Function at 0x10002c030
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, qword [rsp + 0x4d0]
mov eax, r8d
mov r15b, r9b
neg eax
mov rax, qword [rcx]
mov r13d, 0x80004005
sbb r12d, r12d
xor edi, edi
mov edx, r9d
and r12d, 0x7fffbffc
mov dword [rsp + 0x30], r9d
mov r14d, r8d
mov rbp, rcx
mov rsi, rdi
and r15b, 1
add r12d, r13d
call qword [rax + 0x78]
cmp eax, 0x80004004
jne 0x10002c0a7
mov byte [rbp + 0x541], 1
cmp eax, edi
jge 0x10002c0b3
mov edi, r12d
jmp 0x10002c2cf
mov rdx, rbx
mov rcx, rbp
call fcn.100006ae0
xor ebx, ebx
cmp eax, ebx
jge 0x10002c0cc
mov edi, r12d
jmp 0x10002c2d1
mov r8b, r15b
xor edx, edx
mov rcx, rbp
call fcn.1000182fc
cmp al, bl
je 0x10002c0c4
cmp r15b, bl
je 0x10002c183
cmp byte [rbp + 8], bl
jne 0x10002c183
mov byte [rbp + 0x61e], bl
mov rbx, qword [rbp + 0x620]
cmp rbx, rdi
je 0x10002c114
mov rcx, qword [rbx + 0x38]
cmp rcx, rdi
je 0x10002c114
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov qword [rbx + 0x38], rdi
mov rcx, rbp
call fcn.10002d15c
cmp eax, 0x80004004
jne 0x10002c12a
mov byte [rbp + 0x541], 1
xor ebx, ebx
cmp eax, ebx
jl 0x10002c0c4
lea r9, [rbp + 0x212]
lea r8, [0x1000b182c]
lea rcx, [rsp + 0x40]
mov edx, r14d
mov word [rsp + 0x40], bx
call fcn.10000f8c0
cmp eax, ebx
mov edi, eax
jl 0x10002c2da
lea rcx, [0x1000af2e4]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, rbx
je 0x10002c183
mov edx, dword [0x1000da5e0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rbp
call fcn.10000aa04
cmp eax, ebx
mov edi, eax
jl 0x10002c2da
mov rcx, rbp
call fcn.100006470
cmp eax, 2
jne 0x10002c1c9
lea rcx, [rsp + 0x250]
mov edx, r14d
mov word [rsp + 0x250], bx
call fcn.1000323d4
cmp eax, ebx
mov edi, eax
jl 0x10002c2da
jmp 0x10002c2d1
cmp dword [rbp + 0x430], 1
jne 0x10002c2d1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, rbx
je 0x10002c208
mov dword [rax], ebx
mov qword [rax + 8], rbx
mov dword [rax + 0x10], ebx
mov dword [rax + 0x14], ebx
mov qword [rax + 0x20], rbx
jmp 0x10002c20b
mov rsi, rbx
cmp rsi, rbx
jne 0x10002c21a
mov edi, 0x8007000e
jmp 0x10002c2da
test byte [rsp + 0x30], 4
mov dword [rsi + 0x14], ebx
je 0x10002c23a
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x20], rax
lea rax, [rsp + 0x30]
lea r8, [0x100031a14]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov qword [rsi + 0x18], rbp
mov dword [rsi + 0x10], r14d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor edi, edi
mov rbx, rax
cmp rax, rdi
jne 0x10002c292
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x10002c289
movzx r13d, ax
or r13d, 0x80070000
cmp eax, edi
cmovle r13d, eax
cmp r13d, edi
jl 0x10002c0ab
lock add dword [rbp + 0x5c8], 1
mov eax, dword [rsp + 0x30]
lea rcx, [rbp + 0x510]
mov qword [rsi + 8], rbx
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbp + 0x4f0]
mov rdx, rsi
call fcn.100004ef0
lea rcx, [rbp + 0x510]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
cmp edi, ebx
jl 0x10002c2da
cmp edi, 1
jne 0x10002c33d
mov r8b, r15b
mov edx, r14d
mov rcx, rbp
call fcn.10002c370
cmp byte [rbp + 0x541], bl
jne 0x10002c306
lea r9, [rbp + 0x212]
xor edx, edx
mov r8d, 0x7a50b
mov ecx, edi
call fcn.10000b498
cmp rsi, rbx
je 0x10002c33d
mov rcx, qword [rsi + 8]
cmp rcx, rbx
je 0x10002c31a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x20]
cmp rcx, rbx
je 0x10002c329
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1000031d0
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret