Function at 0x140032c20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x40
cmp byte [reloc.ACLUI.dll_CreateSecurityPage], 0
mov rbp, rdx
mov esi, dword [0x14016aa5c]
mov rbx, rcx
je 0x140032c50
cmp esi, 0x1388
mov eax, 0x4e20
cmove esi, eax
mov byte [reloc.ACLUI.dll_CreateSecurityPage], 0
xor r14d, r14d
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x140032cf7
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x140032ca3
cmp dword [rsp + 0x60], 0x103
jne 0x140032ca3
mov rcx, qword [rbx + 0x20]
lea rdi, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x140032cb5
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140032cb1
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rbx + 0x20]
mov qword [rbx + 0x28], r14
cmp qword [rbx + 0x28], r14
jne 0x140032cf2
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140032cce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], r14
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140032ce1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x18], r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x140032cf2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r14
mov rdi, qword [rsp + 0x68]
mov rax, qword [rbx + 0x28]
test rax, rax
jne 0x140032d7a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140032dc4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x140032dc4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x140032dc4
mov qword [rsp + 0x28], r14
lea r8, [0x1400353f0]
mov r9, rbx
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x140032dc4
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x140032dbf
mov eax, dword [rbx + 0xc]
mov ecx, 0x80004005
test eax, eax
cmovns eax, ecx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp eax, 1
je 0x140032dd7
mov eax, 0x80004005
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rbx + 0x18]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov r9d, esi
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
je 0x140032e32
cmp eax, 0xffffffff
jne 0x140032e1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140032e51
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
mov eax, 0x80070102
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
mov rcx, qword [rbx + 0x30]
lea rdx, [0x140125bf8]
mov r8, rbp
call qword [sym.imp.ole32.dll_CoGetInterfaceAndReleaseStream]
mov dword [rbx + 0xc], eax
test eax, eax
js 0x140032e51
mov qword [rbx + 0x30], r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret