Function at 0x140001f6c
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov esi, dword [rsp + 0x88]
lea eax, [rdx - 0xace]
xor r8d, 0x3df2
mov dword [rsp + 0x88], eax
mov eax, r8d
mov dword [rsp + 0x70], r8d
mov ecx, r9d
lea edi, [r9 - 0x6f4]
xor ecx, 0x82b
lea ebp, [r9 + 0x490]
xor eax, 0x3968
mov dword [rsp + 0x68], ecx
xor esi, 0x7946
cmp edi, eax
jge 0x140002086
lea eax, [r8 + 0x3943]
cmp ebp, eax
je 0x1400022c1
mov rbx, qword [rsp + 0x80]
add edi, 0x8c6
xor edi, 0x279
cmp dword [rbx + 0x24], 0x9267
jb 0x14000200e
mov eax, dword [rbx + 0xa0]
sub eax, dword [rbx + 0x120]
sub eax, 0x338899
xor dword [rbx + 0x108], eax
jmp 0x140002029
mov eax, dword [rbx + 0x120]
xor eax, dword [rbx + 0xc4]
mov ecx, dword [0x140041034]
imul ecx, eax
mov dword [0x140041034], ecx
add r8d, 0x3274
lea eax, [rbp - 0x99a]
mov dword [rsp + 0x28], eax
lea edx, [rsi - 0x914]
mov dword [rsp + 0x20], r8d
lea ecx, [rsi - 0x10bc]
add edi, 0xfffff8c7
mov r8, rbx
mov r9d, edi
call fcn.140012190
mov rdx, qword [section..data]
xor edi, 0x3ca
add edi, 0xc32
mov ecx, dword [rdx + 0x5c]
add ecx, 0xc4ec4ec5
add ecx, dword [rbx + 0x154]
mov dword [rdx + 0x34], ecx
jmp 0x1400022c1
mov rbx, qword [rsp + 0x80]
mov rdx, qword [section..data]
mov eax, dword [rbx + 0x138]
add eax, dword [rbx + 0xac]
xor eax, 0x320a
cmp dword [rdx + 0xb4], eax
jb 0x140002295
mov r9d, dword [0x1400410a8]
mov eax, esi
mov r11d, dword [rbx + 0x120]
or eax, 0x3d3d
and r11d, r8d
movsxd r10, ebp
or r11d, dword [rbx + 0x154]
sub eax, edi
movsxd rdx, eax
xor r9d, 0x38cc
mov eax, dword [rsp + 0x88]
sub r9d, ecx
mov rcx, qword [section..data]
xor r8d, edi
imul r8d, dword [rbx + 0x20]
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], r11d
sub eax, dword [rcx + 0xc4]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r10, qword [section..data]
mov eax, 0x320a
mov r8d, dword [rbx + 0x60]
add r8d, dword [rbx + 0xd0]
mov ecx, dword [0x140041164]
xor r8d, eax
mov edx, dword [rbx + 0xf8]
and ecx, eax
mov eax, dword [rbx + 0x64]
or eax, dword [rsp + 0x68]
mov r9d, dword [r10 + 0x100]
or eax, esi
or edx, dword [rbx + 4]
or r9d, dword [rsp + 0x68]
and edx, 0x426d
add ecx, dword [rbx + 0xb8]
xor r9d, dword [rbx + 0x6c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r10
call fcn.140001f6c
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [0x1400410dc]
mov ecx, dword [rsp + 0x68]
add r8d, 0x3df8
mov edx, dword [rbx + 0x88]
xor r8, rcx
mov ecx, dword [rbx + 0xf4]
xor edx, esi
imul edx, dword [rsp + 0x88]
add ecx, esi
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov r8d, dword [rbx + 0x124]
mov rax, qword [section..data]
mov ecx, r8d
or ecx, dword [0x140041130]
or ecx, dword [rsp + 0x88]
mov esi, dword [rsp + 0x68]
or ecx, edi
mov edx, dword [rax + 0x128]
mov eax, esi
sub eax, ecx
sub edx, 0x4c6
mov ecx, eax
and edx, 0x3b3a
xor rcx, r8
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov rax, qword [section..data]
mov r9d, dword [rbx + 0x44]
mov r10d, dword [rbx + 0xc8]
mov r11d, dword [rbx + 0xd0]
mov ecx, dword [rax + 0x104]
xor r11d, 0x3143
imul r9d, esi
add ecx, 0xffffcebd
mov eax, ebp
add r10d, ecx
or r9, rax
mov eax, dword [rsp + 0x70]
add eax, ebp
movsxd r8, eax
mov ecx, dword [rbx + 0x150]
imul eax, esi, 0x332a
xor ecx, edi
mov qword [rsp + 0x28], r10
sub ecx, esi
mov dword [rsp + 0x20], r11d
add eax, 0x3df8
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x3957
mov eax, 0x1370
mov word [rsp + 0x30], ax
mov edx, 0x22b6
mov qword [rsp + 0x28], 0x2a08
mov r9d, 0x1d05
mov qword [rsp + 0x20], 0x1e6a
lea r8d, [rcx + 2]
call fcn.1400012bc
mov dword [0x140058f84], eax
jmp 0x1400022c1
mov ebx, 0x31c0
jmp 0x1400022b3
mov ecx, dword [0x1400410e0]
add ecx, dword [0x140041098]
add ecx, ebp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add esi, 3
mov eax, dword [0x14004107c]
sub eax, ebp
sub eax, ebx
cmp esi, eax
ja 0x14000229c
lea eax, [rdi - 0x2b8]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret