Function at 0x140023214
Capabilities:
Create thread
Resume thread

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x268]
sub rsp, 0x340
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400c2688]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov rsi, rcx
xor r15d, r15d
mov r14d, r15d
lea r13d, [r15 + 0x43]
movzx ebx, r13w
lea r12d, [r15 + 1]
movzx ecx, bx
call fcn.140002d60
test eax, eax
je 0x14002338d
mov dword [rbp + 0x1f4], r15d
mov qword [rbp + 0x1f8], r15
lea rdx, [rbp + 0x1f0]
movzx ecx, bx
call fcn.1400620e0
cmp dword [rbp + 0x1f4], r12d
jne 0x14002338d
movzx ecx, bx
sub ecx, r13d
mov edx, r12d
shl edx, cl
or r14d, edx
movsd xmm0, qword [str..C:]
movsd qword [rbp + 0x220], xmm0
mov eax, dword [0x1400943a8]
mov dword [rbp + 0x228], eax
movzx eax, word [0x1400943ac]
mov word [rbp + 0x22c], ax
mov word [rbp + 0x228], bx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140023559
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90018
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
test eax, eax
je 0x140023547
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9001c
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add bx, r12w
cmp bx, 0x5a
jb 0x140023269
mov rcx, rsi
call fcn.1400295e8
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140007d08
nop
mov ecx, 0x18
call fcn.140026fbc
mov rbx, rax
lea rax, [rsp + 0x60]
mov qword [rbx], rax
mov dword [rbx + 8], 2
mov qword [rbx + 0x10], r15
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x14000f218]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x90], rax
mov rcx, rax
call fcn.1400627d0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
call fcn.1400293ac
mov r8d, 0x3ed
lea rdx, [rsp + 0x50]
mov rcx, qword [rax + 8]
call fcn.14000d8dc
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400080e4
lea rcx, [rsp + 0x60]
call fcn.140033534
or edx, 0xffffffff
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x18
mov rcx, rbx
call fcn.1400037f0
mov rcx, rsi
call fcn.14002979c
movzx ebx, r13w
movzx ecx, bx
call fcn.140002d60
test eax, eax
je 0x1400234ab
mov dword [rbp + 0x204], r15d
mov qword [rbp + 0x208], r15
lea rdx, [rbp + 0x200]
movzx ecx, bx
call fcn.1400620e0
cmp dword [rbp + 0x204], r12d
je 0x14002354f
add bx, r12w
cmp bx, 0x5a
jb 0x140023475
call fcn.1400293ac
mov r8d, 0x3ea
lea rdx, [rsp + 0x48]
mov rcx, qword [rax + 8]
call fcn.14000d8dc
nop
xor r8d, r8d
lea edx, [r8 + 0x40]
mov rcx, qword [rax]
call fcn.140028bf4
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400234fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax + 0x318]
nop
lea rcx, [rsp + 0x60]
call fcn.140007d88
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14005ef50
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140023559
lea rcx, [rsp + 0x60]
call fcn.140007d88
xor edx, edx
lea rcx, [rbp + 0xb0]
call fcn.1400204d8
nop
lea rcx, [rbp + 0xb0]
call fcn.140033534
cmp rax, r12
jne 0x1400236a9
mov rcx, rsi
call fcn.1400295e8
mov r14d, r15d
movzx ebx, r13w
movzx ecx, bx
call fcn.140002d60
test eax, eax
je 0x1400235cc
mov dword [rbp + 0x214], r15d
mov qword [rbp + 0x218], r15
lea rdx, [rbp + 0x210]
movzx ecx, bx
call fcn.1400620e0
cmp dword [rbp + 0x214], r12d
jne 0x1400235cc
movzx ecx, bx
sub ecx, r13d
mov edx, r12d
shl edx, cl
or r14d, edx
add bx, r12w
cmp bx, 0x5a
jb 0x14002358c
mov ecx, 0x18
call fcn.140026fbc
mov rdi, rax
test rax, rax
je 0x1400235ee
mov dword [rax + 0x14], r15d
jmp 0x1400235f1
mov rdi, r15
mov qword [rdi], r15
mov dword [rdi + 8], 3
mov dword [rdi + 0x10], r15d
mov dword [rdi + 0xc], r14d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 4
mov r9, rdi
lea r8, [0x14000f218]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov rcx, rax
call fcn.1400627d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.14002979c
cmp dword [rbp + 0x1e0], r12d
jne 0x14002366e
call fcn.1400293ac
mov rcx, qword [rax + 8]
call fcn.14000ee48
jmp 0x140023685
cmp dword [rbp + 0x1e0], 2
jne 0x14002368d
call fcn.1400293ac
mov rcx, qword [rax + 8]
call fcn.14000f1f0
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax + 0x318]
mov edx, 0x18
mov rcx, rdi
call fcn.1400037f0
nop
lea rcx, [rbp + 0xb0]
call fcn.140020520
jmp 0x140023517