Function at 0x140479640
Capabilities:
Create thread
Get thread local storage value
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
mov r12, r9
test rdx, rdx
je 0x140479669
cmp dword [rdx + 0x14], 1
jae 0x1404798a0
call fcn.1404778a0
mov rbx, rax
test rax, rax
je 0x140479870
test rbp, rbp
je 0x14047968a
mov rax, qword [rax + 0x1d8]
mov qword [rbp], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbx + 0x44], 1
mov dword [rbx + 0xbc], 0
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r13
mov qword [rbx + 8], r12
mov r12, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r12
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140479700
test esi, esi
jne 0x1404796f0
xor ecx, ecx
mov esi, 1
call r14
jmp 0x1404796be
add esi, 1
mov ecx, 0x14
call r13
cmp esi, 5
jne 0x1404796be
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call fcn.1404773a0
cmp eax, 1
je 0x1404798f7
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x140479859
xor edx, edx
test rdi, rdi
je 0x14047976d
mov eax, dword [rdi]
mov rsi, qword [rdi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
jne 0x1404798b8
mov eax, dword [rdi + 0x18]
mov dword [rbx + 0xc0], eax
mov edx, esi
lea r8, [0x140477e50]
mov r9, rbx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140479820
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x1404797d0
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x1404797d0
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
je 0x140479888
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14047982f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.140477230
mov rcx, r12
call fcn.1404773a0
cmp eax, 1
je 0x1404798f7
mov qword [rbx + 0x68], 0xffffffffffffffff
pxor xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
test rbp, rbp
je 0x140479866
mov qword [rbp], 0
cmp qword [rbx + 0x1d0], 0
je 0x1404798e0
mov eax, 0xb
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140479807
mov eax, 0x16
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.140477b10
mov ecx, dword [0x140604638]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1404798f0
mov eax, dword [rax + 0xc0]
jmp 0x140479765
mov rcx, rbx
call fcn.140477970
jmp 0x140479870
call fcn.140477bc0
jmp 0x1404798ce
call fcn.140477700
nop
nop dword [rax]