Function at 0x140009050
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0xec8
mov r14, rcx
mov rdx, r14
lea rcx, [rsp + 0xc60]
call fcn.1400098d0
xor r12d, r12d
cmp byte [rsp + 0xc77], 0
seta r12b
test r12d, r12d
jne 0x1400096d6
mov dword [rsp + 0xc58], 0
lea rcx, [rsp + 0xc30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r8d, dword [rsp + 0xc7c]
xor eax, eax
shl r8d, 0x15
xor r13d, r13d
movzx r10d, byte [rsp + 0xc78]
add r8d, 0x200000
inc r10d
mov ebp, r10d
lea rbx, [rsp + 0xc30]
mov qword [rbx + 0x220], rbp
xor ebp, ebp
mov dword [rbx + 0x228], r8d
mov dword [rbx + 0x230], r10d
mov qword [rbx + 0x208], r14
mov r14, rax
test r12d, r12d
jne 0x14000915c
mov r8d, 6
lea rdx, [rsp + 0xe32]
mov rcx, qword [rdx + 6]
call fcn.14000a460
test eax, eax
jl 0x140009771
mov esi, dword [rsp + 0xe34]
mov rcx, rsi
movzx r15d, word [rsp + 0xe32]
shl r15d, 0x10
call fcn.1400099d0
mov rdx, rax
mov r8, rsi
mov rcx, qword [rsp + 0xe38]
mov qword [rsp + r13 + 0xd0], rax
call fcn.14000a460
test eax, eax
jl 0x140009771
jmp 0x14000917a
mov ecx, 0x1000
call fcn.140009ff0
mov qword [rsp + r13 + 0xd0], rax
mov qword [rsp + r13 + 0xe0], 0x1000
xor ecx, ecx
xor edx, edx
mov edi, dword [rsp + 0xe60]
xor r8d, r8d
xor r9d, r9d
mov esi, r14d
mov qword [rsp + r13 + 0x30], rbx
mov dword [rsp + r13 + 0x38], esi
mov dword [rsp + r13 + 0x3c], edi
mov dword [rsp + r13 + 0x58], 0
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + r13 + 0x60], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, r15d
xor r9b, r9b
mov qword [rsp + r14*8 + 0xdb0], rax
lea rcx, [rsp + r13 + 0x74]
mov qword [rcx - 0xc], rax
lea rax, [rsp + r13 + 0x70]
mov qword [rax - 0x28], 0
lea r8, [rsp + r13 + 0x80]
mov dword [rax - 0x20], 0
lea r10, [rsp + r13 + 0x98]
mov dword [rax - 0x1c], esi
lea r11, [rsp + r13 + 0x88]
mov qword [rsp + 0xe78], r13
lea rsi, [rdx - 1]
mov qword [rsp + 0xe88], rsi
lea rdi, [rsp + r13 + 0x90]
mov qword [rsp + 0xea0], r11
mov rsi, rbp
mov qword [rsp + 0xe98], r10
mov qword [rsp + 0xeb0], r8
mov qword [rsp + 0xea8], rcx
mov qword [rsp + 0xe90], rax
mov qword [rsp + 0xe70], r14
mov r14, rdx
mov dword [rsp + 0xe68], r15d
mov r15b, r9b
mov r13d, dword [rsp + 0xe58]
mov rax, qword [rsp + 0xe90]
lea rcx, [rsp + 0xc30]
mov rbx, qword [rcx + 0x278]
mov rbp, qword [rcx + 0x280]
mov r8, qword [rcx + 0x268]
mov dword [rsi + rax], 0
mov dword [rsi + rbx], 0xffffffff
mov dword [rsi + rbp], r13d
mov qword [rsi + rdi], 0
mov qword [rsi + r8], r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsp + 0xe80], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
lea r8, [rsp + 0xe80]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ecx, ecx
lea rdx, [0x140008054]
lea r8, [rsp + 0xe44]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rbx, rsp
xor edx, edx
mov rcx, qword [rsp + 0xe80]
lea r8, [rsp + 0xe40]
mov r9d, 0x10
xor eax, eax
mov dword [r8], 1
mov dword [r8 + 0xc], 2
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0xe80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000806c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x14000807c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400093ba
call rax
mov rbp, rax
test rbp, rbp
je 0x1400093ba
cmp r14, rbp
jb 0x1400093ba
test r14, r14
je 0x1400096ce
cmp rbp, 1
jbe 0x1400096ce
xor edx, edx
mov rax, qword [rsp + 0xe88]
div rbp
mov rbx, rax
imul rbx, rbp
add rbx, rbp
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x20003000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rbp, rbp
jne 0x14000968d
xor ecx, ecx
mov rdx, r14
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
lea rcx, [rsp + 0xc30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0xea0]
mov qword [rsi + rax], rbp
test r12d, r12d
jne 0x140009404
inc r15b
add rsi, 0x30
cmp r15b, 2
jl 0x14000926c
mov dword [rsp + 0xe58], r13d
xor ebp, ebp
mov r13, qword [rsp + 0xe78]
lea rbx, [rsp + 0xc30]
mov r14, qword [rbx + 0x240]
mov r15d, dword [rbx + 0x238]
mov rdi, rsp
xor ecx, ecx
xor edx, edx
lea r9, [rsp + r13 + 0x30]
lea r8, [0x14000a710]
lea rsi, [rsp + 0xeb8]
mov dword [rdi + 0x20], 0
mov qword [rdi + 0x28], rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
mov qword [rsp + r13 + 0xe8], rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc r14
add r13, 0xc0
cmp r14, qword [rsp + 0xe50]
jl 0x1400090f7
mov rbp, qword [rsp + 0xe50]
mov r14, qword [rsp + 0xe38]
test r12d, r12d
jne 0x14000966b
mov r9, r14
lea rcx, [rsp + 0xc30]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0xdb0]
call fcn.140009a00
mov r13d, eax
xor r14d, r14d
xor r15d, r15d
xor esi, esi
lea rbx, [rsp + 0xc30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rsp + r15 + 0x50], 2
je 0x140009521
mov rcx, rbx
mov dword [rsp + r15 + 0x50], 2
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + r15 + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsp + r14*8 + 0xdb0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rsp + r15 + 0x50], 2
jne 0x1400094e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + r15 + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsp + r14*8 + 0xdb0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rsp + r15 + 0x58]
test edx, edx
jl 0x140009663
mov rdi, qword [rsp + r15 + 0xd0]
test rdi, rdi
je 0x140009576
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + r15 + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + r15 + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8b, r8b
lea rcx, [rsp + r15 + 0x90]
mov qword [rsp + 0xe58], r14
lea rdx, [rsp + r15 + 0x98]
mov qword [rsp + 0xe38], r15
lea rax, [rsp + r15 + 0x88]
mov qword [rsp + 0xe50], rbp
mov rdi, rsi
mov rbx, rax
mov r15, rdx
mov r14, rcx
mov bpl, r8b
mov qword [rdi + r14], rsi
mov qword [rdi + r15], rsi
mov rcx, qword [rdi + rbx]
test rcx, rcx
je 0x1400095ed
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r12d, r12d
jne 0x1400095ff
inc bpl
add rdi, 0x30
cmp bpl, 2
jl 0x1400095ce
mov r14, qword [rsp + 0xe58]
lea rbx, [rsp + 0xc30]
mov r15, qword [rbx + 0x208]
mov rbp, qword [rbx + 0x220]
mov rcx, qword [rsp + r15 + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r14
add r15, 0xc0
cmp r14, rbp
jl 0x1400094cf
lea rcx, [rsp + 0xc30]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, r13d
add rsp, 0xec8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r13d, edx
jmp 0x140009555
mov r9, r14
lea rcx, [rsp + 0xc30]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0xdb0]
call fcn.14000a110
jmp 0x1400094bc
lea rcx, [0x140008090]
call fcn.140009790
lea rcx, [0x140008048]
call fcn.140009790
lea rcx, [0x1400080a8]
call fcn.140009790
shr rbx, 0xa
mov rcx, rbx
call fcn.1400097e0
lea rcx, [0x1400080ac]
call fcn.140009790
jmp 0x1400093d4
mov rbx, r14
jmp 0x140009397
mov rcx, r14
lea rdx, [0x1400080fc]
lea r8, [0x14000810c]
call fcn.14000a010
mov ebp, eax
mov rcx, r14
lea rdx, [0x140008110]
mov r8d, 0x2000000
lea r9, [0x14000810c]
call fcn.140008cf0
mov r13, rax
mov rcx, r14
lea rdx, [rsp + 0xe30]
mov r8d, 2
call fcn.14000a460
test eax, eax
jl 0x140009771
movzx r15d, word [rsp + 0xe30]
lea rcx, [rsp + 0xc60]
shl r15d, 0x10
call fcn.14000a0a0
mov r8d, eax
xor edx, edx
add r8, r15
mov rax, r13
div r8
cmp eax, ebp
cmovb ebp, eax
mov r10d, 1
cmp ebp, 1
cmova r10d, ebp
dec r10d
mov byte [rsp + 0xc78], r10b
jmp 0x14000908e
add rsp, 0xec8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret