Function at 0x180017b20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180081de0]
xor rax, rsp
mov qword [rsp + 0x60], rax
imul r14d, ecx, 0x391
mov r15, r8
mov rbx, rdx
mov ebp, ecx
mov edi, ecx
cmp ecx, r14d
ja 0x180017e37
mov rsi, qword [rsp + 0x38]
mov r13d, 0x73
xor r12d, r12d
lea ecx, [r13 - 0x12]
lea edx, [rcx + 0xc]
lea r8d, [r13 - 0xe]
mov eax, 0x6e
cmp edi, 0x3234
ja 0x180017c87
je 0x180017e2b
mov eax, edi
sub eax, 0x25
je 0x180017c79
sub eax, 0x74
je 0x180017bce
sub eax, 0xd
je 0x180017bc3
sub eax, 0x55
je 0x180017d80
cmp eax, 0xb29
je 0x180017e37
jmp 0x180017d65
mov word [rsp + 0x40], r13w
jmp 0x180017d65
mov r8d, 0x19
mov rdx, rbx
xor ecx, ecx
call fcn.180009ea0
test al, al
je 0x180017e32
cmp qword [rbx + 0x30], r12
jne 0x180017c29
mov ecx, dword [rbx + 0x28]
xor r9d, r9d
mov rdx, qword [rbx + 0x10]
mov qword [rbx + 0x30], rdx
lea rax, [rcx + rcx*2]
lea r8d, [rcx + rcx*2]
shl rax, 4
add rax, rdx
shl r8d, 4
lea ecx, [r9 + 8]
mov qword [rbx + 0x38], rax
call qword [rbx + 0x20]
test eax, eax
jne 0x180017e32
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbx + 0x28]
xor r9d, r9d
mov rdx, qword [rbx + 0x38]
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [rbx + 0x20]
test eax, eax
jne 0x180017e32
xor r8d, r8d
lea ecx, [rax + 0x5b]
mov rdx, rbx
call fcn.180042280
mov rcx, qword [rbx + 0x30]
mov rax, qword [rbx + 0x38]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rcx
mov ecx, 0x61
lea edx, [rcx + 0xc]
lea r8d, [rcx + 4]
jmp 0x180017d65
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x38], rax
jmp 0x180017d65
cmp edi, 0x3678
je 0x180017d40
cmp edi, 0x6c4a
je 0x180017d27
cmp edi, 0xa21c
je 0x180017cf1
cmp edi, 0xd7ee
je 0x180017cc0
cmp edi, 0x10dc0
je 0x180017e37
jmp 0x180017d65
test rsi, rsi
je 0x180017e32
mov rax, rsi
lea rcx, [rsp + 0x40]
xchg qword [0x180081eb0], rax
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov byte [rsp + 0x38], 1
mov ecx, 0x61
lea edx, [rcx + 0xc]
lea r8d, [rcx + 4]
jmp 0x180017d65
mov qword [rsp + 0x28], r12
lea r8, [0x180018180]
mov r9, rbx
mov dword [rsp + 0x20], r12d
xor edx, edx
mov qword [rbx + 0x80], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
mov ecx, 0x61
lea edx, [rcx + 0xc]
lea r8d, [rcx + 4]
jmp 0x180017d65
mov dword [rsp + 0x54], 0x6d0061
mov dword [rsp + 0x58], 0x65
mov qword [0x180081ea8], rbx
jmp 0x180017d65
mov dword [rsp + 0x42], 0x680063
mov dword [rsp + 0x46], 0x6d0065
mov dword [rsp + 0x4a], 0x3a0065
mov dword [rsp + 0x4e], 0x5f005c
mov word [rsp + 0x52], ax
imul eax, ebp, 0x53
add edi, eax
cmp edi, r14d
ja 0x180017e37
jmp 0x180017b7e
mov esi, 0x47
mov eax, esi
sub eax, 0x47
je 0x180017db4
sub eax, 1
je 0x180017da7
cmp eax, 1
jne 0x180017e1b
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180017e1b
mov rcx, qword [rbx + 0x38]
lea rdx, [rbx + 0x58]
call qword [rbx + 0x30]
jmp 0x180017e1b
mov rcx, qword [rbx + 0x18]
lea rdi, [rbx + 0x58]
mov rdx, rdi
call qword [rbx + 0x10]
test al, al
je 0x180017e32
cmp qword [rdi + 0x18], 0x10
jb 0x180017dd0
mov rdi, qword [rdi]
movzx eax, word [rbx + 0x78]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov r9d, 0x132
mov word [rsp + 0x30], ax
xor r8d, r8d
mov rax, qword [0x180081ea8]
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180006fb0
test al, al
jne 0x180017e2b
mov rcx, qword [0x180081ea8]
mov edx, GetAcceptLanguagesA
call fcn.1800571e0
test al, al
je 0x180017e32
inc esi
cmp esi, 0x4a
jb 0x180017d85
jmp 0x180017d80
mov byte [rsp + 0x38], 1
jmp 0x180017e37
mov byte [rsp + 0x38], r12b
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18005fed0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret