Function at 0x18000d0b0
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov qword [rsp + 0x120], rbx
mov rax, qword [0x180154010]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov edi, edx
mov r14, rcx
xor esi, esi
mov dword [rbp - 0x79], esi
mov rax, qword [rcx]
cmp edx, dword [rax]
jae 0x18000d256
lfence
mov rcx, qword [rcx + 8]
call fcn.1800038a0
mov r15, qword [r14 + 0x18]
mov r12, qword [r14 + 0x10]
mov rcx, qword [r12 + rdi*8 + 0x218]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x18002b58a.0]
mov r13, qword [rax + 0x70]
cmp byte [r13], 1
jne 0x18000d21c
mov rax, qword [0x180154f68]
cmp byte [rax + 8], sil
jne 0x18000d15e
xor edx, edx
mov rcx, rax
call fcn.180012e90
test al, al
jne 0x18000d157
movzx eax, word [0x180154f78]
jmp 0x18000d16d
mov rax, qword [0x180154f68]
movsxd rcx, dword [0x180154f70]
mov rax, qword [rax + 0x10]
movzx eax, word [rcx + rax]
test ax, ax
je 0x18000d184
cmp ax, 2
jbe 0x18000d1c1
cmp ax, 3
jne 0x18000d21c
jmp 0x18000d1d7
mov rax, qword [0x180154f98]
cmp byte [rax + 8], sil
jne 0x18000d1ae
xor edx, edx
mov rcx, rax
call fcn.180012e90
test al, al
jne 0x18000d1a7
mov eax, dword [0x180154fa8]
jmp 0x18000d1bc
mov rax, qword [0x180154f98]
movsxd rcx, dword [0x180154fa0]
mov rax, qword [rax + 0x10]
mov eax, dword [rcx + rax]
cmp eax, 1
jne 0x18000d1c5
mov esi, edi
jmp 0x18000d1d2
mov rcx, r15
call fcn.18001ed50
movzx esi, ax
add esi, edi
cmp esi, 4
jae 0x18000d21c
lfence
mov rcx, qword [r12 + rdi*8 + 0x218]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x18002b58a.0]
mov r8d, dword [rax + 0xe8]
mov rdx, r13
lea rcx, [rbp + 7]
call fcn.18003ef80
mov r11, qword [0x18015b070]
lea rdx, [rbp + 7]
mov ecx, esi
mov rax, qword [r11 + 0x308]
call qword [case.0x18002b58a.0]
mov rax, qword [r14 + 0x10]
mov rcx, qword [rax + rdi*8 + 0x218]
cmp byte [rcx + 0x108], 0
je 0x18000d50f
lfence
mov rax, qword [r14 + 0x10]
mov rcx, qword [rax + rdi*8 + 0x218]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x18002b58a.0]
jmp 0x18000d50f
mov edx, 0x7d0
mov rcx, qword [rcx + 8]
call fcn.180003bf0
mov rax, qword [r14 + 0x20]
cmp edi, dword [rax]
jae 0x18000d50f
lfence
mov rax, qword [r14 + 0x28]
mov rdx, qword [rax]
mov rcx, qword [rdx + rdi*8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [r14 + 0x20]
mov ecx, dword [rax]
lea eax, [rcx - 2]
cmp edi, eax
jne 0x18000d2a7
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x18015b070]
call fcn.180006020
jmp 0x18000d50f
lea eax, [rcx - 1]
cmp edi, eax
jne 0x18000d2b8
call fcn.180007e50
jmp 0x18000d50f
mov rax, qword [r14]
sub edi, dword [rax]
mov rcx, qword [0x18015b0c8]
movzx ebx, word [0x18015b0c0]
mov word [rbp - 0x49], bx
mov qword [rbp - 0x41], rcx
mov byte [rbp - 0x39], 1
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
mov qword [rbp - 0x21], 4
xor eax, eax
mov dword [rbp - 0x31], eax
mov byte [rbp - 0x2d], al
mov word [rbp - 0x11], ax
lea rax, [0x180001f40]
mov qword [rbp - 9], rax
mov r15d, 1
test rcx, rcx
je 0x18000d328
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
call qword [case.0x18002b58a.0]
jmp 0x18000d32b
mov eax, r15d
mov r8d, eax
movzx edx, bx
lea rcx, [rbp - 0x49]
call fcn.18002b4e0
nop
mov dword [rbp - 0x79], r15d
mov rcx, qword [rbp - 0x21]
mov rdx, qword [rbp - 0x19]
mov rax, rdx
sub rax, rcx
cmp rax, 0x12
jb 0x18000d386
lea rax, [rcx + 0x12]
mov qword [rbp - 0x21], rax
lea rbx, [rbp - 0x31]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x31]
add rbx, rcx
mov r8d, 0x12
lea rdx, str.write_event__dev:
mov rcx, rbx
call fcn.18006d180
mov byte [rbx + 0x12], 0
jmp 0x18000d3a9
lfence
mov qword [rsp + 0x20], 0x12
lea r9, str.write_event__dev:
xor r8d, r8d
lea edx, [r8 + 0x12]
lea rcx, [rbp - 0x31]
call fcn.1800184f0
mov edx, edi
lea rcx, [rbp - 0x49]
call fcn.18002b900
and r15d, 0xfffffffe
mov dword [rbp - 0x79], r15d
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x18000d3dd
cmp byte [rbp - 0x39], 0
je 0x18000d3dd
mov rax, qword [rcx]
lea rdx, [rbp - 0x49]
mov rax, qword [rax + 0x10]
call qword [case.0x18002b58a.0]
nop
lea rcx, [rbp - 0x31]
call fcn.180002b00
mov rcx, qword [r14 + 0x10]
mov rbx, qword [rcx + rdi*8 + 0x240]
mov byte [rbx + 0xb0], 1
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea r14, [rbx + 0x18]
lea rbx, [r14 + 0x28]
mov qword [rbp - 0x61], rbx
mov rcx, rbx
call fcn.1800434b4
test eax, eax
jne 0x18000d546
cmp byte [r14 + 0x10], al
je 0x18000d488
mov byte [r14 + 0x20], 1
mov rcx, rbx
call fcn.180043530
test eax, eax
jne 0x18000d54e
movzx ebx, di
cmp ebx, dword [0x180154f5c]
jae 0x18000d4fb
mov rcx, qword [0x180154f50]
cmp byte [rcx + 8], 0
jne 0x18000d46c
mov dl, 1
call fcn.180012e90
test al, al
je 0x18000d4fb
mov rcx, qword [0x180154f50]
mov rcx, qword [rcx + 0x10]
add rcx, rbx
movsxd rax, dword [0x180154f58]
add rcx, rax
mov dword [0x180154f64], esi
jmp 0x18000d50c
mov rcx, r14
call fcn.18003e970
mov qword [rbp - 0x59], rbx
mov rcx, rbx
call fcn.1800434b4
test eax, eax
jne 0x18000d536
cmp qword [r14 + 8], 0
jne 0x18000d4ea
mov word [r14 + 0x10], 1
mov dword [r14], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [r14 + 0x18], rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, r14
lea r8, [0x18003ec60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14 + 8], rax
mov rcx, rbx
call fcn.180043530
test eax, eax
jne 0x18000d53e
jmp 0x18000d42a
mov dword [0x180154f64], 0x48f
lea rcx, [0x18015bb00]
mov byte [rcx], 0
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.18003f930
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
call fcn.180042d28
int3
mov ecx, eax
call fcn.180042d28
nop
mov ecx, eax
call fcn.180042d28
int3
mov ecx, eax
call fcn.180042d28
int3