Function at 0x1400a3600
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rsp + 0x138], rbx
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov r13, r8
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r12, rcx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov rcx, rdx
mov qword [rsp + 0x30], rdx
xor esi, esi
mov ebx, esi
mov ebp, esi
movzx eax, word [rdx]
lea r15d, [rsi + 9]
lea r14d, [rsi + 0x20]
lea r8d, [rsi + 1]
test ax, ax
je 0x1400a36a0
lea edx, [rsi + 0x24]
cmp r15w, ax
ja 0x1400a3682
cmp ax, 0xd
jbe 0x1400a369b
cmp r14w, ax
je 0x1400a369b
cmp dx, ax
cmove ebx, r8d
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x1400a3676
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
call fcn.14005b560
mov ecx, 0x2d
mov rax, qword [rsp + 0x30]
cmp cx, word [rax]
jne 0x1400a3776
lea r13d, [rcx - 0x2c]
mov r12d, ecx
mov r8d, 5
lea rdx, [rsp + 0x30]
lea rcx, str._wait
call fcn.1400657f0
test al, al
je 0x1400a36e4
mov ebp, r13d
jmp 0x1400a375d
mov r8d, 4
lea rdx, [rsp + 0x30]
lea rcx, str._exp
call fcn.1400657f0
test al, al
je 0x1400a3704
mov ebx, r13d
jmp 0x1400a375d
mov r8d, 5
lea rdx, [rsp + 0x30]
lea rcx, str._link
call fcn.140065780
test al, al
jne 0x1400a375d
mov rcx, qword [rsp + 0x30]
movzx eax, word [rcx]
test ax, ax
je 0x1400a3753
nop dword [rax]
cmp r15w, ax
ja 0x1400a373c
cmp ax, 0xd
jbe 0x1400a374e
cmp r14w, ax
je 0x1400a374e
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x1400a3730
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
call fcn.14005b560
mov rax, qword [rsp + 0x30]
cmp r12w, word [rax]
je 0x1400a36c4
mov r12, qword [rsp + 0x40]
mov r13, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14005b560
mov r10, qword [rsp + 0x30]
movzx ecx, word [r10]
test cx, cx
jne 0x1400a3798
mov eax, 0x80070057
jmp 0x1400a39e9
mov qword [rsp + 0x38], rsi
test ebx, ebx
je 0x1400a3835
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x38]
mov rdx, rdi
mov rcx, r12
call fcn.14006bc40
mov r11, qword [rsp + 0x38]
mov qword [rsp + 0x48], r11
lea rcx, [rsp + 0x48]
call fcn.14005b560
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov qword [rsp + 0x30], rcx
movzx eax, word [rdi]
test ax, ax
je 0x1400a3809
cmp r15w, ax
ja 0x1400a37f2
cmp ax, 0xd
jbe 0x1400a3804
cmp r14w, ax
je 0x1400a3804
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x1400a37e6
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
call fcn.14005b560
mov r10, qword [rsp + 0x30]
mov cx, word [r10]
test cx, cx
jne 0x1400a3835
lea rcx, [rsp + 0x38]
call fcn.14005b520
mov eax, 0x80070057
jmp 0x1400a39e9
mov ebx, 0x400000
mov qword [rsp + 0x40], rbx
mov al, 0x2a
mov edx, 0x2d
cmp dx, cx
cmove eax, edx
movsx edx, al
movzx eax, cx
cmp edx, eax
jne 0x1400a38a9
movzx eax, word [r10 + 2]
cmp edx, eax
jne 0x1400a38a9
lea rdx, [r10 + 4]
mov r8d, 3
lea rcx, [0x1401524f0]
call fcn.14005c510
test al, al
je 0x1400a38a9
add r10, 0xa
mov qword [rsp + 0x30], r10
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140068f80
mov rbx, qword [rsp + 0x40]
add rbx, 0x1fff
and rbx, 0xffffffffffffe000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 4
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], rsi
lea r13, [0x14019cae8]
mov qword [rsp + 0x88], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
movsxd rdx, ebx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
lea r9, [rsp + 0x50]
lea r8, [0x1400a2ff0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x1400a396c
mov ebx, 0x270f
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400a3939
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x1400a3922
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400a397e
mov r13d, 1
nop dword [rax]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [rsp + 0x68]
test r11, r11
jne 0x1400a3950
lea r13, [0x14019cae8]
jmp 0x1400a397e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmove eax, ecx
mov esi, eax
lea r8, str.__LastTID
mov edx, dword [rsp + 0x70]
mov rcx, r12
call fcn.140065eb0
nop
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x1400a39a9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x1400a39dd
test rdi, rdi
je 0x1400a39dd
mov r8d, dword [rsp + 0x70]
lea rdx, str.__ncd__d
lea rcx, [rsp + 0x98]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x98]
mov rcx, r12
call fcn.140049b94
nop
lea rcx, [rsp + 0x38]
call fcn.14005b520
mov eax, esi
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x138]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret