Function at 0x100081aec
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xc0
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1000cc510]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov ebp, edx
mov rsi, rcx
mov r13d, 7
mov qword [r11 - 0x38], r13
xor edi, edi
mov qword [r11 - 0x40], rdi
mov word [r11 - 0x50], di
or r14, 0xffffffffffffffff
lea r12d, [r13 + 1]
cmp edx, edi
je 0x100081bc3
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx + 8]
call fcn.100027780
nop
mov r9, r14
xor r8d, r8d
mov rdx, rax
lea rcx, [rsi + 0x18]
call fcn.100014140
nop
cmp qword [rsp + 0x78], r12
jb 0x100081b7d
mov rcx, qword [rsp + 0x60]
call fcn.100001218
lea rcx, [rsi + 0x48]
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryInProgress]
lea r11, [rsp + 0x80]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], edi
mov r9, rsi
lea r8, [0x100081f78]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r8d, r8d
lea rdx, [rsi + 0x18]
mov rcx, qword [rsi]
call fcn.100025f64
mov rcx, qword [rsi]
call fcn.10001fc00
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov r8d, 5
lea rdx, str.Valid
lea rcx, [rsp + 0x30]
call fcn.100013f9c
nop
mov rcx, qword [rsi + 8]
add rcx, 0x78
lea rdx, [rsp + 0x30]
call fcn.100083918
mov ebx, 1
mov dword [rax], ebx
cmp qword [rsp + 0x50], r12
jb 0x100081c14
mov rcx, qword [rsp + 0x38]
call fcn.100001218
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x38]
cmp eax, edi
je 0x100081c6d
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov r8, r13
lea rdx, str.Unsaved
lea rcx, [rsp + 0x30]
call fcn.100013f9c
nop
mov rcx, qword [rsi + 8]
add rcx, 0x78
lea rdx, [rsp + 0x30]
call fcn.100083918
mov dword [rax], ebx
cmp qword [rsp + 0x50], r12
jb 0x100081cb6
mov rcx, qword [rsp + 0x38]
call fcn.100001218
jmp 0x100081cb6
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov r8, r13
lea rdx, str.Unsaved
lea rcx, [rsp + 0x30]
call fcn.100013f9c
nop
mov rcx, qword [rsi + 8]
add rcx, 0x78
lea rdx, [rsp + 0x30]
call fcn.100083918
mov dword [rax], edi
cmp qword [rsp + 0x50], r12
jb 0x100081cb6
mov rcx, qword [rsp + 0x38]
call fcn.100001218
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x30]
cmp eax, edi
je 0x100081d0f
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov r8, r12
lea rdx, str.Untitled
lea rcx, [rsp + 0x30]
call fcn.100013f9c
nop
mov rcx, qword [rsi + 8]
add rcx, 0x78
lea rdx, [rsp + 0x30]
call fcn.100083918
mov dword [rax], ebx
cmp qword [rsp + 0x50], r12
jb 0x100081d58
mov rcx, qword [rsp + 0x38]
call fcn.100001218
jmp 0x100081d58
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov r8, r12
lea rdx, str.Untitled
lea rcx, [rsp + 0x30]
call fcn.100013f9c
nop
mov rcx, qword [rsi + 8]
add rcx, 0x78
lea rdx, [rsp + 0x30]
call fcn.100083918
mov dword [rax], edi
cmp qword [rsp + 0x50], r12
jb 0x100081d58
mov rcx, qword [rsp + 0x38]
call fcn.100001218
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov r8d, 0x10
lea rdx, str.OriginalFilePath
lea rcx, [rsp + 0x30]
call fcn.100013f9c
nop
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + 0x40]
mov rbx, rax
mov rcx, qword [rsi + 8]
add rcx, 0x60
lea rdx, [rsp + 0x30]
call fcn.100083790
mov r9, r14
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.100014140
nop
cmp qword [rsp + 0x78], r12
jb 0x100081dc6
mov rcx, qword [rsp + 0x60]
call fcn.100001218
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x70], rdi
mov word [rsp + 0x60], di
cmp qword [rsp + 0x50], r12
jb 0x100081de6
mov rcx, qword [rsp + 0x38]
call fcn.100001218
lea rdx, [rsp + 0x58]
mov rcx, qword [rsi + 8]
call fcn.1000831a8
nop
mov r9, r14
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.100014140
nop
cmp qword [rsp + 0x78], r12
jb 0x100081e1d
mov rcx, qword [rsp + 0x60]
call fcn.100001218
cmp qword [rsp + 0xa8], rdi
ja 0x100081e7c
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov r8d, 5
lea rdx, str.Valid
lea rcx, [rsp + 0x30]
call fcn.100013f9c
nop
mov rcx, qword [rsi + 8]
add rcx, 0x78
lea rdx, [rsp + 0x30]
call fcn.100083918
mov dword [rax], edi
cmp qword [rsp + 0x50], r12
jb 0x100081efd
mov rcx, qword [rsp + 0x38]
call fcn.100001218
jmp 0x100081efd
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x38], di
mov r8d, 0x10
lea rdx, str.RecoveryFilePath
lea rcx, [rsp + 0x30]
call fcn.100013f9c
nop
mov rcx, qword [rsi + 8]
add rcx, 0x60
lea rdx, [rsp + 0x30]
call fcn.100083790
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.100014140
nop
cmp qword [rsp + 0x50], r12
jb 0x100081edd
mov rcx, qword [rsp + 0x38]
call fcn.100001218
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x38]
cmp eax, edi
je 0x100081efd
mov rcx, qword [rsi + 0x10]
mov rax, qword [rcx]
lea rdx, [rsp + 0x90]
call qword [rax + 0x18]
mov rcx, qword [rsi + 8]
call fcn.100082ce0
cmp ebp, edi
je 0x100081f1a
cmp dword [rsi + 0x48], edi
sete dil
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryFinished]
nop
cmp qword [rsp + 0xb0], r12
jb 0x100081f31
mov rcx, qword [rsp + 0x98]
call fcn.100001218
xor eax, eax
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1000010a0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret