Function at 0x180009a7c
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0x320
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x310], rax
lea rdx, str.__SB_WATCHMAN_ATTACHED__
lea rbp, [0x18015f578]
mov rcx, rbp
call fcn.1800098e8
lea rdx, [0x18010d528]
lea rcx, [rsp + 0x48]
call fcn.1800041c0
nop
mov ebx, 0x104
mov r8d, ebx
lea rdx, [rsp + 0x100]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x100]
mov edx, eax
lea rcx, [0x180162a80]
call fcn.180003e28
lea r8, [rsp + 0x100]
lea rdx, str.___CALLING_MODULE_:__s
mov rcx, rbp
call fcn.1800098e8
mov rcx, qword [0x1801624c8]
mov qword [0x180162160], rcx
mov r8d, ebx
lea rdx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x100]
mov edx, eax
lea rcx, [0x180162b20]
call fcn.180003e28
lea r8, [rsp + 0x100]
lea rdx, str.SB_WATCHMAN_dll_:_dll_path_:__s
mov rcx, rbp
call fcn.1800098e8
and qword [0x180162c90], 0
mov esi, 1
mov dword [0x180162ce8], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x180162cd0], rax
xor r9d, r9d
mov r8d, esi
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x180162cd8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x180162ce0], rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [0x180162c90]
lea r8, [0x18000be34]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180162cc8], rax
lea rdx, str.Starting_API_hooking_.....
mov rcx, rbp
call fcn.1800098e8
mov dword [0x1801624d0], 0
lea rcx, [0x180162a80]
call fcn.18000f6a4
mov rcx, rax
test rax, rax
je 0x180009c58
cmp dword [rax + 8], 0
jne 0x180009c3e
mov r8, qword [rax]
mov edx, esi
call qword [r8]
jmp 0x180009c58
mov qword [0x180162c98], rax
mov rax, qword [rax]
call qword [rax + reloc.WS2_32.dll_htonl]
xor edx, edx
test eax, eax
sete dl
xchg dword [0x1801624d0], edx
mov eax, dword [0x1801624d0]
test eax, eax
jne 0x180009c76
lea rdx, str.API_hooking_FAILED___
mov rcx, rbp
call fcn.1800098e8
jmp 0x180009d03
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x18
and dword [rsp + 0x40], eax
mov edx, esi
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x180009d03
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x180009d03
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov r8d, ebx
lea rdx, str.GlobalSBWSIGNALEVNT__d
lea rcx, [rsp + 0x80]
call fcn.1800099b4
lea r9, [rsp + 0x80]
xor r8d, r8d
mov edx, esi
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1801624e0], rax
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
lea rax, [0x18015f758]
cmp rcx, rax
je 0x180009d2a
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x180009d2a
call fcn.1800d1434
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rsi
ret