Function at 0x180001e50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x260
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor esi, esi
cmp dword [0x18008b3a0], esi
mov dword [rsp + 0x30], esi
lea ebx, [rsi + 1]
je 0x18000c106
cmp dword [0x18008b650], 2
je 0x18000c145
mov qword [rsp + 0x28], rsi
lea r8, str.Policy_filter_is_not_designed_for_non_domain_controllers
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call fcn.180001f80
lea rcx, [0x18008b628]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, str.Entered_NotificationQSync_for_freeing_queue
mov dword [rsp + 0x20], esi
mov edx, ebx
xor ecx, ecx
call fcn.180001f80
mov rbx, qword [0x18008b388]
test rbx, rbx
jne 0x18000c34a
mov qword [rsp + 0x28], rsi
lea r8, str.Leaving_NotificationQSync_for_freeing_queue
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
mov qword [0x18008b390], rsi
xor ecx, ecx
call fcn.180001f80
lea rcx, [0x18008b628]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [0x18008b398]
test rcx, rcx
jne 0x18000c36e
mov rcx, qword [0x18008b3a8]
test rcx, rcx
jne 0x18000c386
cmp qword [0x18008ab70], 0xffffffffffffffff
jne 0x18000c39e
mov eax, esi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180002a90
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rsi
ret
lea rcx, [0x18008b650]
call qword [sym.imp.ntdll.dll_RtlGetNtProductType]
nop dword [rax + rax]
test al, al
jne 0x180001e84
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, str.Get_product_type
mov dword [rsp + 0x20], esi
mov edx, ebx
lea ecx, [r9 + 0xa]
call fcn.180001f80
nop
jmp 0x180001e84
lea r9, str.E_ScepSamFilterAndPolicyPropExclusion
mov qword [rsp + 0x270], rdi
mov r8d, ebx
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov qword [0x18008b8a8], rax
test rax, rax
je 0x18000c2ef
mov qword [rsp + 0x28], rsi
lea r8, str.Successfully_created_event_E_ScepSamFilterAndPolicyPropExclusion
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call fcn.180001f80
lea r9, str.E_ScepNotificationQEnqueue
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov qword [0x18008b398], rax
test rax, rax
je 0x18000c2da
mov qword [rsp + 0x28], rsi
lea r8, str.Successfully_created_event_E_ScepNotificationQEnqueue
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call fcn.180001f80
lea r9, str.E_ScepPolicyPropagation
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov qword [0x18008b3a8], rax
test rax, rax
je 0x18000c2bf
mov qword [rsp + 0x28], rsi
lea r8, str.Successfully_created_event_E_ScepPolicyPropagation
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call fcn.180001f80
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x180048760]
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
mov qword [0x18008b970], rax
test rax, rax
je 0x18000c2aa
mov r9d, dword [rsp + 0x30]
lea r8, str.Thread__x
mov edx, 0x104
mov word [rsp + 0x40], si
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea r8, str.Create_Notification_Thread_Success
xor ecx, ecx
mov dword [rsp + 0x20], esi
mov edx, ebx
call fcn.180001f80
mov eax, esi
mov rdi, qword [rsp + 0x270]
jmp 0x180001f52
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.Create_Notification_Thread_Failure
jmp 0x18000c2d4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.Error_creating_event_E_ScepPolicyPropagation
mov ebx, esi
mov edi, eax
mov ecx, eax
jmp 0x18000c308
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.Error_creating_event_E_ScepNotificationQEnqueue
jmp 0x18000c302
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.Error_creating_event_E_ScepSamFilterAndPolicyPropExclusion
mov ebx, esi
mov ecx, eax
mov edi, eax
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov edx, ebx
mov dword [rsp + 0x20], esi
call fcn.180001f80
call fcn.180047bbc
test edi, edi
je 0x18000c343
mov rcx, qword [0x18008b970]
test rcx, rcx
je 0x18000c343
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov qword [0x18008b970], rsi
mov eax, edi
jmp 0x18000c29d
mov rcx, rbx
mov rbx, qword [rbx + 0x60]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
test rbx, rbx
jne 0x18000c34a
mov qword [0x18008b388], rsi
jmp 0x180001eec
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov qword [0x18008b398], rsi
jmp 0x180001f32
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov qword [0x18008b3a8], rsi
jmp 0x180001f42
mov rcx, 0xffffffffffffffff
xchg qword [0x18008ab70], rcx
cmp rcx, 0xffffffffffffffff
je 0x180001f50
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x180001f50