Function at 0x140049720
Capabilities:
Contain obfuscated stackstrings
Terminate thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x140117280]
xor rax, rsp
mov qword [rbp + 0xe8], rax
mov rsi, qword [rbp + 0x130]
xor r14d, r14d
mov qword [rbp + 0xd0], 0x1c9c380
mov rax, qword [0x14012c400]
test rax, rax
jne 0x1400497a9
lea rcx, [0x1400ee358]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400497b7
lea rdx, str.RtlDllShutdownInProgress
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14012c400], rax
test rax, rax
je 0x1400497b7
call qword [case.0x140069c0f.0]
test al, al
jne 0x140049afc
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1400497c9
cmp qword [rcx], r14
je 0x1400497c9
mov al, 1
jmp 0x1400497cb
xor al, al
test al, al
je 0x140049b28
mov rax, qword [rsi + 8]
mov qword [rbp + 0xd8], rax
test rcx, rcx
je 0x1400497ef
mov rax, qword [rcx]
mov qword [rbp + 0xe0], rax
jmp 0x1400497f6
mov qword [rbp + 0xe0], r14
lea rcx, [rsp + 0x60]
call fcn.14002de30
movabs rdi, 0x7fffffffffffffff
mov r12d, 1
mov r13d, 0xff
mov rbx, qword [rbp + 0x138]
cmp rbx, rdi
jne 0x140049826
xor al, al
jmp 0x14004983d
cmp rbx, 0x1c9c380
jne 0x140049833
xor al, al
jmp 0x14004983a
mov eax, r12d
cmovl eax, r13d
shr al, 7
lea rcx, [rbp + 0x138]
lea rdx, [rbp + 0xd0]
test al, al
cmove rcx, rdx
call fcn.14002e690
mov r9d, eax
xor r8d, r8d
lea rdx, [rbp + 0xd8]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov r15d, eax
cmp eax, 0x102
jne 0x140049aa0
cmp rbx, rdi
je 0x140049899
cmp rbx, 0x1c9c380
je 0x140049894
setl al
test al, al
jne 0x140049a9c
cmp rbx, rdi
jne 0x1400498a0
mov qword [rsp + 0x58], rbx
jmp 0x140049907
imul rbx, rbx, 0x3e8
add rbx, qword [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14002de30
mov rax, qword [rsp + 0x20]
cmp rax, rbx
je 0x1400498d2
mov ecx, r12d
cmovl ecx, r13d
test cl, cl
jle 0x1400498d2
mov qword [rsp + 0x58], r14
jmp 0x140049907
sub rbx, rax
cmp rbx, rdi
je 0x140049902
test rbx, rbx
je 0x1400498ff
movabs rax, 0x20c49ba5e353f7cf
imul rbx
mov rdi, rdx
sar rdi, 7
mov rax, rdi
shr rax, 0x3f
add rdi, rax
jmp 0x140049902
mov rdi, r14
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x58]
call fcn.14002e690
mov r9d, eax
mov ecx, dword [rsi + 0x10]
shr ecx, 2
test r12b, cl
je 0x1400499bf
mov dword [rsp + 0x20], 0x32433041
mov dword [rsp + 0x24], 0x41344534
mov dword [rsp + 0x30], 0x6b736174
mov qword [rsp + 0x34], 0x73
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 0x66
lea rcx, [rsp + 0x60]
call fcn.14001c330
lea r9, [rsp + 0x30]
mov r8d, 7
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001b2b0
nop
lea rdx, str.Thread_was_cancelled_before_start_and_was_not_ended_even_after
lea rcx, [rsp + 0x70]
call fcn.140031810
mov qword [rsp + 0x20], 0x1e
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14004bda0
lea rdx, [0x1400f65a0]
mov rcx, rax
call fcn.140031810
nop
lea rcx, [rsp + 0x70]
call fcn.14001d730
jmp 0x140049afc
mov eax, dword [rsi + 0x10]
shr eax, 1
test r12b, al
jne 0x140049a79
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x1400499d9
mov r14, qword [rax]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [rsp + 0x20], 0x32433041
mov dword [rsp + 0x24], 0x41344534
mov dword [rsp + 0x30], 0x6b736174
mov qword [rsp + 0x34], 0x73
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 0x6e
lea rcx, [rsp + 0x60]
call fcn.14001c330
lea r9, [rsp + 0x30]
mov r8d, 7
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001b2b0
nop
lea rcx, [rsp + 0x70]
call fcn.14004bdf0
mov qword [rsp + 0x20], 0x1e
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14004bda0
lea rdx, [0x1400f65a0]
mov rcx, rax
call fcn.140031810
nop
lea rcx, [rsp + 0x70]
call fcn.14001d730
jmp 0x140049afc
test r9d, r9d
je 0x140049a9c
xor r8d, r8d
lea rdx, [rbp + 0xd8]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov r15d, eax
cmp eax, 0x102
jne 0x140049aa0
xor al, al
jmp 0x140049afe
mov eax, dword [rsi + 0x10]
test r12b, al
jne 0x140049add
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x20]
call qword [case.0x140069c0f.0]
lea rcx, str.Thread_was_killed
lea rdx, str.Thread_ended_state_mismatch
test al, al
cmovne rdx, rcx
xchg dword [0x14012bd7c], r12d
test r12d, r12d
jne 0x140049add
call fcn.14006ecb0
test r15d, r15d
jne 0x140049afc
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x140049aee
mov r14, qword [rax]
mov edx, 0xa
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, 1
mov rcx, qword [rbp + 0xe8]
xor rcx, rsp
call fcn.140081ef0
mov rbx, qword [rsp + 0x240]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x30]
call fcn.14004d320
lea rdx, [0x140114a50]
lea rcx, [rsp + 0x30]
call fcn.140084768
int3