Function at 0x180015588
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rbx, rcx
cmp byte [rcx], 1
jne 0x1800155b2
xor al, al
jmp 0x180015a5e
mov byte [rcx], 1
call fcn.180022194
mov rdi, rax
xor ebp, ebp
cmp rax, rbp
je 0x1800155f9
mov dword [rsp + 0x38], 0x28
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], ebp
lea r9, str.Global9b4fbe25_a961_4ae3_a6c8_8d951d55df03
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
mov rcx, rdi
call fcn.180022318
jmp 0x1800155fc
mov rsi, rbp
mov qword [rbx + 8], rsi
mov ecx, 0x50
call fcn.18003c28c
mov rdi, rax
mov qword [rsp + 0x80], rax
mov r12d, 8
cmp rax, rbp
je 0x18001567f
lea rax, vtable.CPatchScanner.0
mov qword [rdi], rax
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c28c
cmp rax, rbp
je 0x180015648
mov qword [rax], rsi
jmp 0x18001564b
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.180011470
mov qword [rsi + 0x30], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rsi + 0x30]
mov qword [rax], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x10], rax
mov qword [rsi + 0x38], rbp
mov byte [rdi + 8], bpl
jmp 0x180015682
mov rdi, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.180015fb8
mov r15d, 0x10
mov rcx, r15
call fcn.18003c28c
cmp rax, rbp
je 0x1800156b0
lea rcx, vtable.CGuestScanner.0
mov qword [rax], rcx
mov byte [rax + 8], bpl
jmp 0x1800156b3
mov rax, rbp
mov rdx, rax
mov rcx, rbx
call fcn.180015fb8
mov rcx, r15
call fcn.18003c28c
cmp rax, rbp
je 0x1800156d7
lea rcx, vtable.CFirewallScanner.0
mov qword [rax], rcx
jmp 0x1800156da
mov rax, rbp
mov rdx, rax
mov rcx, rbx
call fcn.180015fb8
mov ecx, 0x90
call fcn.18003c28c
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x1800157ad
lea rax, vtable.CServicesScanner.0
mov qword [rdi], rax
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c28c
cmp rax, rbp
je 0x18001572b
mov qword [rax], rsi
jmp 0x18001572e
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.180011470
mov qword [rsi + 0x30], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rsi + 0x30]
mov qword [rax], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x10], rax
mov qword [rsi + 0x38], rbp
lea rsi, [rdi + 0x50]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c28c
cmp rax, rbp
je 0x18001577a
mov qword [rax], rsi
jmp 0x18001577d
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.180011470
mov qword [rsi + 0x30], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rsi + 0x30]
mov qword [rax], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x10], rax
mov qword [rsi + 0x38], rbp
jmp 0x1800157b0
mov rdi, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.180015fb8
mov ecx, 0x50
call fcn.18003c28c
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x180015830
lea rax, vtable.CNetScanner.0
mov qword [rdi], rax
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c28c
cmp rax, rbp
je 0x1800157fd
mov qword [rax], rsi
jmp 0x180015800
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.18000e944
mov qword [rsi + 0x30], rax
mov byte [rax + 0x1d], 1
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rsi + 0x30]
mov qword [rax], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x10], rax
mov qword [rsi + 0x38], rbp
jmp 0x180015833
mov rdi, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.180015fb8
mov ecx, 0x90
call fcn.18003c28c
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x18001585f
mov rcx, rax
call fcn.180012580
jmp 0x180015862
mov rax, rbp
mov rdx, rax
mov rcx, rbx
call fcn.180015fb8
mov ecx, 0x80
call fcn.18003c28c
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x1800158ff
lea rax, vtable.CSoftwareScanner.0
mov qword [rdi], rax
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c28c
cmp rax, rbp
je 0x1800158af
mov qword [rax], rsi
jmp 0x1800158b2
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.18001ee44
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rbp
lea rsi, [rdi + 0x48]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c28c
cmp rax, rbp
je 0x1800158e3
mov qword [rax], rsi
jmp 0x1800158e6
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.18001ee44
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rbp
mov byte [rdi + 8], bpl
jmp 0x180015902
mov rdi, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.180015fb8
mov ecx, 0x78
call fcn.18003c28c
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x18001599b
lea rax, vtable.CAntivirusScanner.0
mov qword [rdi], rax
lea rsi, [rdi + 8]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c28c
cmp rax, rbp
je 0x18001594f
mov qword [rax], rsi
jmp 0x180015952
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.180018b44
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rbp
lea rsi, [rdi + 0x40]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c28c
cmp rax, rbp
je 0x180015983
mov qword [rax], rsi
jmp 0x180015986
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.18001ee44
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rbp
jmp 0x18001599e
mov rdi, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.180015fb8
mov rcx, r15
call fcn.18003c28c
cmp rax, rbp
je 0x1800159c2
lea rcx, vtable.CPwdScanner.0
mov qword [rax], rcx
jmp 0x1800159c5
mov rax, rbp
mov rdx, rax
mov rcx, rbx
call fcn.180015fb8
mov ecx, 0x40
call fcn.18003c28c
mov rsi, rax
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x180015a2a
lea rax, vtable.CADDomainScanner.0
mov qword [rsi], rax
lea rdi, [rsi + 8]
mov qword [rsp + 0x88], rdi
mov rcx, r12
call fcn.18003c28c
cmp rax, rbp
je 0x180015a12
mov qword [rax], rdi
jmp 0x180015a15
mov rax, rbp
mov qword [rdi], rax
mov rcx, rdi
call fcn.18000eb20
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rbp
jmp 0x180015a2d
mov rsi, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.180015fb8
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, [0x1800179b4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x80], rax
mov al, 1
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret