Function at 0x140011840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea rbx, [0x14002ea38]
mov edi, 1
lea rsi, [0x14002ea30]
movzx r14d, cl
rol edi, 0
mov r12d, r15d
lea ebp, [r15 + 0x1a]
cmp byte [rbx + 0x10], r15b
je 0x1400118c5
cmp byte [rbx + 0x11], r15b
je 0x140011894
cmp byte [rbx + 0x12], r15b
je 0x1400118c5
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbx + 0x10], r15b
mov byte [rbx + 0x12], r15b
cmp byte [rbx + 0x11], r15b
je 0x14001192e
mov rcx, rsi
call fcn.1400110e0
test al, al
jne 0x1400118e0
or r12d, edi
mov byte [rbx + 0x11], r15b
jmp 0x14001192e
cmp byte [rbx + 0x10], r15b
jne 0x14001192e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea r9, [rbx - 8]
mov qword [rsp + 0x28], r15
lea r8, [0x140011c40]
mov qword [rbx + 8], rax
xor edx, edx
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov qword [rbx], rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov byte [rbx + 0x10], 1
add rsi, 0x20
rol edi, 1
add rbx, 0x20
sub rbp, 1
jne 0x140011882
test r14b, r14b
je 0x140011c15
mov ecx, 0x1000
call fcn.140015ac4
lea r8, str.UNWATCHEABLE_n
mov qword [rsp + 0x30], rax
mov edx, 0x1000
mov qword [rsp + 0x38], 0x1000
mov rcx, rax
mov byte [rax], r15b
call fcn.140015b58
mov edx, r12d
lea rcx, [rsp + 0x30]
call fcn.1400116c0
mov r15, qword [0x14002ed70]
or rbp, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test r15, r15
je 0x140011af0
mov rdi, qword [r15]
movsx ecx, byte [rdi]
call fcn.140013e08
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x1400119dc
mov edx, 1
shl edx, cl
mov eax, edx
and eax, r12d
cmp eax, edx
je 0x140011ae3
mov rcx, rdi
call fcn.140011250
test al, al
jne 0x140011ae3
test rbx, rbx
je 0x140011a04
mov rax, rbp
inc rax
cmp byte [rdi + rax], 0
jne 0x1400119e4
mov rcx, rbp
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400119f0
inc rax
add rax, rcx
cmp rax, rsi
jbe 0x140011a66
mov rax, rbp
inc rax
cmp byte [rdi + rax], 0
jne 0x140011a07
cmp rax, 0x1000
jae 0x140011a1f
mov eax, 0x1000
jmp 0x140011a2b
mov rax, rbp
inc rax
cmp byte [rdi + rax], 0
jne 0x140011a22
add rsi, rax
mov rcx, rsi
call fcn.140015ac4
mov r14, rax
test rbx, rbx
je 0x140011a56
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140015af8
mov rcx, rbx
call fcn.140015abc
jmp 0x140011a59
mov byte [rax], 0
mov rbx, r14
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140015b58
test rbx, rbx
je 0x140011a92
mov rax, rbp
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140011a80
add rax, 2
cmp rax, rsi
jbe 0x140011ad1
add rsi, 0x1000
mov rcx, rsi
call fcn.140015ac4
mov rdi, rax
test rbx, rbx
je 0x140011ac1
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140015af8
mov rcx, rbx
call fcn.140015abc
jmp 0x140011ac4
mov byte [rax], 0
mov rbx, rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
lea r8, [0x14002438c]
mov rdx, rsi
mov rcx, rbx
call fcn.140015b58
mov r15, qword [r15 + 8]
test r15, r15
jne 0x1400119a5
test rbx, rbx
je 0x140011b12
mov rax, rbp
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140011b00
add rax, 9
cmp rax, rsi
jbe 0x140011b51
add rsi, 0x1000
mov rcx, rsi
call fcn.140015ac4
mov rdi, rax
test rbx, rbx
je 0x140011b41
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140015af8
mov rcx, rbx
call fcn.140015abc
jmp 0x140011b44
mov byte [rax], 0
mov rbx, rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
lea r8, str._nREMAP_n
mov rdx, rsi
mov rcx, rbx
call fcn.140015b58
lea rcx, [rsp + 0x30]
call fcn.140011560
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
test rbx, rbx
je 0x140011b92
nop dword [rax]
inc rbp
cmp byte [rbx + rbp], 0
jne 0x140011b80
add rbp, 2
cmp rbp, rdi
jbe 0x140011bc7
add rdi, 0x1000
mov rcx, rdi
call fcn.140015ac4
mov rsi, rax
test rbx, rbx
je 0x140011bc1
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.140015af8
mov rcx, rbx
call fcn.140015abc
jmp 0x140011bc4
mov byte [rax], 0
mov rbx, rsi
lea r8, [0x1400243d4]
mov rdx, rdi
mov rcx, rbx
call fcn.140015b58
lea rcx, [0x14002ed78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, rbx
call fcn.1400144b4
mov ecx, 1
call fcn.140013f54
mov rcx, rax
call fcn.1400143a8
lea rcx, [0x14002ed78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call fcn.140015abc
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret