Function at 0x140011f30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x210
mov rax, qword [0x140055008]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rax, qword [0x140055248]
mov r14, rcx
xor edi, edi
lea rcx, [0x140055248]
mov esi, edi
mov rax, qword [rax + 0x18]
call qword [0x1400185c0]
add rax, 0x18
lea r15d, [rdi + 7]
cmp dword [0x140055944], edi
mov qword [rsp + 0x30], rax
je 0x140011fad
lea r9, str.mftrace_session
movzx edx, r15w
lea r8, str._Opening_real_time_session_for_event_processing:__S_n
mov ecx, 0xfffffff4
call fcn.1400085c0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x1c0
call sub.msvcrt.dll_memset
lea rax, [0x1400123c0]
mov dword [rsp + 0x5c], 0x10000100
mov r8d, 0xf
mov qword [rsp + 0x1e8], rax
lea rdx, str.mftrace_session
mov qword [rsp + 0x1f8], r14
lea rcx, [rsp + 0x30]
call fcn.140007e80
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 8], 1
jle 0x140012012
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.140007cf0
mov rbx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
call qword [sym.imp.api_ms_win_eventing_consumer_l1_1_0.dll_OpenTraceW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140012107
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x140012044
movzx esi, ax
or esi, 0x80070000
test esi, esi
jns 0x140012107
mov r8d, 0x114f
mov r10d, esi
mov r11, rdi
lea r9, [0x14003c070]
nop
mov eax, edi
mov rdx, r10
add rax, rax
mov ecx, edi
mov eax, dword [r9 + rax*8]
sub rdx, rax
je 0x140012093
mov ecx, r8d
sub ecx, edi
shr ecx, 1
add ecx, edi
test rdx, rdx
mov eax, ecx
cmovns eax, r8d
cmovns edi, ecx
inc edi
mov r8d, eax
cmp eax, edi
jae 0x140012060
jmp 0x14001209b
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], 0
je 0x140012209
lea rax, str.HRESULT_FROM_WIN32__GetLastError____
movzx edx, r15w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov r9d, esi
mov qword [rsp + 0x20], r11
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x140012209
lea r9, str.avcoremf_samplesmf360mftracemftracelibetwwriter.cpp
movzx edx, r15w
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0xf6
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140012209
mov qword [rsp + 0x28], rdi
lea r8, [0x140012270]
mov r9, r14
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [r14 + 0x78], rbp
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [r14 + 0x80], rax
test rax, rax
jne 0x140012209
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x14001214d
movzx esi, ax
or esi, 0x80070000
mov r8d, 0x114f
mov r10d, esi
mov r11, rdi
lea r9, [0x14003c070]
mov eax, edi
mov rdx, r10
add rax, rax
mov ecx, edi
mov eax, dword [r9 + rax*8]
sub rdx, rax
je 0x140012193
mov ecx, r8d
sub ecx, edi
shr ecx, 1
add ecx, edi
test rdx, rdx
mov eax, ecx
cmovns eax, r8d
cmovns edi, ecx
inc edi
mov r8d, eax
cmp eax, edi
jae 0x140012160
jmp 0x14001219b
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], 0
je 0x1400121fa
lea rax, str.m_hThread__CreateThread__0__0__CETWWriter::ProcessTraceProc__this__0__0__
movzx edx, r15w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov r9d, esi
mov qword [rsp + 0x20], r11
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x1400121fa
lea r9, str.avcoremf_samplesmf360mftracemftracelibetwwriter.cpp
movzx edx, r15w
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0xfc
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp rbp, 0xffffffffffffffff
je 0x140012209
mov rcx, rbp
call qword [sym.imp.api_ms_win_eventing_consumer_l1_1_0.dll_CloseTrace]
lea rdx, [rbx - 0x18]
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001222c
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x1400185c0]
mov eax, esi
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.140016790
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret