Function at 0x140075cd0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
push r12
push r14
push r15
sub rsp, 0x88
mov rbx, r8
mov r14, rdx
mov r15, rcx
test rcx, rcx
jne 0x140075d06
lea rax, str.BaseNamedObjectsPhSvcApiPort
mov dword [rsp + 0x40], 0x3e003c
mov qword [rsp + 0x48], rax
lea r15, [rsp + 0x40]
test rdx, rdx
jne 0x140075d1f
mov qword [rsp + 0xb0], 0xfffffffff70f2e80
lea r14, [rsp + 0xb0]
mov rdx, qword [0x140193820]
mov ecx, 0x40
call sym.ProcessHacker.exe_PhCreateObject
xor r12d, r12d
mov rdx, rax
mov ecx, 1
mov word [rax], r12w
lock xadd dword [0x1401937ec], ecx
movzx eax, cl
lea rcx, [0x140075c50]
mov qword [rdx + 8], rcx
lea rcx, str.Client
mov qword [rdx + 0x10], rcx
mov byte [rdx + 2], al
mov dword [rdx + 4], r12d
cmp eax, 0x100
jae 0x140076002
lea rcx, [0x140196820]
mov qword [rsp + 0xb8], rbp
mov qword [rcx + rax*8], rdx
mov r8b, 2
lea rax, [0x140197600]
mov qword [0x1401975f0], rdx
mov qword [rsp + 0xc0], rsi
lea rdx, [0x14018b328]
lea rcx, [rsp + 0x30]
mov qword [0x140197608], rax
mov qword [0x140197600], rax
mov qword [rsp + 0x80], rdi
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea edx, [r12 + 1]
lea rcx, [rsp + 0x30]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea rcx, [0x14018e2d0]
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlLengthSid]
lea rcx, [rsp + 0x30]
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [0x140196670]
lea edx, [r12 + 4]
add eax, 0x48
add edi, eax
mov r8d, edi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, rax
lea edx, [r12 + 1]
mov rbp, rax
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
lea edx, [rdi - 0x28]
mov edi, 2
mov r8d, edi
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
lea r9, [rsp + 0x30]
mov r8d, 0x1f0001
mov edx, edi
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea r9, [0x14018e2d0]
mov edx, edi
lea r8d, [r12 + 1]
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
xor r9d, r9d
lea r8, [rbp + 0x28]
mov dl, 1
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
mov r9d, 0xb0
mov dword [rsp + 0x50], 0x30
lea r8d, [r12 + 4]
mov qword [rsp + 0x58], r12
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x68], 0x40
lea rcx, [0x140197618]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntdll.dll_NtCreatePort]
mov rcx, qword [0x140196670]
mov r8, rbp
xor edx, edx
mov esi, eax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbp, qword [rsp + 0xb8]
test esi, esi
js 0x140075ffb
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140197610], eax
xor edx, edx
lea rcx, [0x1400757d0]
call sym.ProcessHacker.exe_PhCreateThread2
sub rdi, 1
jne 0x140075f00
lea r9d, [rdi + 1]
mov byte [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [0x1401975e0]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
js 0x140075f69
lea r9d, [rdi + 1]
mov byte [rsp + 0x20], r12b
xor r8d, r8d
lea rcx, [0x1401975e8]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
mov edi, eax
test eax, eax
jns 0x140075f88
mov rcx, qword [0x1401975e0]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov rsi, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0x80]
add rsp, 0x88
pop r15
pop r14
pop r12
pop rbx
ret
test rbx, rbx
je 0x140075fb1
mov rax, qword [0x1401975e0]
mov qword [rbx + 8], rax
mov rax, qword [0x1401975e8]
mov qword [rbx + 0x10], rax
lock or dword [rsp], r12d
cmp byte [rbx], r12b
je 0x140075fb1
xor eax, eax
jmp 0x140075f69
mov rcx, qword [0x1401975e0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test rbx, rbx
je 0x140075fcd
cmp byte [rbx], r12b
jne 0x140075f67
mov rcx, qword [0x1401975e8]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov edi, eax
test rbx, rbx
je 0x140075fef
cmp byte [rbx], r12b
jne 0x140075f67
cmp eax, 0x102
jne 0x140075fb1
jmp 0x140075f67
mov eax, esi
jmp 0x140075f69
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3