Function at 0x180011d80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rdi, rcx
lea rcx, [rsp + 0x32]
xor ebx, ebx
xor edx, edx
mov r8d, 0xfe
mov word [rsp + 0x30], bx
call fcn.180037390
lea edx, [rbx + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 8], rax
test rax, rax
jne 0x180011dfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov ebx, eax
jae 0x18001203e
test eax, eax
jle 0x180012066
movzx ebx, ax
or ebx, 0xa0070000
jmp 0x180012066
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x180011e40
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov ebx, eax
jae 0x18001203e
test eax, eax
jle 0x180012066
movzx ebx, ax
or ebx, 0xa0070000
jmp 0x180012066
mov eax, dword [rdi + 0x60]
lea r9, str.EC7958E2DA87
lea r8, str.Global_ws__08X
lea rcx, [rsp + 0x30]
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], eax
call fcn.1800372a8
xor r8d, r8d
lea r9, [rsp + 0x30]
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x180011ea9
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov ebx, eax
jae 0x18001203e
test eax, eax
jle 0x180012066
movzx ebx, ax
or ebx, 0xa0070000
jmp 0x180012066
mov eax, dword [rdi + 0x60]
lea r9, str.79D469D3016B
lea r8, str.Global_ws__08X
lea rcx, [rsp + 0x30]
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], eax
call fcn.1800372a8
xor r8d, r8d
lea r9, [rsp + 0x30]
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x20], rax
test rax, rax
jne 0x180011f12
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov ebx, eax
jae 0x18001203e
test eax, eax
jle 0x180012066
movzx ebx, ax
or ebx, 0xa0070000
jmp 0x180012066
mov eax, dword [rdi + 0x60]
lea r9, str.0F83D85D15FE
lea r8, str.Global_ws__08X
lea rcx, [rsp + 0x30]
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], eax
call fcn.1800372a8
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x180011f79
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov ebx, eax
jae 0x18001203e
test eax, eax
jle 0x180012066
movzx ebx, ax
or ebx, 0xa0070000
jmp 0x180012066
xor r8d, r8d
lea r9, str.C465B7B6_1460_42d1_BACD_3B221F33F532
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x30], rax
test rax, rax
jne 0x180011fc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov ebx, eax
jae 0x18001203e
test eax, eax
jle 0x180012066
movzx ebx, ax
or ebx, 0xa0070000
jmp 0x180012066
xor r8d, r8d
lea r9, str.5DF82EFD_5306_4b45_BAF2_4EFB1505F321
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x38], rax
test rax, rax
jne 0x180011ffc
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov ebx, eax
jae 0x18001203e
test eax, eax
jle 0x180012066
movzx ebx, ax
or ebx, 0xa0070000
jmp 0x180012066
lea r8, [0x180012190]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi], rax
test rax, rax
jne 0x18001204d
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov ebx, eax
jae 0x18001203e
test eax, eax
jle 0x180012066
movzx ebx, ax
or ebx, 0xa0070000
jmp 0x180012066
test eax, eax
jle 0x180012066
movzx ebx, ax
or ebx, 0x80070000
jmp 0x180012066
mov rcx, qword [rdi + 0x10]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb ebx, ebx
and ebx, 0x80070102
cmp dword [rdi + 0x58], 0
jne 0x180012085
test ebx, ebx
jns 0x180012085
mov rcx, qword [rdi + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x466
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180037360
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret