Function at 0x14021c0d0
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r14d, ecx
xor r15d, r15d
mov r8d, ecx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x48], rax
test rax, rax
je 0x14021c498
mov ecx, 0x5a4d
lea r12, section..data
cmp word [section..data], cx
jne 0x14021c487
movsxd rbx, dword [0x14048303c]
add rbx, r12
mov rcx, rax
call fcn.140018d40
mov ecx, 0x8664
cmp word [rbx + 4], cx
jne 0x14021c487
cmp eax, 0x40
jne 0x14021c487
mov eax, 0x1000
mov qword [rbp + 0x50], rax
mov ecx, eax
call fcn.14021461c
mov qword [rbp + 0x58], rax
mov r8d, dword [rbx + 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea edi, [r15 + 0xa]
mov qword [rbp - 0x10], rdi
lea esi, [rdi + 5]
mov qword [rbp - 8], rsi
movsd xmm0, qword [str.GTAProcess]
movsd qword [rbp - 0x20], xmm0
movzx eax, word [0x140220bc8]
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], r15b
mov edx, r14d
lea rcx, [rbp - 0x20]
call fcn.14021bb90
mov qword [0x1406a1fa8], rax
mov r8d, dword [rbx + 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rsi
movsd xmm0, qword [str.GTAProcess]
movsd qword [rbp - 0x20], xmm0
movzx eax, word [0x140220bc8]
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], r15b
mov edx, r14d
lea rcx, [rbp - 0x20]
call fcn.14021bb90
mov rcx, rax
mov qword [0x1406a1fa8], rax
test rax, rax
je 0x14021c1a8
mov rax, qword [0x14021d108]
mov qword [rbp - 0x20], rax
mov rax, qword [0x14021d100]
mov qword [rbp - 0x18], rax
movzx edi, word [rbx + 0x14]
add rdi, 0x2c
mov esi, r15d
cmp r15w, word [rbx + 6]
jae 0x14021c25f
add rdi, rbx
cmp dword [rdi - 4], r15d
je 0x14021c251
mov r9d, dword [rdi - 4]
mov r8d, dword [rdi]
add r8, r12
mov edx, dword [rdi - 8]
add rdx, rcx
mov qword [rsp + 0x20], r15
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14021c371
mov rcx, qword [0x1406a1fa8]
inc esi
add rdi, 0x28
movzx eax, word [rbx + 6]
cmp esi, eax
jl 0x14021c21d
movups xmm0, xmmword [rbp - 0x20]
movdqu xmmword [section..data], xmm0
mov qword [rsp + 0x20], r15
mov r9d, 0x1000
mov r8, r12
mov rdx, rcx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14021c382
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov ebx, 0xa
mov qword [rbp - 0x10], rbx
lea edi, [rbx + 5]
mov qword [rbp - 8], rdi
movsd xmm0, qword [str.GTAProcess]
movsd qword [rbp - 0x20], xmm0
movzx eax, word [0x140220bc8]
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], r15b
mov r8, qword [rbp + 0x50]
mov edx, r14d
lea rcx, [rbp - 0x20]
call fcn.14021bb90
mov qword [0x1406a1fa0], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rdi
movsd xmm0, qword [str.GTAProcess]
movsd qword [rbp - 0x20], xmm0
movzx eax, word [0x140220bc8]
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], r15b
mov r8, qword [rbp + 0x50]
mov edx, r14d
lea rcx, [rbp - 0x20]
call fcn.14021bb90
mov qword [0x1406a1fa0], rax
test rax, rax
je 0x14021c2e9
mov qword [rsp + 0x20], r15
mov r9, qword [rbp + 0x50]
lea r8, [0x14021bf34]
mov rdx, rax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x48]
test eax, eax
jne 0x14021c3a5
mov rdx, qword [0x1406a1fa0]
mov r8, qword [rbp + 0x58]
mov r9, qword [rbp + 0x50]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14021c382
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsp + 0x20], r15
mov r9, qword [rbp + 0x50]
mov r8, qword [rbp + 0x58]
mov rdx, qword [0x1406a1fa8]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14021c498
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov rax, qword [0x1406a1fa8]
mov qword [rsp + 0x20], rax
mov r9, qword [0x1406a1fa0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp - 0x40], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14021c47e
mov ecx, 0x20
call fcn.140213e68
test rax, rax
je 0x14021c40e
lea rcx, [rbp - 0x40]
mov qword [rax], rcx
lea rcx, [rbp + 0x48]
mov qword [rax + 8], rcx
lea rcx, [rbp + 0x58]
mov qword [rax + 0x10], rcx
lea rcx, [rbp + 0x50]
mov qword [rax + 0x18], rcx
jmp 0x14021c411
mov rax, r15
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, section..ii
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14021c4aa
cmp dword [rbp - 0x18], r15d
je 0x14021c4b9
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14021c4b9
lea edx, [rax + 1]
mov rcx, qword [rbp + 0x58]
call fcn.140213ea4
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14021c498
mov rcx, qword [rbp + 0x48]
jmp 0x14021c355
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rbp - 0x18], r15d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3