Function at 0x18006ec60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov ebx, dword [rsp + 0x120]
mov rbp, r8
mov r12, r9
mov r8, rdx
mov r14, rcx
lea eax, [rbx + 0xfc]
mov dword [rsp + 0x64], eax
cmp ebx, eax
jae case.0x18006ecf2.127
mov r15d, dword [rsp + 0x120]
lea r9, [0x180000000]
mov edi, dword [rsp + 0x120]
lea rdx, str.bLyhe5yzRCyqOFSDVCoV8g
nop dword [rax + rax]
lea eax, [rbx - 0x7d]
cmp eax, 0xce
ja case.0x18006ecf2.137
movzx eax, byte [r9 + rax + 0x6f3b4]
mov ecx, dword [r9 + rax*4 + 0x6f380]
add rcx, r9
jmp rcx
mov rax, qword [r8]
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x70], rax
mov ecx, dword [rax + 0xc]
mov r15d, dword [rax + 8]
mov dword [rsp + 0x60], ecx
mov ecx, dword [rax + 4]
sub ecx, dword [rax]
mov dword [rsp + 0x5c], ecx
jmp case.0x18006ecf2.137
xor esi, esi
cmp dword [r12 + 0x64], 1
jl 0x18006f301
cmp dword [r14], esi
je 0x18006ee02
mov ebx, 0x3f
nop dword [rax]
cmp ebx, 0x3f
je 0x18006eda5
cmp ebx, 0x2d48
je 0x18006ed70
cmp ebx, 0x5a51
jne 0x18006edf0
mov rdx, qword [rsp + 0x68]
xor r9d, r9d
mov r8d, 0x11b
xor ecx, ecx
call fcn.1800251e0
jmp 0x18006ede9
mov r13, qword [rsp + 0x68]
test r13, r13
je 0x18006f2f1
movsxd rax, dword [r12 + 0x64]
mov rdx, r13
mov rcx, qword [r12 + 0x68]
mov r9, qword [r12 + 0x10]
lea r8, [rax + rax*2]
mov rcx, qword [rcx + r8*8 - 0x18]
call qword [r9 + reloc.SHELL32.dll_SHSetFolderPathW]
mov rsi, rax
jmp 0x18006ede9
mov r10, qword [r12 + 0x10]
cmp dword [r10 + 0x90], 0
je 0x18006f2f8
mov rcx, qword [r12 + 0x68]
lea r9, [rsp + 0x78]
movsxd rax, dword [r12 + 0x64]
mov r8, qword [r12 + 0x50]
mov qword [rsp + 0x78], rdx
lea rdx, [rax + rax*2]
mov rdx, qword [rcx + rdx*8 - 0x18]
mov rcx, qword [rcx]
call qword [r10 + ILFree]
mov qword [rsp + 0x68], rax
lea rdx, str.bLyhe5yzRCyqOFSDVCoV8g
add ebx, 0x2d09
cmp ebx, 0x871b
jbe 0x18006ed40
mov rcx, qword [r12 + 0x68]
mov rax, qword [r12 + 0x10]
mov rcx, qword [rcx]
call qword [rax + 0x80]
mov rcx, qword [r12 + 0x78]
mov rbx, rax
mov rax, qword [r12 + 0x10]
call qword [rax + 0x40]
mov r9d, 0x50
lea rcx, [rsp + 0x90]
mov rdx, rax
mov r8, rsi
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.180029670
mov qword [rsp + 0x50], 0
mov ebx, dword [rsp + 0x120]
lea r9, [0x180000000]
lea rdx, str.bLyhe5yzRCyqOFSDVCoV8g
add ebx, 0x15
mov dword [rsp + 0x120], ebx
cmp ebx, dword [rsp + 0x64]
jae case.0x18006ecf2.127
mov r8, qword [rsp + 0x108]
jmp 0x18006ecd0
mov edx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x58]
imul eax, edx
add eax, dword [rbp]
movsxd rcx, eax
mov rax, qword [r12 + 0x50]
mov byte [rcx + rax - 1], 1
mov eax, dword [r8]
imul eax, edx
add eax, dword [rbp]
movsxd rcx, eax
mov rax, qword [r12 + 0x48]
mov byte [rcx + rax - 1], 1
mov eax, dword [r14]
imul eax, edx
add eax, dword [rbp]
movsxd rcx, eax
mov rax, qword [r12 + 0x40]
mov byte [rcx + rax - 1], 1
jmp 0x18006ee71
mov r10d, dword [r12]
mov edx, 1
mov r11d, dword [r14]
imul r11d, r10d
mov dword [rsp + 0x40], r10d
add r11d, dword [r8]
mov dword [rsp + 0x44], r11d
cmp r10d, edx
jl 0x18006ef2f
cmp edx, dword [rbp]
je 0x18006ef28
mov ecx, dword [r14]
imul ecx, dword [r12]
mov rax, qword [r12 + 0x20]
add ecx, dword [r8]
imul ecx, dword [r12]
add ecx, edx
movsxd rcx, ecx
mov byte [rcx + rax - 1], 0
inc edx
cmp edx, r10d
jle 0x18006ef04
xor edx, edx
test r10d, r10d
jle 0x18006ee71
nop word [rax + rax]
cmp edx, dword [r14]
je 0x18006ef64
mov ecx, dword [r12]
mov rax, qword [r12 + 0x20]
imul ecx, edx
add ecx, dword [r8]
imul ecx, dword [r12]
add ecx, dword [rbp]
movsxd rcx, ecx
mov byte [rcx + rax - 1], 0
inc edx
cmp edx, r10d
jl 0x18006ef40
jmp 0x18006ee71
movsxd r10, dword [rsp + 0x40]
xor edx, edx
test r10d, r10d
jle 0x18006efab
nop dword [rax]
cmp edx, dword [r8]
je 0x18006efa4
mov ecx, dword [r14]
imul ecx, dword [r12]
mov rax, qword [r12 + 0x20]
add ecx, edx
imul ecx, dword [r12]
add ecx, dword [rbp]
movsxd rcx, ecx
mov byte [rcx + rax - 1], 0
inc edx
cmp edx, r10d
jl 0x18006ef80
mov rax, qword [r12 + 8]
xor edx, edx
movsxd r11, dword [rsp + 0x44]
mov rcx, qword [rax + 0x10]
movsxd rax, dword [rcx + r11*4]
mov dword [rsp + 0x58], eax
test r10d, r10d
jle 0x18006ee71
lea r9, [rax*8]
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r12 + 8]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + r9]
mov ecx, dword [rax + rdx*4]
cmp ecx, r11d
je 0x18006f00c
mov eax, dword [r12]
imul eax, ecx
add eax, dword [rbp]
movsxd rcx, eax
mov rax, qword [r12 + 0x20]
mov byte [rcx + rax - 1], 0
inc rdx
cmp rdx, r10
jl 0x18006efe0
jmp 0x18006ee6a
mov qword [rsp + 0x28], 0
lea r8, [0x180010540]
mov r9, r12
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r12], rax
jmp 0x18006ee6a
mov eax, dword [rsp + 0x5c]
lea r9, [rsp + 0x48]
cdq
mov dword [rsp + 0x48], 8
idiv r15d
xor r8d, r8d
mov rdx, r12
mov ecx, 0x85
movsxd rbx, eax
call fcn.18002ff60
lea ecx, [rbx*4]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x48], ecx
lea r9, [rsp + 0x48]
mov ecx, 0x85
xor r8d, r8d
mov rdx, r12
mov rsi, rax
call fcn.18002ff60
lea r8, [rbx*4]
mov qword [rsi], rax
xor edx, edx
mov qword [rsp + 0x48], rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor r13d, r13d
test rbx, rbx
jle 0x18006ee63
mov r9, qword [rsp + 0x70]
mov r12, qword [rsp + 0x110]
mov eax, dword [r9]
cdq
idiv dword [r12]
movsxd rsi, eax
nop dword [rax + rax]
mov ebp, reloc.SHELL32.dll_ILFree
cmp ebp, 0x9b
je 0x18006f120
cmp ebp, 0x726f
je 0x18006f1eb
mov ebx, dword [rsp + 0x120]
cmp ebp, 0xe443
jne 0x18006f1b6
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov dword [rax + r13*4], edi
jmp 0x18006f1b6
xor ebx, ebx
xor r8d, r8d
xor r11d, r11d
test r15d, r15d
jle 0x18006f17c
mov rdi, qword [r14]
mov r10d, dword [r12]
mov eax, dword [rdi + rsi*4]
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
cmovg ebx, eax
cmp r10d, 1
jle 0x18006f16c
lea rcx, [r14 + 8]
lea r9d, [r10 - 1]
nop
mov rax, qword [rcx]
lea rcx, [rcx + 8]
mov eax, dword [rax + rsi*4]
cdq
xor eax, edx
sub eax, edx
cmp eax, r8d
cmovg r8d, eax
sub r9, 1
jne 0x18006f150
inc rsi
add r11d, r10d
cmp r11d, r15d
jl 0x18006f134
mov r9, qword [rsp + 0x70]
mov eax, dword [rsp + 0x60]
xor edi, edi
xor ecx, ecx
dec eax
movsxd rdx, eax
test eax, eax
jle 0x18006f1af
lea rax, [r9 + 0xa18]
cmp ebx, dword [rax - 0x100]
jg 0x18006f1a1
cmp r8d, dword [rax]
jle 0x18006f1eb
inc edi
inc rcx
add rax, 4
cmp rcx, rdx
jl 0x18006f194
mov ebx, dword [rsp + 0x120]
add ebp, 0x71d4
cmp ebp, 0x1557c
jbe 0x18006f0e5
inc r13
cmp r13, qword [rsp + 0x48]
jl 0x18006f0e0
mov r12, qword [rsp + 0x118]
mov rbp, qword [rsp + 0x110]
jmp 0x18006ee6a
mov ebx, 0xcc
mov ebp, 0x726f
mov dword [rsp + 0x120], ebx
jmp 0x18006f1b6
movsxd rdx, dword [rsp + 0x44]
mov rcx, qword [r12 + 0x28]
movzx eax, byte [rbp]
mov byte [rdx + rcx], al
jmp 0x18006ee71
mov rcx, qword [r12 + 0x58]
test rcx, rcx
je case.0x18006ecf2.137
mov r10d, dword [rsp + 0x40]
mov r11d, dword [rsp + 0x44]
mov eax, r11d
cdq
lea r9d, [r10 + 1]
idiv r9d
test edx, edx
jne 0x18006f27b
test r10d, r10d
jle 0x18006f272
xor r8d, r8d
cmp r8d, r11d
je 0x18006f263
mov eax, dword [r12]
imul eax, r9d
imul eax, edx
add eax, dword [rbp]
movsxd rcx, eax
mov rax, qword [r12 + 0x20]
mov byte [rcx + rax - 1], 0
inc edx
add r8d, r9d
cmp edx, r10d
jl 0x18006f243
mov rcx, qword [r12 + 0x58]
movsxd rax, dword [rbp]
mov byte [rax + rcx - 1], 1
mov eax, r11d
lea r9d, [r10 - 1]
cdq
idiv r9d
test edx, edx
jne 0x18006ee6a
test r11d, r11d
jle 0x18006ee6a
mov eax, r10d
imul eax, r10d
dec eax
cmp r11d, eax
jge 0x18006ee6a
test r10d, r10d
jle 0x18006f2d9
mov edx, r9d
mov r8, r10
cmp edx, r11d
je 0x18006f2d0
mov eax, edx
imul eax, dword [r12]
add eax, dword [rbp]
movsxd rcx, eax
mov rax, qword [r12 + 0x20]
mov byte [rcx + rax - 1], 0
add edx, r9d
sub r8, 1
jne 0x18006f2b4
mov eax, dword [rbp]
add eax, r10d
movsxd rcx, eax
mov rax, qword [r12 + 0x58]
mov byte [rcx + rax - 1], 1
jmp 0x18006ee6a
mov rax, qword [rsp + 0x78]
jmp 0x18006f364
lea rax, str.VmodlVimDvsVmVnicNetworkResourcePoolConfigSpec
jmp 0x18006f364
lea rax, str.version__TOKEN_VERSION
jmp 0x18006f364
mov rax, qword [rsp + 0x88]
inc dword [rax + 0x40]
mov rax, qword [rsp + 0x80]
jmp 0x18006f364
cmp qword [r12], 0
jne 0x18006f32d
mov byte [rsp + 0x50], 0
jmp case.0x18006ecf2.127
mov r9d, 0x4c
mov dword [rsp + 0x120], 1
xor r8d, r8d
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x120]
mov rcx, r12
call fcn.180015720
mov byte [rsp + 0x50], 1
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret