Function at 0x140002a84
Capabilities:
Create thread
Link many functions at runtime
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, ecx
lea rcx, [0x140004268]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140008218], rax
test rax, rax
je 0x140002cf6
call fcn.1400031f8
test eax, eax
jne 0x140002abf
call fcn.140002e34
test eax, eax
je 0x140002cf6
mov eax, dword [section..data]
cmp eax, 5
je 0x140002ad3
cmp eax, 0xb
jb 0x140002cf6
and dword [0x140008220], 0
test ebx, ebx
jne 0x140002ae6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea rcx, [0x1400502c0]
mov dword [0x140006104], ebx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x140008218]
lea rdx, str.NtAlpcConnectPort
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140008218]
lea rdx, str.NtQueryLicenseValue
mov qword [0x1400071f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140008218]
lea rdx, str.NtAlpcSendWaitReceivePort
mov qword [0x140007168], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140008218]
lea rdx, str.NtRegisterThreadTerminatePort
mov qword [0x140007188], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.KERNELBASE.dll
mov qword [0x140007198], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b90
lea rdx, str.BaseGetNamedObjectDirectory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140006128], rax
jmp 0x140002b97
mov rax, qword [0x140006128]
test rax, rax
jne 0x140002bd3
lea rcx, [0x140004330]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002bc7
lea rdx, str.BaseGetNamedObjectDirectory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140006128], rax
jmp 0x140002bce
mov rax, qword [0x140006128]
test rax, rax
je 0x140002bdc
lea rcx, [0x1400502a0]
call rax
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtQueryTimerResolution]
test eax, eax
js 0x140002c2e
mov ecx, dword [rsp + 0x50]
lea r8, [rsp + 0x48]
mov eax, dword [rsp + 0x48]
inc ecx
mov dl, 1
mov dword [0x1400071f8], eax
call qword [sym.imp.ntdll.dll_NtSetTimerResolution]
test eax, eax
js 0x140002c24
mov eax, dword [rsp + 0x50]
inc eax
mov dword [0x140007174], eax
jmp 0x140002c2e
mov dword [0x140007174], 1
and qword [rsp + 0x28], 0
lea r8, [0x140001968]
xor r9d, r9d
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140007190], rax
test rax, rax
je 0x140002cf6
mov ecx, 0x8007
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rcx, qword [0x140007190]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [0x140007190]
mov edx, 0x1d4c0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x3e8
mov dword [0x140007170], 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, dword [0x140007180]
test r8d, r8d
je 0x140002cc7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [0x1400071f8]
test eax, eax
je 0x140002cee
mov ecx, dword [0x1400071f8]
lea r8, [0x1400071f8]
mov dl, 1
call qword [sym.imp.ntdll.dll_NtSetTimerResolution]
mov eax, dword [0x140007184]
jmp 0x140002cf8
xor eax, eax
add rsp, 0x30
pop rbx
ret