Function at 0x12c38
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x180
mov rax, qword [0x0001d100]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x50]
or r14, 0xffffffffffffffff
xor ebx, ebx
mov qword [rsp + 0x48], r14
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov edx, dword [rsp + 0x54]
mov eax, dword [rsp + 0x58]
lea ecx, [rdx + rdx*4]
lea r12d, [r14 + 2]
lea edx, [rax + rcx*2]
movzx eax, byte [0x000dd8e1]
lea rdi, [0x001004a0]
cmp edx, 0x64
mov dword [0x000ddd08], edx
lea r8, [0x000fffd0]
cmove eax, r12d
lea rdx, [0x0001a890]
mov rcx, rdi
mov byte [0x000dd8e1], al
mov dword [rsp + 0x40], r12d
call fcn.00011f60
cmp eax, ebx
jge 0x12ce8
lea r8, [0x000fffd0]
lea rdx, [0x0001a8a0]
mov rcx, rdi
call fcn.00011f60
lea r8, [0x000fffb8]
lea rdx, [0x0001a8b0]
mov rcx, rdi
call fcn.00011f60
cmp eax, ebx
jge 0x12d18
lea r8, [0x000fffb8]
lea rdx, [0x0001a8c0]
mov rcx, rdi
call fcn.00011f60
lea r8, [0x00100010]
lea rdx, [0x0001a8d0]
mov rcx, rdi
call fcn.00011f60
cmp eax, ebx
jge 0x12d48
lea r8, [0x00100010]
lea rdx, [0x0001a8e0]
mov rcx, rdi
call fcn.00011f60
lea r8, [0x00100020]
lea rdx, [0x0001a8f0]
mov rcx, rdi
call fcn.00011f60
cmp eax, 0xc0000034
jne 0x12d8f
mov rcx, qword [0x001004a8]
mov r8d, 4
lea r9, [rsp + 0x40]
lea rdx, [0x0001a8f0]
mov dword [rsp + 0x20], r8d
call fcn.00012148
mov byte [0x00100020], 0x30
lea rbp, [0x000de130]
mov rcx, rdi
mov rdx, rbp
call fcn.00012598
cmp eax, ebx
jge 0x12daf
mov ebx, 0xc0000001
jmp 0x13013
lea rdx, [0x000ff990]
mov rcx, rbp
call fcn.000124fc
cmp eax, ebx
jl 0x12da5
mov edx, 0x5c
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_wcsrchr]
mov rcx, r14
mov rdi, rbp
mov rsi, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
mov rdi, rcx
mov rcx, rsi
add edi, edi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
lea r13, [0x000ffba0]
cmp al, bl
je 0x12e22
movsxd rax, edi
lea rdx, [rsi + 2]
lea r8, [rax + rax]
lea rax, [r8 + rbp]
cmp rdx, rax
jae 0x12e22
sub r8, rsi
mov rcx, r13
add r8, rbp
sar r8, 1
call fcn.0001a110
mov edx, 0x2e
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_wcsrchr]
mov r11, rax
sub r11, r13
sar r11, 1
cmp r11d, ebx
jle 0x12e6b
xor eax, eax
mov rcx, r14
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
cmp r11d, ecx
jg 0x12e6b
lea rcx, [0x000ffdb0]
mov r9d, r11d
xor r8d, r8d
mov rdx, r13
call fcn.0001232c
jmp 0x12e7f
lea rcx, [0x000ffdb0]
mov r8, r13
mov edx, 0x208
call fcn.00011008
lea rbp, [0x000ddf20]
mov r12d, 0x104
lea r8, [0x000ffdb0]
mov rcx, rbp
mov rdx, r12
call fcn.00011008
lea r8, [0x0001ab20]
mov rdx, r12
mov rcx, rbp
call fcn.00011080
lea rdi, [0x000ddb00]
lea r8, [0x000ff990]
mov rcx, rdi
mov rdx, r12
call fcn.00011008
lea r8, [0x0001a770]
mov rdx, r12
mov rcx, rdi
call fcn.00011080
mov r8, rbp
mov rdx, r12
mov rcx, rdi
call fcn.00011080
lea r8, [0x0001a740]
lea rcx, [0x000ddd10]
mov rdx, r12
call fcn.00011008
lea rcx, [0x000ddd10]
mov r8, rdi
mov rdx, r12
call fcn.00011080
lea rsi, [0x000de340]
lea r8, [0x000ffdb0]
mov rcx, rsi
mov rdx, r12
call fcn.00011008
lea r8, [0x0001ab30]
mov rdx, r12
mov rcx, rsi
call fcn.00011080
lea rdi, [0x000de550]
lea r8, [0x0001a740]
mov rcx, rdi
mov rdx, r12
call fcn.00011008
lea r8, [0x000ff990]
mov rdx, r12
mov rcx, rdi
call fcn.00011080
lea r8, [0x0001a770]
mov rdx, r12
mov rcx, rdi
call fcn.00011080
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call fcn.00011080
lea rcx, [0x000de760]
xor edx, edx
mov r8d, 0x21020
call fcn.0001a460
lea rcx, [0x000de760]
mov r8, r13
mov rdx, r12
call fcn.00011080
lea rcx, [0x000de968]
mov r8, rbp
mov rdx, r12
call fcn.00011080
lea rcx, [0x000deb70]
mov r8, rsi
mov rdx, r12
call fcn.00011080
mov qword [rsp + 0x30], rbx
lea rax, [0x00012b5c]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [0x000dd8ec], 3
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, ebx
jl 0x13013
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.0001a090
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret