Function at 0x180021a10
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xd0
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800ca088]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r13d, r8d
mov rbx, rdx
mov qword [rbp - 0x59], rdx
movdqa xmm0, xmmword [0x1800c01d0]
movdqa xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
movdqu xmmword [rbp - 0x39], xmm0
mov byte [rbp - 0x49], 0
lea esi, [r8 - 9]
mov dword [rbp - 0x61], esi
movzx edi, byte [rbp - 0x79]
cmp r8d, esi
jbe case.0x180021aa8.12
lea r12d, [r8 - 0xa5]
mov r15, qword [rbp - 0x59]
lea rdx, [0x180000000]
cmp r12d, 0xe
ja case.0x180021aa8.6
mov ecx, dword [rdx + r12*4 + 0x21df8]
add rcx, rdx
jmp rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x18003f5f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne case.0x180021aa8.6
mov ecx, 0x7e
mov eax, ecx
sub eax, 0x7e
je 0x180021af3
cmp eax, 0x4f
je case.0x180021aa8.12
jmp 0x180021af6
xor dil, dil
add ecx, 0x4f
cmp ecx, 0x11c
jb 0x180021ae1
jmp case.0x180021aa8.6
mov byte [0x1800cc91d], 0
jmp case.0x180021aa8.6
mov eax, dword [rbx]
mov qword [rbp - 0x71], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x69], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp - 0x71]
lea rdx, [rbp - 0x69]
lea ecx, [r9 + 0x66]
call fcn.180040950
mov dil, 1
jmp case.0x180021aa8.6
mov eax, 0x1b
nop word [rax + rax]
cmp eax, 0x1b
je 0x180021de3
inc eax
cmp eax, 0x1c
jb 0x180021b50
mov edx, 0x7f
lea rcx, [rbp - 0x49]
call fcn.18001b550
mov r15, rax
jmp case.0x180021aa8.6
test r15, r15
jne case.0x180021aa8.6
mov eax, 0x10
cmp eax, 0x10
je 0x180021c67
add eax, 0x30
cmp eax, 0x30
jbe 0x180021b84
jmp case.0x180021aa8.6
mov r9d, 0x39
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.1800231e0
test al, al
jne 0x180021be1
mov eax, 0x24
nop dword [rax]
cmp eax, 0x24
je 0x180021bd2
cmp eax, 0x654
je case.0x180021aa8.12
jmp 0x180021bd5
xor dil, dil
add eax, 0x630
cmp eax, 0xc60
jbe 0x180021bc0
mov r9d, 0x46
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x29]
call fcn.18000a050
test al, al
jne case.0x180021aa8.6
mov eax, 0x53
cmp eax, 0x53
je 0x180021c10
cmp eax, 0x11d5
je case.0x180021aa8.12
jmp 0x180021c13
xor dil, dil
add eax, 0x1182
cmp eax, 0x2304
jbe 0x180021c02
jmp case.0x180021aa8.6
mov rbx, qword [0x1800d1a98]
cmp rbx, qword [0x1800d1aa0]
je 0x180021dc4
mov rax, qword [rbx]
mov rcx, r15
call rax
test al, al
jne 0x180021db0
mov r14d, 0x9f
nop
mov eax, r14d
sub eax, 0x9f
je 0x180021d22
cmp eax, 1
jne 0x180021da0
xor dil, dil
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x180021ca5
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180021ca0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021df1
call fcn.180080414
movdqa xmm0, xmmword [0x1800c01d0]
movdqu xmmword [rbp - 0x39], xmm0
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x180021cf1
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180021cec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021deb
call fcn.180080414
movzx eax, dil
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1800803f0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rbp - 0x71], r15
mov esi, 0x81
nop dword [rax + rax]
mov eax, esi
sub eax, 0x10
je 0x180021d80
sub eax, 0x71
je 0x180021d64
cmp eax, 0x50f
jne 0x180021d92
mov eax, dword [rbp - 0x65]
mov dword [rbp - 0x69], eax
mov r9d, 0xc5
xor r8d, r8d
lea rdx, [rbp - 0x71]
lea rcx, [rbp - 0x69]
call fcn.180010ce0
mov dword [rbp - 0x65], eax
jmp 0x180021d92
mov rax, qword [0x1800d1a80]
test rax, rax
je 0x180021d92
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x71]
call rax
jmp 0x180021d92
movsxd rdx, dword [rbp - 0x65]
mov cl, byte [pe_dos_header]
mov rax, qword [rbp - 0x71]
mov byte [rdx + rax], cl
add esi, 0x2c58
cmp esi, 0x8508
jbe 0x180021d30
inc r14d
cmp r14d, 0xa1
jb 0x180021c50
add rbx, 8
cmp rbx, qword [0x1800d1aa0]
jne 0x180021c38
mov esi, dword [rbp - 0x61]
mov byte [0x1800cc91d], 1
mov rbx, qword [rbp - 0x59]
dec r13d
dec r12d
cmp r13d, esi
jbe case.0x180021aa8.12
jmp 0x180021a8c
mov dil, 1
jmp case.0x180021aa8.12
call fcn.1800893f4
nop
call fcn.1800893f4
int3