Function at 0x140011104
Capabilities:
Create thread

Disassembly:
jmp 0x140011ba0
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x72
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2d8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, [0x1400280fb]
call fcn.140011497
nop
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov dword [rbp + 0x84], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xe8], 0
movzx eax, byte [0x1400221d8]
test eax, eax
jne 0x140011c55
xor al, al
jmp 0x14001224b
cmp dword [rbp + 0x2b0], 0xd
jbe 0x140011c65
xor al, al
jmp 0x14001224b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140011c8a
jmp 0x14001218c
lea rax, [rbp + 0x84]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x48]
lea r8, [0x140011113]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140011cc8
jmp 0x14001218e
xor eax, eax
cmp eax, 1
je 0x140011d0f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [rbp + 0x84]
mov ecx, eax
call fcn.140011302
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x144], 0xffffffff
jne 0x140011cfb
jmp 0x140012190
cmp dword [rbp + 0x144], 5
jne 0x140011d06
jmp 0x140011d0f
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
nop
jmp 0x140011cc8
mov rcx, qword [rbp + 0x28]
call fcn.14001132a
mov qword [rbp + 0x128], rax
cmp qword [rbp + 0x128], 0
jne 0x140011d33
jmp 0x140012192
mov rax, qword [rbp + 0x128]
add rax, 0x38
lea rdx, [rbp + 0xa8]
mov rcx, rax
call fcn.1400112c1
movzx eax, al
test eax, eax
jne 0x140011d5e
jmp 0x140012194
mov rax, qword [rbp + 0x128]
add rax, 0x58
lea rdx, [rbp + 0xc8]
mov rcx, rax
call fcn.1400112c1
movzx eax, al
test eax, eax
jne 0x140011d89
jmp 0x140012196
mov qword [rbp + 0xe8], 0
mov rax, qword [rbp + 0xa8]
sub rax, 8
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0xc8]
cmp qword [rbp + 0x108], rax
jbe 0x140011e3c
mov qword [rbp + 0x168], 0
lea rdx, [rbp + 0x168]
mov rcx, qword [rbp + 0x108]
call fcn.1400112c1
movzx eax, al
test eax, eax
jne 0x140011de9
jmp 0x140012198
mov rax, qword [0x1400221c8]
cmp qword [rbp + 0x168], rax
jbe 0x140011e25
mov eax, dword [0x1400221dc]
mov rcx, qword [0x1400221c8]
add rcx, rax
mov rax, rcx
cmp qword [rbp + 0x168], rax
jae 0x140011e25
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xe8], rax
jmp 0x140011e3c
mov rax, qword [rbp + 0x108]
sub rax, 8
mov qword [rbp + 0x108], rax
jmp 0x140011da6
cmp qword [rbp + 0xe8], 0
jne 0x140011e50
jmp 0x14001219a
mov rdx, qword [0x1400221f0]
mov rcx, qword [rbp + 0xe8]
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140011e74
jmp 0x14001219a
mov rax, qword [rbp + 0xe8]
add rax, 0x28
mov rdx, qword [rbp + 0x2a0]
mov rcx, rax
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140011e9f
jmp 0x14001219a
cmp dword [rbp + 0x2b0], 0
jbe 0x140011edd
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0xe8]
add rcx, 0x30
mov rdx, qword [rbp + 0x2a8]
mov rdx, qword [rdx + rax]
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140011edd
jmp 0x14001219a
cmp dword [rbp + 0x2b0], 1
jbe 0x140011f1b
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0xe8]
add rcx, 0x38
mov rdx, qword [rbp + 0x2a8]
mov rdx, qword [rdx + rax]
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140011f1b
jmp 0x14001219a
cmp dword [rbp + 0x2b0], 2
jbe 0x140011f59
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rbp + 0xe8]
add rcx, 0x40
mov rdx, qword [rbp + 0x2a8]
mov rdx, qword [rdx + rax]
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140011f59
jmp 0x14001219a
cmp dword [rbp + 0x2b0], 3
jbe 0x140011f97
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rbp + 0xe8]
add rcx, 0x48
mov rdx, qword [rbp + 0x2a8]
mov rdx, qword [rdx + rax]
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140011f97
jmp 0x14001219a
mov rax, qword [rbp + 0xe8]
add rax, 0x50
mov rdx, qword [0x1400221f8]
mov rcx, rax
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140011fc2
jmp 0x14001219a
mov dword [rbp + 0x184], 4
jmp 0x140011fdc
mov eax, dword [rbp + 0x184]
inc eax
mov dword [rbp + 0x184], eax
mov eax, dword [rbp + 0x2b0]
cmp dword [rbp + 0x184], eax
jae 0x140012035
mov eax, dword [rbp + 0x184]
mov ecx, dword [rbp + 0x184]
sub ecx, 4
mov ecx, ecx
lea rcx, [rcx*8 + 0x78]
mov ecx, ecx
mov rdx, qword [rbp + 0xe8]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rbp + 0x2a8]
mov rdx, qword [rdx + rax*8]
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140012033
jmp 0x14001219a
jmp 0x140011fce
mov rax, qword [rbp + 0xe8]
add rax, 0xc0
mov rdx, qword [0x140022200]
mov rcx, rax
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140012062
jmp 0x14001219a
mov rax, qword [rbp + 0xe8]
add rax, 0xc8
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x14001208c
jmp 0x14001219a
mov rax, qword [rbp + 0xe8]
add rax, 0xd0
mov rdx, qword [0x140022208]
mov rcx, rax
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x1400120b9
jmp 0x14001219a
mov rax, qword [rbp + 0xe8]
add rax, 0xd8
mov rdx, qword [0x140022210]
mov rcx, rax
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x1400120e6
jmp 0x14001219a
mov rax, qword [rbp + 0xe8]
add rax, 0xe0
mov rdx, qword [0x1400221f0]
mov rcx, rax
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140012113
jmp 0x14001219a
mov rax, qword [rbp + 0xe8]
add rax, 0x108
mov rdx, qword [0x1400221e8]
mov rcx, rax
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x14001213a
jmp 0x14001219a
mov rax, qword [rbp + 0xe8]
add rax, 0x110
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x14001215e
jmp 0x14001219a
mov rax, qword [rbp + 0xe8]
add rax, 0x118
mov edx, 0x1337
mov rcx, rax
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140012183
jmp 0x14001219a
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
nop
jmp 0x14001219a
jmp 0x14001219a
jmp 0x14001219a
jmp 0x14001219a
jmp 0x14001219a
jmp 0x14001219a
jmp 0x14001219a
jmp 0x14001219a
cmp qword [rbp + 0x48], 0
je 0x14001220a
cmp qword [rbp + 0x28], 0
je 0x14001220a
mov dword [rbp + 0x1a4], 0
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rdx, [rbp + 0x1a4]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
nop
cmp dword [rbp + 0x1a4], 0x1337
jne 0x14001220a
cmp qword [rbp + 0x2b8], 0
je 0x140012203
mov rax, qword [rbp + 0x2b8]
mov rcx, qword [rbp + 0x68]
mov qword [rax], rcx
mov dword [rbp + 4], 1
cmp qword [rbp + 0x48], 0
je 0x14001221c
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x28], 0
je 0x14001222e
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rbp + 4], 0
je 0x14001223d
mov byte [rbp + 0x274], 1
jmp 0x140012244
mov byte [rbp + 0x274], 0
movzx eax, byte [rbp + 0x274]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001e7b0]
call fcn.14001140b
mov rax, rdi
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.140011212
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret