Function at 0x140021240
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x14009d2d0]
xor rax, rsp
mov qword [rbp], rax
mov rsi, rcx
call fcn.140035e60
lea rcx, [rbp - 0x70]
call fcn.1400059c0
nop
call fcn.140020740
mov ecx, 1
call fcn.14002bb50
test eax, eax
je 0x1400212b8
lea rax, str.McAPExe_starts
mov qword [rsp + 0x20], rax
mov r9d, 0x1a
lea r8, str.APServiceMain
lea rdx, str.E:BTc1fd866d_3751_4c72_a231_f6b223727ef9_vscore_srcMcAPExeMcAPExe.cpp
lea ecx, [r9 - 0x19]
call fcn.14000da30
lea rcx, [rsp + 0x58]
call fcn.1400201a0
nop
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1400212d6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [0x1400a0fd8], 0
xor edi, edi
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMcAfeeAPMcVSCIns
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140021326
mov edi, 1
jmp 0x1400213ac
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp - 0x70], rax
test rax, rax
jne 0x140021345
lea edi, [rax + 2]
jmp 0x1400213ac
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x140021363
lea edi, [rax + 3]
jmp 0x1400213ac
lea rcx, [rbp - 0x70]
call fcn.140006ef0
test eax, eax
je 0x140021377
mov edi, 7
jmp 0x1400213ac
mov dword [rsp + 0x50], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, [rbp - 0x70]
lea r8, [0x140005fd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x48], rax
test rax, rax
jne 0x1400213d6
mov edi, 4
mov dword [rsp + 0x50], edi
mov ecx, 1
call fcn.14002bb50
test eax, eax
je 0x1400214c1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
call fcn.140021780
jmp 0x1400214c1
lea r9, [rbp - 8]
call fcn.140005c00
test al, al
jne 0x1400213f3
lea rdx, [0x1400868a0]
lea rcx, [rbp - 8]
call fcn.140007c80
mov rax, qword [rsi + 0x38]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1cff
mov r8d, 0xffffffff
lea rdx, [rsp + 0x50]
mov ecx, 1
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
cmp eax, 0x102
je 0x1400214c1
nop dword [rax + rax]
cmp eax, 1
jne 0x1400214c1
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140021489
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140021454
mov rax, qword [rsi + 0x38]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x1cff
mov r8d, 0xffffffff
lea rdx, [rsp + 0x50]
mov ecx, 1
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
cmp eax, 0x102
jne 0x140021430
test rbx, rbx
je 0x1400214cf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
call fcn.14002bb50
test eax, eax
je 0x140021507
lea rax, str.McAPExe_ends
mov qword [rsp + 0x20], rax
mov r9d, 0x5a
lea r8, str.APServiceMain
lea rdx, str.E:BTc1fd866d_3751_4c72_a231_f6b223727ef9_vscore_srcMcAPExeMcAPExe.cpp
lea ecx, [r9 - 0x59]
call fcn.14000da30
nop
lea rcx, [rbp - 0x70]
call fcn.140005ad0
mov eax, edi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140043760
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret