Function at 0x140049150
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x40
cmp byte [0x1400a3740], 0
mov rbp, rdx
mov esi, dword [0x1400a373c]
mov rbx, rcx
je 0x140049180
cmp esi, 0x1388
mov eax, 0x4e20
cmove esi, eax
mov byte [0x1400a3740], 0
xor r14d, r14d
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x140049227
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1400491d3
cmp dword [rsp + 0x60], 0x103
jne 0x1400491d3
mov rcx, qword [rbx + 0x20]
lea rdi, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1400491e5
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400491e1
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rbx + 0x20]
mov qword [rbx + 0x28], r14
cmp qword [rbx + 0x28], r14
jne 0x140049222
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400491fe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], r14
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140049211
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x18], r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x140049222
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r14
mov rdi, qword [rsp + 0x68]
mov rax, qword [rbx + 0x28]
test rax, rax
jne 0x1400492aa
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x1400492f4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x1400492f4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1400492f4
mov qword [rsp + 0x28], r14
lea r8, [0x14004b850]
mov r9, rbx
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x1400492f4
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x1400492ef
mov eax, dword [rbx + 0xc]
mov ecx, 0x80004005
test eax, eax
cmovns eax, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp eax, 1
je 0x140049307
mov eax, 0x80004005
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rbx + 0x18]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov r9d, esi
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
je 0x140049362
cmp eax, 0xffffffff
jne 0x14004934f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140049381
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
mov eax, 0x80070102
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
mov rcx, qword [rbx + 0x30]
lea rdx, [0x14008ad30]
mov r8, rbp
call qword [sym.imp.ole32.dll_CoGetInterfaceAndReleaseStream]
mov dword [rbx + 0xc], eax
test eax, eax
js 0x140049381
mov qword [rbx + 0x30], r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret