Function at 0x18000df00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r13d, dword [rbp + 0x68]
mov r14, r8
imul eax, r13d, 0x6c8
mov r10, rcx
mov r12d, r13d
mov dword [rbp - 0x40], r13d
mov dword [rbp - 0x18], eax
cmp r13d, eax
ja 0x18000dfae
mov rcx, qword [rbp - 0x30]
mov r8d, reloc.SHELL32.dll_ILClone
mov r15, qword [rbp - 0x30]
xor ebx, ebx
mov dword [rbp - 0x28], r8d
mov qword [rbp - 0x48], rcx
lea r11, [0x180000000]
cmp r12d, 0x6cf
ja 0x18000e429
je 0x18000dfae
cmp r12d, 0x7b
ja 0x18000e36d
je 0x18000e35f
cmp r12d, 7
je 0x18000e01a
cmp r12d, 0x16
je 0x18000dfcd
cmp r12d, 0x54
jne 0x18000dffc
mov rax, qword [r14 + 0x40]
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x48], rcx
test rcx, rcx
jne 0x18000dffc
mov rax, qword [rbp - 0x38]
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test byte [r14 + 0x80], 1
je 0x18000dffc
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
mov ecx, 0xaf
call fcn.1800314d0
mov rdx, qword [rbp + 0x48]
mov r8d, reloc.SHELL32.dll_ILClone
mov rcx, qword [rbp - 0x48]
imul eax, r13d, 0x7c
add r12d, eax
mov dword [rbp - 0x40], r12d
cmp r12d, dword [rbp - 0x18]
ja 0x18000dfae
mov r9, qword [rbp + 0x58]
mov r10, qword [rbp + 0x40]
jmp 0x18000df61
test rdx, rdx
je 0x18000e517
mov qword [rbp - 0x20], rbx
cmp qword [rdx + 8], rbx
jbe 0x18000e2d5
mov r13, rbx
nop dword [rax]
nop dword [rax + rax]
mov r12d, ILFree
nop word [rax + rax]
mov eax, r12d
sub eax, 0x92
je 0x18000e257
sub eax, 1
je 0x18000e251
sub eax, 1
je 0x18000e24b
sub eax, 1
je 0x18000e1ba
cmp eax, 1
jne 0x18000e28f
mov r15, qword [rdx]
add r15, r13
mov rax, qword [r15 + 0x38]
test rax, rax
je 0x18000e28f
mov rsi, qword [rax + 8]
mov edi, 0x2a
nop
cmp edi, 0xc6
ja case.0x18000e0be.4
mov eax, edi
movzx eax, byte [r11 + rax + 0xe5e8]
mov ecx, dword [r11 + rax*4 + 0xe5c8]
add rcx, r11
jmp rcx
mov rcx, r14
call qword [0x180098108]
lea r11, [0x180000000]
jmp case.0x18000e0be.4
test rsi, rsi
je case.0x18000e0be.3
add edi, 0x32
lea eax, [rdi + 0xb7]
cmp eax, 0x2a3
jb 0x18000e0a0
jmp case.0x18000e0be.3
test rsi, rsi
je case.0x18000e0be.3
mov edi, reloc.SHELL32.dll_ILClone
nop
mov eax, edi
sub eax, 0x12
je 0x18000e137
sub eax, 0x4f
je case.0x18000e0be.3
sub eax, 0x14
je 0x18000e120
cmp eax, 0x4f
je case.0x18000e0be.3
jmp 0x18000e166
movzx eax, byte [r14]
mov ecx, eax
cmp al, 0x7f
jbe 0x18000e132
mov ecx, dword [r11 + rax*4 + 0x844a0]
mov dword [rsi + 0xc], ecx
jmp 0x18000e166
mov rax, qword [r14 + 0x28]
lea rdx, [rbp - 0x10]
mov rcx, qword [r14 + 0x18]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8d, 0xea
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x20], rbx
call fcn.180061630
lea r11, [0x180000000]
add edi, 0x4f
cmp edi, 0x14e
jb 0x18000e100
jmp case.0x18000e0be.3
mov rax, qword [r14 + 0x28]
lea rdx, [rbp - 0x30]
mov rcx, qword [r14 + 0x18]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8d, 0xea
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.180061630
jmp case.0x18000e0be.3
xor r9d, r9d
mov r8, r14
xor edx, edx
mov ecx, 0xf0
call fcn.1800497b0
jmp case.0x18000e0be.3
mov r9, qword [r15]
test r9, r9
je 0x18000e1db
mov byte [rbp - 0x50], 1
lea r8, [rbp - 0x50]
mov r9, qword [r9 + 8]
mov rdx, r14
mov ecx, 0xb0
call fcn.18005e2c0
mov r8, qword [r15 + 8]
test r8, r8
je 0x18000e1fd
mov r8, qword [r8 + 8]
lea rdx, [rbp - 0x50]
mov r9, r14
mov byte [rbp - 0x50], 1
mov ecx, SHSetFolderPathW
call fcn.1800430d0
mov r8, qword [r15 + 0x10]
test r8, r8
je 0x18000e226
mov byte [rbp - 0x50], 1
lea rax, [rbp - 0x50]
mov r8, qword [r8 + 8]
mov r9, r14
mov edx, 0x57
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.1800299a0
mov rdx, qword [r15 + 0x18]
test rdx, rdx
je case.0x18000e0be.3
mov rdx, qword [rdx + 8]
lea r9, [rbp - 0x50]
mov r8d, ILClone
mov byte [rbp - 0x50], 1
mov rcx, r14
call fcn.180036dc0
jmp case.0x18000e0be.3
mov r9, qword [r15 + 0x20]
jmp 0x18000e25b
mov r9, qword [r15 + 0x30]
jmp 0x18000e25b
mov r9, qword [r15 + 0x28]
test r9, r9
je 0x18000e28f
lea rax, [rbp - 0x50]
mov byte [rbp - 0x50], 1
mov r9, qword [r9 + 8]
mov r8, r14
mov qword [rsp + 0x28], rbx
mov edx, 5
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.18000a250
mov rdx, qword [rbp + 0x48]
mov r8d, reloc.SHELL32.dll_ILClone
dec r12d
lea r11, [0x180000000]
cmp r12d, 0x91
ja 0x18000e050
mov rax, qword [rbp - 0x20]
lea r11, [0x180000000]
inc rax
add r13, 0x40
mov qword [rbp - 0x20], rax
cmp rax, qword [rdx + 8]
jb 0x18000e040
mov r12d, dword [rbp - 0x40]
lea r11, [0x180000000]
mov r13d, dword [rbp + 0x68]
mov rsi, qword [rdx]
mov edi, r8d
nop dword [rax + rax]
mov eax, edi
sub eax, 0x12
je 0x18000e317
sub eax, 0x4f
je 0x18000dfee
sub eax, 0x14
je 0x18000e300
cmp eax, 0x4f
je 0x18000dfee
jmp 0x18000e348
movzx eax, byte [r14]
mov ecx, eax
cmp al, 0x7f
jbe 0x18000e312
mov ecx, dword [r11 + rax*4 + 0x844a0]
mov dword [rsi + 0xc], ecx
jmp 0x18000e348
test rsi, rsi
je 0x18000dfee
mov rax, qword [r14 + 0x28]
lea rdx, [rbp - 0x20]
mov rcx, qword [r14 + 0x18]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8d, 0xea
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x20], rbx
call fcn.180061630
add edi, 0x4f
lea r11, [0x180000000]
cmp edi, 0x14e
jb 0x18000e2e0
jmp 0x18000dfee
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18000dfee
mov eax, r12d
sub eax, 0x119
je 0x18000e3ef
sub eax, 7
je 0x18000e399
cmp eax, 0x24b
jne 0x18000dffc
cmp byte [r9], bl
jne 0x18000e500
mov qword [rbp - 0x38], rdx
jmp 0x18000dffc
mov qword [rsp + 0x28], rbx
lea r8, [0x18000da60]
mov r9, r14
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14], rax
test rax, rax
je 0x18000e58f
lea rax, [rbp - 0x40]
mov dword [rbp - 0x40], 1
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, 0xb7
mov rcx, r14
call fcn.1800504e0
jmp 0x18000dfee
mov rax, qword [r14 + 0x78]
mov rcx, qword [rax + 0x18]
sub rcx, qword [rdx + 8]
add rcx, qword [r10]
mov qword [rdx + 0x10], rcx
mov dword [rdx], 0x1f
inc qword [r14 + 0xd0]
mov rax, qword [r14 + 0xc0]
test rax, rax
je 0x18000dff8
mov rcx, r14
call rax
jmp 0x18000dfee
cmp r12d, 0x3c0f
ja 0x18000e4db
je 0x18000e517
cmp r12d, 0xabe
je 0x18000e4a2
cmp r12d, 0x1566
je 0x18000e597
cmp r12d, 0x2904
jne 0x18000dffc
mov eax, dword [rcx]
sub eax, 4
cmp eax, 1
jbe 0x18000e48d
cmp qword [rcx + 0x18], rbx
jne 0x18000e475
cmp qword [rcx + 0x20], rbx
je 0x18000e48d
mov r9d, 0xc5
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call fcn.18003ea10
jmp 0x18000dfee
xor edx, edx
mov r8, rcx
xor r9d, r9d
lea ecx, [rdx + 0x3c]
call fcn.1800497b0
jmp 0x18000dfee
cmp qword [r14 + 0x10], rbx
jne 0x18000dffc
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x37]
call fcn.180021de0
mov r8, rax
mov qword [r14 + 0x10], rax
mov rdx, r14
mov ecx, 0x7d
call fcn.180051680
jmp 0x18000dfee
cmp r12d, 0x8935
je 0x18000e5ba
cmp r12d, 0x8ca0
jne 0x18000dffc
mov byte [rbp - 0x38], 1
jmp 0x18000dfae
mov eax, r8d
sub eax, 0x12
je 0x18000e536
sub eax, 0x4f
je 0x18000e517
sub eax, 0x14
je 0x18000e51f
cmp eax, 0x4f
jne 0x18000e572
mov rax, rbx
jmp 0x18000dfb2
movzx eax, byte [r14]
mov ecx, eax
cmp al, 0x7f
jbe 0x18000e531
mov ecx, dword [r11 + rax*4 + 0x844a0]
mov dword [rdx + 0xc], ecx
jmp 0x18000e572
test rdx, rdx
je 0x18000e517
mov rax, qword [r14 + 0x28]
xor r9d, r9d
mov rcx, qword [r14 + 0x18]
mov r8d, 0xea
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.180061630
mov rdx, qword [rbp + 0x48]
lea r11, [0x180000000]
mov r8d, dword [rbp - 0x28]
add r8d, 0x4f
mov dword [rbp - 0x28], r8d
cmp r8d, 0x14e
jb 0x18000e500
mov rax, rbx
jmp 0x18000dfb2
mov byte [rbp - 0x38], bl
jmp 0x18000dfae
mov rax, qword [r9]
mov r8, rdx
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
mov edx, 0x11f
mov rcx, r14
call fcn.1800357d0
mov dword [rbp - 0x38], eax
jmp 0x18000dfae
mov rax, qword [rbp + 0x60]
mov rax, qword [rax]
jmp 0x18000dfb2