Function at 0x140008ecc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rdi, qword [rcx]
xor ebp, ebp
mov rsi, qword [rcx + 8]
mov r13, rcx
mov eax, dword [0x14021fd3c]
mov ebx, ebp
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
lea r14d, [rbp + 1]
test eax, eax
je 0x140008f3d
mov r15d, 0xc8
cmp ebx, r15d
jge 0x140008f35
mov ecx, 0x32
add ebx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14021fd3c]
test eax, eax
jne 0x140008f13
cmp ebx, r15d
jl 0x140008f3d
test eax, eax
jne 0x14000930d
cmp dword [0x14021fd68], ebp
mov dword [0x14021fd3c], r14d
mov dword [0x14021d120], ebp
mov dword [0x14021fd48], ebp
jne 0x140008f75
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x14021d128], rax
call fcn.14000a5f8
test ax, ax
je 0x14000930d
mov rdx, rsi
mov rcx, rdi
call fcn.140008b38
cmp dword [0x14021fd68], ebp
jne 0x140008fb9
mov qword [rsp + 0x28], rbp
lea r8, [0x140008dc0]
mov r9, r13
mov dword [rsp + 0x20], ebp
xor edx, edx
mov dword [0x14021d120], ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x14021fd78]
test eax, eax
jle 0x140008ffb
mov rcx, qword [0x14021fd60]
mov r8d, eax
mov r10d, dword [0x14021fd80]
test r10d, r10d
jle 0x140008ff2
mov rdx, rbp
mov r9, r10
mov rax, qword [rcx]
mov dword [rdx + rax], 0xff
lea rdx, [rdx + 8]
sub r9, r14
jne 0x140008fdf
add rcx, 8
sub r8, r14
jne 0x140008fd4
mov rdx, rsi
mov rcx, rdi
call fcn.140007ef0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14021d120], ebp
jne 0x140009257
mov eax, dword [0x14021fd78]
test eax, eax
jle 0x14000905d
mov rcx, qword [0x14021fd60]
mov r8d, eax
mov r10d, dword [0x14021fd80]
test r10d, r10d
jle 0x140009054
mov rdx, rbp
mov r9, r10
mov rax, qword [rcx]
lea rdx, [rdx + 8]
mov byte [rax + rdx - 4], bpl
sub r9, r14
jne 0x140009043
add rcx, 8
sub r8, r14
jne 0x140009038
mov r8, rsi
mov rdx, rdi
mov ecx, r14d
call fcn.1400080a0
cmp dword [0x14021d120], ebp
jne 0x140009257
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.14000a280
cmp eax, r14d
je 0x140009250
cmp dword [0x14021fd78], ebp
mov ebx, ebp
mov r12, qword [rsp + 0xc8]
jle 0x1400091e9
mov r13, qword [rsp + 0xb8]
mov r15, rbp
cmp dword [0x14021fd80], ebp
mov edi, ebp
jle 0x1400091be
mov r14, rbp
mov esi, dword [0x14021fd50]
mov ebp, dword [0x14021fd74]
imul esi, ebx
imul ebp, edi
cmp dword [0x14021d120], 0
jne 0x1400091b8
cmp dword [0x14021fd48], 0
je 0x140009100
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14021d120], 0
je 0x1400090e3
cmp dword [0x14021d120], 0
jne 0x1400091b8
mov eax, dword [0x14021d130]
cmp dword [0x14021d134], eax
jne 0x1400091b8
mov rax, qword [0x14021fd60]
mov r8, qword [r15 + rax]
mov al, byte [r8 + r14 + 4]
dec al
test al, 0xfd
je 0x1400091a6
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x48]
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x40]
mov edx, esi
mov qword [rsp + 0x20], r12
mov ecx, ebp
call fcn.140009f28
cmp eax, 1
je 0x1400091a6
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x1400091a6
cmp dword [0x14021d120], 0
jne 0x1400091a6
mov r8, qword [rsp + 0xc0]
mov rcx, rsi
mov edx, dword [rsp + 0x48]
call r13
cmp eax, 0xfffffffc
je 0x140009194
test eax, eax
jne 0x14000919e
mov dword [0x14021fd48], 1
jmp 0x14000919e
mov dword [0x14021d120], 1
mov rcx, rsi
call fcn.14016f3a8
inc edi
add r14, 8
cmp edi, dword [0x14021fd80]
jl 0x1400090c4
xor ebp, ebp
lea r14d, [rbp + 1]
add ebx, r14d
add r15, 8
cmp ebx, dword [0x14021fd78]
jl 0x1400090b3
mov r13, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
test r12, r12
je 0x1400091f6
mov rcx, r12
call fcn.14016f3a8
cmp dword [0x14021d120], ebp
mov ebx, dword [0x14021fd5c]
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0x50], rbp
jne 0x140009257
test ebx, ebx
jle 0x140009011
cmp ebx, 0x32
jle 0x14000922e
sub ebx, 0x32
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009238
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, ebp
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepEx]
cmp dword [0x14021d120], ebp
je 0x140009211
jmp 0x140009011
mov dword [0x14021d120], r14d
cmp qword [0x14021fd60], rbp
je 0x14000929f
cmp dword [0x14021fd78], ebp
mov ebx, ebp
jle 0x14000928c
mov rdi, rbp
mov rcx, qword [0x14021fd60]
mov rcx, qword [rdi + rcx]
call fcn.14016f3a8
add ebx, r14d
lea rdi, [rdi + 8]
cmp ebx, dword [0x14021fd78]
jl 0x14000926d
mov rcx, qword [0x14021fd60]
call fcn.14016f3a8
mov qword [0x14021fd60], rbp
mov rcx, qword [0x14021fd98]
test rcx, rcx
je 0x1400092b0
call fcn.14016f3a8
mov rcx, qword [0x14021fe40]
mov dword [0x14021fd94], ebp
mov qword [0x14021fd98], rbp
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov rcx, qword [0x14021fdd0]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [0x14021fe38]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, qword [0x14021fda0]
test rdx, rdx
je 0x1400092f8
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, r13
mov qword [0x14021fda0], rbp
mov dword [0x14021fd3c], ebp
call fcn.14016f3a8
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret