Function at 0x140011998
Capabilities:
Create thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [0x14022e160], r8
lea rsi, [0x14022e010]
mov dword [rbp - 0x20], 0x281b
mov eax, 0x24a3
mov dword [rbp - 0x10], 0x2962
mov dword [rbp - 0x1c], 0x2122
mov dword [rbp - 0x14], eax
mov dword [rbp + 0x20], eax
mov dword [rbp - 0xc], 0x2c64
mov dword [rbp - 0x18], 0x2205
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
add ecx, 0x1b6
cmp eax, ecx
jle 0x140011c98
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x14]
add ecx, 0xfffffe41
cmp eax, ecx
jg 0x140011abb
add dword [rbp + 0x20], 0xfffffc62
xor dword [rbp - 0x20], 0xf11
mov ecx, dword [rbp - 0x20]
mov edx, dword [rbp - 0x18]
sub ecx, 0x5e8
mov r8d, dword [rbp + 0x20]
xor edx, 0xb67
mov r9d, dword [rbp - 0x20]
add r8d, 0x100
mov eax, dword [rbp - 0x20]
sub r9d, 0x579
add eax, 0x55a
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call fcn.140011f3c
mov dword [rbp - 0x10], eax
mov ebx, 0x381
mov ecx, dword [rbp - 0x14]
mov edx, dword [rbp - 0x20]
add ecx, 0x267
mov r8d, dword [rbp - 0xc]
xor edx, 0x60f
mov r9d, dword [rbp - 0x1c]
sub r8d, 0x7c1
mov eax, dword [rbp - 0x1c]
add r9d, ebx
add eax, 0xe3
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call fcn.140010d1c
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp - 0x18]
mov dword [rbp - 0x18], eax
add dword [rbp - 0x1c], ebx
add dword [rbp + 0x20], 0x61c
xor dword [rbp - 0x14], 0x300
jmp 0x140011c98
mov eax, dword [rbp - 0x10]
and eax, dword [0x14022e0d0]
mov dword [rbp - 0x18], eax
mov ecx, dword [rbp - 0x18]
mov edx, dword [rbp - 0x18]
mov rax, qword [section..data]
xor ecx, dword [rax + 0x2c]
mov rax, qword [section..data]
xor edx, ecx
mov dword [rax + 0x2c], edx
mov eax, dword [rbp - 0x1c]
mov r8d, dword [rbp + 0x20]
sub eax, 0x2721
movsxd rbx, eax
mov eax, dword [0x14022e0f0]
sub eax, dword [0x14022e118]
imul edx, eax, 0x2191
mov eax, dword [rbp - 0x14]
xor r8d, eax
mov eax, dword [rbp + 0x20]
mov r11d, dword [rbp - 0x18]
mov ecx, dword [0x14022e0b0]
xor r11d, 0x2721
mov r10d, dword [0x14022e014]
sub ecx, eax
sub r11d, dword [0x14022e0ec]
add r10d, 0xffffddfb
add r8d, dword [0x14022e038]
imul r9d, ecx, 0x2c64
mov rcx, rbx
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x14022e0f8]
imul ecx, dword [0x14022e09c]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x20]
or ecx, eax
mov eax, dword [rbp - 0x14]
mov edx, dword [rbp - 0x20]
mov r11d, dword [0x14022e014]
sub edx, eax
mov rax, qword [section..data]
or edx, 0x2721
mov r8d, dword [rax + 0x100]
sub r11d, dword [rax + 0x28]
imul r8d, dword [rax + 0xb4]
mov eax, dword [rbp + 0x20]
and r11d, dword [0x14022e0e4]
imul r10d, eax, 0x281b
mov rax, qword [section..data]
mov r9d, dword [rax + 0x13c]
add r9d, dword [0x14022e04c]
mov dword [rsp + 0x30], r9d
mov r9, rsi
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.1400026dc
mov dword [rbp - 0x10], eax
mov eax, dword [0x14022e118]
xor eax, 0x227e
add dword [rbp - 0xc], eax
mov ebx, dword [rbp + 0x20]
mov eax, dword [rbp - 0x1c]
xor ebx, 0x4a2
mov r11d, dword [rbp - 0x1c]
or ebx, 0x2105
mov r8d, dword [rbp - 0x18]
mov rcx, qword [section..data]
xor r8d, dword [0x14022e128]
imul r8d, dword [0x14022e0a0]
mov edx, dword [rcx + 0xc0]
mov rcx, qword [section..data]
sub edx, eax
mov eax, dword [rbp + 0x20]
add edx, r11d
mov r9d, dword [0x14022e0d0]
mov r10d, dword [rcx + 0xec]
sub r10d, eax
add r10d, 0x2962
mov eax, dword [rbp - 0x10]
add r9d, 0xffffd85d
add eax, dword [0x14022e038]
mov ecx, ebx
imul eax, dword [0x14022e0ac]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r9d
mov r9, rsi
mov dword [rsp + 0x20], r10d
call fcn.1400026dc
mov dword [rbp - 0x1c], eax
mov edx, dword [rbp - 0x10]
mov eax, dword [0x14022e100]
mov ecx, dword [0x14022e158]
and rdx, rax
xor rcx, rdx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor dword [rbp - 0x14], 0xec1
mov ecx, dword [rbp - 0x1c]
mov r8d, dword [rbp + 0x20]
add ecx, 0x4bf
mov r9d, dword [rbp - 0x20]
add r8d, 0x241
mov r10d, dword [rbp - 0x14]
add r9d, 0x258
mov eax, dword [rbp - 0x14]
xor r10d, 0x867
mov rdx, qword [section..data]
xor eax, 0xb67
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.140012dc0
mov dword [rbp - 0x18], eax
mov rdx, rsi
mov ecx, dword [rbp + 0x20]
mov r8d, dword [rbp - 0x18]
xor ecx, 0x624
mov r9d, dword [rbp - 0xc]
xor r8d, 0xdf5
mov eax, dword [rbp - 0x20]
xor r9d, 0xc88
xor eax, 0x574
mov dword [rsp + 0x20], eax
call fcn.1400114b4
mov rcx, qword [0x14022e0d8]
mov dword [rbp - 0x20], eax
mov rax, qword [section..data]
mov qword [rax + 0x58], rcx
add dword [rbp - 0x1c], 0x27e
xor dword [rbp - 0x18], 0x394
mov rdx, qword [0x14022e160]
mov rcx, qword [0x14022e140]
call qword [0x14022e068]
mov dword [0x14022e134], eax
xor dword [rbp + 0x20], 0x55f
add dword [rbp - 0x20], 0x2ac
add dword [rbp + 0x20], 0x59d
add dword [rbp + 0x20], 0xfffff8d1
add dword [rbp - 0x20], 0xa3
add dword [rbp + 0x20], 0x19
add dword [rbp + 0x20], 0x39e
add dword [rbp - 0x14], 0x302
mov ecx, dword [0x14022e134]
call qword [sym.imp.KERNEL32.dll_ExitProcess]