Function at 0x1002e5540
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
xor r8d, r8d
mov rbx, rdx
mov edi, ecx
mov dword [rsp + 0x68], r8d
mov rcx, qword [0x1003318c8]
lea rbp, [0x1003318c8]
cmp rcx, rbp
je 0x1002e5585
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0xa]
lea r8, [0x10001f9d0]
call fcn.10010e928
mov r8d, dword [rsp + 0x68]
test r8d, r8d
js 0x1002e55c2
xor eax, eax
test edi, edi
mov qword [0x100346ac0], rbx
mov qword [0x100346a98], rax
mov qword [0x100346aa0], rax
mov qword [0x100346aa8], rax
setne al
mov dword [0x100346a98], 0x6264616d
mov dword [0x100346a9c], 0x18
or dword [0x100346aa0], eax
mov edi, 0x80070000
test rbx, rbx
je 0x1002e56a5
test r8d, r8d
js 0x1002e5779
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x100346aa8], rax
test rax, rax
jne 0x1002e560b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, edi
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x68], ecx
jmp 0x1002e560f
mov ecx, dword [rsp + 0x68]
test ecx, ecx
js 0x1002e5779
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x100346ab0], rax
test rax, rax
jne 0x1002e564b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, edi
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x68], ecx
jmp 0x1002e564f
mov ecx, dword [rsp + 0x68]
test ecx, ecx
js 0x1002e5779
lea rax, [rsp + 0x70]
lea r8, [0x1002e53c4]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [0x100346ab8], rax
test rax, rax
jne 0x1002e56a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, edi
test eax, eax
cmovle r8d, eax
mov dword [rsp + 0x68], r8d
jmp 0x1002e56a5
mov r8d, dword [rsp + 0x68]
test r8d, r8d
js 0x1002e5779
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea rcx, [0x10001f9e0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x100331930], rax
cmp rax, 0xffffffffffffffff
jne 0x1002e5703
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, edi
test eax, eax
cmovle ecx, eax
mov rax, qword [0x100331930]
mov dword [rsp + 0x68], ecx
jmp 0x1002e5707
mov ecx, dword [rsp + 0x68]
test ecx, ecx
js 0x1002e5779
and qword [rsp + 0x38], 0
and dword [rsp + 0x70], 0
lea rcx, [0x100346a98]
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x70]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rcx
mov r9d, 8
mov edx, 0x8000a00c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1002e5771
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, edi
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x68], ecx
jmp 0x1002e5775
mov ecx, dword [rsp + 0x68]
test ecx, ecx
jns 0x1002e5782
call fcn.1002e50c8
mov ecx, dword [rsp + 0x68]
mov rax, qword [0x1003318c8]
cmp rax, rbp
je 0x1002e57aa
mov r9d, ecx
mov rcx, qword [rax + 0x10]
lea r8, [0x10001f9d0]
mov edx, 0xb
call fcn.1002dd1a4
mov ecx, dword [rsp + 0x68]
mov eax, ecx
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret