Function at 0x1800431c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
lea r15d, [rcx + 0x13]
mov r13, r8
mov rsi, rdx
cmp ecx, r15d
jae case.0x180043241.3
mov edi, dword [rbp + 0x67]
lea r14d, [rcx - 0xfd]
mov rbx, qword [rbp + 0x7f]
lea rdx, [0x180000000]
mov r12, qword [rbp + 0x7f]
lea r10, [0x1800a6fe0]
lea r11, [0x1800a6fe8]
lea r8, [0x1800859e0]
lea r9, [0x180085a20]
cmp r14d, 0x4c
ja case.0x180043241.16
movzx eax, byte [rdx + r14 + 0x43604]
mov ecx, dword [rdx + rax*4 + 0x435c0]
add rcx, rdx
jmp rcx
movsxd rax, edi
cmp byte [rax + rsi - 4], 0x2e
jne 0x18004326b
cmp byte [rax + rsi - 3], 0x62
jne 0x18004326b
cmp byte [rax + rsi - 2], 0x7a
jne 0x18004326b
cmp byte [rax + rsi - 1], 0x32
jne 0x18004326b
mov byte [rbp - 0x69], 1
jmp case.0x180043241.16
mov byte [rbp - 0x69], 0
jmp case.0x180043241.16
lea r9, [rbp - 0x51]
mov qword [rbp - 0x51], r10
mov r8d, 0x15
mov qword [rbp - 0x49], r10
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.18004ad70
lea rax, [0x1800a6fe4]
mov r8d, 0x15
lea r9, [rbp - 0x41]
mov qword [rbp - 0x41], rax
mov rdx, rbx
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x39]
call fcn.18004ad70
jmp 0x18004352e
mov qword [rbp - 0x31], 0
test r12, r12
jne case.0x180043241.16
mov byte [rbp - 0x69], 0
mov rax, qword [rbp - 0x69]
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp byte [0x1800a75f3], 0
je case.0x180043241.16
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.CPsLookupNameRelationMetadata_CPsLookupFieldSchemaNameMetadata_IPsLookupFieldSchemaNameMetadata_IPsEnumFieldMetadata_IPsEnumFieldIdMetadata_PsFieldSchemaNameRelation_PsFieldMetadataRecord_PsFieldIdMetadataRecord_PsCacheFieldRecord_.HrLookup
call fcn.180085950
jmp 0x18004352e
mov rcx, qword [rbp - 0x31]
call sub.IMM32.dll_ImmIsIME
jmp 0x18004352e
lea r9, [rbp - 0x29]
mov qword [rbp - 0x29], r11
mov r8d, 0x15
mov qword [rbp - 0x21], r11
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.18004ad70
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
mov rcx, rbx
lea r8d, [r9 + 0x52]
call fcn.18004dc60
jmp 0x18004352e
mov ecx, 1
mov ebx, 0xff
mov dword [rbp + 0x67], ecx
mov eax, ebx
sub eax, 2
je 0x18004338f
sub eax, 0x90
je 0x1800433be
cmp eax, 0x6d
jne 0x1800433b0
mov dword [0x1800a6c78], ecx
jmp 0x1800433b0
mov eax, dword [pe_dos_header]
lea r9, [rbp + 0x67]
lea r8, [rbp - 0x61]
mov dword [rbp - 0x61], eax
mov edx, 0x34
xor ecx, ecx
call fcn.180030540
mov ecx, dword [rbp + 0x67]
add ebx, 0x90
cmp ebx, 0x2af
jb 0x180043374
lea rax, [0x1800859e0]
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x19]
lea rax, [0x180085a20]
mov qword [rbp - 0x11], rax
lea rcx, [rbp - 0x11]
jmp 0x180043518
mov qword [rbp - 9], r8
lea rdx, [rbp - 9]
mov qword [rbp - 1], r9
lea rcx, [rbp - 1]
xor r9d, r9d
mov dword [rsp + 0x20], 0xbe
xor r8d, r8d
call fcn.18004ba30
mov rbx, rax
lea r9, [rbp + 7]
lea rax, [0x1800a6c7c]
mov rdx, rbx
mov r8d, 0x15
mov qword [rbp + 7], rax
lea rcx, [rbp + 0xf]
mov qword [rbp + 0xf], rax
call fcn.18004ad70
jmp 0x18004352e
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x180043440
cmp edi, 4
jle 0x1800432cd
jmp case.0x180043241.16
mov qword [0x1800a75a8], rsi
mov qword [rsi + 0x80], r13
jmp case.0x180043241.16
mov rax, r12
xchg qword [0x1800a75b0], rax
jmp case.0x180043241.16
mov qword [rsp + 0x28], 0
lea r8, [0x180031b20]
mov r9, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
jmp 0x18004352e
xor ecx, ecx
mov ebx, 0xff
mov dword [rbp + 0x7f], ecx
mov eax, ebx
sub eax, 2
je 0x1800434cb
sub eax, 0x90
je 0x1800434fa
cmp eax, 0x6d
jne 0x1800434ec
mov dword [0x1800a6c78], ecx
jmp 0x1800434ec
mov eax, dword [pe_dos_header]
lea r9, [rbp + 0x7f]
lea r8, [rbp - 0x59]
mov dword [rbp - 0x59], eax
mov edx, 0x34
xor ecx, ecx
call fcn.180030540
mov ecx, dword [rbp + 0x7f]
add ebx, 0x90
cmp ebx, 0x2af
jb 0x1800434b0
lea rax, [0x1800859e0]
mov qword [rbp + 0x17], rax
lea rdx, [rbp + 0x17]
lea rax, [0x180085a20]
mov qword [rbp + 0x1f], rax
lea rcx, [rbp + 0x1f]
xor r9d, r9d
mov dword [rsp + 0x20], 0xbe
xor r8d, r8d
call fcn.18004ba30
mov rbx, rax
lea r11, [0x1800a6fe8]
lea r10, [0x1800a6fe0]
lea r9, [0x180085a20]
lea r8, [0x1800859e0]
lea rdx, [0x180000000]
inc r14d
lea eax, [r14 + 0xfd]
cmp eax, r15d
jb 0x180043224
jmp case.0x180043241.3
movzx ecx, byte [rsi + 6]
movzx eax, byte [rsi + 7]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsi + 5]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsi + 4]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsi + 3]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsi + 2]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsi + 1]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsi]
shl rax, 8
or rax, rcx
jmp 0x1800432d5