Function at 0x100028d90
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
mov rcx, qword [0x1000dedd8]
mov r14, qword [rsp + 0x90]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x100028e18
test byte [rcx + 0x1c], 1
je 0x100028e18
cmp byte [rcx + 0x19], 5
jb 0x100028e18
mov rax, qword [r9]
mov rcx, qword [rcx + 0x10]
mov r9, qword [r13]
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], rax
mov rax, qword [r8]
lea r8, [0x100008e80]
mov edx, 0xa4
mov qword [r11 - 0x48], rax
call fcn.100021608
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
xor r15d, r15d
mov esi, 0x80070006
mov ebx, r15d
cmp qword [r13], r15
je 0x100028e5b
mov ebx, esi
cmp rcx, rax
je 0x100028e5b
test byte [rcx + 0x1c], 1
je 0x100028e5b
cmp byte [rcx + 0x19], 2
jb 0x100028e5b
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0xa5
mov r9d, esi
call fcn.100020d8c
mov rcx, qword [0x1000dedd8]
cmp qword [r12], r15
je 0x100028e9a
mov ebx, esi
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x100028ea1
test byte [rcx + 0x1c], 1
je 0x100028ea1
cmp byte [rcx + 0x19], 2
jb 0x100028ea1
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0xa6
mov r9d, esi
call fcn.100020d8c
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp qword [rbp], r15
je 0x100028ed9
mov ebx, esi
cmp rcx, rax
je 0x100028ed9
test byte [rcx + 0x1c], 1
je 0x100028ed9
cmp byte [rcx + 0x19], 2
jb 0x100028ed9
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0xa7
mov r9d, esi
call fcn.100020d8c
mov rcx, qword [0x1000dedd8]
cmp r14, r15
jne 0x100028f1a
mov ebx, 0x80070057
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x100028f1a
test byte [rcx + 0x1c], 1
je 0x100028f1a
cmp byte [rcx + 0x19], 2
jb 0x100028f1a
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0xa8
mov r9d, ebx
call fcn.100020d8c
mov rcx, qword [0x1000dedd8]
cmp ebx, r15d
mov rsi, r15
jl 0x100029223
mov ecx, 0x18
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rsi, rax
cmp rax, r15
je 0x100028f45
mov qword [rax], rdi
mov qword [rax + 0x10], r15
mov qword [rax + 8], r15
jmp 0x100028f4a
mov ebx, 0x8007000e
cmp ebx, r15d
jl 0x10002921c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r12], rax
cmp rax, r15
je 0x100028f71
mov ebx, r15d
jmp 0x100028f86
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
lea rdi, [0x1000dedd8]
cmp rcx, rdi
je 0x100028fcd
test byte [rcx + 0x1c], 1
je 0x100028fcd
cmp byte [rcx + 0x19], 5
jb 0x100028fcd
mov rax, qword [r12]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0xa9
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.100021328
mov rcx, qword [0x1000dedd8]
cmp ebx, r15d
jl 0x10002922a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [r12]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x10]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
jne 0x100029015
mov ebx, r15d
jmp 0x10002902a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
lea rdi, [0x1000dedd8]
cmp rcx, rdi
je 0x10002906d
test byte [rcx + 0x1c], 1
je 0x10002906d
cmp byte [rcx + 0x19], 5
jb 0x10002906d
mov r9, qword [r12]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0xaa
mov dword [rsp + 0x20], ebx
call fcn.100021510
mov rcx, qword [0x1000dedd8]
cmp ebx, r15d
jl 0x10002922a
xor r9d, r9d
xor ecx, ecx
lea edx, [r9 + 1]
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp], rax
cmp rax, r15
je 0x100029096
mov ebx, r15d
jmp 0x1000290ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
cmp rcx, rdi
je 0x1000290eb
test byte [rcx + 0x1c], 1
je 0x1000290eb
cmp byte [rcx + 0x19], 5
jb 0x1000290eb
mov rax, qword [rbp]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0xab
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.100021328
mov rcx, qword [0x1000dedd8]
cmp ebx, r15d
jl 0x10002922a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 8]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
jne 0x100029133
mov ebx, r15d
jmp 0x100029148
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
lea rdi, [0x1000dedd8]
cmp rcx, rdi
je 0x10002918b
test byte [rcx + 0x1c], 1
je 0x10002918b
cmp byte [rcx + 0x19], 5
jb 0x10002918b
mov r9, qword [rbp]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0xac
mov dword [rsp + 0x20], ebx
call fcn.100021510
mov rcx, qword [0x1000dedd8]
cmp ebx, r15d
jl 0x10002922a
mov r9, rsi
mov r8, r14
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r13], rax
cmp rax, r15
je 0x1000291bc
mov ebx, r15d
jmp 0x1000291d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
cmp rcx, rdi
je 0x100029211
test byte [rcx + 0x1c], 1
je 0x100029211
cmp byte [rcx + 0x19], 5
jb 0x100029211
mov rax, qword [r13]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0xad
mov r9d, ebx
mov qword [rsp + 0x20], rax
call fcn.100021328
mov rcx, qword [0x1000dedd8]
cmp ebx, r15d
jge 0x1000292b5
jmp 0x10002922a
mov rcx, qword [0x1000dedd8]
lea rdi, [0x1000dedd8]
cmp qword [r13], r15
je 0x100029245
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13], r15
mov rcx, qword [0x1000dedd8]
cmp qword [r12], r15
je 0x100029260
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12], r15
mov rcx, qword [0x1000dedd8]
cmp qword [rbp], r15
je 0x10002927b
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp], r15
mov rcx, qword [0x1000dedd8]
cmp rsi, r15
je 0x1000292b5
mov rcx, qword [rsi + 0x10]
cmp rcx, r15
je 0x100029293
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x10], r15
mov rcx, qword [rsi + 8]
cmp rcx, r15
je 0x1000292a6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 8], r15
mov rcx, rsi
call fcn.1000cd7b0
mov rcx, qword [0x1000dedd8]
cmp rcx, rdi
je 0x1000292de
test byte [rcx + 0x1c], 1
je 0x1000292de
cmp byte [rcx + 0x19], 5
jb 0x1000292de
mov rcx, qword [rcx + 0x10]
lea r8, [0x100008e80]
mov edx, 0xae
mov r9d, ebx
call fcn.100020d8c
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret