Function at 0x14000b070
Capabilities:
Create thread

Disassembly:
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov r13d, edx
mov r12, rcx
xor r14d, r14d
mov dword [rsp + 0x3c], r14d
lea rax, [rcx + 0x28]
mov qword [rsp + 0x68], rax
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
lea r15, [rcx + 0x40]
mov qword [rsp + 0x70], r15
mov qword [r15], r14
mov qword [r15 + 8], r14
mov qword [r15 + 0x10], r14
xorps xmm0, xmm0
movups xmmword [rcx + 0x68], xmm0
xor eax, eax
mov qword [rcx + 0x78], rax
mov dword [rcx + 0x80], eax
mov qword [rcx + 0x88], rax
mov byte [rcx + 0x90], al
lea rax, [rcx + 0x98]
mov qword [rsp + 0x60], rax
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
lea rax, [rcx + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov eax, r14d
xchg dword [rcx + 0x78], eax
mov eax, r14d
xchg dword [rcx + 0x80], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r12 + 0x58], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r12 + 0x60], rax
mov qword [r12], r14
mov qword [r12 + 8], r14
mov qword [r12 + 0x18], r14
mov qword [r12 + 0x10], r14
mov qword [r12 + 0x20], r14
mov r8, r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.pdh.dll_PdhOpenQueryW]
test eax, eax
je 0x14000b188
xor ebx, ebx
mov qword [r12], rbx
jmp 0x14000b99d
test r13b, 1
je 0x14000b221
lea r9, [r12 + 0x10]
xor r8d, r8d
lea rdx, str.Processor_Information__Total___Processor_Time
mov rcx, qword [r12]
call qword [sym.imp.pdh.dll_PdhAddEnglishCounterW]
test eax, eax
je 0x14000b1b8
mov qword [r12 + 0x10], 0
lea r9, [r12 + 8]
xor r8d, r8d
lea rdx, str.Processor_Information__Total___Processor_Utility
mov rcx, qword [r12]
call qword [sym.imp.pdh.dll_PdhAddEnglishCounterW]
test eax, eax
je 0x14000b1fb
lea r9, [r12 + 8]
xor r8d, r8d
lea rdx, str.Processor_Information__Total___Processor_Time
mov rcx, qword [r12]
call qword [sym.imp.pdh.dll_PdhAddEnglishCounterW]
test eax, eax
je 0x14000b1fb
mov qword [r12 + 8], 0
lea r9, [r12 + 0x18]
xor r8d, r8d
lea rdx, str.SystemProcessor_Queue_Length
mov rcx, qword [r12]
call qword [sym.imp.pdh.dll_PdhAddEnglishCounterW]
xor ebx, ebx
test eax, eax
je 0x14000b223
mov qword [r12 + 0x18], rbx
jmp 0x14000b223
xor ebx, ebx
mov edi, dword [rbp + 0xc8]
test dil, 2
je 0x14000b251
lea r9, [r12 + 0x20]
xor r8d, r8d
lea rdx, str.MemoryFree__Zero_Page_List_Bytes
mov rcx, qword [r12]
call qword [sym.imp.pdh.dll_PdhAddEnglishCounterW]
test eax, eax
je 0x14000b251
mov qword [r12 + 0x20], rbx
lea rcx, [rbp + 0x10]
call fcn.140077090
nop
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov r13d, ebx
mov dword [rsp + 0x30], ebx
mov r12, rbx
mov esi, edi
and esi, 4
mov dword [rsp + 0x34], esi
and edi, 8
mov dword [rbp + 0xc8], edi
nop word [rax + rax]
mov dword [rbp + 0xd8], ebx
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx + 8]
mov r10, rcx
cmp byte [rax + 0x19], 0
jne 0x14000b2bf
cmp dword [rax + 0x20], r13d
jae 0x14000b2b3
mov rax, qword [rax + 0x10]
jmp 0x14000b2b9
mov r10, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14000b2a7
cmp byte [r10 + 0x19], 0
jne 0x14000b2cc
cmp r13d, dword [r10 + 0x20]
jae 0x14000b2cf
mov r10, rcx
cmp r10, rcx
je 0x14000b333
mov r11, qword [r10 + 0x30]
mov r10, qword [r10 + 0x28]
cmp r10, r11
je 0x14000b333
mov r13d, 1
nop word [rax + rax]
xor edx, edx
mov r9, qword [r10]
mov rax, r13
lea r8d, [rdx + 0x20]
nop dword [rax]
test rax, r9
lea ecx, [rdx + 1]
cmove ecx, edx
rol rax, 1
test rax, r9
lea edx, [rcx + 1]
cmove edx, ecx
rol rax, 1
sub r8, r13
jne 0x14000b300
add ebx, edx
add r10, 0x10
cmp r10, r11
jne 0x14000b2f0
mov dword [rbp + 0xd8], ebx
mov r13d, dword [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
xor ebx, ebx
mov qword [rbp - 0x60], rbx
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rbx
test esi, esi
je 0x14000b3aa
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
je 0x14000b370
mov qword [rdx], rbx
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rbx
add qword [rax + 8], 0x18
jmp 0x14000b37c
lea r8, [rbp - 0x70]
mov rcx, rax
call fcn.140047750
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
je 0x14000b39d
mov qword [rdx], rbx
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rbx
add qword [rax + 8], 0x18
jmp 0x14000b3aa
lea r8, [rsp + 0x78]
mov rcx, rax
call fcn.140047970
test edi, edi
je 0x14000b58d
mov rax, qword [rsp + 0x40]
mov rdi, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
je 0x14000b48f
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov r15, qword [rbp - 0x68]
mov r14, qword [rbp - 0x70]
sub r15, r14
mov rsi, r15
sar rsi, 2
test r15, r15
je 0x14000b483
movabs rax, 0x3fffffffffffffff
cmp rsi, rax
ja 0x14000ba55
lea rsi, [rsi*4]
cmp rsi, 0x1000
jb 0x14000b43b
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x14000ba61
call fcn.1400ff088
mov rcx, rax
test rax, rax
je 0x14000ba5b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000b44d
test rsi, rsi
je 0x14000b44a
mov rcx, rsi
call fcn.1400ff088
jmp 0x14000b44d
mov rax, rbx
mov qword [rdi], rax
mov qword [rdi + 8], rax
add rax, rsi
mov qword [rdi + 0x10], rax
mov qword [rbp - 0x30], rdi
mov rbx, qword [rdi]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call fcn.14012c6c0
lea rax, [rbx + rsi]
mov qword [rdi + 8], rax
xor ebx, ebx
mov qword [rbp - 0x30], rbx
mov rax, qword [rsp + 0x40]
add qword [rax + 8], 0x18
mov r15, qword [rsp + 0x70]
jmp 0x14000b4a2
lea r8, [rbp - 0x70]
mov rdx, rdi
mov rcx, rax
call fcn.140047750
mov r14, qword [rbp - 0x70]
mov rdi, qword [r15 + 8]
cmp rdi, qword [r15 + 0x10]
je 0x14000b57b
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov r13, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x78]
sub r13, rsi
mov r15, r13
sar r15, 3
test r13, r13
je 0x14000b56a
movabs rax, 0x1fffffffffffffff
cmp r15, rax
ja 0x14000ba67
lea r15, [r15*8]
cmp r15, 0x1000
jb 0x14000b527
lea rcx, [r15 + 0x27]
cmp rcx, r15
jbe 0x14000ba61
call fcn.1400ff088
mov rcx, rax
test rax, rax
je 0x14000ba5b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000b539
test r15, r15
je 0x14000b536
mov rcx, r15
call fcn.1400ff088
jmp 0x14000b539
mov rax, rbx
mov qword [rdi], rax
mov qword [rdi + 8], rax
add rax, r15
mov qword [rdi + 0x10], rax
mov qword [rbp - 0x28], rdi
mov rbx, qword [rdi]
mov r8, r13
mov rdx, rsi
mov rcx, rbx
call fcn.14012c6c0
lea rax, [rbx + r15]
mov qword [rdi + 8], rax
xor ebx, ebx
mov qword [rbp - 0x28], rbx
mov rax, qword [rsp + 0x70]
add qword [rax + 8], 0x18
mov r13d, dword [rsp + 0x30]
jmp 0x14000b596
lea r8, [rsp + 0x78]
mov rdx, rdi
mov rcx, r15
call fcn.140047970
jmp 0x14000b591
mov r14, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
mov edi, ebx
cmp dword [rbp + 0xd8], 0
jbe 0x14000b88d
mov r14, rbx
mov r15, rbx
mov esi, 0xffffffff
cmp dword [rsp + 0x34], 0
je 0x14000b62e
mov dword [rsp + 0x58], edi
lea rax, [r12 + r12*2]
lea rbx, [rax*8]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
add rcx, rbx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14000b5e5
mov dword [rdx], edi
add qword [rcx + 8], 4
jmp 0x14000b5ef
lea r8, [rsp + 0x58]
call fcn.1400473f0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rcx, qword [rbx + rax]
mov dword [r15 + rcx], esi
xor r8d, r8d
mov qword [rbp - 0x20], r8
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
add rcx, rbx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14000b625
mov qword [rdx], r8
add qword [rcx + 8], 8
jmp 0x14000b62e
lea r8, [rbp - 0x20]
call fcn.1400475a0
cmp dword [rbp + 0xc8], 0
je 0x14000b6b1
mov dword [rsp + 0x5c], edi
lea rax, [r12 + r12*2]
lea rbx, [rax*8]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
add rcx, rbx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14000b665
mov dword [rdx], edi
add qword [rcx + 8], 4
jmp 0x14000b66f
lea r8, [rsp + 0x5c]
call fcn.1400473f0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rbx + rax]
mov dword [r15 + rcx], esi
xor r8d, r8d
mov qword [rbp - 0x18], r8
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax + 0x40]
add rcx, rbx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14000b6a8
mov qword [rdx], r8
add qword [rcx + 8], 8
jmp 0x14000b6b1
lea r8, [rbp - 0x18]
call fcn.1400475a0
cmp dword [rsp + 0x34], 0
je 0x14000b7bd
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14000ba6d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rax, str.Time
cmp byte [rbp + 0xd0], 0
lea rcx, str.Utility
cmovne rax, rcx
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8d, r13d
lea rdx, str.Processor_Information__u__u____Processor__s
lea rcx, [rsp + 0x48]
call fcn.140005d70
mov qword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.pdh.dll_PdhAddEnglishCounterW]
test eax, eax
je 0x14000b78b
mov r9d, edi
mov r8d, r13d
lea rdx, str.Processor_Information__u__u____Processor_Time
lea rcx, [rsp + 0x48]
call fcn.140005d70
mov rbx, qword [rsp + 0x48]
cmp byte [rbp + 0xd0], 0
je 0x14000b782
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.pdh.dll_PdhAddEnglishCounterW]
test eax, eax
je 0x14000b78b
xor edx, edx
mov qword [rsp + 0x50], rdx
jmp 0x14000b790
mov rdx, qword [rsp + 0x50]
lea rcx, [r12 + r12*2]
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8]
mov qword [r14 + rcx], rdx
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b7bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rbp + 0xc8], 0
je 0x14000b86c
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14000ba78
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
mov r9d, edi
mov r8d, r13d
lea rdx, str.Processor_Information__u__u_Parking_Status
lea rcx, [rbp - 0x58]
call fcn.140005d70
mov qword [rbp - 0x50], 0
lea rsi, [r12 + r12*2]
lea r9, [rbp - 0x50]
xor r8d, r8d
mov rbx, qword [rbp - 0x58]
mov rdx, rbx
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.pdh.dll_PdhAddEnglishCounterW]
test eax, eax
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 0x40]
mov rcx, qword [rax + rsi*8]
je 0x14000b846
mov qword [r14 + rcx], 0
jmp 0x14000b84e
mov rax, qword [rbp - 0x50]
mov qword [r14 + rcx], rax
lea rdx, [rbx - 0x18]
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b86c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc edi
add r15, 4
add r14, 8
cmp edi, dword [rbp + 0xd8]
jb 0x14000b5b0
mov r14, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
xor ebx, ebx
test rsi, rsi
je 0x14000b8df
mov rax, qword [rbp - 0x78]
sub rax, rsi
sar rax, 3
lea rdx, [rax*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000b8ca
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba83
mov rcx, rsi
call fcn.1400ff054
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rbx
test r14, r14
je 0x14000b930
mov rax, qword [rbp - 0x60]
sub rax, r14
sar rax, 2
lea rdx, [rax*4]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000b91c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba89
mov rcx, r14
call fcn.1400ff054
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rbx
inc r13d
mov dword [rsp + 0x30], r13d
inc r12
cmp r13d, dword [rsp + 0x38]
ja 0x14000b956
mov r15, qword [rsp + 0x70]
mov edi, dword [rbp + 0xc8]
mov esi, dword [rsp + 0x34]
jmp 0x14000b290
lea rcx, [rbp + 0x60]
call fcn.140077c90
nop
lea rcx, [rbp + 0x50]
call fcn.140077cf0
nop
lea rax, [rbp + 0x18]
mov qword [rbp + 0xd8], rax
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b996
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov r12, qword [rbp + 0xc0]
mov ecx, InitCommonControls
call fcn.1400ff088
mov qword [rax], r12
lea rcx, [0x14000aab0]
mov qword [rax + 8], rcx
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rax
mov ecx, 1
mov dword [rsp + 0x3c], ecx
mov qword [rbp - 8], rbx
mov qword [rbp], rax
and ecx, 0xfffffffe
mov dword [rsp + 0x3c], ecx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140049720]
xor edx, edx
xor ecx, ecx
call fcn.14011068c
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14000ba47
mov qword [rbp], rbx
cmp dword [r12 + 0x70], 0
jne 0x14000ba8f
xorps xmm0, xmm0
movaps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movups xmmword [r12 + 0x68], xmm1
cmp dword [rbp - 0x38], 0
jne 0x14000ba41
mov rax, r12
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140115530
nop
mov dword [rbp - 0x38], ebx
mov ecx, 6
call fcn.1400d7b54
nop
call fcn.140045cc0
int3
call fcn.14010b448
int3
call fcn.140006440
int3
call fcn.140045cc0
int3
mov ecx, 0x80004005
call fcn.140002b00
int3
mov ecx, 0x80004005
call fcn.140002b00
nop
call fcn.14010b448
nop
call fcn.14010b448
nop
call fcn.140115530
int3