Function at 0x140011bf0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x210
mov rax, qword [0x140055008]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rax, qword [0x140055248]
mov r15, rcx
xor edi, edi
lea rcx, [0x140055248]
mov rbx, rdx
mov esi, edi
mov rax, qword [rax + 0x18]
call qword [0x1400185c0]
add rax, 0x18
lea r12d, [rdi + 7]
cmp dword [0x140055944], edi
mov qword [rsp + 0x30], rax
je 0x140011c6a
mov r9, rbx
movzx edx, r12w
lea r8, str._Opening_ETL_file_session_for_event_processing:__S_n
mov ecx, 0xfffffff4
call fcn.1400085c0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x1c0
call sub.msvcrt.dll_memset
mov dword [rsp + 0x5c], 0x10000000
lea rax, [0x1400123c0]
mov qword [rsp + 0x1e8], rax
mov rbp, 0xffffffffffffffff
mov qword [rsp + 0x1f8], r15
test rbx, rbx
jne 0x140011cab
mov eax, edi
jmp 0x140011cb9
mov rax, rbp
nop
inc rax
cmp word [rbx + rax*2], si
jne 0x140011cb0
mov r8d, eax
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.140007e80
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 8], 1
jle 0x140011ce6
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.140007cf0
mov rbx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
call qword [sym.imp.api_ms_win_eventing_consumer_l1_1_0.dll_OpenTraceW]
mov r14, rax
cmp rax, rbp
jne 0x140011dd9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x140011d17
movzx esi, ax
or esi, 0x80070000
test esi, esi
jns 0x140011dd9
mov r8d, 0x114f
mov r10d, esi
mov r11, rdi
lea r9, [0x14003c070]
mov eax, edi
mov rdx, r10
add rax, rax
mov ecx, edi
mov eax, dword [r9 + rax*8]
sub rdx, rax
je 0x140011d65
mov ecx, r8d
sub ecx, edi
shr ecx, 1
add ecx, edi
test rdx, rdx
mov eax, ecx
cmovns eax, r8d
cmovns edi, ecx
inc edi
mov r8d, eax
cmp eax, edi
jae 0x140011d32
jmp 0x140011d6d
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], 0
je 0x140011eda
lea rax, str.HRESULT_FROM_WIN32__GetLastError____
movzx edx, r12w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov r9d, esi
mov qword [rsp + 0x20], r11
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x140011eda
lea r9, str.avcoremf_samplesmf360mftracemftracelibetwwriter.cpp
movzx edx, r12w
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0xcc
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140011eda
mov qword [rsp + 0x28], rdi
lea r8, [0x140012270]
mov r9, r15
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [r15 + 0x78], r14
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [r15 + 0x80], rax
test rax, rax
jne 0x140011eda
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x140011e1f
movzx esi, ax
or esi, 0x80070000
mov r8d, 0x114f
mov r10d, esi
mov r11, rdi
lea r9, [0x14003c070]
mov eax, edi
mov rdx, r10
add rax, rax
mov ecx, edi
mov eax, dword [r9 + rax*8]
sub rdx, rax
je 0x140011e65
mov ecx, r8d
sub ecx, edi
shr ecx, 1
add ecx, edi
test rdx, rdx
mov eax, ecx
cmovns eax, r8d
cmovns edi, ecx
inc edi
mov r8d, eax
cmp eax, edi
jae 0x140011e32
jmp 0x140011e6d
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], 0
je 0x140011ecc
lea rax, str.m_hThread__CreateThread__0__0__CETWWriter::ProcessTraceProc__this__0__0__
movzx edx, r12w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov r9d, esi
mov qword [rsp + 0x20], r11
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x140011ecc
lea r9, str.avcoremf_samplesmf360mftracemftracelibetwwriter.cpp
movzx edx, r12w
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0xd2
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp r14, rbp
je 0x140011eda
mov rcx, r14
call qword [sym.imp.api_ms_win_eventing_consumer_l1_1_0.dll_CloseTrace]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x140011ef8
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x1400185c0]
mov eax, esi
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.140016790
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret