Function at 0x140096c60
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0x38
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x30], r13
mov r13, rdx
mov rbx, rcx
mov r12d, 1
lock xadd dword [0x1401154c4], r12d
mov rax, qword [rsp + 0x80]
mov ebp, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x98]
xor r14d, r14d
mov qword [rcx + 0x10], rax
mov eax, dword [rsp + 0x90]
inc r12d
mov qword [rcx], r8
mov qword [rcx + 8], r9
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0x98], r14
mov qword [rcx + 0xa0], r14
mov qword [rcx + 0xa8], r14
mov qword [rcx + 0xb0], r14
mov qword [rcx + 0xb8], r14
mov qword [rcx + 0xc8], r14
mov qword [rcx + 0xd0], r14
mov dword [rcx + 0xd8], ebp
mov qword [rcx + 0xe0], r14
mov qword [rcx + 0xe8], r14
mov qword [rcx + 0xf0], r14
mov qword [rcx + 0xf8], r14
mov qword [rcx + 0x130], r14
mov qword [rcx + 0x138], r14
mov byte [rcx + 0x100], r14b
mov dword [rcx + 0x140], r14d
mov qword [rcx + 0x148], r14
mov qword [rcx + 0x150], r14
mov byte [rcx + 0x158], r14b
mov byte [rcx + 0x159], r14b
test rdi, rdi
je 0x140096dc9
mov ecx, 0x370
call fcn.1400abd9c
test rax, rax
je 0x140096d81
mov r9, qword [rsp + 0xa0]
mov r8d, dword [rbx + 0xc0]
mov rdx, rdi
mov rcx, rax
call fcn.140097870
mov rdi, rax
jmp 0x140096d84
mov rdi, r14
mov rcx, rdi
call fcn.1400977c0
test al, al
je 0x140096db4
mov rsi, qword [rbx + 0x18]
cmp rsi, rdi
je 0x140096dc9
test rsi, rsi
je 0x140096dae
mov rcx, rsi
call fcn.140097810
mov rcx, rsi
call fcn.1400ab7f0
mov qword [rbx + 0x18], rdi
jmp 0x140096dc9
test rdi, rdi
je 0x140096dc9
mov rcx, rdi
call fcn.140097810
mov rcx, rdi
call fcn.1400ab7f0
mov rsi, qword [rsp + 0x68]
cmp qword [rbx + 0x18], r14
jne 0x140096ee6
lea rcx, [rbx + 0x108]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
xor ecx, ecx
mov qword [rbx + 0x130], rax
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [rbx + 0x138], rax
test rax, rax
je 0x140096e50
cmp qword [rbx + 0x130], r14
je 0x140096e50
lea rax, [rsp + 0x60]
lea r8, [0x140095000]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xf8], rax
lea rcx, [0x1400edda0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0xb0], rax
test rax, rax
je 0x140096e80
lea rdx, str.MiniDumpWriteDump
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xb8], rax
lea rcx, str.rpcrt4.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0xc8], rax
test rax, rax
je 0x140096eb0
lea rdx, str.UuidCreate
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xd0], rax
lea rdi, [rbx + 0x20]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rdi
mov rdx, r13
call fcn.140003e20
cmp qword [rdi + 0x20], 8
jb 0x140096ed3
mov rdi, qword [rdi + 8]
jmp 0x140096ed7
add rdi, 8
mov rcx, rbx
mov qword [rbx + 0x98], rdi
call fcn.140095e40
mov r13, qword [rsp + 0x30]
cmp r12d, 1
mov r12, qword [rsp + 0x78]
jne 0x140096f03
lea rcx, [0x140115490]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test ebp, ebp
je 0x140096fd8
lea rcx, [0x140115490]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [0x1401154b8]
test rdi, rdi
jne 0x140096f6d
lea ecx, [rdi + 0x30]
call fcn.1400abd9c
mov rdi, rax
test rax, rax
je 0x140096f63
mov ecx, 8
call fcn.1400abd9c
test rax, rax
je 0x140096f48
mov qword [rax], rdi
jmp 0x140096f4b
mov rax, r14
mov qword [rdi], rax
mov qword [rdi + 0x18], r14
mov qword [rdi + 0x20], r14
mov qword [rdi + 0x28], r14
mov qword [0x1401154b8], rdi
jmp 0x140096f6d
mov rdi, r14
mov qword [0x1401154b8], r14
lea rdx, [rsp + 0x70]
mov rcx, rdi
mov qword [rsp + 0x70], rbx
call fcn.140096bb0
test bpl, 1
je 0x140096f99
lea rcx, [0x140096a20]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov qword [rbx + 0xe0], rax
test bpl, 2
je 0x140096fb2
lea rcx, [0x1400963d0]
call fcn.1400abc4c
mov qword [rbx + 0xe8], rax
test bpl, 4
je 0x140096fcb
lea rcx, [0x140096620]
call fcn.1400ac460
mov qword [rbx + 0xf0], rax
lea rcx, [0x140115490]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x38
pop r14
pop rdi
pop rbp
pop rbx
ret