Function at 0x14000a0d0
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x5c8
mov qword [rsp + 0x68], 0
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14003ce30
cmp qword [rsp + 0x5e8], 0
jne 0x14000a12e
lea rcx, [rsp + 0x50]
call fcn.140009900
test eax, eax
je 0x14000a12e
lea rax, [rsp + 0x50]
mov qword [rsp + 0x5e8], rax
call fcn.140009af0
mov r8d, dword [rsp + 0x5f0]
mov rax, qword [rsp + 0x610]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x608]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x600]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x5f8]
mov rdx, qword [rsp + 0x5e8]
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x14000a5a6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140008a60
mov edi, eax
mov rcx, qword [rsp + 0x5e0]
call fcn.140008dc0
mov ecx, eax
call fcn.140008a60
cmp edi, eax
je 0x14000a5a6
movzx eax, byte [rsp + 0x618]
test eax, eax
jne 0x14000a5a6
xor edx, edx
lea rcx, [0x14003fc00]
call fcn.14000d610
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x14000a5a6
mov qword [rsp + 0x78], 0
cmp qword [rsp + 0x5e8], 0
je 0x14000a20e
mov rax, qword [rsp + 0x5e8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], 0
mov dword [rsp + 0x84], 0
cmp dword [rsp + 0x5f0], 0
je 0x14000a25c
mov eax, dword [rsp + 0x608]
and eax, 0x10000
test eax, eax
je 0x14000a24e
mov eax, dword [rsp + 0x5f0]
mov dword [rsp + 0x80], eax
jmp 0x14000a25c
mov eax, dword [rsp + 0x5f0]
mov dword [rsp + 0x84], eax
mov rcx, qword [rsp + 0x5e0]
call fcn.14000acd0
test eax, eax
je 0x14000a3e2
xor edx, edx
lea rcx, [0x14003fe28]
call fcn.14000d560
mov rdx, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x600]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, 1
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x5e0]
call qword [rsp + 0x70]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0
jl 0x14000a3dd
mov dword [rsp + 0xd0], 0x100003
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000a3a5
mov rax, qword [rsp + 0x138]
sub rax, 0x30
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x5f8]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x600]
mov qword [rsp + 0x128], rax
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x14000a37c
mov eax, dword [rsp + 0x608]
and eax, 4
test eax, eax
jne 0x14000a37a
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14000a3a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], 0
jmp 0x14000a3cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x610]
mov eax, dword [rsp + 0x94]
mov dword [rcx], eax
jmp 0x14000a5a6
mov r8d, 0x71af0000
mov rdx, qword [rsp + 0x5e0]
mov ecx, 0x25
call fcn.140007de0
mov qword [rsp + 0x570], rax
cmp qword [rsp + 0x570], 0
je 0x14000a494
lea rdi, [rsp + 0x578]
lea rsi, [0x14003fe80]
mov ecx, 0x25
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x5f8]
mov dword [rsp + 0x57d], eax
mov eax, dword [rsp + 0x570]
mov dword [rsp + 0x58d], eax
mov rcx, qword [rsp + 0x5e0]
call fcn.1400086f0
movzx eax, al
test eax, eax
je 0x14000a473
mov eax, dword [0x140051c40]
mov dword [rsp + 0x592], eax
mov eax, dword [0x140051bd0]
mov dword [rsp + 0x597], eax
jmp 0x14000a494
mov rdx, qword [rsp + 0x5e0]
mov rcx, qword [rsp + 0x570]
call fcn.140008020
mov qword [rsp + 0x570], 0
cmp qword [rsp + 0x570], 0
je 0x14000a5a6
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x25
lea r8, [rsp + 0x578]
mov rdx, qword [rsp + 0x570]
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000a5a0
mov eax, dword [rsp + 0x608]
and eax, 4
test eax, eax
je 0x14000a4f7
mov dword [rsp + 0x5b8], 1
jmp 0x14000a502
mov dword [rsp + 0x5b8], 0
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x600]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x570]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, dword [rsp + 0x5b8]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x5e0]
call qword [rsp + 0x70]
mov dword [rsp + 0x5a8], eax
cmp dword [rsp + 0x5a8], 0
jl 0x14000a589
mov rcx, qword [rsp + 0x610]
mov eax, dword [rsp + 0x5b4]
mov dword [rcx], eax
jmp 0x14000a59e
mov rdx, qword [rsp + 0x5e0]
mov rcx, qword [rsp + 0x570]
call fcn.140008020
jmp 0x14000a5a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rsp + 0x58], 0
je 0x14000a5c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x68]
add rsp, 0x5c8
pop rdi
pop rsi
ret