Function at 0x2100cf720
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x160
lea rbp, [rsp + 0x80]
add rsp, 0xffffffffffffff80
lea rdi, [rcx + 0x40]
lea rsi, [rbp + 0x10]
mov rbx, rcx
lea r12, [rsp + 0x40]
lea r13, [rbp - 0x30]
nop dword [rax]
mov r9, r12
mov r8d, 2
mov rdx, rsi
mov rcx, rbx
call method.lockf_t.create_lock_obj_attr_lockfattr_t__unsigned_int__void_
xor r9d, r9d
mov edx, 0x120003
mov rcx, rdi
mov dword [rsp + 0x20], 0
mov r8, rax
call sym.NtCreateEvent
test eax, eax
js 0x2100cf7b0
test byte [rbx], 0x20
jne 0x2100cf820
lea rsp, [rbp + 0xe0]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
cmp eax, 0xc0000035
jne 0x2100cfa2d
mov rcx, rbx
call method.lockf_t.open_lock_obj__
test al, al
je 0x2100cf758
mov rcx, qword [rbx + 0x40]
xor edx, edx
mov r9d, 8
mov r8, r13
mov qword [rsp + 0x20], 0
call sym.NtQueryEvent
test eax, eax
js 0x2100cf7ef
mov eax, dword [rbp - 0x2c]
test eax, eax
jne 0x2100cf800
mov edx, 0xc0000035
lea rcx, str.NtCreateEvent_lock_:__y
call sym.api_fatal
mov rcx, qword [rbx + 0x40]
call sym.NtClose
add word [rbx + 0x24], 1
mov qword [rbx + 0x40], 0
jmp 0x2100cf758
mov rax, qword [0x21024fce8]
lea r13, [rbp - 0x30]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
mov edx, dword [rax + 8]
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0
call method.pinfo.init_int__unsigned_int__void_
mov rax, qword [rbp - 8]
test rax, rax
je 0x2100cf794
mov r8d, dword [rax + 0x14]
xor edx, edx
mov ecx, 0x47a
call sym.OpenProcess
mov r12, rax
test rax, rax
je 0x2100cf90f
mov r14, qword [rbx + 0x40]
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
lea r9, [rbp - 0x38]
mov r8, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r14
mov dword [rsp + 0x20], 1
call sym.DuplicateHandle
test eax, eax
jne 0x2100cf927
test byte [0x210273880], 1
jne 0x2100cf9e5
mov rcx, r12
call sym.CloseHandle
cmp byte [rbp - 0x18], 0
je 0x2100cf794
cmp qword [rbp - 8], 0
je 0x2100cf794
mov rcx, r13
call method.pinfo.release__
jmp 0x2100cf794
test byte [0x210273880], 1
jne 0x2100cf9b6
cmp byte [rbp - 0x18], 0
jne 0x2100cf8f7
jmp 0x2100cf794
mov rax, qword [rbp - 0x38]
lea r9, [sym.create_lock_in_parent_void_]
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x30], 0
mov r8d, 0x40000
mov dword [rsp + 0x28], 0x10000
mov qword [rsp + 0x20], rax
call sym.CreateRemoteThread
mov r14, rax
test rax, rax
je 0x2100cf97a
mov edx, 0xffffffff
mov rcx, rax
call sym.WaitForSingleObject
mov rcx, r14
call sym.CloseHandle
jmp 0x2100cf8e5
test byte [0x210273880], 1
jne 0x2100cfa09
mov rdx, qword [rbp - 0x38]
xor r9d, r9d
mov r8, r12
mov rcx, r12
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
jmp 0x2100cf8e5
mov rax, qword [rbp - 8]
lea r9, str.OpenProcess___u_:__E
lea r8, str.void_lockf_t::create_lock_obj__
mov edx, 0x40
lea rcx, [0x210273880]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x20], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100cf91c
lea r9, str.DuplicateHandle__lf_obj_:__E
lea r8, str.void_lockf_t::create_lock_obj__
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100cf8e5
lea r9, str.CreateRemoteThread:__E
lea r8, str.void_lockf_t::create_lock_obj__
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100cf987
mov edx, eax
lea rcx, str.NtCreateEvent_lock_:__y
call sym.api_fatal
nop
nop dword [rax]