Function at 0x14001c6dc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rbp, rcx
mov qword [rsp + 0x58], rbx
cmp byte [rcx + 0x10], bl
je 0x14001c707
mov edi, 0x80004005
jmp 0x14001c910
mov eax, dword [rcx + 0x58]
cmp eax, dword [rcx + 0x54]
ja 0x14001c727
lea edx, [rax + 5]
add rcx, 0x48
shl rdx, 3
call fcn.140058fbc
test al, al
je 0x14001c6fd
add dword [rbp + 0x58], 5
mov ecx, 0xc28
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14001c747
mov rdx, rbp
mov rcx, rax
call fcn.14001c4a8
mov rsi, rax
jmp 0x14001c749
xor esi, esi
test rsi, rsi
jne 0x14001c758
mov edi, 0x8007000e
jmp 0x14001c910
mov r9d, 0x1f0003
xor r8d, r8d
xor edx, edx
xor ecx, ecx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateEventExW]
mov rcx, qword [rsi + 0xc00]
mov r14, rax
test rcx, rcx
je 0x14001c789
and qword [rsi + 0xc00], rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0xc00], r14
test r14, r14
jne 0x14001c7a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14001c7b7
mov rbx, rsi
xor esi, esi
mov qword [rsp + 0x58], rbx
or r14d, 0xffffffff
test rsi, rsi
je 0x14001c802
mov eax, r14d
lock xadd dword [rsi + 0xc24], eax
add eax, r14d
jne 0x14001c7fd
mov rcx, qword [rsi + 0xc00]
test rcx, rcx
je 0x14001c7ea
and qword [rsi + 0xc00], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x58]
test edi, edi
js 0x14001c8c9
cmp qword [rbp + 0x60], 0
jne 0x14001c81b
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rbp + 0x60], rax
lock inc dword [rbx + 0xc24]
mov rsi, qword [rsp + 0x58]
lea r8, [0x14001d120]
mov r9, rsi
xor edx, edx
xor ecx, ecx
lea rax, [rsi + 0xbf8]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14001c89f
mov eax, r14d
lock xadd dword [rbx + 0xc24], eax
mov rbx, qword [rsp + 0x58]
add eax, r14d
jne 0x14001c898
test rbx, rbx
je 0x14001c898
mov rcx, qword [rbx + 0xc00]
test rcx, rcx
je 0x14001c885
and qword [rbx + 0xc00], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edi, 0x80004005
jmp 0x14001c8c9
mov qword [rsi + 0xbf0], rax
mov ecx, dword [rbp + 0x54]
mov rax, qword [rbp + 0x48]
mov qword [rax + rcx*8], rsi
mov eax, 0x3e
inc dword [rbp + 0x54]
and qword [rsp + 0x58], 0
lock xadd dword [rbp + 0x50], eax
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14001c910
mov eax, r14d
lock xadd dword [rbx + 0xc24], eax
add eax, r14d
jne 0x14001c910
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0xc00]
test rcx, rcx
je 0x14001c8fd
and qword [rbx + 0xc00], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret