Function at 0x140001d90
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x120
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400a8650]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rdi, rcx
cmp byte [rcx + 0x20], 0
jne 0x1400022ae
mov rax, qword [rcx + 0x60]
mov rcx, qword [rax + 0x28]
mov r8d, dword [rcx + 0x40]
xor edx, edx
mov ecx, 0x100c3a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rdi + 0xa0], rax
test rax, rax
je 0x1400022c4
mov qword [rsp + 0xd8], 7
xor esi, esi
mov qword [rsp + 0xd0], rsi
mov word [rsp + 0xc0], si
lea r8d, [rsi + 0x10]
lea rdx, [0x14008f890]
lea rcx, [rsp + 0xc0]
call fcn.14000cea0
nop
mov rax, qword [rdi + 0x60]
mov rcx, qword [rax + 0x28]
mov r8d, dword [rcx + 0x40]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x48]
call fcn.140020480
nop
cmp qword [rsp + 0xd8], 8
jb 0x140001e62
mov rcx, qword [rsp + 0xc0]
call fcn.140046688
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], rsi
mov word [rsp + 0xc0], si
cmp qword [rsp + 0x58], 0
jne 0x140002054
lea rcx, [rsp + 0xe0]
call fcn.140014b30
nop
lea r8, [0x14008fa0c]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140007d30
nop
lea r8, [rdi + 0x70]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140007cf0
nop
mov rdx, rax
mov rcx, qword [rdi + 0x60]
call fcn.14001e590
test al, al
sete bl
cmp qword [rsp + 0x98], 8
jb 0x140001eee
mov rcx, qword [rsp + 0x80]
call fcn.140046688
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rsi
mov word [rsp + 0x80], si
cmp qword [rsp + 0xb8], 8
jb 0x140001f22
mov rcx, qword [rsp + 0xa0]
call fcn.140046688
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rsi
mov word [rsp + 0xa0], si
cmp qword [rsp + 0xf8], 8
jb 0x140001f56
mov rcx, qword [rsp + 0xe0]
call fcn.140046688
test bl, bl
jne 0x1400022b2
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rsi
mov word [rsp + 0x80], si
mov r8d, 0x10
lea rdx, [0x14008f890]
lea rcx, [rsp + 0x80]
call fcn.14000cea0
nop
mov rax, qword [rdi + 0x60]
mov rcx, qword [rax + 0x28]
mov r8d, dword [rcx + 0x40]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xe0]
call fcn.140020480
nop
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x58], rcx
lea rdx, [rax + 0x18]
lea rax, [rsp + 0x60]
cmp rax, rdx
je 0x140001ffc
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.14000cae0
nop
cmp qword [rsp + 0x110], 8
jb 0x140002014
mov rcx, qword [rsp + 0xf8]
call fcn.140046688
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], rsi
mov word [rsp + 0xf8], si
cmp qword [rsp + 0x98], 8
jb 0x140002048
mov rcx, qword [rsp + 0x80]
call fcn.140046688
cmp qword [rsp + 0x58], 0
je 0x1400022b2
lea rcx, [rsp + 0xe0]
call fcn.140014b30
nop
lea r8, [0x14008fa0c]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140007d30
nop
lea r8, [rdi + 0x70]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140007cf0
cmp qword [rax + 0x18], 8
jb 0x140002098
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp qword [rsp + 0xb8], 8
jb 0x1400020bc
mov rcx, qword [rsp + 0xa0]
call fcn.140046688
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rsi
mov word [rsp + 0xa0], si
cmp qword [rsp + 0x98], 8
jb 0x1400020f0
mov rcx, qword [rsp + 0x80]
call fcn.140046688
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rsi
mov word [rsp + 0x80], si
cmp qword [rsp + 0xf8], 8
jb 0x140002124
mov rcx, qword [rsp + 0xe0]
call fcn.140046688
mov qword [rsp + 0xf8], 7
mov qword [rsp + 0xf0], rsi
mov word [rsp + 0xe0], si
test rbx, rbx
je 0x1400022b2
cmp qword [rsp + 0x58], 0
je 0x1400022b2
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x1400022b2
mov rax, qword [rsp + 0x48]
sub rax, rbx
add rax, rcx
mov qword [rdi + 0x90], rax
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x1400022b2
mov rax, qword [rsp + 0x48]
sub rax, rbx
add rax, rcx
mov qword [rdi + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9, qword [rdi + 0x90]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov rcx, qword [rdi + 0x60]
mov rdx, qword [rcx + 0x28]
mov r8d, eax
mov edx, dword [rdx + 0x40]
mov rcx, rdi
call fcn.140001750
test al, al
je 0x1400022b2
mov edx, ebx
mov rcx, rdi
call fcn.1400011b0
nop
mov rcx, rdi
call fcn.140002380
test al, al
jne 0x140002267
cmp qword [rsp + 0x78], 8
jb 0x140002250
mov rcx, qword [rsp + 0x60]
call fcn.140046688
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
xor al, al
jmp 0x1400022c6
mov rcx, rdi
call fcn.1400024b0
test al, al
jne 0x14000229c
cmp qword [rsp + 0x78], 8
jb 0x140002285
mov rcx, qword [rsp + 0x60]
call fcn.140046688
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
xor al, al
jmp 0x1400022c6
cmp qword [rsp + 0x78], 8
jb 0x1400022ae
mov rcx, qword [rsp + 0x60]
call fcn.140046688
mov al, 1
jmp 0x1400022c6
cmp qword [rsp + 0x78], 8
jb 0x1400022c4
mov rcx, qword [rsp + 0x60]
call fcn.140046688
xor al, al
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.1400466a0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret