Function at 0x140005ef0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb20
mov qword [rsp + 0xb00], 0xfffffffffffffffe
mov rax, qword [0x140038020]
xor rax, rsp
mov qword [rsp + 0xb10], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
mov rdx, qword [rsp + 0xb30]
add rdx, 0x308
lea rcx, [rsp + 0x390]
call fcn.1400025b0
nop
mov rcx, qword [rsp + 0xb30]
add rcx, 0x27f
call fcn.14000b710
movzx eax, al
test eax, eax
je 0x140005fef
mov dword [rsp + 0x44], 0x137f9009
xor eax, eax
cmp eax, 1
je 0x140005fdd
call fcn.140004430
mov qword [rsp + 0x6d8], rax
cmp qword [rsp + 0x6d8], 0
je 0x140005fdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x6d8]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x137f9009
mov dword [rsp + 0x28], 0x137
lea rax, [0x14002b038]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b080]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x6d8]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rcx, qword [rsp + 0xb30]
add rcx, 0x27f
call fcn.140013110
mov rdi, rax
mov rcx, qword [rsp + 0xb30]
add rcx, 0x2af
call fcn.140013110
cmp rdi, rax
je 0x1400060ab
mov dword [rsp + 0x44], 0x138f9009
xor eax, eax
cmp eax, 1
je 0x140006099
call fcn.140004430
mov qword [rsp + 0x6e0], rax
cmp qword [rsp + 0x6e0], 0
je 0x140006099
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x6e0]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x138f9009
mov dword [rsp + 0x28], 0x138
lea rax, [0x14002b0e8]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b130]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x6e0]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rcx, qword [rsp + 0xb30]
add rcx, 0x27f
xor edx, edx
call fcn.14000b750
movzx eax, byte [rax]
mov dword [rsp + 0x398], eax
mov rcx, qword [rsp + 0xb30]
add rcx, 0x2af
xor edx, edx
call fcn.14000b750
movzx eax, byte [rax]
mov dword [rsp + 0x6d0], eax
mov eax, dword [rsp + 0x6d0]
cmp dword [rsp + 0x398], eax
jne 0x140006187
mov dword [rsp + 0x44], 0x13cf9313
xor eax, eax
cmp eax, 1
je 0x140006175
call fcn.140004430
mov qword [rsp + 0x6e8], rax
cmp qword [rsp + 0x6e8], 0
je 0x140006175
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x6e8]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x13cf9313
mov dword [rsp + 0x28], 0x13c
lea rax, [0x14002b198]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b1e0]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x6e8]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rcx, qword [rsp + 0xb30]
call fcn.140005260
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14000622b
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x140006219
call fcn.140004430
mov qword [rsp + 0x6f0], rax
cmp qword [rsp + 0x6f0], 0
je 0x140006219
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x6f0]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x13e
lea rax, [0x14002b248]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b290]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x6f0]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rax, qword [rsp + 0xb30]
cmp qword [rax + 0x330], 0
jne 0x1400062c9
mov dword [rsp + 0x44], 0x140f9318
xor eax, eax
cmp eax, 1
je 0x1400062b7
call fcn.140004430
mov qword [rsp + 0x6f8], rax
cmp qword [rsp + 0x6f8], 0
je 0x1400062b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x6f8]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x140f9318
mov dword [rsp + 0x28], 0x140
lea rax, [0x14002b2f8]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b340]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x6f8]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rax, qword [rsp + 0xb30]
cmp qword [rax + 0x338], 0
jne 0x140006367
mov dword [rsp + 0x44], 0x141f9318
xor eax, eax
cmp eax, 1
je 0x140006355
call fcn.140004430
mov qword [rsp + 0x700], rax
cmp qword [rsp + 0x700], 0
je 0x140006355
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x700]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x141f9318
mov dword [rsp + 0x28], 0x141
lea rax, [0x14002b3a8]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b3f0]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x700]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x330]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x330]
mov rax, qword [rax]
call qword [rax + pe_nt_image_headers64]
mov byte [rsp + 0x60], 0
lea rdi, [rsp + 0x64]
xor eax, eax
mov ecx, 0x320
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x5b8d80
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x398]
call qword [rax + 0x20]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140006484
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x140006472
call fcn.140004430
mov qword [rsp + 0x708], rax
cmp qword [rsp + 0x708], 0
je 0x140006472
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x708]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x146
lea rax, [0x14002b458]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b4a0]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x708]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
movzx eax, byte [rsp + 0x71]
test eax, eax
je 0x140006519
mov dword [rsp + 0x44], 0x147f9330
xor eax, eax
cmp eax, 1
je 0x140006507
call fcn.140004430
mov qword [rsp + 0x710], rax
cmp qword [rsp + 0x710], 0
je 0x140006507
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x710]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x147f9330
mov dword [rsp + 0x28], 0x147
lea rax, [0x14002b508]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b550]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x710]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov byte [rsp + 0x3a0], 0
lea rdi, [rsp + 0x3a4]
xor eax, eax
mov ecx, 0x320
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x5b8d80
lea r8, [rsp + 0x3a0]
mov edx, dword [rsp + 0x6d0]
call qword [rax + 0x20]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140006618
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x140006606
call fcn.140004430
mov qword [rsp + 0x718], rax
cmp qword [rsp + 0x718], 0
je 0x140006606
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x718]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x14a
lea rax, [0x14002b5b8]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b600]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x718]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
movzx eax, byte [rsp + 0x3b1]
test eax, eax
je 0x1400066b0
mov dword [rsp + 0x44], 0x14bf9330
xor eax, eax
cmp eax, 1
je 0x14000669e
call fcn.140004430
mov qword [rsp + 0x720], rax
cmp qword [rsp + 0x720], 0
je 0x14000669e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x720]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x14bf9330
mov dword [rsp + 0x28], 0x14b
lea rax, [0x14002b668]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b6b0]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x720]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov dword [rsp + 0x4c], 0
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x5b8d80
mov r8d, dword [rsp + 0x398]
lea rdx, [rsp + 0x4c]
call qword [rax + 0x18]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14000679c
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x14000678a
call fcn.140004430
mov qword [rsp + 0x728], rax
cmp qword [rsp + 0x728], 0
je 0x14000678a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x728]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x14e
lea rax, [0x14002b718]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b760]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x728]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov dword [rsp + 0x730], 0
jmp 0x1400067ba
mov eax, dword [rsp + 0x730]
add eax, 1
mov dword [rsp + 0x730], eax
mov eax, dword [rsp + 0x4c]
cmp dword [rsp + 0x730], eax
jae 0x140006aee
mov byte [rsp + 0x740], 0
lea rdi, [rsp + 0x741]
xor eax, eax
mov ecx, 0x19b
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x5b8d80
lea r9, [rsp + 0x740]
mov r8d, dword [rsp + 0x730]
mov edx, dword [rsp + 0x398]
call qword [rax + 0x28]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
and eax, 0xfff
test eax, eax
je 0x140006863
mov eax, dword [rsp + 0x40]
and eax, 0xfff
cmp eax, 0x30d
je 0x140006863
jmp 0x1400067a9
mov qword [rsp + 0x8e0], 0
jmp 0x140006885
mov rax, qword [rsp + 0x8e0]
add rax, 1
mov qword [rsp + 0x8e0], rax
mov rcx, qword [rsp + 0xb30]
add rcx, 0x27f
call fcn.140013110
cmp qword [rsp + 0x8e0], rax
jae 0x140006ae9
mov rcx, qword [rsp + 0xb30]
add rcx, 0x27f
mov rdx, qword [rsp + 0x8e0]
call fcn.14000b750
mov qword [rsp + 0x8f0], rax
mov rcx, qword [rsp + 0xb30]
add rcx, 0x2af
mov rdx, qword [rsp + 0x8e0]
call fcn.14000b750
mov qword [rsp + 0x8e8], rax
mov rax, qword [rsp + 0x8f0]
mov rax, qword [rax + 0x15b]
cmp qword [rsp + 0x89c], rax
je 0x14000690d
jmp 0x140006871
mov rcx, qword [rsp + 0x8f0]
movzx eax, byte [rsp + 0x741]
mov byte [rcx + 1], al
mov rcx, qword [rsp + 0x8f0]
mov eax, dword [rsp + 0x8a8]
mov dword [rcx + 0x167], eax
mov rcx, qword [rsp + 0x8f0]
mov eax, dword [rsp + 0x8b8]
mov dword [rcx + 0x177], eax
mov rcx, qword [rsp + 0x8f0]
mov eax, dword [rsp + 0x8ac]
mov dword [rcx + 0x16b], eax
mov rcx, qword [rsp + 0x8f0]
mov eax, dword [rsp + 0x8b0]
mov dword [rcx + 0x16f], eax
mov rcx, qword [rsp + 0x8f0]
mov eax, dword [rsp + 0x8b4]
mov dword [rcx + 0x173], eax
mov rcx, qword [rsp + 0x8f0]
movzx eax, byte [rsp + 0x8d6]
mov byte [rcx + 0x195], al
mov rcx, qword [rsp + 0x8f0]
movzx eax, byte [rsp + 0x8d7]
mov byte [rcx + 0x196], al
mov rcx, qword [rsp + 0x8f0]
mov eax, dword [rsp + 0x8cc]
mov dword [rcx + 0x18b], eax
mov rcx, qword [rsp + 0x8f0]
mov rax, qword [rsp + 0x884]
mov qword [rcx + 0x143], rax
mov rcx, qword [rsp + 0x8f0]
mov rax, qword [rsp + 0x88c]
mov qword [rcx + 0x14b], rax
mov rcx, qword [rsp + 0x8f0]
mov rax, qword [rsp + 0x894]
mov qword [rcx + 0x153], rax
mov rcx, qword [rsp + 0x8f0]
movzx eax, byte [rsp + 0x8d5]
mov byte [rcx + 0x194], al
mov rcx, qword [rsp + 0x8f0]
mov eax, dword [rsp + 0x8a4]
mov dword [rcx + 0x163], eax
mov rcx, qword [rsp + 0x8f0]
movzx eax, byte [rsp + 0x8d4]
mov byte [rcx + 0x193], al
mov rcx, qword [rsp + 0x8e8]
movzx eax, byte [rsp + 0x741]
mov byte [rcx + 1], al
mov rcx, qword [rsp + 0x8e8]
mov eax, dword [rsp + 0x6b8]
mov dword [rcx + 0x167], eax
mov rcx, qword [rsp + 0x8e8]
mov rax, qword [rsp + 0x8f0]
movzx eax, byte [rax + 0x193]
mov byte [rcx + 0x193], al
mov rax, qword [rsp + 0x8f0]
cmp dword [rax + 0x18f], 0
jne 0x140006ac4
mov rax, qword [rsp + 0x8e8]
cmp dword [rax + 0x18f], 0
jne 0x140006ac4
mov dword [rsp + 0xb08], 0
jmp 0x140006acf
mov dword [rsp + 0xb08], 1
mov rcx, qword [rsp + 0x8e8]
mov eax, dword [rsp + 0xb08]
mov dword [rcx + 0x18f], eax
jmp 0x140006871
jmp 0x1400067a9
mov rcx, qword [rsp + 0xb30]
call fcn.1400057f0
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140006b92
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x140006b80
call fcn.140004430
mov qword [rsp + 0x8f8], rax
cmp qword [rsp + 0x8f8], 0
je 0x140006b80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x8f8]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x172
lea rax, [0x14002b7c8]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b810]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x8f8]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 0x30
mov rax, qword [rax + 0x30]
call qword [rax + 8]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140006c52
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x140006c40
call fcn.140004430
mov qword [rsp + 0x900], rax
cmp qword [rsp + 0x900], 0
je 0x140006c40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x900]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x174
lea rax, [0x14002b878]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b8c0]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x900]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rax, qword [rsp + 0xb30]
movzx edx, byte [rax + 0x27a]
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 8
mov rax, qword [rax + 8]
call qword [rax + 0x30]
mov rdx, qword [rsp + 0xb30]
movzx edx, byte [rdx + 0x278]
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
mov rax, qword [rax]
call qword [rax + pe_nt_image_headers64]
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 8
mov rax, qword [rax + 8]
mov edx, dword [rsp + 0x398]
call qword [rax + 0x48]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140006d87
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x140006d75
call fcn.140004430
mov qword [rsp + 0x908], rax
cmp qword [rsp + 0x908], 0
je 0x140006d75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x908]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x179
lea rax, [0x14002b928]
mov qword [rsp + 0x20], rax
lea r9, [0x14002b970]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x908]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 8
mov rax, qword [rax + 8]
mov edx, dword [rsp + 0x6d0]
call qword [rax + 0x58]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140006e4e
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x140006e3c
call fcn.140004430
mov qword [rsp + 0x910], rax
cmp qword [rsp + 0x910], 0
je 0x140006e3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x910]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x17a
lea rax, [0x14002b9d8]
mov qword [rsp + 0x20], rax
lea r9, [0x14002ba20]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x910]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rax, qword [rsp + 0xb30]
movzx edx, byte [rax + 0x279]
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 8
mov rax, qword [rax + 8]
call qword [rax + 0xc0]
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 0x18
mov rax, qword [rax + 0x18]
call qword [rax + 8]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140006f49
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x140006f37
call fcn.140004430
mov qword [rsp + 0x918], rax
cmp qword [rsp + 0x918], 0
je 0x140006f37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x918]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x17d
lea rax, [0x14002ba88]
mov qword [rsp + 0x20], rax
lea r9, [0x14002bad0]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0x918]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov qword [rsp + 0x920], 0
jmp 0x140006f6b
mov rax, qword [rsp + 0x920]
add rax, 1
mov qword [rsp + 0x920], rax
mov rcx, qword [rsp + 0xb30]
add rcx, 0x2af
call fcn.140013110
cmp qword [rsp + 0x920], rax
jae 0x1400070b3
mov rcx, qword [rsp + 0xb30]
add rcx, 0x2af
mov rdx, qword [rsp + 0x920]
call fcn.14000b750
mov qword [rsp + 0xad0], rax
mov rax, qword [rsp + 0xad0]
cmp qword [rax + 0x143], 0
ja 0x140006fc5
jmp 0x140006f57
mov byte [rsp + 0x930], 0
lea rdi, [rsp + 0x931]
xor eax, eax
mov ecx, 0x19b
rep stosb byte [rdi], al
lea r8, [rsp + 0x930]
mov rdx, qword [rsp + 0xad0]
mov rcx, qword [rsp + 0xb30]
call fcn.14000b2a0
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
add rcx, 0x18
mov rax, qword [rax + 0x18]
lea rdx, [rsp + 0x930]
call qword [rax + 0x18]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400070ae
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x1400070ac
call fcn.140004430
mov qword [rsp + 0xad8], rax
cmp qword [rsp + 0xad8], 0
je 0x1400070ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0xad8]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x187
lea rax, [0x14002bb38]
mov qword [rsp + 0x20], rax
lea r9, [0x14002bb80]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0xad8]
call qword [rdi + 0x30]
jmp 0x1400070b3
jmp 0x140006f57
mov eax, dword [rsp + 0x44]
and eax, 0xfff
test eax, eax
je 0x1400070d2
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rax, qword [rsp + 0xb30]
movzx eax, byte [rax + 0x271]
test eax, eax
je 0x140007171
mov dword [rsp + 0x44], 0x18bf901a
xor eax, eax
cmp eax, 1
je 0x14000715f
call fcn.140004430
mov qword [rsp + 0xae0], rax
cmp qword [rsp + 0xae0], 0
je 0x14000715f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0xae0]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x18bf901a
mov dword [rsp + 0x28], 0x18b
lea rax, [0x14002bbe8]
mov qword [rsp + 0x20], rax
lea r9, [0x14002bc30]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0xae0]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdx, rax
mov rax, qword [rsp + 0xb30]
mov qword [rax + 0x350], rdx
mov rax, qword [rsp + 0xb30]
cmp qword [rax + 0x350], 0
jne 0x140007234
mov dword [rsp + 0x44], 0x18ef9259
xor eax, eax
cmp eax, 1
je 0x140007222
call fcn.140004430
mov qword [rsp + 0xae8], rax
cmp qword [rsp + 0xae8], 0
je 0x140007222
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0xae8]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x18ef9259
mov dword [rsp + 0x28], 0x18e
lea rax, [0x14002bc98]
mov qword [rsp + 0x20], rax
lea r9, [0x14002bce0]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0xae8]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xb30]
lea r8, [0x14000ac10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
mov rax, qword [rsp + 0xb30]
mov qword [rax + 0x348], rdx
mov rax, qword [rsp + 0xb30]
cmp qword [rax + 0x348], 0
jne 0x140007317
mov dword [rsp + 0x44], 0x192f9246
xor eax, eax
cmp eax, 1
je 0x140007305
call fcn.140004430
mov qword [rsp + 0xaf0], rax
cmp qword [rsp + 0xaf0], 0
je 0x140007305
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0xaf0]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x192f9246
mov dword [rsp + 0x28], 0x192
lea rax, [0x14002bd48]
mov qword [rsp + 0x20], rax
lea r9, [0x14002bd90]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0xaf0]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
mov rax, qword [rsp + 0xb30]
mov rax, qword [rax + 0x338]
mov rcx, qword [rsp + 0xb30]
mov rcx, qword [rcx + 0x338]
mov rax, qword [rax]
call qword [rax + 0x38]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400073cf
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x44], eax
xor eax, eax
cmp eax, 1
je 0x1400073c0
call fcn.140004430
mov qword [rsp + 0xaf8], rax
cmp qword [rsp + 0xaf8], 0
je 0x1400073c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0xaf8]
mov rdi, qword [rdi]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x194
lea rax, [0x14002bdf8]
mov qword [rsp + 0x20], rax
lea r9, [0x14002be40]
mov r8d, 0xf9
mov edx, 1
mov rcx, qword [rsp + 0xaf8]
call qword [rdi + 0x30]
nop
lea rcx, [rsp + 0x390]
call fcn.1400025f0
jmp 0x1400073e6
lea rcx, [rsp + 0x390]
call fcn.1400025f0
xor eax, eax
test eax, eax
jne 0x140005f2b
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0xb10]
xor rcx, rsp
call fcn.1400239c0
add rsp, 0xb20
pop rdi
ret