Function at 0x14001c0f1
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
xor r13d, r13d
mov qword [rsp + 0x60], r13
mov rax, qword [rcx + 8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [0x14011d820]
movaps xmmword [rsp + 0x70], xmm0
mov r12, qword [rcx]
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r13
mov edi, dword [rdx + 0xc]
add edi, 0x30
test r8, r8
lea rax, [rsp + 0xa8]
mov r15, r8
cmove r15, rax
mov ecx, 0x40
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
je 0x14001c406
mov r14, rax
mov rcx, rax
add rcx, 0x20
mov r8d, dword [rbx + 0xc]
add r8d, 0x10
mov rdx, rbx
call fcn.1400eeb30
lea rcx, [rsp + 0x60]
mov rdx, rdi
mov r8d, 4
call fcn.140015e34
test eax, eax
je 0x14001c250
lea rdx, [rsp + 0x70]
mov qword [rdx], r14
lea rcx, [rsp + 0x60]
mov r8, rdi
call fcn.140015a18
xor r13d, r13d
test eax, eax
je 0x14001c3f3
mov rcx, qword [rsi + 8]
mov eax, dword [rcx]
cmp eax, 3
je 0x14001c258
cmp eax, 1
jne 0x14001c3f3
cmp dword [0x140177fe8], 6
mov rax, qword [rsp + 0x60]
mov r9, qword [rsi]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
jb 0x14001c2c7
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x48], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_RtlCreateUserThread
test eax, eax
jns 0x14001c309
mov qword [rsp + 0x58], 0
lea rcx, str.L_t__t__tF_t__t__t__t2_t__t__t_te_tJ_t_tl_th_t_tl_t_tz_tl_t_t__ta_t_tl_th_tm_t__t__t9_tq_t__t9_t1_tq_t__t
jmp 0x14001c302
xor r13d, r13d
jmp 0x14001c3fd
mov r8, qword [rsp + 0x60]
lea rdi, [rsp + 0x98]
mov qword [rdi + 8], r8
lea rcx, str.m9Q9
mov rdx, r12
call fcn.140016430
mov rax, qword [rsi + 8]
mov rax, qword [rax + 8]
mov rcx, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0
mov edx, 0x22c1c3
mov r8, rdi
mov r9d, 0x10
call fcn.140013114
test eax, eax
jne 0x14001c335
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140144460]
mov edx, eax
call fcn.140016430
jmp 0x14001c3f3
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14001c317
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1401443e0]
mov edx, eax
call fcn.140016430
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001c3f3
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14001c3f3
lea rcx, [rsp + 0x70]
mov qword [rcx], r15
lea rdx, [rsp + 0x60]
mov r8d, Ordinal_36
call fcn.140015a18
test eax, eax
je 0x14001c3f3
mov esi, eax
test rbp, rbp
mov rbx, rbp
lea rdi, [rsp + 0xa8]
cmove rbx, rdi
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14001c3f0
cmp r15, rdi
je 0x14001c3e3
test rbp, rbp
mov qword [rbx + 0x18], 0
cmovne rdi, rbp
mov edx, dword [rdi + 0x10]
test rdx, rdx
je 0x14001c3da
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14001c3da
mov r8d, dword [rdi + 0x10]
lea rbp, [rsp + 0x70]
lea rdx, [rsp + 0x88]
mov rcx, rbp
call fcn.140015a18
mov rcx, qword [rbp]
test eax, eax
je 0x14001c3d4
mov esi, eax
mov qword [rbx + 0x18], rcx
jmp 0x14001c3e3
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rdi + 0x10], 0
xor esi, esi
lea rcx, [rsp + 0x88]
call fcn.140015ee8
mov r13d, esi
lea rcx, [rsp + 0x60]
call fcn.140015ee8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, r13d
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret