Function at 0x140004470
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0xb8
mov eax, dword [rsp + 0xd0]
xor eax, 0x73e3
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0xe0]
add eax, 0x1b8
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0xc0]
sub eax, 0x1d9
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0xd8]
xor eax, 0x5e
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xd0]
sub eax, 0x40f6
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xe0]
add eax, 0x46
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0xe0]
add eax, 0x5c8
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x4c]
sub eax, 0x9e5
cmp dword [rsp + 0x40], eax
jg 0x140004c40
mov eax, dword [rsp + 0x40]
xor eax, 0x34ee
cmp dword [rsp + 0x44], eax
je 0x1400049e8
mov eax, dword [rsp + 0x3c]
add eax, 0x941
mov dword [rsp + 0x3c], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0xc8]
mov eax, dword [rcx + rax + 0xc4]
sub eax, 0x190f37
mov rcx, qword [rsp + 0xc8]
mov ecx, dword [rcx + 0x70]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc8]
mov dword [rcx + 0x70], eax
mov rax, qword [rsp + 0xc8]
lea rcx, [0x14001d490]
mov qword [rax + 0x90], rcx
mov dword [rsp + 0x34], 0
jmp 0x14000458a
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x2bb6
jge 0x1400049e3
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc8]
mov eax, dword [rax + 0x78]
imul eax, dword [rcx + 0xf8]
mov rcx, qword [rsp + 0xc8]
mov dword [rcx + 0x78], eax
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx + 0x90]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rsp + 0x38]
imul ecx, dword [rax + 0x70]
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0xc8]
mov eax, dword [rcx + rax + 0x10]
xor eax, 1
mov rcx, qword [rsp + 0xc8]
mov ecx, dword [rcx + 0x134]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc8]
mov dword [rcx + 0x134], eax
mov eax, dword [rsp + 0x38]
shr eax, 8
mov rcx, qword [rsp + 0xc8]
movsxd rcx, dword [rcx + 0x7c]
mov rdx, qword [rsp + 0xc8]
mov rdx, qword [rdx + 0xb0]
mov byte [rdx + rcx], al
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 0x7c]
inc eax
mov rcx, qword [rsp + 0xc8]
mov dword [rcx + 0x7c], eax
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 0x50]
mov rcx, qword [rsp + 0xc8]
add eax, dword [rcx + 0x134]
mov rcx, qword [rsp + 0xc8]
mov dword [rcx + 0x50], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0xc8]
mov ecx, dword [rcx + 0xbc]
dec ecx
mov rdx, qword [rsp + 0xc8]
mov eax, dword [rdx + rax]
sub eax, ecx
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0xc8]
mov dword [rdx + rcx], eax
mov eax, 4
imul rax, rax, 3
mov ecx, 4
imul rcx, rcx, 2
mov rdx, qword [rsp + 0xc8]
mov ecx, dword [rdx + rcx + 0x64]
mov rdx, qword [rsp + 0xc8]
mov edx, dword [rdx + 0x78]
lea ecx, [rcx + rdx - 2]
mov rdx, qword [rsp + 0xc8]
mov eax, dword [rdx + rax + 0x100]
xor eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0xc8]
mov dword [rdx + rcx + 0x100], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 2
mov edx, 4
imul rdx, rdx, 2
mov r8, qword [rsp + 0xc8]
mov r9, qword [rsp + 0xc8]
mov edx, dword [r9 + rdx + 0x10]
mov ecx, dword [r8 + rcx + 0x64]
sub ecx, edx
sub ecx, 0xffffffff
mov rdx, qword [rsp + 0xc8]
mov eax, dword [rdx + rax + 0x48]
imul eax, ecx
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0xc8]
mov dword [rdx + rcx + 0x48], eax
mov rax, qword [rsp + 0xc8]
movsxd rax, dword [rax + 0x7c]
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx + 0xb0]
movzx edx, byte [rsp + 0x38]
mov byte [rcx + rax], dl
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 0x7c]
inc eax
mov rcx, qword [rsp + 0xc8]
mov dword [rcx + 0x7c], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0xc8]
mov edx, dword [rdx + 0xa0]
mov r8, qword [rsp + 0xc8]
add edx, dword [r8 + rcx + 0x100]
mov ecx, edx
mov rdx, qword [rsp + 0xc8]
mov eax, dword [rdx + rax + 0xd0]
mov edx, 0xffe30331
lea rcx, [rcx + rdx]
add eax, ecx
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0xc8]
mov dword [rdx + rcx + 0xd0], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0xc8]
mov ecx, dword [rcx + 0x54]
mov rdx, qword [rsp + 0xc8]
mov eax, dword [rdx + rax + 0xd0]
mov edx, 0xffffffec
lea rcx, [rcx + rdx]
add eax, ecx
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0xc8]
mov dword [rdx + rcx + 0xd0], eax
mov eax, 4
imul rax, rax, 3
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0xc8]
mov ecx, dword [rdx + rcx + 0xa4]
add ecx, 0xffffffee
mov rdx, qword [rsp + 0xc8]
mov eax, dword [rdx + rax + 0x110]
imul eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0xc8]
mov dword [rdx + rcx + 0x110], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 2
mov rdx, qword [rsp + 0xc8]
mov r8, qword [rsp + 0xc8]
mov ecx, dword [r8 + rcx + 0x10]
mov edx, dword [rdx + 0xc0]
sub edx, ecx
mov ecx, edx
sub ecx, 0xfffff302
mov rdx, qword [rsp + 0xc8]
mov eax, dword [rdx + rax + 0x12c]
imul eax, ecx
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0xc8]
mov dword [rdx + rcx + 0x12c], eax
mov eax, 4
imul rax, rax, 2
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rsp + 0xc8]
mov ecx, dword [rdx + rcx + 0xd8]
mov rdx, qword [rsp + 0xc8]
mov eax, dword [rdx + rax + 0x3c]
mov edx, 0xfffffff8
lea rcx, [rcx + rdx]
add eax, ecx
mov ecx, 4
imul rcx, rcx, 2
mov rdx, qword [rsp + 0xc8]
mov dword [rdx + rcx + 0x3c], eax
mov eax, 4
imul rax, rax, 0
mov ecx, 4
imul rcx, rcx, 1
mov rdx, qword [rsp + 0xc8]
mov eax, dword [rdx + rax + 0x48]
mov rdx, qword [rsp + 0xc8]
mov ecx, dword [rdx + rcx + 0x124]
lea eax, [rax + rcx - 0x1ac82f]
mov rcx, qword [rsp + 0xc8]
mov ecx, dword [rcx + 0x74]
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xc8]
mov dword [rcx + 0x74], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0xc8]
mov ecx, dword [rcx + 0x54]
add ecx, 0xffffffec
mov rdx, qword [rsp + 0xc8]
mov eax, dword [rdx + rax + 0x64]
sub eax, ecx
mov ecx, 4
imul rcx, rcx, 2
mov rdx, qword [rsp + 0xc8]
mov dword [rdx + rcx + 0x64], eax
jmp 0x140004580
jmp 0x140004c40
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc8]
mov edx, dword [rdx + 0xf0]
mov eax, dword [rcx + rax + 0x100]
sub eax, edx
mov rcx, qword [rsp + 0xc8]
add eax, dword [rcx + 0xc0]
cmp dword [rsp + 0x3c], eax
jne 0x140004c40
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x40]
or ecx, eax
mov eax, ecx
cdqe
mov qword [rsp + 0x80], rax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0xc8]
mov eax, dword [rcx + rax + 0x100]
add eax, 0x3594
mov eax, eax
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rsp + 0x30]
imul ecx, dword [rax + 0xf0]
mov eax, ecx
xor eax, 0x346e
mov eax, eax
mov qword [rsp + 0x70], rax
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0xc8]
mov eax, dword [rcx + rax + 0x110]
mov rcx, qword [rsp + 0xc8]
add eax, dword [rcx + 0xfc]
or eax, 0x4455
mov eax, eax
mov qword [rsp + 0x68], rax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0xc8]
mov eax, dword [rcx + rax + 0x10]
sub eax, 0x3e8d
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc8]
mov ecx, dword [rcx + 0xa0]
mov eax, dword [rax + 0xb8]
xor eax, ecx
or eax, 0x43db
mov eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rax + 0xfc]
or eax, ecx
mov eax, eax
mov qword [rsp + 0xa8], rax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
cdqe
mov qword [rsp + 0xa0], rax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0xc8]
mov eax, dword [rcx + rax + 0xd0]
mov ecx, dword [rsp + 0x44]
and ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 2
mov rdx, qword [rsp + 0xc8]
or eax, dword [rdx + rcx + 0xa4]
mov eax, eax
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 0x58]
mov ecx, dword [rsp + 0x40]
or ecx, eax
mov eax, ecx
and eax, dword [rsp + 0x48]
mov eax, eax
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 0xf8]
sub eax, 0x34ee
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x54]
or ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0xc8]
and eax, dword [rdx + rcx + 0x2c]
mov eax, eax
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [rsp + 0x48]
xor eax, 0x40c
add rsp, 0xb8
ret