Function at 0x1400a7220
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, rdx
test rcx, rcx
je 0x1400a7263
movzx eax, word [rcx]
mov word [rsp + 0x68], ax
add ax, 2
mov word [rsp + 0x6a], ax
mov rax, qword [rcx + 8]
jmp 0x1400a7272
mov dword [rsp + 0x68], 0x3e003c
lea rax, str.BaseNamedObjectsSiSvcApiPort
mov qword [rsp + 0x70], rax
call fcn.140182ac0
mov edx, 4
mov rdi, rax
movzx ecx, byte [rax + 1]
lea ebx, [rcx*4 + 0x5c]
mov rcx, qword [0x1402bfe50]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, rax
mov edx, 1
mov rbp, rax
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
lea edx, ds:[rbx - 0x28]
mov ebx, 2
mov r8d, ebx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
mov r9, rdi
lea rcx, [rbp + 0x28]
mov r8d, 0x1f0001
mov edx, ebx
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea r9, [0x14023dce0]
mov edx, ebx
lea r8d, [rbx - 1]
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
xor r9d, r9d
lea r8, [rbp + 0x28]
mov dl, 1
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
xor ecx, ecx
mov dword [rsp + 0x30], 0x30
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea r8d, [rbx + 2]
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x30]
lea rcx, [0x1402c4ce8]
mov dword [rsp + 0x48], 0x40
mov r9d, 0xb0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbp
call qword [sym.imp.ntdll.dll_NtCreatePort]
mov rcx, qword [0x1402bfe50]
mov r8, rbp
xor edx, edx
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
jns 0x1400a7374
lfence
mov eax, edi
jmp 0x1400a7492
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1402c4ce0], eax
xor edx, edx
lea rcx, [0x1400a6a40]
call sym.SystemInformer.exe_PhCreateThread2
sub rbx, 1
jne 0x1400a7380
lea r9d, [rbx + 1]
mov byte [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [0x1402bedf0]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
jns 0x1400a73be
lfence
jmp 0x1400a7492
mov r9d, 1
mov byte [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [0x1402bede8]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
mov ebx, eax
test eax, eax
jns 0x1400a73f9
lfence
mov rcx, qword [0x1402bedf0]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x1400a7490
test r14, r14
je 0x1400a7423
mov rax, qword [0x1402bedf0]
mov qword [r14 + 8], rax
mov rax, qword [0x1402bede8]
mov qword [r14 + 0x10], rax
lock or dword [rsp], 0
cmp byte [r14], 0
je 0x1400a7423
xor eax, eax
jmp 0x1400a7492
mov rcx, qword [0x1402bedf0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test r14, r14
je 0x1400a7469
cmp byte ds:[r14], 0
jne 0x1400a7490
mov rcx, qword [0x1402bede8]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x60], 0xfffffffffa0a1f00
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp byte [r14], 0
mov ebx, eax
jne 0x1400a7490
jmp 0x1400a7488
mov rcx, qword [0x1402bede8]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x60], 0xfffffffffa0a1f00
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ebx, eax
cmp ebx, 0x102
jne 0x1400a7423
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401dd6a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret