Function at 0x406f80
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rcx
mov qword [r11 - 0x50], rdx
lea rax, [0x0049ca50]
mov qword [rcx], rax
lea rax, [0x0049e988]
mov qword [rcx + 8], rax
lea rax, [0x0049ca90]
mov qword [rcx], rax
lea rax, [0x0049cad0]
mov qword [rcx + 8], rax
xor edi, edi
mov byte [rcx + 0x10], dil
mov qword [rcx + 0x18], rdi
lea r15d, [rdi + 7]
mov qword [rcx + 0x40], r15
mov qword [rcx + 0x38], rdi
mov word [rcx + 0x28], di
mov qword [rcx + 0x48], rdi
mov qword [rcx + 0x70], r15
mov qword [rcx + 0x68], rdi
mov word [rcx + 0x58], di
mov byte [rcx + 0x78], dil
mov byte [rcx + 0x79], dil
mov byte [rcx + 0x7a], dil
mov qword [rcx + 0xa0], r15
mov qword [rcx + 0x98], rdi
mov word [rcx + 0x88], di
mov qword [rcx + 0xe8], rdi
mov qword [rcx + 0xf0], rdi
mov qword [rcx + 0xf8], rdi
mov qword [rcx + 0x100], rdi
mov qword [rcx + 0x108], rdi
add rcx, 0x110
mov qword [rcx + 0x20], r15
mov qword [rcx + 0x18], rdi
mov word [rcx + 8], di
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.004020b0
nop
mov dword [rsi + 0x138], edi
lea rcx, [rsi + 0x140]
call fcn.0040c2b0
mov qword [rsi + 0x148], rax
mov qword [rsi + 0x150], rdi
lea rcx, [rsi + 0x158]
call fcn.0040260c
nop
mov byte [rsi + 0x238], dil
mov byte [rsi + 0x239], dil
mov ebx, edi
lea r14, [rsi + 0xb8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r14], rax
cmp rax, rdi
je 0x4074ae
inc ebx
add r14, 8
cmp ebx, 6
jb 0x4070bf
cmp dword [rsi + 0x158], edi
je 0x4070f6
mov rcx, rsi
call fcn.0040768c
mov ebx, 0x102
mov edx, 0x20
mov rcx, qword [0x004c5760]
call fcn.0041004c
cmp eax, edi
je 0x40712f
mov r8d, 0x17
lea rdx, str.ADDEPLOY1_ACTIONADMIN
lea rcx, [rsi + 0x50]
call fcn.00404e54
or r14, 0xffffffffffffffff
jmp 0x4072f7
mov edx, 0x22
mov rcx, qword [0x004c5760]
call fcn.0041004c
cmp eax, edi
je 0x4072dd
mov r8d, 0x3c
lea rdx, str.USING_EXUIH_SILENT1_REBOOTReallySuppress_FILESINUSETEXT__
lea rcx, [rsi + 0x50]
call fcn.00404e54
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x78], rdi
mov word [rsp + 0x68], di
mov rax, qword [0x004c5760]
mov rdx, qword [rax + 0x28]
add rdx, 0xd38
or r14, 0xffffffffffffffff
mov r9, r14
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.004020b0
mov qword [rsp + 0x20], 3
lea r9, [0x0049ad40]
mov r8, qword [rsp + 0x78]
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.00406604
cmp eax, edi
jne 0x4071c1
lea ebx, [r14 + 4]
jmp 0x4071ec
mov qword [rsp + 0x20], 4
lea r9, str._qb_
mov r8, qword [rsp + 0x78]
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.00406604
mov ecx, 0x23
cmp eax, edi
cmove ebx, ecx
mov edx, 0x2d
mov rcx, qword [0x004c5760]
call fcn.0041004c
cmp eax, 1
jne 0x4072b4
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xc8], rdi
mov word [rsp + 0xb8], di
mov rax, qword [0x004c5760]
mov rdx, qword [rax + 0x28]
add rdx, 0x28
mov r9, r14
xor r8d, r8d
lea rcx, [rsp + 0xb0]
call fcn.004020b0
mov r8d, 0x11
lea rdx, str._LOCPRODUCTNAME_
lea rcx, [rsi + 0x50]
call fcn.00404a40
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0xb0]
lea rcx, [rsi + 0x50]
call fcn.0040490c
mov r8d, 1
lea rdx, [0x004993f8]
lea rcx, [rsi + 0x50]
call fcn.00404a40
nop
cmp qword [rsp + 0xd0], 8
jb 0x40729c
mov rcx, qword [rsp + 0xb8]
call fcn.00443d3c
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xc8], rdi
mov word [rsp + 0xb8], di
cmp qword [rsp + 0x80], 8
jb 0x4072c9
mov rcx, qword [rsp + 0x68]
call fcn.00443d3c
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x78], rdi
mov word [rsp + 0x68], di
jmp 0x4072f7
mov r8d, 0x35
lea rdx, str.USING_EXUIH1_REBOOTReallySuppress_FILESINUSETEXT__
lea rcx, [rsi + 0x50]
call fcn.00404e54
or r14, 0xffffffffffffffff
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xa0], rdi
mov word [rsp + 0x90], di
mov rax, qword [0x004c5760]
mov rdx, qword [rax + 0x28]
add rdx, 0x708
mov r9, r14
xor r8d, r8d
lea rcx, [rsp + 0x88]
call fcn.004020b0
cmp qword [rsp + 0xa0], rdi
je 0x40736b
mov r8d, 1
lea rdx, [0x0049ad7c]
lea rcx, [rsi + 0x50]
call fcn.00404a40
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsi + 0x50]
call fcn.0040490c
cmp dword [rsi + 0x158], edi
je 0x4073db
cmp dword [rsi + 0x158], edi
je 0x407389
xor edx, edx
mov ecx, ebx
call qword [rsi + 0x180]
cmp eax, edi
jne 0x4073db
mov ecx, 0x840
call fcn.004443a8
mov qword [rsp + 0x48], rax
cmp rax, rdi
je 0x4073c4
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebx
lea r9, [0x0049ad80]
mov edx, 0x1fff
mov r8d, edx
mov rcx, rax
call fcn.00401de0
mov rdi, rax
mov qword [rsp + 0x40], rdi
lea rdx, [0x004bc148]
lea rcx, [rsp + 0x40]
call fcn.00449f60
int3
xor edx, edx
mov rcx, rsi
call fcn.00407968
lea rdx, str.Entering_CMsiInstaller::ThreadInit
mov rcx, qword [0x004c5758]
call fcn.00429b54
lea r11, [rsp + 0x40]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], edi
mov r9, rsi
lea r8, [0x0040b6e8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0xa8], rax
cmp rax, rdi
jne 0x407439
lea rdx, str.Worker_Thread_creation_failed_
mov rcx, qword [0x004c5758]
call fcn.00429edc
mov eax, dword [rsp + 0x40]
mov dword [rsi + 0xb0], eax
lea rdx, str.Leaving_CMsiInstaller::ThreadInit
mov rcx, qword [0x004c5758]
call fcn.00429b54
nop
cmp qword [rsp + 0xa8], 8
jb 0x40746f
mov rcx, qword [rsp + 0x90]
call fcn.00443d3c
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xa0], rdi
mov word [rsp + 0x90], di
cmp qword [r12 + 0x20], 8
jb 0x407499
mov rcx, qword [r12 + 8]
call fcn.00443d3c
mov qword [r12 + 0x20], r15
mov qword [r12 + 0x18], rdi
mov word [r12 + 8], di
mov rax, rsi
jmp 0x4074f3
mov ecx, 0x840
call fcn.004443a8
mov qword [rsp + 0x48], rax
cmp rax, rdi
je 0x4074dc
lea r9, str.Cannot_create_Event_objects
mov edx, 0x1fff
mov r8d, edx
mov rcx, rax
call fcn.00401de0
mov rdi, rax
mov qword [rsp + 0x40], rdi
lea rdx, [0x004bc148]
lea rcx, [rsp + 0x40]
call fcn.00449f60
nop
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.00443d60
mov rbx, qword [rsp + 0x140]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret