Function at 0x14007bd00
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Create thread
Resume thread
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14b, byte [rsp + 0xd8]
mov r13d, ecx
mov rcx, rdx
mov al, r14b
and r14b, 0xf
mov ebp, r9d
and al, 0xc0
mov r15, r8
mov rdi, rdx
mov byte [rsp + 0x40], al
mov byte [rsp + 0xd8], r14b
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r10, eax
mov rcx, r15
lea rsi, [r10 + r10 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea r12, [rcx + rcx + 2]
lea rcx, [rsp + 0x48]
lea rdx, [r12 + rsi + 0x40]
call fcn.140063028
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
mov qword [rsp + 0x60], rbx
call fcn.14005ae5c
lea r11, [0x14013d7f8]
lea r8, [0x140060e54]
mov qword [rsp + 0x28], r11
mov r9, rbx
mov edx, 0x20000
xor ecx, ecx
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14007bdd5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, 1
mov ebx, eax
test eax, eax
cmove ebx, ebp
jmp 0x14007c210
mov eax, dword [rsp + 0xd0]
mov dword [rbx + 0x20], ebp
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0x24], eax
mov qword [rbx + 0x18], r15
lea rcx, [rbx + 0x40]
lea rax, [rbx + rsi + 0x40]
mov qword [rbx], 2
mov dword [rbx + 8], r13d
mov byte [rbx + 0x28], r14b
mov ebp, 1
mov r8, rsi
mov rdx, rdi
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x10], rcx
mov dword [rbx + 0x34], ebp
call fcn.14001d7d8
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, r15
call fcn.14001d7d8
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rsp + 0x58]
mov rdi, rax
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r14, str.32770
xor esi, esi
xor r12d, r12d
mov qword [rsp + 0x50], r14
cmp r13d, 2
jne 0x14007be96
xor r14d, r14d
lea r15, [0x1401271c0]
lea r12, [0x1401271b0]
mov qword [rsp + 0x50], r14
movzx eax, word [0x14013e20c]
mov ecx, 4
xor dil, dil
mov dword [rsp + 0x44], esi
test cl, al
jne 0x14007becc
or ax, cx
lea edx, [rcx - 2]
lea rcx, str.SeDebugPrivilege
xor r8d, r8d
mov dil, bpl
mov word [0x14013e20c], ax
call fcn.14001c318
mov r13d, 0xa
sub r13d, ebp
js 0x14007bf14
mov rdx, r15
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007bf14
test r12, r12
je 0x14007bf04
mov rdx, r12
mov rcx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007bf14
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14007bed2
mov r13d, 0xa
test rsi, rsi
jne 0x14007bf86
sub r13d, ebp
js 0x14007bf5c
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007bf86
test r12, r12
je 0x14007bf4f
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007bf86
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14007bf1f
test rsi, rsi
jne 0x14007bf86
and qword [rsp + 0x38], rsi
and qword [rsp + 0x30], rsi
and dword [rsp + 0x28], esi
and dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.1400e3594
mov rsi, rax
mov r14d, 0x5a
mov r13d, r14d
test rsi, rsi
jne 0x14007c023
mov rbx, qword [rsp + 0x50]
sub r13d, ebp
js 0x14007bfdf
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007bfdf
test r12, r12
je 0x14007bfcf
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007bfdf
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14007bf9d
mov rbx, qword [rsp + 0x60]
jmp 0x14007c01e
sub r14d, ebp
js 0x14007c023
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007c023
test r12, r12
je 0x14007c016
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14007c023
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
je 0x14007bfe6
mov r13d, dword [rsp + 0xb0]
mov r14, qword [rsp + 0xc0]
xor r15d, r15d
cmp r13d, 2
jne 0x14007c04d
cmp rsi, r15
je 0x14007c04d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowTextW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
cmp r13d, ebp
jne 0x14007c06f
cmp rsi, r15
je 0x14007c06f
mov rcx, qword [0x14013ca30]
cmp rcx, r15
je 0x14007c06f
mov qword [rcx], rsi
cmp byte [rsp + 0x40], 0x80
je 0x14007c158
cmp r13d, ebp
jne 0x14007c088
cmp rsi, r15
je 0x14007c158
cmp r13d, 2
jne 0x14007c0e8
mov ebx, dword [rsp + 0xd0]
cmp ebx, r15d
jg 0x14007c0d3
cmp dil, r15b
je 0x14007c0be
mov eax, 0xfffb
lea edx, [r13 + 2]
lea rcx, str.SeDebugPrivilege
and word [0x14013e20c], ax
xor r8d, r8d
call fcn.14001c318
mov ebx, r15d
jmp 0x14007c210
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r12d
cmp eax, ebx
jge 0x14007c0de
mov al, byte [0x14013a24f]
cmp al, r15b
jg 0x14007c0c6
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
jmp 0x14007c153
mov al, byte [0x14013a24f]
cmp al, r15b
jle 0x14007c13d
mov ebp, dword [rsp + 0xd0]
cmp ebp, r15d
jle 0x14007c110
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r12d
cmp eax, ebp
jge 0x14007c234
mov rcx, qword [rsp + 0x50]
mov rdx, r14
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
cmp rax, r15
je 0x14007c13d
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11b, byte [0x14013a24f]
cmp r11b, r15b
jg 0x14007c0fa
mov eax, dword [rbx + 0x34]
mov dword [rsp + 0x44], eax
mov rax, qword [0x14013ca30]
cmp rax, r15
je 0x14007c153
mov qword [rax], r15
mov rbx, qword [rsp + 0x48]
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec qword [rbx]
cmp qword [rbx], r15
mov dword [rbx + 0x30], r15d
cmovg rbx, r15
lea rcx, [0x14013e190]
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rsi, r15
je 0x14007c1cf
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
mov ebx, 0x111
lea r8d, [r9 + 2]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov edx, ebx
lea r8d, [r9 + 7]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rbx, qword [rsp + 0x58]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x44]
cmp dil, r15b
je 0x14007c210
xor r8d, r8d
mov eax, 0xfffb
lea rcx, str.SeDebugPrivilege
and word [0x14013e20c], ax
lea edx, [r8 + 4]
call fcn.14001c318
lea rcx, [rsp + 0x48]
call fcn.14005aef8
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, byte [rsp + 0xd8]
jmp 0x14007c140