Function at 0x7fff25d75350
Capabilities:
Create thread
Print debug messages
Resume thread

Disassembly:
mov r11, rsp
push rbx
push rsi
push r13
push r14
push r15
sub rsp, 0x5c0
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x5b0], rax
mov qword [rsp + 0x110], r9
mov qword [rsp + 0x100], r8
mov r14, rcx
mov rax, qword [rsp + 0x610]
mov qword [rsp + 0x108], rax
mov rbx, qword [rsp + 0x620]
mov r13, qword [rsp + 0x628]
xor ecx, ecx
mov byte [rsp + 0xb1], cl
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [r11 - 0x508], rcx
xorps xmm1, xmm1
movups xmmword [rsp + 0x120], xmm1
mov byte [rsp + 0xb0], cl
mov qword [r11 - 0x530], rcx
test dword [rsp + 0x618], 0xfffefffb
jne 0x7fff25de8740
lea r9, [r11 - 0x4d0]
xor r8d, r8d
lea rcx, [r11 - 0x438]
call sym.KERNELBASE.dll_BaseFormatObjectAttributes
mov dword [rsp + 0xb4], eax
xor r9d, r9d
test eax, eax
js 0x7fff25de8761
mov qword [rsp + 0x1e8], 0x10003
mov qword [rsp + 0x1f0], 0x10
mov qword [rsp + 0x200], r9
lea rax, [rsp + 0x120]
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x208], 0x10004
mov qword [rsp + 0x210], 8
mov qword [rsp + 0x220], r9
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x218], rax
mov dword [rsp + 0xc0], 2
test rbx, rbx
jne 0x7fff25de8765
mov eax, dword [rsp + 0xc0]
shl rax, 5
add rax, 8
mov qword [rsp + 0x1e0], rax
mov r15d, dword [rsp + 0x618]
and r15d, 0x10000
mov qword [rsp + 0xc8], r9
mov sil, 1
or rcx, 0xffffffffffffffff
cmp r14, rcx
jne 0x7fff25de8805
test sil, sil
je 0x7fff25d75566
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], 0x10
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov ecx, r9d
call qword [sym.imp.ntdll.dll_RtlQueryInformationActivationContext]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0xb4], eax
xor r9d, r9d
test eax, eax
js 0x7fff25d7578b
cmp byte [0x7fff25fd0c84], r9b
jne 0x7fff25d7555e
mov rax, qword gs:[0x30]
cmp qword [rax + 0x1720], r9
jne 0x7fff25d7555e
cmp qword [rsp + 0xd0], r9
jne 0x7fff25d75554
mov byte [rsp + 0xb0], r9b
test byte [rsp + 0x618], 4
mov edx, r9d
jne 0x7fff25d75570
jmp 0x7fff25d75575
test byte [rsp + 0xd8], 1
jne 0x7fff25d7553d
mov byte [rsp + 0xb0], 1
cmp byte [rsp + 0xb0], r9b
je 0x7fff25d75545
mov edx, 1
mov dword [rsp + 0xe8], edx
mov eax, r15d
neg eax
fmul dword [rax + 0x1b]
leave
mov rax, qword [rsp + 0x100]
and rcx, rax
test r15d, r15d
cmovne rax, r9
lea r8, [rsp + 0x1e0]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], edx
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, qword [rsp + 0x118]
mov edx, 0x1fffff
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0xb4], eax
xor esi, esi
test eax, eax
js 0x7fff25d757c5
cmp byte [rsp + 0xb0], sil
jne 0x7fff25d7565f
test r13, r13
je 0x7fff25d75622
mov rax, qword [rsp + 0x128]
mov dword [r13], eax
cmp byte [rsp + 0xb0], sil
je 0x7fff25d757c5
test byte [rsp + 0x618], 4
jne 0x7fff25d757c5
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_NtResumeThread]
nop dword [rax + rax]
jmp 0x7fff25d757c5
mov rax, qword gs:[0x30]
cmp qword [rax + 0x1720], rsi
je 0x7fff25d75690
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x1720]
mov rax, qword [rsp + 0xf0]
mov qword [rax + 0x1720], rcx
cmp qword [rsp + 0xd0], rsi
jne 0x7fff25d75706
mov ebx, dword [rsp + 0xb4]
cmp byte [0x7fff25fd0c84], sil
je 0x7fff25d75611
lea rcx, str.csrsrv
call sym.KERNELBASE.dll_GetModuleHandleA
mov r8, qword [rsp + 0x5e8]
lea rdx, str.CsrCreateRemoteThread
mov rcx, rax
call sym.KERNELBASE.dll_GetProcAddressForCaller
test rax, rax
je 0x7fff25d75611
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0xb8]
call qword [case.0x7fff25dc97c1.0]
mov ebx, eax
mov dword [rsp + 0xb4], eax
test eax, eax
js 0x7fff25d757c5
jmp 0x7fff25d75611
test byte [rsp + 0xd8], 1
jne 0x7fff25d7569a
lea rcx, [rsp + 0xe0]
call qword [sym.imp.ntdll.dll_RtlAllocateActivationContextStack]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0xb4], eax
test eax, eax
js 0x7fff25d757a5
mov rcx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xf0]
mov qword [rax + 0x2c8], rcx
lea r9, [rsp + 0x130]
mov r8, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xf0]
mov ecx, 1
call qword [sym.imp.ntdll.dll_RtlActivateActivationContextEx]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0xb4], eax
test eax, eax
js 0x7fff25d757ae
mov byte [rsp + 0xb1], 1
jmp 0x7fff25d756a1
mov r8d, eax
lea rdx, [0x7fff25fa52e0]
lea rcx, str.SXS:__s___Failing_thread_create_because_RtlQueryInformationActivationContext___failed_with_status__08lx_n
call sub.ntdll.dll_DbgPrint
xor esi, esi
jmp 0x7fff25d757c5
lea rcx, str.SXS:__s___Failing_thread_create_because_RtlAllocateActivationContextStack___failed_with_status__08lx_n
jmp 0x7fff25d757b5
lea rcx, str.SXS:__s___Failing_thread_create_because_RtlActivateActivationContextEx___failed_with_status__08lx_n
lea rdx, [0x7fff25fa52e0]
mov r8d, eax
call sub.ntdll.dll_DbgPrint
nop
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
jne 0x7fff25d75814
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
jne 0x7fff25de8903
test ebx, ebx
js 0x7fff25de8915
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x5b0]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x5c0
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
call qword [sym.imp.ntdll.dll_RtlReleaseActivationContext]
nop dword [rax + rax]
jmp 0x7fff25d757d2
add byte [rax], al
add eax, 0x43000501
add byte [rax + rax + 0x53], cl
add byte [rcx], cl
add byte [rdx], r8b
or eax, 0x4010002
invalid
add byte [rcx], r12b
je 0x7fff25de8767
invalid
add byte [rsi], dh
add byte gs:[rax + rax + 2], ch
or eax, 0x4010004
add al, 0
add byte [rax], al
add byte [rax], al
add dword [rcx], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
enter 0x9d, 0
add byte [rax], al
add byte [rax], al
add dword [rcx], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
invalid
add byte [rcx], ch
invalid
add byte [rbp], ah
jbe 0x7fff25de891a
add byte gs:[rax + rax], ch
add byte [rax + 0x52], dl
push rsi
pop r8
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
adc byte [rsi + rbx*4 + 0x4d0000], al
imul eax, dword [rax], 0x720063
outsd dx, dword [rsi]
add byte [rbx], dh
outsd dx, dword [rsi]
add byte [rsi], ah
je 0x7fff25de8946
sub eax, 0x69005700
add byte [rsi], ch
add byte fs:[rdi], ch
ja 0x7fff25de8954
jae 0x7fff25de8956
sub eax, 0x69004400
add byte [rbx], dh
je 0x7fff25de8960
jb 0x7fff25de8962
imul eax, dword [rax], 0x750062
je 0x7fff25de896a
add byte gs:[rax + rax + 0x43], ah
add byte [rdi], cl
add byte [r8], r8b
add byte [rax], al
add byte [rdi + 0x50], cl
add byte [r8], r8b
add byte [rax], al
add byte [rax], al
add byte [rax], al
push r14
xor byte [rax], r8b
add byte [rax], al
add dword [rax], eax
add byte [rax], al
add al, byte [rax]
add byte [rax], al
add al, byte [rax]
add byte [rcx - 0x14], dl
sahf
add byte [rax], al
sbb byte [rax], al
add byte [rax], al
ja 0x7fff25de89a2
imul eax, dword [rax], 0x3a006e
add byte [r10], r14b
jb 0x7fff25de89ae
outsd dx, dword [rsi]
add byte [rdx], dh
add byte [rax], al
push rsp
push r11
add byte [r8], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
pop r9
push rdi
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x3800], al
adc dword [rdi + rbx*4], ebp
add byte [rax], al
sub al, 0
add byte [rax], al
ja 0x7fff25de89e2
imul eax, dword [rax], 0x3a006e
add byte [r14], r14b
add byte gs:[rsi], ch
je 0x7fff25de89f2
insb byte [rdi], dx
add byte [rdi], ch
add byte [ebx], al
insb byte [rdi], dx
add byte [rcx], ah
jae 0x7fff25de8a00
jae 0x7fff25de8a02
imul eax, dword [rax], 0x63
push r14
push rsp
xchg esp, eax
invalid