Function at 0x14008a6b8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x118
mov ax, word [rdx]
xor ebp, ebp
mov r13, rcx
mov qword [rsp + 0x30], rdx
mov edi, ebp
mov r15d, ebp
mov r12d, ebp
mov r14d, ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x178], ebp
mov dword [rsp + 0x3c], ebp
lea r9d, [rbp + 9]
lea r8d, [rbp + 0x2a]
cmp ax, bp
je 0x14008a792
lea r13d, [rbp + 0x20]
cmp r9w, ax
ja 0x14008a71d
cmp ax, 0xd
jbe 0x14008a78a
cmp r13w, ax
je 0x14008a78a
mov ecx, 0x24
cmp cx, ax
jne 0x14008a732
lea edi, [rcx - 0x23]
jmp 0x14008a779
cmp r8w, ax
jne 0x14008a741
movsx r12d, byte [rdx]
mov r14d, ebp
jmp 0x14008a779
mov ecx, 0x2b
cmp cx, ax
jne 0x14008a754
movsx r14d, byte [rdx]
mov r12d, ebp
jmp 0x14008a779
mov ecx, 0x26
cmp cx, ax
jne 0x14008a768
mov dword [rsp + 0x40], 1
jmp 0x14008a779
mov ecx, 0x23
cmp cx, ax
jne 0x14008a779
movsx eax, byte [rdx]
mov dword [rsp + 0x3c], eax
add rdx, 2
mov qword [rsp + 0x30], rdx
mov ax, word [rdx]
cmp ax, bp
jne 0x14008a711
mov r13, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.140044ef4
mov rsi, qword [rsp + 0x30]
mov ecx, 0x2d
cmp cx, word [rsi]
movzx eax, r8b
mov dword [rsp + 0x38], 0x80000000
cmove eax, ecx
mov qword [rsp + 0x168], rsi
movsx ebx, al
movzx eax, word [rsi]
cmp ebx, eax
jne 0x14008a90d
lea rdx, [rsp + 0x30]
lea rcx, str._wait
mov r8d, 5
call fcn.14004e5bc
cmp al, bpl
je 0x14008a7f5
mov r15d, 1
jmp 0x14008a8fd
lea rdx, [rsp + 0x30]
lea rcx, str._waitx
mov r8d, 6
call fcn.14004e5bc
cmp al, bpl
je 0x14008a81c
mov r15d, 2
jmp 0x14008a8fd
lea rdx, [rsp + 0x30]
lea rcx, str._here
mov r8d, 5
call fcn.14004e5bc
cmp al, bpl
je 0x14008a848
mov dword [rsp + 0x178], pe_nt_image_headers64
jmp 0x14008a8fd
lea rdx, [rsp + 0x30]
lea rcx, str._idle
mov r8d, 5
call fcn.14004e5bc
cmp al, bpl
je 0x14008a871
mov dword [rsp + 0x38], 0xfffffff1
jmp 0x14008a8fd
lea rdx, [rsp + 0x30]
lea rcx, str._exp
mov r8d, 4
call fcn.14004e5bc
cmp al, bpl
je 0x14008a894
mov edi, 1
jmp 0x14008a8fd
lea rdx, [rsp + 0x30]
lea rcx, str._link
mov r8d, 5
call fcn.14004e5bc
cmp al, bpl
je 0x14008a8bb
mov r12d, 0x2a
mov r14d, ebp
jmp 0x14008a8fd
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx]
cmp ax, bp
je 0x14008a8f3
mov edx, 0x20
lea r8d, [rdx - 0x17]
cmp r8w, ax
ja 0x14008a8dd
cmp ax, 0xd
jbe 0x14008a8ee
cmp dx, ax
je 0x14008a8ee
add rcx, 2
mov ax, word [rcx]
cmp ax, bp
jne 0x14008a8d1
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
call fcn.140044ef4
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax]
cmp ebx, ecx
je 0x14008a7ce
lea rcx, [rsp + 0x30]
call fcn.140044ef4
mov rcx, qword [rsp + 0x30]
cmp word [rcx], bp
jne 0x14008a92b
mov eax, 0x80070057
jmp 0x14008aca7
mov qword [rsp + 0x50], rbp
cmp edi, ebp
je 0x14008a978
lea r8, [rsp + 0x50]
xor r9d, r9d
mov rdx, rsi
mov rcx, r13
mov byte [rsp + 0x20], 1
call fcn.140054c4c
mov r11, qword [rsp + 0x50]
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x168], r11
call fcn.140044ef4
mov rsi, qword [rsp + 0x168]
mov r11, rsi
mov qword [rsp + 0x30], rsi
jmp 0x14008a98c
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
call fcn.140044ef4
mov r11, qword [rsp + 0x30]
cmp word [r11], bp
jne 0x14008a99c
mov ebx, 0x80070057
jmp 0x14008ac9b
movzx eax, word [r11]
mov edi, 0x400000
mov qword [rsp + 0x48], rdi
cmp ebx, eax
jne 0x14008aa52
movzx eax, word [r11 + 2]
cmp ebx, eax
jne 0x14008aa52
lea rdx, [r11 + 4]
lea rcx, [0x1400e0828]
mov r8d, 3
call fcn.140045fc8
cmp al, bpl
je 0x14008aa52
add r11, 0xa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r11
call fcn.140051edc
mov rdi, qword [rsp + 0x48]
add rdi, 0x1fff
and rdi, 0xffffffffffffe000
mov qword [rsp + 0x48], rdi
jmp 0x14008aa52
cmp ax, bp
je 0x14008aa3d
mov ecx, 0x20
lea edx, [rcx - 0x17]
cmp dx, ax
ja 0x14008aa24
cmp ax, 0xd
jbe 0x14008aa35
cmp cx, ax
je 0x14008aa35
add rsi, 2
mov ax, word [rsi]
cmp ax, bp
jne 0x14008aa19
mov qword [rsp + 0x168], rsi
lea rcx, [rsp + 0x168]
call fcn.140044ef4
mov rsi, qword [rsp + 0x168]
movzx eax, word [rsi]
cmp ebx, eax
je 0x14008aa0c
cmp r12d, ebp
je 0x14008aa64
mov rbx, qword [r13 + 0x40]
jmp 0x14008aa67
mov rbx, rbp
mov eax, dword [rsp + 0x178]
test eax, eax
je 0x14008aa77
test r15d, r15d
jne 0x14008aa89
mov rcx, rbx
call fcn.1400451f0
mov rbp, rax
mov eax, dword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 4
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbx
movsxd rcx, r12d
xor esi, esi
mov qword [rsp + 0xa0], rcx
movsxd rcx, r14d
mov qword [rsp + 0xa8], rcx
movsxd rcx, eax
movsxd rax, dword [rsp + 0x40]
or rcx, rax
movsxd rax, dword [rsp + 0x3c]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 0
lea rcx, [0x1400f2808]
cmp r15d, 2
je 0x14008ab41
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x14008ab4b
xor edx, edx
mov r8d, 0x1000
mov rcx, r13
call fcn.140013908
lea rcx, [0x1400f2808]
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x14008ab2a
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea r8, [0x14008a22c]
mov qword [rsp + 0x28], rax
movsxd rdx, edi
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14008ab87
xor ebx, ebx
lea r14d, [rbx + 1]
jmp 0x14008ab9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, 1
mov ebx, eax
test eax, eax
cmove ebx, r14d
test rdi, rdi
je 0x14008ac06
mov esi, 0x3e7
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14008abbc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub esi, r14d
jns 0x14008aba5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movsxd r12, r15d
jmp 0x14008abe6
cmp r12, 2
je 0x14008abd8
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14008abe6
xor r8d, r8d
mov edx, r14d
mov rcx, r13
call fcn.140013908
mov rsi, qword [rsp + 0x78]
test rsi, rsi
jne 0x14008abc7
mov eax, dword [rsp + 0x38]
cmp eax, 0x80000000
je 0x14008ac06
mov edx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [rsp + 0x80]
lea r8, str.__LastTID
mov rcx, r13
call fcn.14004ed18
lea rcx, [0x1400f2808]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rsi, rsi
cmovne ebx, r14d
test r15d, r15d
je 0x14008ac6e
test rdi, rdi
je 0x14008ac7c
mov rax, qword [rsp + 0x80]
test eax, eax
je 0x14008ac6e
lea rdx, [0x1400e0810]
lea rcx, [rsp + 0xd0]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xd0]
mov rcx, r13
call fcn.14002f0fc
test rdi, rdi
je 0x14008ac7c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x14008ac9b
test rdi, rdi
je 0x14008ac9b
mov r9, qword [r13 + 0x40]
mov r8, r14
mov edx, 0x451
mov rcx, rbp
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rsp + 0x50]
call fcn.140044f24
mov eax, ebx
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret