Function at 0x14007da80
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rbp, r8
mov r14, rdx
mov r15, rcx
test rcx, rcx
jne 0x14007dac2
lea rax, str.BaseNamedObjectsPhSvcApiPort
mov dword [rsp + 0x40], 0x3e003c
mov qword [rsp + 0x48], rax
lea r15, [rsp + 0x40]
test rdx, rdx
jne 0x14007dadb
mov qword [rsp + 0xa0], 0xfffffffff70f2e80
lea r14, [rsp + 0xa0]
xor r9d, r9d
lea r8, [0x14007d9f0]
xor edx, edx
lea rcx, str.Client
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObjectTypeEx
mov qword [0x140192208], rax
lea rdx, [0x140188c50]
lea rax, [0x140192210]
mov r8b, 2
lea rcx, [rsp + 0x30]
mov qword [0x140192218], rax
mov qword [0x140192210], rax
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edx, 1
lea rcx, [rsp + 0x30]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea rcx, [rsp + 0x30]
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlLengthSid]
lea rcx, [0x140185e88]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
add eax, 0x48
add ebx, eax
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, rax
mov edx, 1
mov rsi, rax
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
lea edx, [rbx - 0x28]
mov ebx, 2
mov r8d, ebx
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
lea r9, [rsp + 0x30]
mov r8d, 0x1f0001
mov edx, ebx
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea r9, [0x140185e88]
mov r8d, 1
mov edx, ebx
lea rcx, [rsi + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
xor r9d, r9d
lea r8, [rsi + 0x28]
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
xor eax, eax
mov dword [rsp + 0x50], 0x30
mov r9d, 0xb0
mov qword [rsp + 0x58], rax
mov r8d, 4
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea rcx, [0x140192228]
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], rsi
call qword [sym.imp.ntdll.dll_NtCreatePort]
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
js 0x14007dd69
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140192220], eax
nop dword [rax]
xor r8d, r8d
lea rdx, [0x14007d300]
xor ecx, ecx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateThread
test rax, rax
je 0x14007dc7f
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtClose]
sub rbx, 1
jne 0x14007dc60
mov r9d, 1
mov byte [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [0x1401921f8]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
js 0x14007dd6b
mov r9d, 1
mov byte [rsp + 0x20], bl
xor r8d, r8d
lea rcx, [0x140192200]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
mov ebx, eax
test eax, eax
jns 0x14007dce6
mov rcx, qword [0x1401921f8]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
jmp 0x14007dd6b
test rbp, rbp
je 0x14007dd10
mov rax, qword [0x1401921f8]
mov qword [rbp + 8], rax
mov rax, qword [0x140192200]
mov qword [rbp + 0x10], rax
lock or dword [rsp], 0
cmp byte [rbp], 0
je 0x14007dd10
xor eax, eax
jmp 0x14007dd6b
mov rcx, qword [0x1401921f8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test rbp, rbp
je 0x14007dd49
cmp byte [rbp], 0
jne 0x14007dd65
mov rcx, qword [0x140192200]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp byte [rbp], 0
mov ebx, eax
jne 0x14007dd65
jmp 0x14007dd5d
mov rcx, qword [0x140192200]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ebx, eax
cmp ebx, 0x102
jne 0x14007dd10
mov eax, ebx
jmp 0x14007dd6b
mov eax, edi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret