Function at 0x1800708c4
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r14, rdx
mov rbx, rcx
lea rax, vtable.nfapi::AutoLock.0
mov qword [rbp - 0x30], rax
lea r12, [0x1802c7458]
mov qword [rbp - 0x28], r12
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
xor edi, edi
cmp byte [0x1802c7c60], dil
jne 0x180070c30
call fcn.180072f9c
test al, al
jne 0x180070938
mov edi, 0xfffffffb
jmp 0x180070c30
mov rcx, rbx
call fcn.18007339c
or r15, 0xffffffffffffffff
cmp rax, r15
jne 0x180070951
mov edi, r15d
jmp 0x180070c30
mov qword [0x1802c0c00], rax
mov r8d, 0x104
mov rdx, rbx
lea rcx, [0x1802c7d10]
call fcn.1801d1f30
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [0x1802c6a30]
lea r8, [0x180070fd4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [rbp + 0x58], edi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1802c0c00]
cmp rcx, r15
jne 0x1800709b1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x180070a22
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x22019c
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180070a00
cmp dword [rbp - 0x40], edi
jbe 0x180070a00
mov eax, dword [rbp + 0x58]
dec eax
cmp eax, 1
setbe bl
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x180070a0c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov bl, dil
mov eax, dword [0x1802c0c10]
mov ecx, 0x20000
test bl, bl
cmovne eax, ecx
mov dword [0x1802c0c10], eax
mov dword [rbp + 0x50], edi
mov esi, 0x20
cmp qword [0x1802c7d08], rdi
jne 0x180070a51
mov ecx, esi
call fcn.18009e460
mov rbx, rax
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.1801c27d0
mov qword [0x1802c7d08], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, rax
mov r8, rsi
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1801c27d0
mov qword [rbp - 8], rbx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], esi
mov rax, qword [0x1802c7d08]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x12c800
mov rcx, qword [0x1802c0c00]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x180070abd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x180070ae1
mov r9d, 1
lea r8, [rbp + 0x50]
lea rdx, [rbp - 0x20]
mov rcx, qword [0x1802c0c00]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x180070ae1
cmp dword [rbp + 0x50], esi
je 0x180070b03
mov rcx, qword [0x1802c0c00]
cmp rcx, r15
je 0x180070c1e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1802c0c00], r15
jmp 0x180070c1e
lea rax, [0x1802c7c68]
mov qword [0x1802c7c70], rax
mov qword [0x1802c7c68], rax
lea rax, [0x1802c7c88]
mov qword [0x1802c7c90], rax
mov qword [0x1802c7c88], rax
mov r13d, 0x1800c
mov ecx, r13d
call fcn.1801ca874
mov rsi, rax
test rax, rax
jne 0x180070b48
mov rsi, rdi
jmp 0x180070b5b
mov r8, r13
xor edx, edx
mov rcx, rsi
call fcn.1801c27d0
mov dword [rsi], 0x3001
mov qword [0x1802c7c78], rsi
mov rcx, r13
call fcn.1801ca874
mov rsi, rax
test rax, rax
jne 0x180070b77
mov rsi, rdi
jmp 0x180070b8a
mov r8, r13
xor edx, edx
mov rcx, rsi
call fcn.1801c27d0
mov dword [rsi], 0x3001
mov qword [0x1802c7c98], rsi
mov dword [0x1802c7454], edi
lea rcx, [0x1802c75f8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
lea r8d, [rdx + 0x60]
lea rsi, [0x1802c7ca0]
mov rcx, rsi
call fcn.1801c27d0
mov qword [0x1802c7ca8], rsi
mov qword [0x1802c7ca0], rsi
lea rax, [0x1802c7cb8]
mov qword [0x1802c7cc0], rax
mov qword [0x1802c7cb8], rax
lea rax, [0x1802c7cd0]
mov qword [0x1802c7cd8], rax
mov qword [0x1802c7cd0], rax
lea rax, [0x1802c7ce8]
mov qword [0x1802c7cf0], rax
mov qword [0x1802c7ce8], rax
mov byte [0x1802c7c60], 1
mov rcx, r14
call fcn.180070dfc
test eax, eax
je 0x180070c21
call fcn.180070c58
mov edi, r15d
cmp rbx, r15
je 0x180070c30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret