Function at 0x1400b7e5c
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf8
xor r11d, r11d
mov eax, 0x400000
mov r15, rcx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x80], rax
mov ax, word [rdx]
lea ebp, [r11 + 9]
mov ebx, r11d
mov qword [rsp + 0x38], rdx
mov r12d, r11d
mov r8d, r11d
mov dword [rsp + 0x30], r11d
mov r14d, r11d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x158], ebx
mov dword [rsp + 0x50], r11d
mov edi, r11d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x64], r11d
mov r9d, r11d
mov dword [rsp + 0x34], r11d
movzx r13d, r11w
lea esi, [rbp + 0x21]
lea r10d, [r11 + 1]
cmp ax, r11w
je 0x1400b7f71
lea edi, [rbp + 0x17]
cmp bp, ax
ja 0x1400b7efa
cmp ax, 0xd
jbe 0x1400b7f62
cmp di, ax
je 0x1400b7f62
mov ecx, 0x24
cmp cx, ax
jne 0x1400b7f0e
mov r12d, r10d
jmp 0x1400b7f50
cmp si, ax
jne 0x1400b7f1c
movsx r14d, byte [rdx]
mov ebx, r11d
jmp 0x1400b7f50
mov ecx, 0x2b
cmp cx, ax
jne 0x1400b7f2e
movsx ebx, byte [rdx]
mov r14d, r11d
jmp 0x1400b7f50
mov ecx, 0x26
cmp cx, ax
jne 0x1400b7f3f
mov dword [rsp + 0x50], r10d
jmp 0x1400b7f50
mov ecx, 0x23
cmp cx, ax
jne 0x1400b7f50
movsx eax, byte [rdx]
mov dword [rsp + 0x64], eax
add rdx, 2
mov qword [rsp + 0x38], rdx
mov ax, word [rdx]
cmp ax, r11w
jne 0x1400b7eef
mov dword [rsp + 0x158], ebx
mov dword [rsp + 0x48], r14d
mov edi, r8d
lea rax, str.__LastTID
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x88], r11
mov qword [rsp + 0x90], rax
call fcn.1400598f0
mov rbp, qword [rsp + 0x38]
mov ecx, 0x2d
cmp cx, word [rbp]
movzx eax, sil
mov dword [rsp + 0x60], 0x80000000
cmove eax, ecx
mov qword [rsp + 0x148], rbp
movsx esi, al
movzx eax, word [rbp]
cmp esi, eax
jne 0x1400b8308
lea r15d, [rcx - 0xd]
mov ebx, 5
lea rdx, [rsp + 0x38]
lea rcx, [0x14011b0c0]
mov r8d, ebx
call fcn.140064d6c
xor r11d, r11d
cmp al, r11b
je 0x1400b8006
lea r10d, [rbx - 4]
mov r8d, r10d
mov dword [rsp + 0x30], r10d
jmp 0x1400b82df
lea rdx, [rsp + 0x38]
lea rcx, str._waitx
mov r8d, 6
call fcn.140064d6c
xor r11d, r11d
cmp al, r11b
je 0x1400b8033
lea r8d, [r11 + 2]
mov dword [rsp + 0x30], r8d
jmp 0x1400b82d9
lea rdx, [rsp + 0x38]
lea rcx, str._here
mov r8d, ebx
call fcn.140064d6c
xor r11d, r11d
cmp al, r11b
je 0x1400b805c
bts edi, 8
mov dword [rsp + 0x40], edi
jmp 0x1400b82d4
lea rdx, [rsp + 0x38]
lea rcx, [0x14011ce50]
mov r8d, 6
call fcn.140064d6c
xor r11d, r11d
cmp al, r11b
je 0x1400b8089
mov eax, 0x200
or r13w, ax
jmp 0x1400b82d4
lea rdx, [rsp + 0x38]
lea rcx, str._waitp
mov r8d, 6
call fcn.140064d6c
xor r11d, r11d
cmp al, r11b
je 0x1400b80c1
mov r8d, dword [rsp + 0x30]
mov r9d, 0x400
lea r10d, [r11 + 1]
mov dword [rsp + 0x34], r9d
jmp 0x1400b82e4
lea rdx, [rsp + 0x38]
lea rcx, str._idle
mov r8d, ebx
call fcn.140064d6c
xor r11d, r11d
cmp al, r11b
je 0x1400b80ea
mov dword [rsp + 0x60], 0xfffffff1
jmp 0x1400b82d4
lea rdx, [rsp + 0x38]
lea rcx, [0x14012482c]
mov r8d, 4
call fcn.140064d6c
xor r11d, r11d
cmp al, r11b
je 0x1400b811a
mov r8d, dword [rsp + 0x30]
lea r10d, [r11 + 1]
mov r12d, r10d
jmp 0x1400b82df
lea rdx, [rsp + 0x38]
lea rcx, str._link
mov r8d, ebx
call fcn.140064d6c
xor r11d, r11d
cmp al, r11b
je 0x1400b8157
mov r8d, dword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov ebx, r11d
mov dword [rsp + 0x158], ebx
lea r14d, [r11 + 0x2a]
lea r10d, [r11 + 1]
jmp 0x1400b82eb
mov rbx, qword [rsp + 0x38]
lea rcx, str.tid:
mov r8d, 4
lea rdx, [rbx + 2]
call fcn.14005af04
cmp al, r11b
je 0x1400b8215
mov rdi, rbx
add rbx, 0xa
movzx eax, word [rbx]
mov qword [rsp + 0x38], rbx
mov rdx, rbx
cmp ax, r11w
je 0x1400b81bb
mov ecx, 9
cmp cx, ax
ja 0x1400b81a3
cmp ax, 0xd
jbe 0x1400b81bb
cmp r15w, ax
je 0x1400b81bb
add rbx, 2
mov qword [rsp + 0x38], rbx
mov ax, word [rbx]
cmp ax, r11w
jne 0x1400b8198
mov r8, rbx
lea rcx, [rsp + 0x58]
sub r8, rdx
sar r8, 1
call fcn.14006245c
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x90], rax
mov r10d, 1
cmp rdi, rbx
jae 0x1400b81fa
sub rbx, rdi
movzx eax, r15w
sub rbx, r10
shr rbx, 1
lea rcx, [r10 + rbx]
rep stosw word [rdi], ax
lea rcx, [rsp + 0x38]
call fcn.1400598f0
mov edi, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x30]
xor r11d, r11d
jmp 0x1400b82df
lea rdx, [rbx + 2]
lea rcx, str.htid:
mov r8d, 5
call fcn.14005af04
cmp al, r11b
je 0x1400b8295
mov rdi, rbx
add rbx, 0xc
movzx eax, word [rbx]
mov qword [rsp + 0x38], rbx
mov rdx, rbx
cmp ax, r11w
je 0x1400b8270
mov ecx, 9
cmp cx, ax
ja 0x1400b8258
cmp ax, 0xd
jbe 0x1400b8270
cmp r15w, ax
je 0x1400b8270
add rbx, 2
mov qword [rsp + 0x38], rbx
mov ax, word [rbx]
cmp ax, r11w
jne 0x1400b824d
mov r8, rbx
lea rcx, [rsp + 0x70]
sub r8, rdx
sar r8, 1
call fcn.14006245c
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x88], rax
jmp 0x1400b81db
movzx eax, word [rbx]
cmp ax, r11w
je 0x1400b82c6
mov ecx, 9
cmp cx, ax
ja 0x1400b82ae
cmp ax, 0xd
jbe 0x1400b82c6
cmp r15w, ax
je 0x1400b82c6
add rbx, 2
mov qword [rsp + 0x38], rbx
mov ax, word [rbx]
cmp ax, r11w
jne 0x1400b82a3
lea rcx, [rsp + 0x38]
call fcn.1400598f0
mov edi, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x30]
mov r10d, 1
mov r9d, dword [rsp + 0x34]
mov ebx, dword [rsp + 0x158]
mov rax, qword [rsp + 0x38]
movzx ecx, word [rax]
cmp esi, ecx
je 0x1400b7fd4
mov r15, qword [rsp + 0x140]
mov dword [rsp + 0x48], r14d
cmp ebx, r11d
jne 0x1400b8312
cmp r8d, r11d
je 0x1400b831a
mov r9d, r11d
mov dword [rsp + 0x34], r11d
movsx r13d, r13w
lea rcx, [rsp + 0x38]
or r13d, r9d
or r13d, edi
or r13d, dword [rsp + 0x50]
call fcn.1400598f0
mov rcx, qword [rsp + 0x38]
cmp word [rcx], r11w
jne 0x1400b835e
lea rcx, [rsp + 0x70]
call fcn.140059920
lea rcx, [rsp + 0x58]
call fcn.140059920
mov rax, 0xffffffff80070057
jmp 0x1400b88d7
mov qword [rsp + 0x68], r11
cmp r12d, r11d
je 0x1400b8390
lea r8, [rsp + 0x68]
xor r9d, r9d
mov rdx, rbp
mov rcx, r15
mov byte [rsp + 0x20], r10b
call fcn.140077e38
mov rdx, qword [rsp + 0x68]
xor r11d, r11d
mov qword [rsp + 0x148], rdx
lea rcx, [rsp + 0x148]
call fcn.1400598f0
mov rbp, qword [rsp + 0x148]
mov di, word [rbp]
mov qword [rsp + 0x38], rbp
cmp di, r11w
jne 0x1400b83c0
mov rdi, 0xffffffff80070057
jmp 0x1400b88b6
movzx ebx, di
cmp esi, ebx
jne 0x1400b8485
movzx eax, word [rbp + 2]
cmp esi, eax
jne 0x1400b8430
lea rdx, [rbp + 4]
lea rcx, [0x140124810]
mov r8d, 3
call fcn.14005af04
cmp al, r11b
je 0x1400b8430
lea rax, [rbp + 0xa]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
call fcn.140069334
mov rax, qword [rsp + 0x80]
add rax, 0x1fff
and rax, 0xffffffffffffe000
xor r11d, r11d
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x80], rax
cmp esi, ebx
jne 0x1400b8485
cmp di, r11w
je 0x1400b8468
mov eax, 0x20
lea ecx, [rax - 0x17]
cmp cx, di
ja 0x1400b844d
cmp di, 0xd
jbe 0x1400b8460
cmp ax, di
je 0x1400b8460
add rbp, 2
mov di, word [rbp]
cmp di, r11w
jne 0x1400b8442
mov qword [rsp + 0x148], rbp
lea rcx, [rsp + 0x148]
call fcn.1400598f0
mov rbp, qword [rsp + 0x148]
movzx edi, word [rbp]
cmp esi, edi
je 0x1400b8434
cmp r14d, r11d
je 0x1400b8490
mov r14, qword [r15 + 0x40]
jmp 0x1400b8493
mov r14, r11
mov ecx, 8
call fcn.1400fded8
mov rsi, rax
test rax, rax
je 0x1400b84e0
mov rdi, qword [r15 + 0x78]
and qword [rax], 0
test rdi, rdi
je 0x1400b84e2
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [rdi]
test r11, r11
je 0x1400b84d1
inc dword [r11 + 8]
mov rax, qword [rdi]
mov qword [rsi], rax
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400b84e2
xor esi, esi
mov r12, qword [r15 + 0x80]
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0xa0], rsi
call fcn.1400fded8
mov rbx, rax
test rax, rax
je 0x1400b851f
mov rdx, r15
mov rcx, rax
call fcn.140017c98
mov rdx, r15
mov rcx, rbx
call fcn.140018678
mov qword [rbx + 0x40], r14
jmp 0x1400b8521
xor ebx, ebx
cmp dword [rsp + 0x40], 0
mov qword [rsp + 0xa8], rbx
lea rdi, [0x1401370d0]
jne 0x1400b8547
mov byte [rbx + 0xd9], 1
test r14, r14
jne 0x1400b8547
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x80], r12
mov rdx, qword [rsp + 0x68]
xor r8d, r8d
mov rcx, rbx
call fcn.140071a2c
mov r12d, dword [rsp + 0x40]
mov qword [rbx + 0x78], rsi
test r12d, r12d
je 0x1400b8571
mov rdi, r15
jmp 0x1400b8581
test r14, r14
je 0x1400b8581
mov rdi, qword [r14 + 0x278]
mov qword [rbx + 0x38], rdi
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test r12d, r12d
mov r12d, dword [rsp + 0x48]
jne 0x1400b85d3
test r12d, r12d
je 0x1400b85d3
cmp dword [rsp + 0x30], 0
je 0x1400b85d3
mov rax, r15
mov edx, 0x7fffd
test rax, rax
je 0x1400b85d3
mov cl, byte [rax + 0xd9]
test cl, 1
je 0x1400b85c1
test cl, 0x42
jne 0x1400b85cc
sub edx, 1
mov rax, qword [rax + 0x38]
js 0x1400b85d3
jmp 0x1400b85ac
mov qword [rbx + 0x38], rax
mov rdi, rax
mov r8, rdi
mov rdx, r15
mov rcx, rbx
call fcn.14005c8e4
mov edi, dword [rsp + 0x50]
test edi, edi
je 0x1400b85f6
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140079b80
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov cl, byte [r15 + 0xda]
mov byte [rbx + 0xda], cl
mov al, byte [r15 + 0xd]
mov byte [rbx + 0xd], al
test edi, edi
je 0x1400b861f
mov byte [rbx + 0xd], 1
lea rcx, [rsp + 0x78]
mov rdx, rbp
call fcn.14006e2a8
lea rcx, [rsp + 0x48]
mov edx, 0x88
call fcn.140061f7c
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.140059884
mov r11, qword [rsp + 0x78]
mov rax, qword [rsp + 0x150]
mov qword [rdi + 8], r11
xor edx, edx
movsxd rcx, r13d
mov qword [rdi + 0x10], rdx
mov qword [rdi + 0x18], 4
mov qword [rdi + 0x20], rdx
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rdx
mov qword [rdi + 0x38], r14
movsxd rax, r12d
mov r13d, edx
mov r12b, dl
mov qword [rdi + 0x40], rax
movsxd rax, dword [rsp + 0x158]
lea r8, [0x1400b7a84]
mov qword [rdi + 0x48], rax
movsxd rax, dword [rsp + 0x50]
mov r9, rdi
or rcx, rax
movsxd rax, dword [rsp + 0x64]
mov qword [rdi + 0x50], rcx
mov qword [rdi + 0x58], rax
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x68], rbx
mov qword [rdi + 0x70], r14
mov qword [rdi + 0x78], r14
mov dword [rsp + 0x44], edx
mov rdx, qword [rsp + 0x98]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0x10004
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x1400b87ab
cmp dword [rsp + 0x40], r13d
je 0x1400b8702
cmp dword [rsp + 0x30], r13d
jne 0x1400b8714
test r14, r14
je 0x1400b8714
mov rcx, r14
call fcn.140059ef8
xor r14d, r14d
jmp 0x1400b871a
xor r14d, r14d
mov rax, r14
mov qword [rdi + 0x30], rax
mov eax, dword [rsp + 0x44]
lea rcx, [0x140138118]
mov qword [rdi + 0x20], rax
mov qword [rdi], r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, 1
cmp dword [rsp + 0x158], r14d
jne 0x1400b8758
add dword [0x1401377a0], edi
cmp dword [rsp + 0x34], r14d
je 0x1400b8758
add dword [0x1401377a4], edi
movzx eax, byte [0x140136cb1]
mov ecx, eax
cmp al, r14b
cmove ecx, edi
mov byte [0x140136cb1], cl
lea rcx, [0x140138118]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0x60]
cmp eax, 0x80000000
je 0x1400b8790
mov edx, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x48], r14
mov rsi, r14
mov rbx, r14
jmp 0x1400b87c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r14d, r14d
lea edi, [r14 + 1]
mov r13d, eax
cmp eax, r14d
cmove r13d, edi
cmp qword [rsp + 0x58], r14
je 0x1400b87dd
mov r8, qword [rsp + 0x90]
mov edx, dword [rsp + 0x44]
mov rcx, r15
call fcn.140065544
mov edx, dword [rsp + 0x44]
lea r8, str.__LastTID
mov rcx, r15
call fcn.140065544
mov rax, qword [rsp + 0x88]
cmp rax, r14
je 0x1400b881c
cmp word [rax], r14w
je 0x1400b881c
mov r8, rax
mov rdx, rbp
mov rcx, r15
call fcn.14003f380
movzx r12d, r12b
cmp rax, r14
cmovne r12d, edi
cmp rbp, r14
je 0x1400b882f
cmp r12b, r14b
jne 0x1400b882f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x30], r14d
je 0x1400b886a
cmp rbp, r14
je 0x1400b886a
mov r8d, dword [rsp + 0x44]
cmp r8d, r14d
je 0x1400b886a
lea rdx, str.__ncd__u
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0xb0]
mov rcx, r15
call fcn.14003ddf4
lea rcx, [rsp + 0x48]
movsxd rdi, r13d
call fcn.140059920
lea rcx, [rsp + 0x78]
call fcn.140059920
cmp rbx, r14
je 0x1400b88a1
xor edx, edx
mov rcx, rbx
call fcn.14004dac4
lea rcx, [rbx + 0x70]
call fcn.140059920
mov rcx, rbx
call fcn.1400fdcec
cmp rsi, r14
je 0x1400b88b6
mov rcx, rsi
call fcn.1400286ec
mov rcx, rsi
call fcn.1400fdcec
lea rcx, [rsp + 0x68]
call fcn.140059920
lea rcx, [rsp + 0x70]
call fcn.140059920
lea rcx, [rsp + 0x58]
call fcn.140059920
mov rax, rdi
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret