Function at 0x1000705d4
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
xor ebx, ebx
mov rsi, r8
mov r13, rdx
and dword [rax + 0x10], ebx
lea r8, [0x10002ba58]
lea rcx, [rax - 0x38]
lea edx, [rbx + 0x5e]
xor edi, edi
xor ebp, ebp
xor r12d, r12d
call sub.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64
test r13, r13
je 0x100070745
test rsi, rsi
je 0x100070745
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
lea r14d, [rbx + 8]
lea r8d, [rbx + 0x20]
mov rcx, rax
mov edx, r14d
call sub.vdsutil.dll_void____ptr64___cdecl_VdsHeapAlloc_void____ptr64__unsigned_long_int__unsigned_long_long_unsigned___int64__
mov rbx, rax
test rax, rax
jne 0x100070664
lea r8, [0x10002bb40]
lea ecx, [rdi + 0x5f]
mov r9d, r14d
xor edx, edx
mov r12d, r14d
mov qword [rsp + 0x20], r13
call sub.vdsutil.dll_void___cdecl_VdsTraceExW_unsigned_long_int__unsigned_long_int__unsigned_short_int____ptr64_
jmp 0x100070777
mov qword [rax + 0x18], rsi
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea rbp, [rcx - 1]
lea rdi, [rcx + rcx]
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
mov r8, rdi
mov edx, r14d
mov rcx, rax
call sub.vdsutil.dll_void____ptr64___cdecl_VdsHeapAlloc_void____ptr64__unsigned_long_int__unsigned_long_long_unsigned___int64__
mov r8, r13
mov rdi, rax
test rax, rax
jne 0x1000706e4
lea rdx, [0x10002bbe0]
xor ecx, ecx
call sub.vdsutil.dll_void___cdecl_VdsTraceW_unsigned_long_int__unsigned_short_int____ptr64_
lea rcx, [rsp + 0x30]
call sub.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
mov r8, rsi
mov rcx, rax
xor edx, edx
call sub.vdsutil.dll_int___cdecl_VdsHeapFree_void____ptr64__unsigned_long_int__void____ptr64_
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call sub.vdsutil.dll_int___cdecl_VdsHeapFree_void____ptr64__unsigned_long_int__void____ptr64_
mov eax, r14d
jmp 0x1000707da
lea rdx, [rbp + 1]
mov rcx, rax
call fcn.100036ff8
lea rax, [rsp + 0x78]
lea r8, [0x1000707fc]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], r12d
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rbx], rdi
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_CreateThread]
mov rbp, rax
test rax, rax
jne 0x10007073d
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
lea rdx, [0x10002bc50]
mov r8, r13
mov r9d, eax
xor ecx, ecx
mov r12d, eax
call sub.vdsutil.dll_void___cdecl_VdsTraceW_unsigned_long_int__unsigned_short_int____ptr64_
jmp 0x100070777
xor ebx, ebx
xor edi, edi
xor esi, esi
jmp 0x100070777
test r13, r13
lea rax, [0x100007348]
mov r12d, 0x57
cmovne rax, r13
xor edx, edx
lea r8, [0x10002ba90]
lea ecx, [rdx + 0x5f]
mov r9d, r12d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call sub.vdsutil.dll_void___cdecl_VdsTraceExW_unsigned_long_int__unsigned_long_int__unsigned_short_int____ptr64_
lea rcx, [rsp + 0x30]
call sub.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64
test rbp, rbp
je 0x10007078f
mov rcx, rbp
call qword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
test rsi, rsi
je 0x1000707a7
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.vdsutil.dll_int___cdecl_VdsHeapFree_void____ptr64__unsigned_long_int__void____ptr64_
test rdi, rdi
je 0x1000707bf
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.vdsutil.dll_int___cdecl_VdsHeapFree_void____ptr64__unsigned_long_int__void____ptr64_
test rbx, rbx
je 0x1000707d7
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.vdsutil.dll_int___cdecl_VdsHeapFree_void____ptr64__unsigned_long_int__void____ptr64_
mov eax, r12d
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret