Function at 0x14006ab70
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x258]
sub rsp, 0x350
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rdi, rcx
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x30], 7
xor esi, esi
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x48], si
lea r8d, [rsi + 0x33]
lea rdx, str._pbfilter_base___start_thread_____Entering_routine.
lea rcx, [rbp - 0x48]
call fcn.14000dc20
nop
lea r8d, [rsi + 6]
lea rdx, [rbp - 0x48]
call fcn.140078560
mov byte [rdi + 0xf2], 1
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x80], rax
test rax, rax
jne 0x14006ac43
lea rcx, [rbp - 0x28]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp - 0x28], rax
lea rax, str.CreateEvent
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rsi
mov dword [rbp], esi
lea rdx, [0x14022dc38]
lea rcx, [rbp - 0x28]
call fcn.140170da8
int3
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rsi
mov word [rbp - 0x68], si
mov r8d, gethostname
lea rdx, str._pbfilter_base___start_thread_____creating_thread_thunk
lea rcx, [rbp - 0x68]
call fcn.14000dc20
nop
mov r8d, 5
lea rdx, [rbp - 0x68]
call fcn.140078560
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x14006c9f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x78], rax
test rax, rax
jne 0x14006ad3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rdi + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x38], si
mov r8d, 0x3f
lea rdx, str._pbfilter_base___start_thread_____ERROR_creating_thread_thunk__
lea rcx, [rsp + 0x38]
call fcn.14000dc20
nop
mov r8d, 2
lea rdx, [rsp + 0x38]
call fcn.140078560
lea rcx, [rbp + 8]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp + 8], rax
lea rax, [0x1401d7370]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rsi
mov dword [rbp + 0x30], ebx
lea rdx, [0x14022dc38]
lea rcx, [rbp + 8]
call fcn.140170da8
int3
mov r9, rax
lea r8, str._pbfilter_base___start_thread_____thread_thunk_created_with_handle:__p_
mov edx, 0x100
lea rcx, [rbp + 0x40]
call fcn.140167410
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x58], si
cmp word [rbp + 0x40], 0
jne 0x14006ad7f
mov r8, rsi
jmp 0x14006ad9b
lea rax, [rbp + 0x40]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14006ad90
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.14000dc20
nop
mov r8d, 6
lea rdx, [rsp + 0x58]
call fcn.140078560
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], rsi
mov word [rsp + 0x78], si
mov r8d, 0x32
lea rdx, str._pbfilter_base___start_thread_____Leaving_routine.
lea rcx, [rsp + 0x78]
call fcn.14000dc20
nop
mov r8d, 6
lea rdx, [rsp + 0x78]
call fcn.140078560
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140166980
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret