Function at 0x140001040
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov dword [rbp - 0x30], 0x4121113
xor eax, eax
mov word [rbp - 0x2c], 0x18
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x2a], 0xa8
lea edi, [rbx + 1]
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x13
jb 0x14000108a
xor eax, eax
mov dword [rbp - 0x30], 0xd4c2c1c3
mov qword [rbp - 0x19], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x2c], 0xd0d8
mov byte [rbp - 0x2a], 0x48
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x1f
jb 0x1400010d1
xor eax, eax
mov dword [rbp - 0x30], 0x8a808583
mov qword [rbp - 0x29], rax
mov byte [rbp - 0x21], al
mov word [rbp - 0x2c], 0x928a
mov byte [rbp - 0x2a], 0x36
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x140001114
xor eax, eax
mov dword [rbp - 0x30], 0x90aaada3
mov qword [rbp - 0x29], rax
mov word [rbp - 0x21], ax
mov word [rbp - 0x2c], 0x9494
mov byte [rbp - 0x2a], 0x3c
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x11
jb 0x140001158
xor eax, eax
mov dword [rbp - 0x30], 0x9a94999b
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], al
mov word [rbp - 0x2c], 0x9a92
mov byte [rbp - 0x2a], 0x26
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x14
jb 0x14000119e
xor eax, eax
mov dword [rbp - 0x30], 0x100a0d03
mov qword [rbp - 0x19], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x2c], 0x1414
mov byte [rbp - 0x2a], 0xbc
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x1f
jb 0x1400011e5
xor eax, eax
mov dword [rbp - 0x30], 0xe2e8d5eb
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
mov word [rbp - 0x2c], 0xeae2
mov byte [rbp - 0x2a], 0x56
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x13
jb 0x140001228
lea rax, section..text
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
js 0x1400018e8
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [0x140005004]
test ecx, ecx
je 0x1400018c0
mov r10d, 2
lea r9, [0x140005090]
lea r11d, [r10 + 6]
cmp ecx, edi
jne 0x140001309
xor eax, eax
mov dword [0x140005088], ebx
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], al
mov dword [0x14000508c], ebx
mov dword [0x14000ecd0], ebx
mov dword [rbp - 0x30], 0x44525153
mov word [rbp - 0x2c], 0x4058
mov byte [rbp - 0x2a], 0x28
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x14
jb 0x1400012dd
mov ecx, r10d
mov dword [0x140005004], ecx
jmp 0x1400012a2
cmp ecx, r10d
jne 0x140001376
mov eax, dword [section..data]
cmp dword [0x140005088], eax
jg 0x140001821
xor eax, eax
mov dword [0x140005004], 4
mov qword [rbp - 0x29], rax
mov word [rbp - 0x21], ax
mov byte [rbp - 0x1f], al
mov dword [rbp - 0x30], 0x2a202523
mov word [rbp - 0x2c], 0x122a
mov byte [rbp - 0x2a], 0xb6
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x12
jb 0x140001350
jmp 0x1400018b2
cmp ecx, 3
jne 0x140001404
mov r8d, dword [0x14000ecd0]
mov eax, 0x51eb851f
add r8d, dword [0x140005088]
xorps xmm0, xmm0
add r8d, r8d
mov dword [0x140005004], 0xc
imul r8d
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x30], 0x8af0f5f3
sar edx, 5
mov eax, edx
mov word [rbp - 0x2c], 0x828a
shr eax, 0x1f
add edx, eax
mov byte [rbp - 0x2a], 0x66
imul eax, edx, 0x64
sub r8d, eax
xor eax, eax
mov dword [0x14000ecd0], r8d
mov byte [rbp - 0x19], al
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x18
jb 0x1400013de
jmp 0x1400018b2
cmp ecx, 4
jne 0x140001422
mov eax, dword [0x140005088]
mov ecx, ebx
cmp dword [0x14000508c], eax
setl cl
add ecx, 5
jmp 0x140001301
cmp ecx, 5
jne 0x14000144b
movsxd rcx, dword [0x140005088]
mov edx, dword [0x14000ecd0]
add edx, ecx
imul rcx, rcx, 0x194
mov dword [rcx + r9], edx
mov ecx, 9
jmp 0x140001301
cmp ecx, 6
jne 0x1400014bf
mov eax, dword [0x14000508c]
and eax, 0x80000001
jge 0x140001464
sub eax, edi
or eax, 0xfffffffe
add eax, edi
test eax, eax
jne 0x1400014b5
xorps xmm0, xmm0
mov dword [0x140005004], r11d
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x30], 0x808a8d93
mov word [rbp - 0x2c], 0x8484
mov byte [rbp - 0x2a], 0x7c
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x17
jb 0x14000148f
jmp 0x1400018b2
mov ecx, 7
jmp 0x140001301
cmp ecx, 7
jne 0x1400014f3
movsxd rax, dword [0x140005088]
movsxd rdx, dword [0x14000508c]
mov r8d, eax
sub r8d, edx
imul r8d, dword [0x14000ecd0]
imul rcx, rax, 0x64
add rcx, rdx
mov dword [r9 + rcx*4], r8d
mov ecx, r11d
jmp 0x140001301
cmp ecx, r11d
jne 0x140001609
xor eax, eax
mov dword [rbp - 0x30], 0xe4d2d1d3
mov qword [rbp - 0x19], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x2c], 0xe0d8
mov byte [rbp - 0x2a], 0x48
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x1f
jb 0x140001522
xor eax, eax
mov dword [rbp - 0x30], 0xd0cacdc3
mov byte [rbp - 0x19], al
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x2c], 0xd4d4
mov byte [rbp - 0x2a], 0xbc
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x18
jb 0x140001568
mov eax, dword [0x14000508c]
add eax, edi
add dword [0x14000ecd0], eax
cmp eax, dword [0x140005088]
mov dword [0x14000508c], eax
jge 0x1400015fa
xor eax, eax
mov dword [0x140005004], 6
mov dword [rbp - 0x19], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x30], 0x78020d0b
mov word [rbp - 0x2c], 0x7404
mov byte [rbp - 0x2a], 0x9c
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x1b
jb 0x1400015d4
jmp 0x1400018b2
mov dword [0x140005004], 4
jmp 0x1400018b2
cmp ecx, 9
jne 0x14000172d
mov edx, dword [0x14000ecd0]
mov eax, edx
and eax, 0x80000001
jge 0x140001628
sub eax, edi
or eax, 0xfffffffe
add eax, edi
movsxd rcx, dword [0x140005088]
imul r8, rcx, 0x194
inc ecx
test eax, eax
mov eax, edx
cdq
jne 0x14000168a
idiv ecx
mov dword [rbp - 0x30], 0xf8e2edeb
add dword [r8 + r9], eax
xor eax, eax
mov word [rbp - 0x2c], 0xf4e4
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x2a], 0x9c
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x13
jb 0x140001667
jmp 0x1400016d4
idiv ecx
mov dword [rbp - 0x30], 0xa000503
sub dword [r8 + r9], eax
xor eax, eax
mov word [rbp - 0x2c], 0x120a
mov qword [rbp - 0x29], rax
mov word [rbp - 0x21], ax
mov byte [rbp - 0x2a], 0xb6
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x11
jb 0x1400016b3
xor eax, eax
mov dword [0x140005004], 0xa
mov dword [rbp - 0x19], eax
xorps xmm0, xmm0
mov word [rbp - 0x15], ax
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x30], 0x78424d4b
mov word [rbp - 0x2c], 0x7444
mov byte [rbp - 0x2a], 0xdc
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x1d
jb 0x140001707
jmp 0x1400018b2
cmp ecx, 0xa
jne 0x1400017ad
mov eax, dword [0x140005088]
add eax, edi
add dword [0x14000ecd0], eax
cmp eax, dword [section..data]
mov dword [0x140005088], eax
jg 0x14000179d
xor eax, eax
mov dword [rbp - 0x30], 0x43a393b
mov word [rbp - 0x19], ax
xorps xmm0, xmm0
mov byte [rbp - 0x17], al
movups xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x2c], 0x800
mov byte [rbp - 0x2a], 0xb0
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x1a
jb 0x140001777
mov eax, r10d
jmp 0x1400017a2
mov eax, 0xb
mov dword [0x140005004], eax
jmp 0x1400018b2
cmp ecx, 0xb
jne 0x14000182b
movsxd rax, dword [section..data]
xorps xmm0, xmm0
mov edx, dword [0x14000508c]
add edx, dword [0x140005088]
imul edx, dword [0x14000ecd0]
imul rcx, rax, 0x194
movups xmmword [rbp - 0x29], xmm0
xor eax, eax
mov dword [rbp - 0x30], 0x5a64999b
mov dword [rbp - 0x19], eax
mov word [rbp - 0x15], ax
mov word [rbp - 0x2c], 0x5a62
mov dword [rcx + r9], edx
mov byte [rbp - 0x2a], 0xf6
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x1d
jb 0x140001800
mov ecx, 3
jmp 0x140001301
cmp ecx, 0xc
jne 0x1400018a7
movsxd rax, dword [0x140005088]
movsxd rdx, dword [0x14000508c]
imul rcx, rax, 0x64
lea r8d, [rdx + rax]
mov dword [0x140005004], 0xd
imul r8d, dword [0x14000ecd0]
add rcx, rdx
xor eax, eax
mov dword [rbp - 0x30], 0xb8b2cdcb
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], al
mov dword [r9 + rcx*4], r8d
mov word [rbp - 0x2c], 0xa4b4
mov byte [rbp - 0x2a], 0x5c
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov rax, qword [rbp - 0x40]
add rax, rdi
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0x14
jb 0x140001884
jmp 0x1400018b2
cmp ecx, 0xd
jne 0x1400018b2
mov dword [0x140005004], ebx
mov ecx, dword [0x140005004]
test ecx, ecx
jne 0x1400012a2
call fcn.140002cf4
call fcn.140002c24
call fcn.14000190c
test eax, eax
js 0x1400018e8
call fcn.140001ee8
test eax, eax
js 0x1400018e8
call fcn.1400025ec
test eax, eax
cmovs ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400035b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret