Function at 0x14003aa20
Capabilities:
Create thread
Write file on windows

Disassembly:
push rsi
sub rsp, 0x80
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov qword [rsp + 0x98], rbx
add rcx, 0x10
cmp qword [rcx + 0x18], 8
jb 0x14003aa51
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 0x30], rax
lea rbx, [rsi + 0x10]
cmp rax, 0xffffffffffffffff
jne 0x14003aab0
cmp qword [rbx + 0x18], 8
jb 0x14003aa94
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbx
lea rcx, str.Could_not_create_log_file__error__d_:__s
mov edx, eax
call fcn.14007de10
jmp 0x14003ab3b
lea r9, [rsp + 0x58]
mov word [rsp + 0x54], 0xfeff
mov r8d, 2
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x54]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 8
jb 0x14003aae3
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.Log_file_written_to:__s
call fcn.14007de10
cmp qword [0x140108360], 8
lea rax, [0x140108348]
lea r9, [0x140108388]
mov rcx, rsi
cmovae rax, qword [0x140108348]
lea r8, str._____s___s_____
cmp qword [0x1401083a0], 8
lea rdx, [0x1400e20b0]
mov qword [rsp + 0x20], rax
cmovae r9, qword [0x140108388]
call fcn.14003bb00
mov r8d, dword [rsi + 0x60]
lea rax, [0x1400e3c50]
lea rcx, [0x1400e3c70]
nop dword [rax]
cmp dword [rax], r8d
je 0x14003ab76
add rax, 0x10
cmp rax, rcx
jne 0x14003ab50
lea rbx, [0x140111d28]
mov rcx, rbx
lea rdx, str.Unknown_state___d_
call fcn.140031750
jmp 0x14003ab7a
mov rbx, qword [rax + 8]
mov r9, rbx
lea r8, str.Task_starting:__S
lea rdx, [0x1400e20b0]
mov rcx, rsi
call fcn.14003bb00
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.1400892a0
test al, al
je 0x14003abd6
mov eax, dword [rsp + 0x54]
lea r8, str.CPU:__d_sockets___d_cores___d_logical_processors
mov r9d, dword [rsp + 0x58]
lea rdx, [0x1400e20b0]
mov dword [rsp + 0x28], eax
mov rcx, rsi
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
call fcn.14003bb00
mov edx, 1
mov rcx, rsi
call fcn.14003a700
cmp dword [rsi + 0x60], 1
jne 0x14003ae2c
mov rax, qword [rsi + 0x88]
mov qword [rsp + 0xa0], rbp
xor ebp, ebp
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r15
mov r15, qword [rax + 0x78]
mov r14, qword [rax + 0x70]
cmp r14, r15
je 0x14003ae1a
mov qword [rsp + 0xa8], rdi
mov rbx, qword [r14]
mov edx, dword [rbx + 0x6c]
test edx, edx
je 0x14003ac73
cmp qword [rbx + 0x38], 8
lea rax, [rbx + 0x20]
jb 0x14003ac39
mov rax, qword [rax]
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14003ac46
mov rcx, qword [rbx]
mov r9d, dword [rbx + 0x40]
lea r8, str.Failed_to_add_target:_origin_d__ref_file_s__ref_id_s__result_d
mov dword [rsp + 0x30], edx
lea rdx, [0x1400e20b0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.14003bb00
jmp 0x14003ae05
mov eax, dword [rbx + 0x108]
test eax, eax
jne 0x14003acf8
lea rdi, [rbx + 0x48]
mov rcx, rsi
mov rdx, rdi
call fcn.14003a970
mov dword [rbx + 0x68], eax
mov edx, eax
test eax, eax
je 0x14003ae05
cmp qword [rdi + 0x18], 8
jb 0x14003aca3
mov rdi, qword [rdi]
cmp qword [rbx + 0x38], 8
lea rcx, [rbx + 0x20]
jb 0x14003acb1
mov rcx, qword [rcx]
cmp qword [rbx + 0x18], 8
mov rax, rbx
jb 0x14003acbe
mov rax, qword [rbx]
mov qword [rsp + 0x40], rdi
lea r8, str.File_target__u:_origin_d__ref_file_s__ref_id_s__path_id_u:___s_
mov dword [rsp + 0x38], edx
inc ebp
mov qword [rsp + 0x30], rcx
lea rdx, [0x1400e20b0]
mov qword [rsp + 0x28], rax
mov r9d, ebp
mov eax, dword [rbx + 0x40]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14003bb00
jmp 0x14003ae05
cmp eax, 1
jne 0x14003ad38
cmp qword [rbx + 0x38], 8
lea rax, [rbx + 0x20]
mov edx, dword [rbx + 0xd0]
jb 0x14003ad11
mov rax, qword [rax]
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14003ad1e
mov rcx, qword [rbx]
mov dword [rsp + 0x38], edx
lea r8, str.Process_target__u:_origin_d__ref_file_s__ref_id_s__process_id_u
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
jmp 0x14003adea
cmp eax, 2
jne 0x14003ad6f
cmp qword [rbx + 0x60], 8
lea rax, [rbx + 0x48]
jb 0x14003ad4b
mov rax, qword [rax]
cmp qword [rbx + 0x38], 8
lea rcx, [rbx + 0x20]
jb 0x14003ad59
mov rcx, qword [rcx]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14003ad66
mov rdx, qword [rbx]
lea r8, str.Registry_key_target__u:_origin_d__ref_file_s__ref_id_s:___s_
jmp 0x14003addb
cmp eax, 3
jne 0x14003ada6
cmp qword [rbx + 0x60], 8
lea rax, [rbx + 0x48]
jb 0x14003ad82
mov rax, qword [rax]
cmp qword [rbx + 0x38], 8
lea rcx, [rbx + 0x20]
jb 0x14003ad90
mov rcx, qword [rcx]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14003ad9d
mov rdx, qword [rbx]
lea r8, str.Registry_value_target__u:_origin_d__ref_file_s__ref_id_s:___s_
jmp 0x14003addb
cmp eax, 4
jne 0x14003ae05
cmp qword [rbx + 0x60], 8
lea rax, [rbx + 0x48]
jb 0x14003adb9
mov rax, qword [rax]
cmp qword [rbx + 0x38], 8
lea rcx, [rbx + 0x20]
jb 0x14003adc7
mov rcx, qword [rcx]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14003add4
mov rdx, qword [rbx]
lea r8, str.Repair_registry_target__u:_origin_d__ref_file_s__ref_id_s:___s_
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
mov eax, dword [rbx + 0x40]
lea rdx, [0x1400e20b0]
inc ebp
mov dword [rsp + 0x20], eax
mov r9d, ebp
mov rcx, rsi
call fcn.14003bb00
add r14, 8
cmp r14, r15
jne 0x14003ac21
mov rdi, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x78]
mov rbp, qword [rsp + 0xa0]
mov r15, qword [rsp + 0x70]
mov rcx, rsi
call fcn.14003b1f0
mov rbx, qword [rsp + 0x98]
test al, al
je 0x14003ae7f
mov rcx, rsi
call fcn.14003af40
test al, al
je 0x14003ae7f
lea rax, [rsp + 0x58]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x14003cfe0]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x50], rax
test rax, rax
je 0x14003ae7f
mov al, 1
jmp 0x14003ae95
mov edx, 9
mov dword [rsi + 0x7c], 0xffffffff
mov rcx, rsi
call fcn.14003a700
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140091ba0
add rsp, 0x80
pop rsi
ret