Function at 0x1400025a0
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x140064018]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x140065db8]
mov edx, dword [0x140065dbc]
lea ebx, [rax - 1]
imul ebx, eax
test bl, 1
sete byte [rbp - 1]
cmp edx, 0xa
setl byte [rbp - 2]
mov rsi, rcx
mov eax, 0xd942adce
mov r14d, 0x272ea10e
mov r15d, 0xd62cc7f0
mov r12d, 0xb97595fd
mov r13d, 0xac443aa0
mov ebx, 0x8c62401
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002630
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call rdi
add rsp, 0x20
mov eax, 0xad1f2d4c
nop word cs:[rax + rax]
nop
cmp eax, 0xf6998d65
jg 0x140002670
cmp eax, 0xb97595fc
jle 0x1400026b0
cmp eax, 0xd62cc7ef
jg 0x14000274b
cmp eax, 0xb97595fd
je 0x1400027bf
cmp eax, 0xc2dd2081
jne 0x140002630
mov eax, dword [rbp - 8]
cmp eax, 0x71
setne byte [rbp - 3]
mov eax, 0x56c95057
jmp 0x140002630
cmp eax, 0x272ea10d
jle 0x140002710
cmp eax, 0x59dd17c5
jg 0x14000277d
cmp eax, 0x272ea10e
je 0x1400027fb
cmp eax, 0x56c95057
jne 0x140002630
cmp byte [rbp - 3], 0
mov eax, 0xfbb8d1b9
cmovne eax, ebx
jmp 0x140002630
cmp eax, 0xad1f2d4b
jg 0x1400027aa
cmp eax, 0x8b0e6c55
je 0x140002805
cmp eax, 0xac443aa0
jne 0x140002630
sub rsp, 0x20
call fcn.140002310
add rsp, 0x20
mov eax, dword [0x140065db8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5b04c6c6
cmove eax, r14d
cmp dword [0x140065dbc], 0xa
cmovl eax, r14d
jmp 0x140002630
cmp eax, 0xf6998d66
je 0x14000289f
cmp eax, 0xfbb8d1b9
je 0x1400028c7
cmp eax, 0x8c62401
jne 0x140002630
sub rsp, 0x20
call fcn.14001ecc0
add rsp, 0x20
mov dword [rbp - 8], eax
mov eax, 0xc2dd2081
jmp 0x140002630
cmp eax, 0xd62cc7f0
je 0x140002901
cmp eax, 0xd942adce
jne 0x140002630
movzx ecx, byte [rbp - 1]
cmp byte [rbp - 2], 0
mov eax, 0xb556ca37
cmovne eax, r12d
test cl, cl
cmovne eax, r12d
jmp 0x140002630
cmp eax, 0x59dd17c6
je 0x140002611
cmp eax, 0x5b04c6c6
jne 0x140002630
sub rsp, 0x20
call fcn.140002310
add rsp, 0x20
mov eax, 0xac443aa0
jmp 0x140002630
cmp eax, 0xb556ca37
jne 0x14000290b
mov eax, 0xb97595fd
jmp 0x140002630
mov eax, 0x10
call fcn.140003720
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x140065db8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb556ca37
cmove eax, r15d
cmp dword [0x140065dbc], 0xa
cmovl eax, r15d
jmp 0x140002630
mov eax, 0x8c62401
jmp 0x140002630
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [section..data]
mov rcx, qword [0x140064b58]
sub rsp, 0x40
lea rdx, [0x140065d70]
mov qword [rsp + 0x30], rdx
lea rdx, [0x140065d68]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x38], 0
lea rdx, [0x140064d68]
mov r8d, 0x1000
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
add rsp, 0x40
mov rax, qword [rbp - 0x10]
sub rsp, 0x30
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
lea r8, section..text
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x30
mov qword [rbp - 0x20], rax
mov eax, 0xf6998d66
jmp 0x140002630
mov eax, dword [0x140065db8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5b04c6c6
cmove eax, r13d
cmp dword [0x140065dbc], 0xa
cmovl eax, r13d
jmp 0x140002630
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov eax, 0x59dd17c6
jmp 0x140002630
mov eax, 0x8b0e6c55
jmp 0x140002630
cmp eax, 0xad1f2d4c
jne 0x140002630
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.140003780
nop
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret