Function at 0x1400056c0
Capabilities:
Create thread
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [r11 - 0x2d8]
sub rsp, 0x3b0
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov r9, qword [0x140079b70]
mov r12d, r8d
mov qword [r11 + 0x18], rbx
mov edi, edx
mov qword [r11 - 0x30], rsi
lea rbx, [0x140079b70]
mov r15d, ecx
test byte [r9 + 0x1c], 4
je 0x140005770
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x104
call fcn.1400423d0
mov r9d, r15d
mov dword [rsp + 0x20], edi
lea r8, str.CheckNotification__dwNotifyCode__0x_x__dwParam__0x_x
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140006720
mov r9, qword [0x140079b70]
cmp r9, rbx
je 0x140005770
test byte [r9 + 0x1c], 4
je 0x140005770
mov rcx, qword [r9 + 0x10]
lea rax, [rsp + 0x70]
mov edx, 0xa
mov qword [rsp + 0x20], rax
call fcn.14003f070
mov r9, qword [0x140079b70]
xor r13d, r13d
lea eax, [r15 - 0x4b]
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x34], r13d
lea esi, [r13 + 2]
cmp eax, 0xaf
ja case.default.0x1400057b1
lea rdx, [0x140000000]
mov qword [rsp + 0x3a0], r14
movzx eax, byte [rdx + rax + 0x6658]
mov ecx, dword [rdx + rax*4 + 0x65c4]
add rcx, rdx
jmp rcx
mov edx, r13d
cmp edi, esi
jne 0x1400057d3
mov ecx, 1
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
call fcn.14003ec90
jmp case.0x1400057b1.76
cmp edi, 3
jne 0x1400057ef
mov ecx, r13d
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
call fcn.14003ec90
jmp case.0x1400057b1.76
test edi, edi
lea r9, [rsp + 0x34]
mov ecx, esi
lea r8, [rsp + 0x30]
sete dl
call fcn.14003ec90
jmp case.0x1400057b1.76
lea r9, [rsp + 0x34]
mov edx, edi
lea r8, [rsp + 0x30]
xor ecx, ecx
call fcn.140016ce0
jmp case.0x1400057b1.76
lea r9, [rsp + 0x34]
mov edx, edi
lea r8, [rsp + 0x30]
mov ecx, 1
call fcn.140016ce0
jmp case.0x1400057b1.76
cmp dword [0x14007b3a4], r13d
je case.0x1400057b1.76
cmp dword [0x140079950], r13d
je case.0x1400057b1.76
mov eax, dword [0x14007b3a0]
dec eax
cmp eax, 1
ja case.0x1400057b1.76
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14007b388]
mov qword [0x14007b378], rax
test rcx, rcx
jne 0x140006431
lea r8, [0x1400115f0]
jmp 0x1400061c5
mov dword [rsp + 0x30], 0x57
cmp dword [0x14007cb8c], r13d
je case.0x1400057b1.76
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
cmp dword [0x14007cb88], r13d
mov qword [0x14007cb80], rax
jne case.0x1400057b1.76
mov dword [0x14007cb88], 1
lea r8, [0x14003c8c0]
jmp 0x1400061c5
mov dword [rsp + 0x30], 0x58
jmp case.0x1400057b1.76
mov rax, qword [0x14007d110]
dec rax
cmp rax, 0xfffffffffffffffd
ja case.0x1400057b1.76
lea rax, [rsp + 0x38]
mov dword [rsp + 0x48], 0x60027
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r8d, 4
mov dword [rsp + 0x38], 4
lea rdx, [rsp + 0x48]
mov ecx, 0x53545344
call fcn.140006780
test eax, eax
je case.0x1400057b1.76
cmp dword [rsp + 0x38], 4
mov eax, r13d
cmovae eax, dword [rsp + 0x58]
bt eax, 0x10
jae case.0x1400057b1.76
and eax, 1
test edi, edi
jne case.0x1400057b1.76
mov dword [rsp + 0x30], 0x78
mov dword [rsp + 0x34], eax
jmp case.0x1400057b1.76
xor ecx, ecx
call fcn.1400075f0
jmp case.0x1400057b1.76
cmp edi, 0x80
mov ecx, r13d
setae cl
jae 0x140005984
mov edx, esi
jmp 0x140005995
lea edx, [rdi - 0x200]
cmp edi, 0x200
jae 0x140005995
lea edx, [rdi - 0x80]
mov r8d, r13d
cmp edi, 0x80
jae 0x1400059a8
test edi, edi
sete r8b
jmp 0x1400059b2
cmp edi, 0x200
setae r8b
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400192f0
jmp case.0x1400057b1.76
cmp edi, 0x80
mov r14d, r13d
setae r14b
jb 0x1400059f3
lea esi, [rdi - 0x200]
cmp edi, 0x200
jae 0x1400059eb
lea esi, [rdi - 0x80]
cmp edi, 0x80
jae 0x1400059fd
test edi, edi
mov ebx, r13d
sete bl
jmp 0x140005a09
cmp edi, 0x200
mov ebx, r13d
setae bl
lea eax, [rdi - 0x40]
cmp eax, 1
jbe 0x140005a56
lea rax, [rsp + 0x34]
mov r8d, ebx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, esi
mov ecx, r14d
call fcn.14001aee0
test eax, eax
jne case.0x1400057b1.76
lea rax, [rsp + 0x34]
mov r8d, ebx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, esi
mov ecx, r14d
call fcn.140019dc0
jmp case.0x1400057b1.76
cmp dword [0x14007b4c8], 1
jne case.0x1400057b1.76
cmp dword [0x14007b4b4], r13d
je case.0x1400057b1.76
cmp dword [0x14007b4bc], r13d
jne 0x140005a86
cmp dword [0x14007b4b8], r13d
je case.0x1400057b1.76
mov edx, r13d
lea rcx, str.GPUClockOption
cmp edi, 0x41
sete dl
mov dword [0x140079984], edx
call fcn.1400320f0
call fcn.14001b420
jmp case.0x1400057b1.76
cmp edi, 0x80
mov ecx, r13d
setae cl
jae 0x140005abd
mov edx, esi
jmp 0x140005ace
lea edx, [rdi - 0x200]
cmp edi, 0x200
jae 0x140005ace
lea edx, [rdi - 0x80]
mov r8d, r13d
cmp edi, 0x80
jae 0x140005ae1
test edi, edi
sete r8b
jmp 0x140005aeb
cmp edi, 0x200
setae r8b
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14001b7e0
jmp case.0x1400057b1.76
cmp dword [0x14007c914], r13d
je case.0x1400057b1.76
lea rsi, str.Request_Hibernate_helper
cmp r9, rbx
je 0x140005b37
test byte [r9 + 0x1c], 4
je 0x140005b37
mov rcx, qword [r9 + 0x10]
mov edx, 0xb
mov qword [rsp + 0x20], rsi
call fcn.14003f070
mov rcx, rsi
call fcn.14003fe60
mov ecx, 1
call fcn.140031830
jmp case.0x1400057b1.76
lea rsi, str.Request_Hibernate
cmp r9, rbx
je 0x140005b74
test byte [r9 + 0x1c], 4
je 0x140005b74
mov rcx, qword [r9 + 0x10]
mov edx, 0xb
mov qword [rsp + 0x20], rsi
call fcn.14003f070
mov rcx, rsi
call fcn.14003fe60
xor ecx, ecx
call fcn.140031830
test eax, eax
jne case.0x1400057b1.76
call fcn.140031790
jmp case.0x1400057b1.76
xor ecx, ecx
call fcn.140031900
jmp case.0x1400057b1.76
call fcn.14002a650
jmp case.0x1400057b1.76
mov edx, r13d
cmp edi, esi
jne 0x140005bb7
mov ecx, r13d
jmp 0x140005bc8
cmp edi, 3
jne 0x140005bc1
lea ecx, [rdi - 2]
jmp 0x140005bc8
test edi, edi
mov ecx, esi
sete dl
lea rax, [rsp + 0x34]
mov r8d, 1
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14000b210
jmp case.0x1400057b1.76
test edi, edi
mov dword [rsp + 0x28], 1
mov r8d, r13d
lea rax, [rsp + 0x34]
sete r8b
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r9, [rsp + 0x30]
mov edx, 1
call fcn.140027940
jmp case.0x1400057b1.76
test edi, edi
mov dword [rsp + 0x28], 1
mov r8d, r13d
lea rax, [rsp + 0x34]
sete r8b
mov qword [rsp + 0x20], rax
xor edx, edx
lea r9, [rsp + 0x30]
xor ecx, ecx
call fcn.140027940
jmp case.0x1400057b1.76
cmp edi, 0x80
jae 0x140005c5e
test edi, edi
mov r8d, r13d
mov ecx, r13d
mov edx, esi
sete r8b
jmp 0x140005c7c
mov ecx, 1
cmp edi, 0x100
jb 0x140005c76
lea edx, [rdi - 0x100]
mov r8d, ecx
jmp 0x140005c7c
lea edx, [rdi - 0x80]
mov r8d, r13d
lea rax, [rsp + 0x34]
mov dword [rsp + 0x28], 1
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140027940
jmp case.0x1400057b1.76
cmp dword [0x14007b9fc], r13d
jne 0x140005cb3
cmp dword [0x14007b9f8], r13d
je case.0x1400057b1.76
mov ebx, dword [0x140079adc]
call fcn.140026cf0
mov ecx, ebx
call fcn.140027e90
jmp case.0x1400057b1.76
mov ecx, 1
xor edx, edx
mov r8d, ecx
call fcn.140028100
cmp dword [0x14007b9fc], r13d
jne case.0x1400057b1.76
cmp dword [0x14007b9f8], r13d
jne case.0x1400057b1.76
cmp dword [0x140079b5c], 1
jne case.0x1400057b1.76
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140026d70
test eax, eax
je case.0x1400057b1.76
cmp dword [0x140079b58], r13d
jne 0x140005d88
mov eax, dword [0x140079998]
dec eax
test eax, 0xfffffffa
jne 0x140005d88
cmp dword [0x14007b544], r13d
jne 0x140005d91
xor edx, edx
lea rcx, [rbp + 0x80]
mov r8d, 0x208
call fcn.1400423d0
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x3c], r13d
lea rdx, [rbp + 0x80]
mov ecx, 1
call fcn.1400140d0
test eax, eax
je 0x140005d88
cmp dword [rsp + 0x3c], r13d
je 0x140005d88
xor r9d, r9d
mov qword [rsp + 0x28], r13
xor r8d, r8d
mov dword [rsp + 0x20], r13d
mov edx, esi
lea ecx, [r9 + 0x16]
call fcn.1400242b0
cmp dword [0x14007b544], r13d
je 0x140005db6
cmp dword [0x14007994c], 1
mov ecx, dword [0x140079948]
je 0x140005da6
mov ecx, dword [0x140079944]
cmp ecx, esi
je 0x140005db6
test ecx, ecx
mov eax, r13d
cmove eax, esi
test eax, eax
je 0x140005dbb
call fcn.140015cd0
call fcn.140037720
jmp case.0x1400057b1.76
cmp dword [0x14007b9fc], r13d
jne 0x140005ddb
cmp dword [0x14007b9f8], r13d
je case.0x1400057b1.76
mov edx, 1
xor ecx, ecx
call fcn.140026d70
test eax, eax
je case.0x1400057b1.76
call fcn.140028550
jmp case.0x1400057b1.76
mov edx, r13d
cmp edi, esi
jne 0x140005e05
mov ecx, r13d
jmp 0x140005e16
cmp edi, 3
jne 0x140005e0f
lea ecx, [rdi - 2]
jmp 0x140005e16
test edi, edi
mov ecx, esi
sete dl
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
call fcn.14000c4a0
test r12d, r12d
je case.0x1400057b1.76
mov edx, 1
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x50]
call fcn.140031c50
test eax, eax
je case.0x1400057b1.76
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x6c]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x5c], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.PhysicalKey
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140005ec0
mov eax, dword [rsp + 0x60]
test al, 1
jne 0x140005ec0
mov rcx, qword [rsp + 0x50]
lea rdx, str.PhysicalKey
or eax, 1
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x64], eax
mov r9d, 4
lea rax, [rsp + 0x64]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp case.0x1400057b1.76
cmp edi, esi
jne 0x140005f03
cmp qword [0x14007cff8], r13
je case.0x1400057b1.76
xor edx, edx
lea rcx, str.ArrowKeySwitch
call fcn.1400320f0
test eax, eax
je case.0x1400057b1.76
mov rcx, qword [0x14007cff8]
jmp 0x140006431
cmp edi, 3
jne 0x140005f38
cmp qword [0x14007cff8], r13
je case.0x1400057b1.76
lea edx, [rdi - 2]
lea rcx, str.ArrowKeySwitch
call fcn.1400320f0
test eax, eax
je case.0x1400057b1.76
mov rcx, qword [0x14007cff8]
jmp 0x140006431
cmp qword [0x14007cff8], r13
je case.0x1400057b1.76
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], r13d
call fcn.1400397a0
mov ebx, r13d
lea rcx, str.ArrowKeySwitch
cmp dword [rsp + 0x40], ebx
sete bl
mov edx, ebx
call fcn.1400320f0
test eax, eax
je 0x140005f7d
mov rcx, qword [0x14007cff8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
test edi, edi
jne case.0x1400057b1.76
mov dword [rsp + 0x30], 0x4b
mov dword [rsp + 0x34], ebx
jmp case.0x1400057b1.76
cmp dword [0x14007c90c], r13d
je case.0x1400057b1.76
xor ecx, ecx
call fcn.140039a50
test eax, eax
lea rcx, str.FnSwitch
mov esi, r13d
sete sil
mov edx, esi
call fcn.1400320f0
mov ecx, esi
call fcn.140039870
mov edx, 1
mov dword [0x140079a4c], esi
xor ecx, ecx
call fcn.140039970
mov r14d, dword [0x7ffe02d8]
cmp r14d, 0xffffffff
je 0x14000603a
mov ecx, dword [0x14007d4d0]
mov ebx, r13d
test ecx, ecx
je 0x14000603a
lea r13, [0x140000000]
nop dword [rax]
mov eax, ebx
lea rdx, [rax*8 + 0x7d450]
mov rax, qword [rdx + r13]
cmp dword [rax], r14d
jne 0x140006031
cmp qword [rax + 8], 0
je 0x140006031
mov dword [rax + 0x20], esi
mov rcx, qword [rdx + r13]
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov ecx, dword [0x14007d4d0]
inc ebx
cmp ebx, ecx
jb 0x140006000
xor r13d, r13d
test edi, edi
jne case.0x1400057b1.76
mov dword [rsp + 0x30], 0x4e
mov dword [rsp + 0x34], esi
jmp case.0x1400057b1.76
mov ecx, dword [0x140079a0c]
mov eax, dword [0x1400799b4]
cmp ecx, esi
jne 0x14000608e
mov ecx, r13d
mov dword [0x140079a0c], ecx
cmp eax, esi
jne 0x140006081
call fcn.14002aa70
mov ecx, dword [0x140079a0c]
mov eax, dword [0x1400799b4]
cmp eax, 1
jne 0x14000608e
mov dword [0x140079a0c], eax
jmp 0x1400060d1
cmp ecx, 1
je 0x1400060d1
mov ecx, dword [0x140079a08]
cmp ecx, esi
jne 0x1400060c8
mov ecx, r13d
mov dword [0x140079a08], ecx
cmp eax, esi
jne 0x1400060bb
call fcn.14002aa70
mov eax, dword [0x1400799b4]
mov ecx, dword [0x140079a08]
cmp eax, 1
jne 0x1400060c8
mov dword [0x140079a08], eax
jmp 0x1400060d1
cmp ecx, 1
jne case.0x1400057b1.76
call fcn.14002ba60
mov eax, dword [0x140079a0c]
cmp eax, esi
jne 0x140006111
cmp dword [0x1400799b4], esi
mov eax, r13d
mov dword [0x140079a0c], eax
jne 0x1400060fc
call fcn.14002aa70
mov eax, dword [0x140079a0c]
cmp dword [0x1400799b4], 1
jne 0x140006111
mov dword [0x140079a0c], 1
jmp 0x140006116
cmp eax, 1
jne 0x140006150
cmp dword [0x1400799b0], r13d
jne 0x14000612d
cmp dword [0x14007c068], r13d
mov eax, 1
jne 0x140006130
mov eax, r13d
cmp dword [0x14007cfe0], eax
je 0x140006150
mov rcx, qword [0x14007cfe8]
mov dword [0x14007cfe0], eax
test rcx, rcx
je 0x140006150
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov eax, dword [0x140079a08]
cmp eax, esi
jne 0x14000618b
cmp dword [0x1400799b4], esi
mov eax, r13d
mov dword [0x140079a08], eax
jne 0x140006176
call fcn.14002aa70
mov eax, dword [0x140079a08]
cmp dword [0x1400799b4], 1
jne 0x14000618b
mov dword [0x140079a08], 1
jmp 0x140006194
cmp eax, 1
jne case.0x1400057b1.76
cmp dword [0x14007c068], r13d
je case.0x1400057b1.76
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov rcx, qword [0x14007c078]
mov qword [0x14007c070], rax
test rcx, rcx
jne 0x140006431
lea r8, [0x14002bb70]
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je case.0x1400057b1.76
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp case.0x1400057b1.76
mov rax, qword [0x14007d110]
dec rax
cmp rax, 0xfffffffffffffffd
ja case.0x1400057b1.76
lea rax, [rsp + 0x44]
mov dword [rsp + 0x4c], 0x10
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r8d, 4
mov dword [rsp + 0x44], 4
lea rdx, [rsp + 0x4c]
mov ecx, 0x474f4457
call fcn.140006780
test eax, eax
je case.0x1400057b1.76
cmp dword [rsp + 0x44], 4
mov ecx, r13d
cmovae ecx, dword [rsp + 0x68]
mov edx, ecx
mov eax, ecx
and edx, 0x7fff
and eax, 0x8000
cmove edx, ecx
lea eax, [rdx - 3]
cmp eax, 0x129
ja 0x140006282
imul eax, edx, 0x3e8
mov dword [0x14007cef4], 1
mov dword [0x140079a74], eax
mov rax, qword [0x14007cef8]
test rax, rax
je 0x1400062d9
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov rcx, qword [0x14007cf08]
test rcx, rcx
je 0x1400062c2
mov edx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x14007cf08]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x14007cf08], r13
mov rcx, qword [0x14007cef8]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, r13
mov qword [0x14007cef8], rax
cmp dword [0x14007cef4], r13d
je case.0x1400057b1.76
test rax, rax
jne case.0x1400057b1.76
xor r9d, r9d
lea edx, [rax + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov qword [0x14007cef8], rax
test rax, rax
je case.0x1400057b1.76
cmp qword [0x14007cf08], r13
jne case.0x1400057b1.76
mov qword [rsp + 0x28], r13
lea r8, [0x14003ef70]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x14007cf08], rax
jmp case.0x1400057b1.76
xor edx, edx
lea rcx, str.NKeyRollover
call fcn.1400320f0
test eax, eax
je case.0x1400057b1.76
mov rcx, qword [0x14007cff0]
mov dword [rsp + 0x30], 0xab
test rcx, rcx
je case.0x1400057b1.76
jmp 0x140006431
mov edx, 1
lea rcx, str.NKeyRollover
call fcn.1400320f0
test eax, eax
je case.0x1400057b1.76
mov dword [rsp + 0x34], 1
jmp 0x14000635d
cmp dword [0x14007b3a4], r13d
je case.0x1400057b1.76
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
sub rax, qword [0x14007b338]
cmp rax, 0xea60
jae case.0x1400057b1.76
lea rdx, str.Fail
lea rcx, str.SetUMASwitch_notify
call fcn.14003fbe0
jmp case.0x1400057b1.76
cmp dword [0x14007b3a4], r13d
je case.0x1400057b1.76
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
sub rax, qword [0x14007b338]
cmp rax, 0xea60
jae case.0x1400057b1.76
lea rdx, str.Eject
lea rcx, str.SetUMASwitch_notify
call fcn.14003fbe0
jmp case.0x1400057b1.76
call fcn.14000fdb0
jmp case.0x1400057b1.76
mov dword [rsp + 0x30], 0xc9
jmp case.0x1400057b1.76
cmp qword [0x14007c918], r13
je case.0x1400057b1.76
call fcn.140039b40
test eax, eax
je case.0x1400057b1.76
mov rcx, qword [0x14007c918]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov r14, qword [rsp + 0x3a0]
cmp dword [0x14007c03c], 0
mov rsi, qword [rsp + 0x3a8]
mov rbx, qword [rsp + 0x3f0]
jne 0x140006462
cmp r15d, 0x35
jne 0x140006578
mov ecx, dword [0x140079a00]
cmp ecx, 2
jne 0x140006481
call fcn.14003e150
mov ecx, r13d
cmp eax, 0xffffffff
sete cl
mov dword [0x140079a00], ecx
cmp ecx, 1
jne 0x140006578
cmp r15d, 0x35
jne 0x14000654c
cmp dword [0x1400799a8], 0
mov eax, dword [0x14007b278]
je 0x140006515
test eax, eax
je 0x140006505
mov rcx, qword [0x14007c060]
test rcx, rcx
je 0x1400064be
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
jmp 0x14000654c
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea r8, [0x14002b900]
mov qword [0x14007c060], rax
xor edx, edx
mov dword [rsp + 0x20], r13d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
test rax, rax
je 0x14000654c
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x14000654c
mov ecx, dword [0x7ffe02d8]
cmp ecx, 0xffffffff
je 0x14000654c
xor edx, edx
jmp 0x14000653c
test eax, eax
je 0x14000652b
mov rcx, qword [0x14007c060]
test rcx, rcx
je 0x14000652b
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov ecx, dword [0x7ffe02d8]
cmp ecx, 0xffffffff
je 0x14000654c
mov edx, 2
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
call fcn.14003d1c0
cmp dword [0x14007c03c], 0
je 0x140006578
mov rax, qword [0x14007cbc8]
test rax, rax
je 0x140006578
mov edx, dword [0x14007cbc0]
test edx, edx
je 0x140006578
mov r8, r15
xor r9d, r9d
mov ecx, 0xffff
call rax
mov eax, dword [rsp + 0x34]
mov r8d, edi
mov r9d, dword [rsp + 0x30]
mov edx, r15d
mov qword [rsp + 0x28], r13
mov ecx, 0x81
mov dword [rsp + 0x20], eax
call fcn.1400242b0
mov edx, r12d
mov ecx, r15d
call fcn.14000b0d0
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1400406e0
add rsp, 0x3b0
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret