Function at 0x14000e840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea rbx, [0x14002ba38]
mov edi, 1
lea rsi, [0x14002ba30]
movzx r14d, cl
rol edi, 0
mov r12d, r15d
lea ebp, [r15 + 0x1a]
cmp byte [rbx + 0x10], r15b
je 0x14000e8c5
cmp byte [rbx + 0x11], r15b
je 0x14000e894
cmp byte [rbx + 0x12], r15b
je 0x14000e8c5
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbx + 0x10], r15b
mov byte [rbx + 0x12], r15b
cmp byte [rbx + 0x11], r15b
je 0x14000e92e
mov rcx, rsi
call fcn.14000e0e0
test al, al
jne 0x14000e8e0
or r12d, edi
mov byte [rbx + 0x11], r15b
jmp 0x14000e92e
cmp byte [rbx + 0x10], r15b
jne 0x14000e92e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rbx - 8]
mov qword [rsp + 0x28], r15
lea r8, [0x14000ec40]
mov qword [rbx + 8], rax
xor edx, edx
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov qword [rbx], rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov byte [rbx + 0x10], 1
add rsi, 0x20
rol edi, 1
add rbx, 0x20
sub rbp, 1
jne 0x14000e882
test r14b, r14b
je 0x14000ec15
mov ecx, 0x1000
call fcn.140012ac4
lea r8, str.UNWATCHEABLE_n
mov qword [rsp + 0x30], rax
mov edx, 0x1000
mov qword [rsp + 0x38], 0x1000
mov rcx, rax
mov byte [rax], r15b
call fcn.140012b58
mov edx, r12d
lea rcx, [rsp + 0x30]
call fcn.14000e6c0
mov r15, qword [0x14002bd70]
or rbp, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test r15, r15
je 0x14000eaf0
mov rdi, qword [r15]
movsx ecx, byte [rdi]
call fcn.140010e08
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x14000e9dc
mov edx, 1
shl edx, cl
mov eax, edx
and eax, r12d
cmp eax, edx
je 0x14000eae3
mov rcx, rdi
call fcn.14000e250
test al, al
jne 0x14000eae3
test rbx, rbx
je 0x14000ea04
mov rax, rbp
inc rax
cmp byte [rdi + rax], 0
jne 0x14000e9e4
mov rcx, rbp
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14000e9f0
inc rax
add rax, rcx
cmp rax, rsi
jbe 0x14000ea66
mov rax, rbp
inc rax
cmp byte [rdi + rax], 0
jne 0x14000ea07
cmp rax, 0x1000
jae 0x14000ea1f
mov eax, 0x1000
jmp 0x14000ea2b
mov rax, rbp
inc rax
cmp byte [rdi + rax], 0
jne 0x14000ea22
add rsi, rax
mov rcx, rsi
call fcn.140012ac4
mov r14, rax
test rbx, rbx
je 0x14000ea56
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140012af8
mov rcx, rbx
call fcn.140012abc
jmp 0x14000ea59
mov byte [rax], 0
mov rbx, r14
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140012b58
test rbx, rbx
je 0x14000ea92
mov rax, rbp
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x14000ea80
add rax, 2
cmp rax, rsi
jbe 0x14000ead1
add rsi, 0x1000
mov rcx, rsi
call fcn.140012ac4
mov rdi, rax
test rbx, rbx
je 0x14000eac1
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140012af8
mov rcx, rbx
call fcn.140012abc
jmp 0x14000eac4
mov byte [rax], 0
mov rbx, rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
lea r8, [0x14002138c]
mov rdx, rsi
mov rcx, rbx
call fcn.140012b58
mov r15, qword [r15 + 8]
test r15, r15
jne 0x14000e9a5
test rbx, rbx
je 0x14000eb12
mov rax, rbp
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x14000eb00
add rax, 9
cmp rax, rsi
jbe 0x14000eb51
add rsi, 0x1000
mov rcx, rsi
call fcn.140012ac4
mov rdi, rax
test rbx, rbx
je 0x14000eb41
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140012af8
mov rcx, rbx
call fcn.140012abc
jmp 0x14000eb44
mov byte [rax], 0
mov rbx, rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
lea r8, str._nREMAP_n
mov rdx, rsi
mov rcx, rbx
call fcn.140012b58
lea rcx, [rsp + 0x30]
call fcn.14000e560
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
test rbx, rbx
je 0x14000eb92
nop dword [rax]
inc rbp
cmp byte [rbx + rbp], 0
jne 0x14000eb80
add rbp, 2
cmp rbp, rdi
jbe 0x14000ebc7
add rdi, 0x1000
mov rcx, rdi
call fcn.140012ac4
mov rsi, rax
test rbx, rbx
je 0x14000ebc1
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.140012af8
mov rcx, rbx
call fcn.140012abc
jmp 0x14000ebc4
mov byte [rax], 0
mov rbx, rsi
lea r8, [0x1400213d4]
mov rdx, rdi
mov rcx, rbx
call fcn.140012b58
lea rcx, [0x14002bd78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, rbx
call fcn.1400114b4
mov ecx, 1
call fcn.140010f54
mov rcx, rax
call fcn.1400113a8
lea rcx, [0x14002bd78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call fcn.140012abc
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret