Function at 0x1400094c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
mov rbx, rcx
xor edi, edi
add rcx, 0xb0
call fcn.140002490
cmp dword [rbx + 0x1c], edi
jne 0x14000974d
cmp qword [0x140024c98], rdi
lea rcx, [0x140024cb0]
mov rax, qword [sym.imp.ArmouryCrate.Toolkit.dll_class_CCriticalSectionWrapper____ptr64___ptr64_g_cswThreadOwners]
mov qword [rsp + 0x50], rsi
mov qword [rax], rcx
lea rcx, [0x140024d20]
mov rax, qword [sym.imp.ArmouryCrate.Toolkit.dll__g_threadOwners__3PEAV__unordered_map_KV__stack_U_ThreadOwner__V__deque_U_ThreadOwner__V__allocat]
mov qword [rax], rcx
lea rcx, [0x140008870]
mov rax, qword [sym.imp.ArmouryCrate.Toolkit.dll_void____cdecl___void____ptr64__unsigned_long_int__struct__EXCEPTION_POINTERS____ptr64__struct__GUID_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64_g_fnLogCrash]
mov qword [rax], rcx
mov rax, qword [sym.imp.ArmouryCrate.Toolkit.dll_void____ptr64___ptr64_g_pLogCrashParam]
mov qword [rax], rbx
jne 0x14000958e
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140024c90], rax
test rax, rax
je 0x14000958e
mov qword [rsp + 0x28], rdi
lea r8, [0x140001ac0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140024c98], rax
test rax, rax
jne 0x14000958e
mov rcx, qword [0x140024c90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140024c90], rdi
lea rcx, [0x140001a30]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140001a50]
call qword [sym.imp.VCRUNTIME140.dll__set_purecall_handler]
lea rcx, [0x140001a60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_new_handler]
lea rcx, [0x140001a80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler]
mov edx, 2
mov ecx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_abort_behavior]
lea rdx, [0x140001a90]
mov ecx, 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
lea rdx, [0x140001aa0]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
lea rdx, [0x140001ab0]
mov ecx, 0xf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
lea r8, str.MainThread
lea rdx, str.ArmouryCrate.UserSessionHelper
lea rcx, [0x14001a6d0]
call qword [sym.imp.ArmouryCrate.Toolkit.dll_void___cdecl_SetThreadCrashHandlers_struct__GUID_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64_]
lea r8, str._____________User_Session_Helper_start_to_initialize_____________
mov edx, 1
mov rcx, rbx
call fcn.14000a5c0
mov esi, 0x80004005
cmp qword [rbx + 0x410], rdi
jne 0x1400096ed
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x420], rax
test rax, rax
je 0x1400096ed
mov qword [rsp + 0x28], rdi
lea r8, [0x14000c1b0]
mov r9, rbx
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x418], rax
mov rdx, rax
test rax, rax
je 0x1400096d9
mov rax, qword [rbx + 0x420]
xor r8d, r8d
mov qword [rsp + 0x38], rdx
mov r9d, 0xffffffff
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x1400096c5
mov esi, edi
jmp 0x1400096d9
mov rcx, qword [rbx + 0x418]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x418], rdi
mov rcx, qword [rbx + 0x420]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x420], rdi
test esi, esi
js 0x14000972f
lea rcx, [rbx + 0x2e8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov dword [rbx + 0x1c], eax
test eax, eax
jne 0x140009714
mov rcx, rbx
mov esi, 0x80004005
call fcn.14000a6f0
jmp 0x14000972f
lea r8, str.GlobalQueryEndSessionEvent
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x6c8], rax
mov r9d, esi
lea r8, str._____________User_Session_Helper_initialized:_0x_08X_____________
mov edx, 1
mov rcx, rbx
call fcn.14000a5c0
mov rsi, qword [rsp + 0x50]
jmp 0x140009752
mov edi, 0xa0800005
lea rcx, [rbx + 0xb0]
call fcn.140002600
mov rbx, qword [rsp + 0x58]
mov eax, edi
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret