Function at 0x14000dd20
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov r12, r9
mov r15, rcx
mov rsi, qword [rax + 0x48]
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x14000dd5b
lock inc dword [rbx + 8]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x70], rbx
mov ebp, 0xffffffff
test rbx, rbx
je 0x14000dd97
mov eax, ebp
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14000dd97
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax]
mov eax, ebp
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000dd97
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rsp + 0xd0]
cmp ecx, 0x4000004
jg 0x14000e0b7
je 0x14000dfdf
sub ecx, 0x3000000
je 0x14000df08
sub ecx, 0x1000000
je 0x14000de6e
cmp ecx, 2
jne 0x14000e314
mov ecx, 0x588
call fcn.1401dee38
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x588
mov rcx, rax
call fcn.1401e1b90
mov r9d, 1
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 2]
mov rcx, rbx
call fcn.14000b000
lea rax, vtable.CFileTransfer.1.0
mov qword [rbx], rax
lea rax, vtable.CFileTransfer.0
mov qword [rbx + 0x70], rax
xor r14d, r14d
mov qword [rbx + 0x570], r14
mov qword [rbx + 0x578], r14
mov qword [rbx + 0x580], r14
mov qword [rbx + 0x568], r12
mov dword [rbx + 0x550], r14d
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rbx
call fcn.14000b230
mov rcx, rbx
call fcn.14000b340
mov edx, 0x4000003
jmp 0x14000e305
mov ecx, 0x588
call fcn.1401dee38
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x588
mov rcx, rax
call fcn.1401e1b90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 3]
mov rcx, rbx
call fcn.14000b000
lea rax, vtable.CFileTransfer.1.0
mov qword [rbx], rax
lea rax, vtable.CFileTransfer.0
mov qword [rbx + 0x70], rax
xor r14d, r14d
mov qword [rbx + 0x570], r14
mov qword [rbx + 0x578], r14
mov qword [rbx + 0x580], r14
mov qword [rbx + 0x568], r12
mov dword [rbx + 0x550], r14d
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rbx
call fcn.14000b230
mov rcx, rbx
call fcn.14000b340
mov edx, 0x4000001
jmp 0x14000e305
mov ecx, 0x5b8
call fcn.1401dee38
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x5b8
mov rcx, rax
call fcn.1401e1b90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 2]
mov rcx, rbx
call fcn.14000b000
lea rax, vtable.CRemoteShell.1.0
mov qword [rbx], rax
lea rax, vtable.CRemoteShell.0
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x568], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x570], rax
lea rcx, [rbx + 0x578]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r14d, r14d
mov qword [rbx + 0x5a0], r14
mov qword [rbx + 0x5a8], r14
mov qword [rbx + 0x5b0], r14
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, rbx
lea r8, [0x14000a790]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rbx
call fcn.14000b230
mov rcx, rbx
call fcn.14000b340
mov edx, 0x3000001
jmp 0x14000e305
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000dff9
lock inc dword [rcx + 8]
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x38]
call fcn.14000ea40
mov ebx, eax
mov ecx, 0x588
call fcn.1401dee38
mov rdi, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x588
mov rcx, rax
call fcn.1401e1b90
mov r9d, 0x400
mov qword [rsp + 0x20], r12
mov r8d, 3
mov rcx, rdi
call fcn.14000b000
lea rax, vtable.CFileTransfer.1.0
mov qword [rdi], rax
lea rax, vtable.CFileTransfer.0
mov qword [rdi + 0x70], rax
xor r14d, r14d
mov qword [rdi + 0x570], r14
mov qword [rdi + 0x578], r14
mov qword [rdi + 0x580], r14
mov qword [rdi + 0x568], r12
mov dword [rdi + 0x550], ebx
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rdi
call fcn.14000b230
mov rcx, rdi
call fcn.14000b340
mov edx, 0x4000005
jmp 0x14000e305
cmp ecx, 0x400000b
je 0x14000e232
cmp ecx, 0x5000000
je 0x14000e1b7
cmp ecx, 0x6000000
jne 0x14000e314
mov ecx, 0x5d0
call fcn.1401dee38
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x5d0
mov rcx, rax
call fcn.1401e1b90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 5]
mov rcx, rbx
call fcn.14000b000
lea rax, vtable.CDesktopMonitor.1.0
mov qword [rbx], rax
lea rax, vtable.CDesktopMonitor.0
mov qword [rbx + 0x70], rax
xor r14d, r14d
mov qword [rbx + 0x570], r14
mov dword [rbx + 0x580], r14d
mov qword [rbx + 0x5a8], r14
mov qword [rbx + 0x5b8], r14
mov qword [rbx + 0x5c0], 7
mov qword [rbx + 0x568], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x578], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, rbx
lea r8, [0x140002a70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rbx
call fcn.14000b230
mov rcx, rbx
call fcn.14000b340
mov edx, 0x6000001
jmp 0x14000e305
mov ecx, 0x570
call fcn.1401dee38
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x570
mov rcx, rax
call fcn.1401e1b90
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 4]
mov rcx, rbx
call fcn.14000b000
lea rax, vtable.CImageCapture.1.0
mov qword [rbx], rax
lea rax, vtable.CImageCapture.0
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x568], r12
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rbx
call fcn.14000b230
mov rcx, rbx
call fcn.14000b340
mov edx, 0x5000001
jmp 0x14000e305
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000e24c
lock inc dword [rcx + 8]
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x60], eax
lea rdx, [rsp + 0x50]
call fcn.14000ea40
mov ebx, eax
mov ecx, 0x588
call fcn.1401dee38
mov rdi, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x588
mov rcx, rax
call fcn.1401e1b90
mov r9d, 0x401
mov qword [rsp + 0x20], r12
mov r8d, 3
mov rcx, rdi
call fcn.14000b000
lea rax, vtable.CFileTransfer.1.0
mov qword [rdi], rax
lea rax, vtable.CFileTransfer.0
mov qword [rdi + 0x70], rax
xor r14d, r14d
mov qword [rdi + 0x570], r14
mov qword [rdi + 0x578], r14
mov qword [rdi + 0x580], r14
mov qword [rdi + 0x568], r12
mov dword [rdi + 0x550], ebx
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rdi
call fcn.14000b230
mov rcx, rdi
call fcn.14000b340
mov edx, 0x400000c
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call fcn.14000b430
nop
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x14000e344
mov eax, ebp
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14000e344
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], ebp
cmp ebp, 1
jne 0x14000e344
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret