Function at 0x140001840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea rbx, [0x14001ea38]
mov edi, 1
lea rsi, [0x14001ea30]
movzx r14d, cl
rol edi, 0
mov r12d, r15d
lea ebp, [r15 + 0x1a]
cmp byte [rbx + 0x10], r15b
je 0x1400018c5
cmp byte [rbx + 0x11], r15b
je 0x140001894
cmp byte [rbx + 0x12], r15b
je 0x1400018c5
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbx + 0x10], r15b
mov byte [rbx + 0x12], r15b
cmp byte [rbx + 0x11], r15b
je 0x14000192e
mov rcx, rsi
call fcn.1400010e0
test al, al
jne 0x1400018e0
or r12d, edi
mov byte [rbx + 0x11], r15b
jmp 0x14000192e
cmp byte [rbx + 0x10], r15b
jne 0x14000192e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rbx - 8]
mov qword [rsp + 0x28], r15
lea r8, [0x140001c40]
mov qword [rbx + 8], rax
xor edx, edx
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov qword [rbx], rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov byte [rbx + 0x10], 1
add rsi, 0x20
rol edi, 1
add rbx, 0x20
sub rbp, 1
jne 0x140001882
test r14b, r14b
je 0x140001c15
mov ecx, 0x1000
call fcn.140005ac4
lea r8, str.UNWATCHEABLE_n
mov qword [rsp + 0x30], rax
mov edx, 0x1000
mov qword [rsp + 0x38], 0x1000
mov rcx, rax
mov byte [rax], r15b
call fcn.140005b58
mov edx, r12d
lea rcx, [rsp + 0x30]
call fcn.1400016c0
mov r15, qword [0x14001ed70]
or rbp, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test r15, r15
je 0x140001af0
mov rdi, qword [r15]
movsx ecx, byte [rdi]
call fcn.140003e08
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x1400019dc
mov edx, 1
shl edx, cl
mov eax, edx
and eax, r12d
cmp eax, edx
je 0x140001ae3
mov rcx, rdi
call fcn.140001250
test al, al
jne 0x140001ae3
test rbx, rbx
je 0x140001a04
mov rax, rbp
inc rax
cmp byte [rdi + rax], 0
jne 0x1400019e4
mov rcx, rbp
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400019f0
inc rax
add rax, rcx
cmp rax, rsi
jbe 0x140001a66
mov rax, rbp
inc rax
cmp byte [rdi + rax], 0
jne 0x140001a07
cmp rax, 0x1000
jae 0x140001a1f
mov eax, 0x1000
jmp 0x140001a2b
mov rax, rbp
inc rax
cmp byte [rdi + rax], 0
jne 0x140001a22
add rsi, rax
mov rcx, rsi
call fcn.140005ac4
mov r14, rax
test rbx, rbx
je 0x140001a56
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140005af8
mov rcx, rbx
call fcn.140005abc
jmp 0x140001a59
mov byte [rax], 0
mov rbx, r14
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140005b58
test rbx, rbx
je 0x140001a92
mov rax, rbp
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140001a80
add rax, 2
cmp rax, rsi
jbe 0x140001ad1
add rsi, 0x1000
mov rcx, rsi
call fcn.140005ac4
mov rdi, rax
test rbx, rbx
je 0x140001ac1
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140005af8
mov rcx, rbx
call fcn.140005abc
jmp 0x140001ac4
mov byte [rax], 0
mov rbx, rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
lea r8, [0x14001438c]
mov rdx, rsi
mov rcx, rbx
call fcn.140005b58
mov r15, qword [r15 + 8]
test r15, r15
jne 0x1400019a5
test rbx, rbx
je 0x140001b12
mov rax, rbp
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140001b00
add rax, 9
cmp rax, rsi
jbe 0x140001b51
add rsi, 0x1000
mov rcx, rsi
call fcn.140005ac4
mov rdi, rax
test rbx, rbx
je 0x140001b41
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140005af8
mov rcx, rbx
call fcn.140005abc
jmp 0x140001b44
mov byte [rax], 0
mov rbx, rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
lea r8, str._nREMAP_n
mov rdx, rsi
mov rcx, rbx
call fcn.140005b58
lea rcx, [rsp + 0x30]
call fcn.140001560
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
test rbx, rbx
je 0x140001b92
nop dword [rax]
inc rbp
cmp byte [rbx + rbp], 0
jne 0x140001b80
add rbp, 2
cmp rbp, rdi
jbe 0x140001bc7
add rdi, 0x1000
mov rcx, rdi
call fcn.140005ac4
mov rsi, rax
test rbx, rbx
je 0x140001bc1
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.140005af8
mov rcx, rbx
call fcn.140005abc
jmp 0x140001bc4
mov byte [rax], 0
mov rbx, rsi
lea r8, [0x1400143d4]
mov rdx, rdi
mov rcx, rbx
call fcn.140005b58
lea rcx, [0x14001ed78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, rbx
call fcn.1400044b4
mov ecx, 1
call fcn.140003f54
mov rcx, rax
call fcn.1400043a8
lea rcx, [0x14001ed78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call fcn.140005abc
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret