Function at 0x14008177c
Capabilities:
Create thread
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor eax, eax
mov r12, rcx
xor r13d, r13d
mov dword [r11 - 0x70], r13d
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
lea rcx, [r11 + 0x20]
lea rdx, [r11 - 0x70]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov rsi, r8
call fcn.14007f648
movsx r10d, al
mov rax, qword [rsp + 0xf8]
movzx r8d, word [rax]
mov dword [rsp + 0x78], r10d
cmp r8w, r13w
je 0x1400817ef
mov r9w, word [rax + 2]
jmp 0x1400817f2
mov r9d, r13d
mov ebx, 0x2b
lea r11d, [rbx - 0x29]
cmp r8w, 0x2a
je 0x14008180f
cmp r8w, 0x2d
je 0x14008180f
cmp bx, r8w
jne 0x14008181a
add rax, r11
mov qword [rsp + 0xf8], rax
cmp r8w, word [rax]
jne 0x140081831
add rax, r11
cmp r8w, word [rax]
je 0x140081820
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0xf8]
call fcn.14005aec8
lea rcx, [rsp + 0xe8]
call fcn.14005aec8
mov r15, r13
cmp r10d, r13d
je 0x140081867
cmp rsi, r13
je 0x140081867
cmp byte [rsi + 0x111], r13b
jne 0x140081867
mov r15, qword [rsi + 0x20]
jmp 0x14008186c
mov dword [rsp + 0x78], r13d
test byte [rsp + 0x78], r11b
mov rax, r13
mov r14d, r13d
cmovne rax, r15
mov qword [rsp + 0x58], rax
cmp r8w, 0x2a
jne 0x140081aff
mov ecx, 0xa88
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
call fcn.1401021d8
mov ebp, 0x271b
mov rbx, rax
cmp rax, r13
je 0x1400818dc
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140072e3c
mov rbx, rax
jmp 0x1400818df
mov rbx, r13
mov ecx, 0xf0
call fcn.1401021d8
mov r13, rax
xor eax, eax
cmp r13, rax
je 0x14008190f
mov rdx, r12
mov rcx, r13
call fcn.140017d28
mov rdx, r12
mov rcx, r13
call fcn.140018708
mov qword [r13 + 0x40], rbx
jmp 0x140081912
mov r13, rax
mov eax, dword [rsp + 0x100]
mov rdi, qword [rsp + 0xf8]
xor r8d, r8d
mov rcx, r13
mov rdx, rdi
mov byte [r13 + 0xd9], 3
mov dword [r13 + 0x24], eax
call fcn.14007392c
mov rax, qword [rsp + 0xe8]
mov edx, 1
mov rcx, rbx
mov qword [rbx + 0x290], rax
mov qword [rbx + 0x140], r15
mov qword [rbx + 0x280], r13
call fcn.14007f7b0
lea rcx, [rsp + 0x88]
mov rdx, rdi
call fcn.14006ff14
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.14007409c
lea rcx, [rbx + 0x118]
mov rdx, rax
call fcn.14006ffb0
lea rcx, [rsp + 0x88]
call fcn.14005aef8
xor r15d, r15d
cmp rdi, r15
je 0x1400819c1
cmp byte [rbx + 0x111], r15b
je 0x1400819d1
lea rcx, [rbx + 0x150]
mov rdx, rdi
call fcn.14006ffb0
cmp byte [rbx + 0x111], r15b
je 0x1400819d1
mov edi, 0x271c
jmp 0x1400819f2
cmp byte [rbx + 0x14a], r15b
je 0x1400819e1
mov edi, 0x271d
jmp 0x1400819f2
cmp byte [rbx + 0x149], r15b
mov edi, 0x271c
cmovne ebp, edi
mov edi, ebp
mov rcx, rbx
call fcn.1400e5aa8
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x48]
call fcn.14005b4d0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, r15
je 0x140081a34
mov rax, qword [rsp + 0x48]
cmp byte [rax + 0x111], r15b
je 0x140081a34
mov eax, 2
cmp dword [r12 + 0x20], eax
cmovle r14d, eax
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x68]
mov edx, edi
mov rcx, rbx
call fcn.14005e014
mov rdx, qword [rbx + 0x20]
lea r9, [0x14011c710]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.1400665bc
xor edx, edx
mov rcx, rbx
call fcn.1400e8708
lea rcx, [0x14013e190]
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x14013e190]
mov qword [r13 + 0x40], r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rcx, r13
call fcn.14004eb6c
lea rcx, [r13 + 0x70]
call fcn.14005aef8
mov rcx, r13
call fcn.140101fec
mov r11, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r11 + 0x18]
mov r11, qword [rsp + 0x50]
cmp r11, r15
je 0x140081adc
mov rcx, qword [rsp + 0x50]
mov r8d, r14d
xor r9d, r9d
or r8, 1
mov edx, 0x451
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14d, dword [rsp + 0x48]
movsxd rax, r14d
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r8w, 0x2d
jne 0x140081d0b
mov ecx, 0xa88
call fcn.1401021d8
mov ebp, 0x271b
mov rbx, rax
cmp rax, r13
je 0x140081b51
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140072e3c
mov rbx, rax
jmp 0x140081b54
mov rbx, r13
mov ecx, 0xf0
call fcn.1401021d8
mov rdi, rax
cmp rax, r13
je 0x140081b82
mov rdx, r12
mov rcx, rax
call fcn.140017d28
mov rdx, r12
mov rcx, rdi
call fcn.140018708
mov qword [rdi + 0x40], rbx
jmp 0x140081b85
mov rdi, r13
mov eax, dword [rsp + 0x100]
mov r13, qword [rsp + 0xf8]
xor r8d, r8d
mov rcx, rdi
mov rdx, r13
mov byte [rdi + 0xd9], 3
mov dword [rdi + 0x24], eax
call fcn.14007392c
mov rax, qword [rsp + 0xe8]
mov edx, 1
mov rcx, rbx
mov qword [rbx + 0x290], rax
mov qword [rbx + 0x140], r15
mov qword [rbx + 0x280], rdi
call fcn.14007f7b0
mov r11, qword [rbx + 0x280]
lea rcx, [rsp + 0x90]
mov rdx, r13
mov qword [rbx + 0x278], r11
call fcn.14006ff14
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.14007409c
lea rcx, [rbx + 0x118]
mov rdx, rax
call fcn.14006ffb0
lea rcx, [rsp + 0x90]
call fcn.14005aef8
mov rdx, qword [rsp + 0x80]
xor r15d, r15d
cmp rdx, r15
je 0x140081c3c
lea rcx, [rbx + 0x118]
call fcn.140070048
cmp r13, r15
je 0x140081c59
cmp byte [rbx + 0x111], r15b
je 0x140081c62
lea rcx, [rbx + 0x150]
mov rdx, r13
call fcn.14006ffb0
cmp byte [rbx + 0x111], r15b
jne 0x140081c7b
cmp byte [rbx + 0x149], r15b
jne 0x140081c7b
cmp byte [rbx + 0x14a], r15b
je 0x140081c80
mov ebp, 0x271d
jmp 0x140081c80
mov ebp, 0x271c
mov rcx, rbx
call fcn.1400e5aa8
mov qword [rbx + 0xc8], rsi
mov byte [rbx + 0x110], 1
cmp rsi, r15
je 0x140081cc3
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rsi + 0x1b8]
lea rcx, [0x14013e190]
mov byte [rbx + 0x110], 9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rsp + 0x58]
lea r9, [rsp + 0x68]
mov edx, ebp
mov rcx, rbx
call fcn.14005e014
mov rdx, qword [rbx + 0x20]
lea r9, [0x14011c710]
lea r8, str.__LastWinID
mov rcx, r12
call fcn.1400665bc
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x110
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140081ae1
mov rax, qword [rsp + 0xf8]
mov ebp, r13d
cmp bx, word [rax - 2]
mov qword [rsp + 0x50], rax
mov rax, rsi
sete dil
cmp r9w, r8w
sete bpl
cmp dil, r13b
cmovne rax, r13
mov qword [rsp + 0x58], rax
cmp dil, r13b
jne 0x140081d61
cmp rsi, r13
jne 0x140081d61
xor edx, edx
mov rcx, r12
call fcn.14001b3ec
cmp qword [r12 + 0x40], r13
jne 0x140081d61
mov rax, 0xffffffff80070057
jmp 0x140081ae4
lea rcx, [rsp + 0x60]
mov edx, 0xa8
call fcn.140063028
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.14005ae5c
lea rax, [rsp + 0x40]
lea r8, [0x140080f04]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov edx, 0x400000
xor ecx, ecx
lea rsi, [rbx + 0x78]
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r13, rax
xor eax, eax
cmp r13, rax
je 0x140081ee6
lea rdx, [rsp + 0x68]
lea r8d, [rax + 0x20]
mov rcx, rsi
mov qword [rsp + 0x60], rax
call fcn.140102b50
mov rcx, qword [rsp + 0xe8]
mov rax, qword [rsp + 0x50]
mov qword [rbx], r12
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rax
xor eax, eax
movsxd rcx, ebp
or rcx, 4
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x20], rax
movsxd rax, dword [rsp + 0x100]
mov qword [rbx + 0x28], rax
mov eax, dword [rsp + 0x40]
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x48], r15
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.14005b4d0
xor r15d, r15d
mov qword [rbx + 0x50], rax
cmp dil, r15b
jne 0x140081e57
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x14013d7e8]
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, r15
cmp ebp, r15d
jne 0x140081e78
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rbx + 0x60], rax
mov rsi, r15
cmp ebp, r15d
jne 0x140081e99
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
mov qword [rbx + 0x68], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, r15d
jne 0x140081eee
cmp rdi, r15
je 0x140081eca
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rbx + 0x30]
mov qword [rbx + 0x70], 1
cmp rsi, r15
je 0x140081eee
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x140081eee
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov edx, dword [rsp + 0x40]
lea r8, str.__LastTID
mov rcx, r12
call fcn.140066648
lea r9, [0x14011c710]
lea r8, str.__LastWinID
mov rdx, r14
mov rcx, r12
call fcn.1400665bc
lea rcx, [rsp + 0x60]
call fcn.14005aef8
mov r14d, r15d
jmp 0x140081ae1