Function at 0x14000dfc0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov r12, r9
mov r15, rcx
mov rsi, qword [rax + 0x48]
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x14000dffb
lock inc dword [rbx + 8]
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x70], rbx
mov ebp, 0xffffffff
test rbx, rbx
je 0x14000e037
mov eax, ebp
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14000e037
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax]
mov eax, ebp
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000e037
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rsp + 0xd0]
cmp ecx, 0x4000004
jg 0x14000e357
je 0x14000e27f
sub ecx, 0x3000000
je 0x14000e1a8
sub ecx, 0x1000000
je 0x14000e10e
cmp ecx, 2
jne 0x14000e5b4
mov ecx, 0x588
call fcn.1401df0d8
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x588
mov rcx, rax
call fcn.1401e1df0
mov r9d, 1
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 2]
mov rcx, rbx
call fcn.14000b2a0
lea rax, vtable.CFileTransfer.1.0
mov qword [rbx], rax
lea rax, vtable.CFileTransfer.0
mov qword [rbx + 0x70], rax
xor r14d, r14d
mov qword [rbx + 0x570], r14
mov qword [rbx + 0x578], r14
mov qword [rbx + 0x580], r14
mov qword [rbx + 0x568], r12
mov dword [rbx + 0x550], r14d
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rbx
call fcn.14000b4d0
mov rcx, rbx
call fcn.14000b5e0
mov edx, 0x4000003
jmp 0x14000e5a5
mov ecx, 0x588
call fcn.1401df0d8
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x588
mov rcx, rax
call fcn.1401e1df0
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 3]
mov rcx, rbx
call fcn.14000b2a0
lea rax, vtable.CFileTransfer.1.0
mov qword [rbx], rax
lea rax, vtable.CFileTransfer.0
mov qword [rbx + 0x70], rax
xor r14d, r14d
mov qword [rbx + 0x570], r14
mov qword [rbx + 0x578], r14
mov qword [rbx + 0x580], r14
mov qword [rbx + 0x568], r12
mov dword [rbx + 0x550], r14d
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rbx
call fcn.14000b4d0
mov rcx, rbx
call fcn.14000b5e0
mov edx, 0x4000001
jmp 0x14000e5a5
mov ecx, 0x5b8
call fcn.1401df0d8
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x5b8
mov rcx, rax
call fcn.1401e1df0
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 2]
mov rcx, rbx
call fcn.14000b2a0
lea rax, vtable.CRemoteShell.1.0
mov qword [rbx], rax
lea rax, vtable.CRemoteShell.0
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x568], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x570], rax
lea rcx, [rbx + 0x578]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r14d, r14d
mov qword [rbx + 0x5a0], r14
mov qword [rbx + 0x5a8], r14
mov qword [rbx + 0x5b0], r14
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, rbx
lea r8, [0x14000aa30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rbx
call fcn.14000b4d0
mov rcx, rbx
call fcn.14000b5e0
mov edx, 0x3000001
jmp 0x14000e5a5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000e299
lock inc dword [rcx + 8]
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x38]
call fcn.14000ece0
mov ebx, eax
mov ecx, 0x588
call fcn.1401df0d8
mov rdi, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x588
mov rcx, rax
call fcn.1401e1df0
mov r9d, 0x400
mov qword [rsp + 0x20], r12
mov r8d, 3
mov rcx, rdi
call fcn.14000b2a0
lea rax, vtable.CFileTransfer.1.0
mov qword [rdi], rax
lea rax, vtable.CFileTransfer.0
mov qword [rdi + 0x70], rax
xor r14d, r14d
mov qword [rdi + 0x570], r14
mov qword [rdi + 0x578], r14
mov qword [rdi + 0x580], r14
mov qword [rdi + 0x568], r12
mov dword [rdi + 0x550], ebx
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rdi
call fcn.14000b4d0
mov rcx, rdi
call fcn.14000b5e0
mov edx, 0x4000005
jmp 0x14000e5a5
cmp ecx, 0x400000b
je 0x14000e4d2
cmp ecx, 0x5000000
je 0x14000e457
cmp ecx, 0x6000000
jne 0x14000e5b4
mov ecx, 0x5d0
call fcn.1401df0d8
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x5d0
mov rcx, rax
call fcn.1401e1df0
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 5]
mov rcx, rbx
call fcn.14000b2a0
lea rax, vtable.CDesktopMonitor.1.0
mov qword [rbx], rax
lea rax, vtable.CDesktopMonitor.0
mov qword [rbx + 0x70], rax
xor r14d, r14d
mov qword [rbx + 0x570], r14
mov dword [rbx + 0x580], r14d
mov qword [rbx + 0x5a8], r14
mov qword [rbx + 0x5b8], r14
mov qword [rbx + 0x5c0], 7
mov qword [rbx + 0x568], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x578], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, rbx
lea r8, [0x140002a70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rbx
call fcn.14000b4d0
mov rcx, rbx
call fcn.14000b5e0
mov edx, 0x6000001
jmp 0x14000e5a5
mov ecx, 0x570
call fcn.1401df0d8
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x570
mov rcx, rax
call fcn.1401e1df0
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 4]
mov rcx, rbx
call fcn.14000b2a0
lea rax, vtable.CImageCapture.1.0
mov qword [rbx], rax
lea rax, vtable.CImageCapture.0
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x568], r12
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rbx
call fcn.14000b4d0
mov rcx, rbx
call fcn.14000b5e0
mov edx, 0x5000001
jmp 0x14000e5a5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000e4ec
lock inc dword [rcx + 8]
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x60], eax
lea rdx, [rsp + 0x50]
call fcn.14000ece0
mov ebx, eax
mov ecx, 0x588
call fcn.1401df0d8
mov rdi, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, 0x588
mov rcx, rax
call fcn.1401e1df0
mov r9d, 0x401
mov qword [rsp + 0x20], r12
mov r8d, 3
mov rcx, rdi
call fcn.14000b2a0
lea rax, vtable.CFileTransfer.1.0
mov qword [rdi], rax
lea rax, vtable.CFileTransfer.0
mov qword [rdi + 0x70], rax
xor r14d, r14d
mov qword [rdi + 0x570], r14
mov qword [rdi + 0x578], r14
mov qword [rdi + 0x580], r14
mov qword [rdi + 0x568], r12
mov dword [rdi + 0x550], ebx
lea rdx, [r15 + 0xe4]
movzx r8d, word [r15 + 0x124]
mov rcx, rdi
call fcn.14000b4d0
mov rcx, rdi
call fcn.14000b5e0
mov edx, 0x400000c
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call fcn.14000b6d0
nop
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x14000e5e4
mov eax, ebp
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14000e5e4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], ebp
cmp ebp, 1
jne 0x14000e5e4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret