Function at 0x140053ff0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor esi, esi
test rcx, rcx
je 0x14005453b
mov rbx, r8
cmp r8, 9
ja 0x14005453b
mov r15, r9
mov r14, rdx
mov r12, rcx
mov qword [rsp + 0x88], 0
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rdi, rax
test rax, rax
je 0x140054490
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x84], 0
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x140053fd0]
xor ecx, ecx
xor edx, edx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x1400544a7
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0xa0], 0
mov esi, dword [rsp + 0x84]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [rsp + 0xa0]
mov ecx, eax
mov edx, esi
call fcn.140052ba0
test al, al
je 0x140054131
cmp dword [rsp + 0xa0], 5
je 0x140054131
mov rbx, qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rsi, [rsp + 0xa0]
nop word [rax + rax]
call rbx
mov dword [rsp + 0xa0], 0
mov ebp, dword [rsp + 0x84]
call r14
mov ecx, eax
mov edx, ebp
mov r8, rsi
call fcn.140052ba0
test al, al
je 0x140054131
cmp dword [rsp + 0xa0], 5
jne 0x140054100
mov esi, dword [rsp + 0x84]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, [rsp + 0xa0]
mov ecx, eax
mov edx, esi
call fcn.140052ba0
test al, al
mov rbx, qword [rsp + 0x30]
je 0x1400544a7
mov rcx, rbx
call fcn.140052ac0
test rax, rax
je 0x1400544a7
mov r13, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
lea rsi, [rax + 0x38]
mov rbp, qword [0x14013b988]
lea rbx, [rax + 0x40]
cmp rbx, rsi
jbe 0x140054219
lea r15, [rsp + 0x78]
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, rsi
lea r8, [rsp + 0xa0]
lea r9, [rsp + 0x90]
call fcn.140053530
test al, al
je 0x140054492
mov r14, rbx
sub r14, rsi
mov eax, dword [rsp + 0x90]
sub eax, dword [rsp + 0x9c]
cmp r14, rax
cmovae r14, rax
mov rcx, qword [rsp + 0xa0]
mov rdx, r15
mov r8, r14
call qword [0x14013b960]
test al, al
je 0x140054492
add rsi, r14
add r15, r14
cmp rbx, rsi
ja 0x1400541a0
mov rbp, qword [0x14013b988]
lea rsi, [r13 + 0x58]
add r13, 0x60
cmp r13, rsi
jbe 0x1400542aa
lea r15, [rsp + 0x70]
lea rbx, [rsp + 0x9c]
nop word [rax + rax]
mov qword [rsp + 0x20], rbx
mov rcx, rbp
mov rdx, rsi
lea r8, [rsp + 0xa0]
lea r9, [rsp + 0x90]
call fcn.140053530
test al, al
je 0x140054492
mov r14, r13
sub r14, rsi
mov eax, dword [rsp + 0x90]
sub eax, dword [rsp + 0x9c]
cmp r14, rax
cmovae r14, rax
mov rcx, qword [rsp + 0xa0]
mov rdx, r15
mov r8, r14
call qword [0x14013b960]
test al, al
je 0x140054492
add rsi, r14
add r15, r14
cmp r13, rsi
ja 0x140054240
mov rbp, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
sub rbp, r14
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov rcx, r14
mov rdx, rax
mov r8, rbp
call fcn.140053860
test al, al
mov r15, qword [rsp + 0x38]
je 0x140054499
mov rax, qword [0x14013b978]
mov rcx, qword [0x14013b980]
add rcx, rax
and rbp, 0xfffffffffffffff8
add rbp, 8
mov rbx, qword [rsp + 0x30]
nop dword [rax]
mov rdx, qword [rsi + rbp - 8]
add rbp, 0xfffffffffffffff8
cmp rdx, rax
jbe 0x140054300
cmp rdx, rcx
jae 0x140054300
mov r13, qword [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x68], r13
add r13, rbp
mov r14, qword [rsp + 0x48]
je 0x1400544a7
mov r8, qword [0x14013b990]
mov rcx, r13
xor edx, edx
call fcn.140054690
mov rcx, r13
mov edx, 0x28
mov r8, r12
call fcn.140054690
mov rsi, qword [rsp + 0x40]
test rsi, rsi
mov qword [rsp + 0x50], r13
je 0x1400543ac
mov r8, qword [r14]
mov rcx, r13
mov edx, 0x30
call fcn.140054690
cmp rsi, 1
je 0x1400543ac
mov r8, qword [r14 + 8]
mov rcx, r13
mov edx, 0x38
call fcn.140054690
cmp rsi, 3
jb 0x1400543ac
mov r8, qword [r14 + 0x10]
mov rcx, r13
mov edx, 0x40
call fcn.140054690
cmp rsi, 3
jne 0x140054561
mov r8, qword [0x14013b998]
mov rcx, r13
mov edx, 0x50
call fcn.140054690
mov r8, qword [0x14013b9a0]
mov r14, qword [rsp + 0x50]
mov rcx, r14
mov edx, 0xc0
call fcn.140054690
lea r8, [rsp + 0x88]
mov rcx, r14
mov edx, 0xc8
call fcn.140054690
mov r8, qword [0x14013b9a8]
mov rcx, r14
mov edx, 0xd0
call fcn.140054690
mov r8, qword [0x14013b9b0]
mov rcx, r14
mov edx, 0xd8
call fcn.140054690
mov r8, qword [0x14013b990]
mov rcx, r14
mov edx, 0xe0
call fcn.140054690
lea rdx, str.ZwTerminateThread
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.140046550
mov rcx, rsi
call fcn.140053e00
mov rcx, r14
mov edx, 0x108
mov r8, rax
call fcn.140054690
mov rcx, rsi
call fcn.1400534c0
mov rcx, r14
mov edx, 0x110
mov rbx, qword [rsp + 0x30]
mov r8, rbx
call fcn.140054690
mov r8d, 0x539
mov rcx, r14
mov edx, 0x118
call fcn.140054690
mov r15, qword [rsp + 0x38]
jmp 0x1400544a7
jmp 0x1400544a7
mov r15, qword [rsp + 0x38]
jmp 0x1400544a2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
test rdi, rdi
je 0x14005451d
test rbx, rbx
je 0x14005451d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xa0], 0
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0xa0], 0x539
jne 0x140054522
test r15, r15
je 0x140054507
mov rax, qword [rsp + 0x88]
mov qword [r15], rax
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call rsi
mov rcx, rbx
call rsi
mov sil, 1
jmp 0x14005453b
test rdi, rdi
je 0x14005452b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140054539
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400d2000
mov eax, esi
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8, qword [r14 + 0x18]
mov rcx, r13
mov edx, 0x48
call fcn.140054690
mov r8, qword [0x14013b998]
mov rcx, r13
mov edx, 0x50
call fcn.140054690
cmp rsi, 5
jb 0x1400543c0
mov eax, 4
mov r13d, pe_nt_image_headers64
jmp 0x1400545be
mov rax, qword [rsp + 0x60]
inc rax
mov r13, qword [rsp + 0x58]
add r13, 8
cmp rax, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
je 0x1400543c0
mov qword [rsp + 0x58], r13
and r13d, 0xfffffff8
add r13, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov rax, qword [r14 + rax*8]
mov qword [rsp + 0x90], rax
mov rsi, rbp
add rsi, r13
cmp rsi, 0xfffffffffffffff7
ja 0x14005459d
mov r15, qword [0x14013b988]
lea rbx, [r13 + 8]
add rbx, rbp
lea r12, [rsp + 0x90]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, rsi
lea r8, [rsp + 0xa0]
lea r9, [rsp + 0x9c]
call fcn.140053530
test al, al
je 0x14005459d
mov rax, r13
sub rax, rsi
add rax, rbp
add rax, 8
mov r14d, dword [rsp + 0x9c]
sub r14d, dword [rsp + 0x98]
cmp rax, r14
cmovb r14, rax
mov rcx, qword [rsp + 0xa0]
mov rdx, r12
mov r8, r14
call qword [0x14013b968]
test al, al
je 0x14005459d
add rsi, r14
add r12, r14
cmp rbx, rsi
ja 0x140054603
jmp 0x14005459d