edi, 0x271d
jmp 0x14008cb46
cmp byte [rbx + 0xe9], r15b
mov edi, 0x271c
cmovne esi, edi
mov edi, esi
mov rcx, rbx
call fcn.14004ed38
mov qword [rsp + 0x48], rbp
mov rcx, qword [rsp + 0x48]
call fcn.14004ef64
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, r15
je 0x14008cb87
mov rax, qword [rsp + 0x48]
cmp byte [rax + 0xb1], r15b
je 0x14008cb87
mov eax, 2
cmp dword [r14 + 0x20], eax
cmovle r13d, eax
mov r8, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov edx, edi
mov rcx, rbx
call fcn.14005178c
mov rdx, qword [rbx + 0x20]
lea r9, [0x1400ee708]
lea r8, str.__LastWinID
mov rcx, r14
call fcn.140058ea4
xor edx, edx
mov rcx, rbx
call fcn.1400be310
lea rcx, [0x140107de8]
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140107de8]
mov qword [r12 + 0x40], r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rcx, r12
call fcn.140042014
lea rcx, [r12 + 0x70]
call fcn.14004ea6c
mov rcx, r12
call fcn.1400cc9bc
mov r11, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r11 + 0x18]
mov r11, qword [rsp + 0x40]
cmp r11, r15
je 0x14008cc31
mov rcx, qword [rsp + 0x40]
mov r8d, r13d
xor r9d, r9d
or r8, 1
mov edx, 0x451
call qword [sym.imp.USER32.dll_SendMessageW]
mov r13d, dword [rsp + 0x48]
movsxd rax, r13d
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r8w, 0x2d
jne 0x14008ce4e
mov ecx, 0xa00
call fcn.1400ccba8
mov esi, 0x271b
mov rbx, rax
cmp rax, r12
je 0x14008cca6
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.140063098
mov rbx, rax
jmp 0x14008cca9
mov rbx, r12
mov ecx, 0xf0
call fcn.1400ccba8
mov rdi, rax
cmp rax, r12
je 0x14008ccd7
mov rdx, r14
mov rcx, rax
call fcn.140015138
mov rdx, r14
mov rcx, rdi
call fcn.1400158b0
mov qword [rdi + 0x40], rbx
jmp 0x14008ccda
mov rdi, r12
mov eax, dword [rsp + 0x160]
mov r12, qword [rsp + 0x158]
xor r8d, r8d
mov rcx, rdi
mov rdx, r12
mov byte [rdi + 0xd9], 3
mov dword [rdi + 0x24], eax
call fcn.1400636ec
mov rax, qword [rsp + 0x148]
mov dl, 1
mov rcx, rbx
mov qword [rbx + 0x220], rax
mov qword [rbx + 0xe0], r15
mov qword [rbx + 0x210], rdi
call fcn.14008b0b4
mov r11, qword [rbx + 0x210]
lea rcx, [rsp + 0x78]
mov rdx, r12
mov qword [rbx + 0x208], r11
call fcn.14006016c
lea rdx, [rsp + 0x78]
mov rcx, r12
call fcn.140063e5c
lea rcx, [rbx + 0xb8]
mov rdx, rax
call fcn.1400601ec
lea rcx, [rsp + 0x78]
call fcn.14004ea6c
mov rdx, qword [rsp + 0x70]
xor r15d, r15d
cmp rdx, r15
je 0x14008cd82
lea rcx, [rbx + 0xb8]
call fcn.140060284
cmp r12, r15
je 0x14008cd9f
cmp byte [rbx + 0xb1], r15b
je 0x14008cda8
lea rcx, [rbx + 0xf0]
mov rdx, r12
call fcn.1400601ec
cmp byte [rbx + 0xb1], r15b
jne 0x14008cdc1
cmp byte [rbx + 0xe9], r15b
jne 0x14008cdc1
cmp byte [rbx + 0xea], r15b
je 0x14008cdc6
mov esi, 0x271d
jmp 0x14008cdc6
mov esi, 0x271c
mov rcx, rbx
call fcn.14004ed38
mov qword [rbx + 0x70], rbp
mov byte [rbx + 0xb0], 1
cmp rbp, r15
je 0x14008ce06
lea rcx, [0x140107de8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rbp + 0x150]
lea rcx, [0x140107de8]
mov byte [rbx + 0xb0], 9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov edx, esi
mov rcx, rbx
call fcn.14005178c
mov rdx, qword [rbx + 0x20]
lea r9, [0x1400ee708]
lea r8, str.__LastWinID
mov rcx, r14
call fcn.140058ea4
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14008cc36
mov rax, qword [rsp + 0x158]
cmp r11w, word [rax - 2]
cmove rbp, r12
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x40], r12
mov rcx, qword [rsp + 0x50]
call fcn.14004ef64
lea rcx, [0x140107968]
mov esi, r12d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0xa0], rax
movsxd rax, dword [rsp + 0x160]
mov qword [rsp + 0xa8], 4
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11, [rsp + 0xc8]
lea r9, [rsp + 0x90]
lea r8, [0x14008c400]
mov qword [rsp + 0x28], r11
mov edx, 0x400000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp rax, r12
je 0x14008cf9f
mov esi, dword [rsp + 0xc8]
mov ebx, 0x270f
mov rcx, qword [rsp + 0xa8]
cmp rcx, r12
je 0x14008cf7a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x14008cf60
mov rax, qword [rsp + 0xa8]
cmp rax, r12
je 0x14008cf9f
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rsp + 0xa8]
cmp r11, r12
jne 0x14008cf87
lea rcx, [0x140107968]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, r12
je 0x14008cfba
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
cmp rax, r12
je 0x14008cfe8
mov rax, qword [rsp + 0xe0]
cmp rax, r12
je 0x14008cfe8
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov edx, 0x451
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, str.__LastTID
mov edx, esi
mov rcx, r14
call fcn.140058f30
mov rdx, qword [rsp + 0xc0]
lea r9, [0x1400ee708]
lea r8, str.__LastWinID
mov rcx, r14
call fcn.140058ea4
jmp 0x14008cc36