Function at 0x14005bce0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rsi, rcx
lea rbx, [rcx + 0x198]
mov edi, 0x20
nop dword [rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx], rax
lea rbx, [rbx + 8]
sub rdi, 1
jne 0x14005bd10
xor r9d, r9d
lea r8d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsi + 0x298], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r14d, r14d
lea rcx, [0x14005c1f0]
xor r9d, r9d
mov qword [rsi + 0x2a0], rax
mov qword [rsp + 0x28], r14
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0x20], 4
call fcn.14010fba8
mov rbp, rax
test rax, rax
jne 0x14005bda6
lea r8, str.DriverEventMgr.cpp
mov edx, LoadRegTypeLib
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x14005bf53
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
lea r9, [rsi + 0x2a8]
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov r8, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsi + 0x2b0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor r8d, r8d
mov qword [rsi + 0x2b8], rax
mov rdx, rsi
mov dword [rsp + 0x20], 4
lea rcx, [0x14005c480]
call fcn.14010fba8
mov rbp, rax
test rax, rax
jne 0x14005be5d
lea r8, str.DriverEventMgr.cpp
mov edx, 0xae
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x14005bf53
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
lea r9, [rsi + 0x2c0]
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov r8, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsi + 0x338], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor r8d, r8d
mov qword [rsi + 0x340], rax
mov rdx, rsi
mov dword [rsp + 0x20], 4
lea rcx, [0x14005c530]
call fcn.14010fba8
mov rbp, rax
test rax, rax
jne 0x14005bf11
lea r8, str.DriverEventMgr.cpp
mov edx, 0xbf
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x14005bf53
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x58]
lea r9, [rsi + 0x348]
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov r8, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret