Function at 0x140008c10
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0xee8
mov r14, rcx
mov rdx, r14
lea rcx, [rsp + 0xc60]
call fcn.140009460
movzx r12d, byte [rsp + 0xc81]
mov eax, 1
test r12d, r12d
cmovne r12d, eax
test r12d, r12d
jne 0x14000928a
mov dword [rsp + 0xc58], 0
lea rcx, [rsp + 0xc30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r8d, dword [rsp + 0xc84]
xor eax, eax
shl r8d, 0x15
xor r13d, r13d
movzx r10d, byte [rsp + 0xc82]
add r8d, 0x200000
inc r10d
mov ebp, r10d
lea rbx, [rsp + 0xc30]
mov qword [rbx + 0x248], rbp
xor ebp, ebp
mov dword [rbx + 0x250], r8d
mov dword [rbx + 0x258], r10d
mov qword [rbx + 0x230], r14
mov r14, rax
test r12d, r12d
jne 0x140008d22
mov r8d, 6
lea rdx, [rsp + 0xe5a]
mov rcx, qword [rdx + 6]
call fcn.140009c10
test eax, eax
jl 0x140009325
mov esi, dword [rsp + 0xe5c]
mov rcx, rsi
movzx r15d, word [rsp + 0xe5a]
shl r15d, 0x10
call fcn.1400095c0
mov rdx, rax
mov r8, rsi
mov rcx, qword [rsp + 0xe60]
mov qword [rsp + r13 + 0xd0], rax
call fcn.140009c10
test eax, eax
jl 0x140009325
jmp 0x140008d40
mov ecx, 0x1000
call fcn.140009d30
mov qword [rsp + r13 + 0xd0], rax
mov qword [rsp + r13 + 0xe0], 0x1000
xor ecx, ecx
xor edx, edx
mov edi, dword [rsp + 0xe88]
xor r8d, r8d
xor r9d, r9d
mov esi, r14d
mov qword [rsp + r13 + 0x30], rbx
mov dword [rsp + r13 + 0x38], esi
mov dword [rsp + r13 + 0x3c], edi
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + r13 + 0x60], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, r15d
lea rcx, [rsp + r13 + 0x74]
mov qword [rsp + r14*8 + 0xdd8], rax
lea r8, [rsp + r13 + 0x80]
mov qword [rcx - 0xc], rax
xor al, al
mov qword [rcx - 0x2c], 0
lea r9, [rsp + r13 + 0x90]
mov dword [rcx - 0x24], 0
lea r10, [rsp + r13 + 0x98]
mov dword [rcx - 0x20], esi
lea r11, [rsp + r13 + 0x88]
mov qword [rsp + 0xea0], r13
lea rdi, [rdx - 1]
mov qword [rsp + 0xeb0], rdi
lea rsi, [rsp + r13 + 0x70]
mov qword [rsp + 0xed0], r11
mov rdi, rbp
mov qword [rsp + 0xec8], r10
mov qword [rsp + 0xeb8], r9
mov qword [rsp + 0xec0], r8
mov qword [rsp + 0xed8], rcx
mov qword [rsp + 0xe98], r14
mov r14, rdx
mov dword [rsp + 0xe90], r15d
mov r15b, al
mov r13d, dword [rsp + 0xe80]
mov rbx, qword [rsp + 0xed8]
lea rcx, [rsp + 0xc30]
mov rbp, qword [rcx + 0x290]
mov r8, qword [rcx + 0x288]
mov r9, qword [rcx + 0x298]
mov dword [rdi + rsi], 0
mov dword [rdi + rbx], 0xffffffff
mov dword [rdi + rbp], r13d
mov qword [rdi + r8], 0
mov qword [rdi + r9], r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsp + 0xea8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
lea r8, [rsp + 0xea8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ecx, ecx
lea rdx, [0x140007c14]
lea r8, [rsp + 0xe6c]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rbp, rsp
xor edx, edx
mov rcx, qword [rsp + 0xea8]
lea r8, [rsp + 0xe68]
mov r9d, 0x10
xor ebx, ebx
mov dword [r8], 1
mov dword [r8 + 0xc], 2
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0xea8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140007c2c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140007c3c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008f76
call rax
mov rbp, rax
test rbp, rbp
je 0x140008f76
cmp r14, rbp
jb 0x140008f76
test r14, r14
je 0x140009282
cmp rbp, 1
jbe 0x140009282
xor edx, edx
mov rax, qword [rsp + 0xeb0]
div rbp
mov rbx, rax
imul rbx, rbp
add rbx, rbp
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x20003000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rbp, rbp
jne 0x140009241
xor ecx, ecx
mov rdx, r14
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
lea rcx, [rsp + 0xc30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0xed0]
mov qword [rdi + rcx], rbp
test r12d, r12d
jne 0x140008fc0
inc r15b
add rdi, 0x30
cmp r15b, 2
jl 0x140008e28
mov dword [rsp + 0xe80], r13d
xor ebp, ebp
mov r13, qword [rsp + 0xea0]
lea rbx, [rsp + 0xc30]
mov r14, qword [rbx + 0x268]
mov r15d, dword [rbx + 0x260]
mov rdi, rsp
xor ecx, ecx
xor edx, edx
lea r9, [rsp + r13 + 0x30]
lea r8, [0x14000a330]
lea rsi, [rsp + 0xee0]
mov dword [rdi + 0x20], 0
mov qword [rdi + 0x28], rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
mov qword [rsp + r13 + 0xe8], rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc r14
add r13, 0xc0
cmp r14, qword [rsp + 0xe78]
jl 0x140008cbd
mov rbp, qword [rsp + 0xe78]
mov r14, qword [rsp + 0xe60]
test r12d, r12d
jne 0x14000921f
mov r9, r14
lea rcx, [rsp + 0xc30]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0xdd8]
call fcn.1400095f0
mov r13d, eax
xor r15d, r15d
xor r14d, r14d
xor esi, esi
lea rbx, [rsp + 0xc30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rsp + r14 + 0x50], 2
jne 0x1400091ea
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + r14 + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsp + r15*8 + 0xdd8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rsp + r14 + 0x58]
test edx, edx
jl 0x1400091e2
mov rdi, qword [rsp + r14 + 0xd0]
test rdi, rdi
je 0x1400090f5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + r14 + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + r14 + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8b, r8b
lea rcx, [rsp + r14 + 0x90]
mov qword [rsp + 0xe80], r14
lea rdx, [rsp + r14 + 0x98]
mov qword [rsp + 0xe60], r15
lea rax, [rsp + r14 + 0x88]
mov qword [rsp + 0xe78], rbp
mov rdi, rsi
mov rbx, rax
mov r15, rdx
mov r14, rcx
mov bpl, r8b
mov qword [rdi + r14], rsi
mov qword [rdi + r15], rsi
mov rcx, qword [rdi + rbx]
test rcx, rcx
je 0x14000916c
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r12d, r12d
jne 0x14000917e
inc bpl
add rdi, 0x30
cmp bpl, 2
jl 0x14000914d
mov r14, qword [rsp + 0xe80]
lea rbx, [rsp + 0xc30]
mov r15, qword [rbx + 0x230]
mov rbp, qword [rbx + 0x248]
mov rcx, qword [rsp + r14 + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r15
add r14, 0xc0
cmp r15, rbp
jl 0x14000908b
lea rcx, [rsp + 0xc30]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, r13d
add rsp, 0xee8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r13d, edx
jmp 0x1400090d4
mov rcx, rbx
mov dword [rsp + r14 + 0x50], 2
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + r14 + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsp + r15*8 + 0xdd8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14000908b
mov r9, r14
lea rcx, [rsp + 0xc30]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0xdd8]
call fcn.140009e50
jmp 0x140009078
lea rcx, [0x140007c50]
call fcn.140009340
lea rcx, [0x140007c08]
call fcn.140009340
lea rcx, [0x140007c68]
call fcn.140009340
shr rbx, 0xa
mov rcx, rbx
call fcn.140009390
lea rcx, [0x140007c6c]
call fcn.140009340
jmp 0x140008f90
mov rbx, r14
jmp 0x140008f53
mov rcx, r14
lea rdx, [0x140007cbc]
lea r8, [0x140007ccc]
call fcn.140009d50
mov ebp, eax
mov rcx, r14
lea rdx, [0x140007cd0]
mov r8d, 0x2000000
lea r9, [0x140007ccc]
call fcn.1400088a0
mov r13, rax
mov rcx, r14
lea rdx, [rsp + 0xe58]
mov r8d, 2
call fcn.140009c10
test eax, eax
jl 0x140009325
movzx r15d, word [rsp + 0xe58]
lea rcx, [rsp + 0xc60]
shl r15d, 0x10
call fcn.140009de0
mov r8d, eax
xor edx, edx
add r8, r15
mov rax, r13
div r8
cmp eax, ebp
cmovb ebp, eax
mov r10d, 1
cmp ebp, 1
cmova r10d, ebp
dec r10d
mov byte [rsp + 0xc82], r10b
jmp 0x140008c54
add rsp, 0xee8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret