Function at 0x140025b50
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call fcn.140023f90
mov r12, rax
test rax, rax
je 0x140025db9
test rdi, rdi
je 0x140025b8a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x140025bf7
add ebx, 1
cmp ebx, 1
je 0x140025d00
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x140025bc5
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call fcn.140027810
cmp eax, 1
je 0x140025dfa
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x140025da2
xor edx, edx
test rsi, rsi
je 0x140025c6f
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x140025dd0
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [0x140024400]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140025d60
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x140025d30
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x140025d10
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x140025bc5
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140025cdf
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140025cb5
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x140025cb5
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140025d70
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call fcn.1400238c0
mov rcx, r14
call fcn.140027810
cmp eax, 1
je 0x140025dfa
mov qword [r12 + 0x68], 0xffffffffffffffff
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x140025dae
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x140025df0
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call fcn.1400245b0
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x140025c6f
mov rcx, r12
call fcn.140024060
jmp 0x140025db9
call fcn.140023d60
nop
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x140025f20
lea r13, [0x1400291a8]
mov rcx, r13
call fcn.1400233d0
mov rcx, rbx
call fcn.140023a50
mov rcx, r13
mov r12, rax
call fcn.1400236f0
test r12, r12
je 0x140025f20
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x140025f20
lea rdx, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140025f20
test byte [r12 + 0x44], 4
jne 0x140025f30
call fcn.1400245b0
test rax, rax
je 0x140025e88
cmp rbx, qword [rax + 0x1d8]
je 0x140025f40
mov eax, dword [r12 + 0xbc]
mov rcx, qword [r12 + 0x28]
test eax, eax
je 0x140025ea3
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140025eb3
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [r12 + 0x28]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140025ec8
call rbx
mov qword [r12 + 0x30], 0
test rsi, rsi
je 0x140025ede
mov rax, qword [r12 + 8]
mov qword [rsi], rax
lea rcx, [r12 + 0x38]
call fcn.1400238c0
lea rcx, [r12 + 0x68]
call fcn.140027810
cmp eax, 1
je 0x140025f47
mov qword [r12 + 0x68], 0xffffffffffffffff
xor eax, eax
cmp qword [r12 + 0x1d0], 0
jne 0x140025f25
mov rcx, r12
mov dword [rsp + 0x2c], eax
call fcn.140024060
mov eax, dword [rsp + 0x2c]
jmp 0x140025f25
mov eax, 3
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov eax, 0x16
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
mov eax, 0x24
jmp 0x140025f25
call fcn.140023d60
nop
nop dword [rax]
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
lea r13, [0x1400291a8]
mov rbx, rcx
mov rcx, r13
mov rsi, rdx
call fcn.1400233d0
mov rcx, rbx
call fcn.140023a50
mov r12, rax
test rax, rax
je 0x140026068
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140026068
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140026068
test byte [r12 + 0x44], 4
jne 0x140026080
call fcn.1400245b0
test rax, rax
je 0x1400260d0
mov rax, qword [rax + 0x1d8]
cmp rbx, rax
je 0x1400260e0
mov edx, dword [r12 + 0xbc]
mov rcx, qword [r12 + 0x28]
test edx, edx
jne 0x140025ff3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400260a0
mov rcx, qword [r12 + 0x28]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x140026008
call rbx
mov qword [r12 + 0x30], 0
test rsi, rsi
je 0x14002601e
mov rax, qword [r12 + 8]
mov qword [rsi], rax
lea rcx, [r12 + 0x38]
call fcn.1400238c0
lea rcx, [r12 + 0x68]
call fcn.140027810
cmp eax, 1
je 0x1400260f2
cmp qword [r12 + 0x1d0], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
je 0x1400260c0
mov rcx, r13
call fcn.1400236f0
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, r13
call fcn.1400236f0
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, r13
call fcn.1400236f0
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret
mov eax, dword [r12 + 0xbc]
test eax, eax
jne 0x140025fee
mov rcx, r13
call fcn.1400236f0
mov eax, 0x10
jmp 0x140026059
mov rcx, r12
call fcn.140024060
jmp 0x14002604f
xor eax, eax
jmp 0x140025fc4
mov rcx, r13
call fcn.1400236f0
mov eax, 0x24
jmp 0x140026059
call fcn.140023d60
nop
nop dword [rax + rax]