Function at 0x180021fa0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x218]
sub rsp, 0x318
movdqa xmm0, xmmword [0x180043640]
xor edi, edi
movdqu xmmword [rbp + 0x5a], xmm0
mov r14, rcx
mov esi, r9d
movdqu xmmword [rbp + 0x2a], xmm0
mov qword [rbp + 0x40], rdi
lea ecx, [rdi + 0x30]
xorps xmm0, xmm0
mov word [rbp + 0x48], di
mov r15, r8
mov byte [rbp + 0x4a], dil
mov r13, rdx
mov qword [rbp + 0x10], rdi
mov word [rbp + 0x18], di
mov byte [rbp + 0x1a], dil
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xb0], rdi
call fcn.180025238
xorps xmm0, xmm0
lea r10d, [rsi - 0x11]
xorps xmm2, xmm2
mov dword [rsp + 0x30], r10d
xorps xmm1, xmm1
mov r8, 0xffffffffffffffff
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xa8], rax
xor eax, eax
mov qword [rbp + 0x170], rax
mov byte [rbp + 0x178], al
mov word [rbp + 0x1c0], ax
movsd qword [rbp + 0xc0], xmm2
movsd qword [rbp + 0x1b8], xmm2
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xd0], rdi
mov dword [rbp + 0xd8], 1
movdqa xmmword [rbp + 0xe0], xmm0
movdqa xmmword [rbp + 0xf0], xmm1
movdqa xmmword [rbp + 0x100], xmm0
movdqa xmmword [rbp + 0x110], xmm1
mov qword [rbp + 0x120], r8
mov dword [rbp + 0x128], edi
mov qword [rbp + 0x188], rdi
mov qword [rbp + 0x190], 0xf
mov word [rbp + 0x198], di
mov dword [rbp + 0x19c], edi
mov qword [rbp + 0x1a0], rdi
mov byte [rbp - 0x10], al
mov qword [rbp], rdi
mov qword [rbp + 8], 0xf
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x1a8], xmm0
mov byte [rbp + 0x1c2], al
mov eax, esi
mov dword [rsp + 0x40], eax
cmp esi, r10d
jbe 0x180022501
lea rdx, [0x180000000]
mov r8d, 0x1bb
lea r9d, [rdi + 0x43]
lea rsi, [0x180006c40]
add eax, 0xffffff5a
movabs r11, 0x6666666666666667
movabs rbx, 0x666666666666666
cmp eax, 0x59
ja case.0x18002219a.183
movzx eax, byte [rdx + rax + 0x22d00]
mov ecx, dword [rdx + rax*4 + 0x22cb8]
add rcx, rdx
jmp rcx
mov r9, qword [r13 + 8]
mov rax, r11
mov r8, qword [r14]
mov rsi, r9
mov rcx, qword [r14 + 0x10]
mov r12, qword [r13]
sub rcx, r8
imul rcx
sub rsi, r12
mov qword [rbp - 0x80], r9
sar rdx, 4
mov rax, rdx
sar rsi, 5
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jbe 0x18002224a
cmp rsi, rbx
ja 0x180022cb1
mov rcx, qword [r14 + 8]
mov rax, r11
sub rcx, r8
imul rcx
mov rcx, r14
mov rdi, rdx
mov rdx, rsi
sar rdi, 4
mov rax, rdi
shr rax, 0x3f
add rdi, rax
call fcn.18001dbf0
mov rdx, qword [r14 + 8]
mov r9, r14
mov rcx, qword [r14]
mov r8, rax
mov rbx, rax
call fcn.180003d40
mov r9, rsi
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.180019f20
mov r9, qword [r13 + 8]
xor edi, edi
mov r12, qword [r13]
movabs r11, 0x6666666666666667
mov r10d, dword [rsp + 0x30]
mov qword [rbp - 0x80], r9
cmp r12, r9
je 0x1800224c7
nop dword [rax]
nop word [rax + rax]
mov r13d, 0xf
mov qword [rsp + 0x68], rdi
movzx ecx, di
mov qword [rsp + 0x70], r13
mov edx, edi
mov word [rsp + 0x78], cx
mov eax, 0x24
mov dword [rsp + 0x7c], edx
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x58], 0
nop dword [rax]
sub eax, 0x23
je 0x1800222d9
cmp eax, 1
jne 0x180022449
lea rax, [rsp + 0x58]
cmp rax, r12
je 0x1800222cb
cmp qword [r12 + 0x18], 0x10
mov rdx, r12
jb 0x1800222b7
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
lea rcx, [rsp + 0x58]
call fcn.18001e0e0
mov r13, qword [rsp + 0x70]
movzx ecx, word [r15]
mov word [rsp + 0x78], cx
jmp 0x180022449
mov rbx, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
cmp rbx, r8
je 0x18002231d
movups xmm1, xmmword [rsp + 0x68]
mov r13d, 0xf
mov qword [rsp + 0x68], rdi
movups xmm0, xmmword [rsp + 0x58]
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x58], 0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov word [rbx + 0x20], cx
mov dword [rbx + 0x24], edx
add qword [r14 + 8], 0x28
jmp 0x180022449
mov r9, qword [r14]
mov rcx, rbx
sub rcx, r9
mov rax, r11
imul rcx
movabs r10, 0x666666666666666
mov r14, rdx
sar r14, 4
mov rax, r14
shr rax, 0x3f
add r14, rax
cmp r14, r10
je 0x180022cb1
sub r8, r9
lea r15, [r14 + 1]
mov rax, r11
imul r8
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r10
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
jbe 0x180022381
mov rdi, r15
jmp 0x18002238c
lea rdi, [rcx + rdx]
cmp rdi, r15
cmovb rdi, r15
mov rcx, qword [rbp + 0x260]
mov rdx, rdi
call fcn.18001dbf0
movups xmm1, xmmword [rsp + 0x68]
mov rsi, rax
lea r14, [r14 + r14*4]
movups xmm0, xmmword [rsp + 0x58]
mov r13d, 0xf
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], r13
mov r8, rsi
movups xmmword [rax + r14*8], xmm0
mov byte [rsp + 0x58], 0
movups xmmword [rax + r14*8 + 0x10], xmm1
movzx eax, word [rsp + 0x78]
mov word [rsi + r14*8 + 0x20], ax
mov eax, dword [rsp + 0x7c]
mov dword [rsi + r14*8 + 0x24], eax
mov rax, qword [rbp + 0x260]
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
cmp rbx, rdx
je 0x18002241b
mov r9, rax
mov rdx, rbx
call fcn.180003d40
mov rax, qword [rbp + 0x260]
lea r8, [r14 + 5]
mov rcx, rbx
lea r8, [rsi + r8*8]
mov rdx, qword [rax + 8]
mov r14, qword [rbp + 0x260]
mov r9, r14
call fcn.180003d40
mov r9, rdi
mov r8, r15
mov rdx, rsi
mov rcx, r14
call fcn.180019f20
movzx ecx, word [rsp + 0x78]
xor edi, edi
mov r15, qword [rbp + 0x270]
mov eax, dword [rsp + 0x38]
movabs r11, 0x6666666666666667
mov edx, dword [rsp + 0x7c]
dec eax
mov dword [rsp + 0x38], eax
cmp eax, 0x22
ja 0x180022290
cmp r13, 0x10
jb 0x1800224a3
mov rcx, qword [rsp + 0x58]
lea rdx, [r13 + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002249e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180022cab
call fcn.180025274
add r12, 0x20
movabs r11, 0x6666666666666667
cmp r12, qword [rbp - 0x80]
jne 0x180022260
mov r13, qword [rbp + 0x268]
mov r10d, dword [rsp + 0x30]
lea rsi, [0x180006c40]
mov r9d, 0x43
lea rdx, [0x180000000]
mov r8d, 0x1bb
mov eax, dword [rsp + 0x40]
dec eax
mov dword [rsp + 0x40], eax
cmp eax, r10d
ja 0x180022166
mov esi, dword [rbp + 0x278]
mov r8, 0xffffffffffffffff
lea edi, [rsi + 0xab1]
cmp esi, edi
jae 0x180022aa7
mov rbx, qword [rsp + 0x48]
lea r14, [0x180008d10]
nop dword [rax + rax]
cmp esi, 0x230
ja 0x180022a20
je 0x180022a10
cmp esi, 0x17e
ja 0x18002297c
je 0x180022959
mov eax, esi
sub eax, 0xaa
je 0x180022935
sub eax, 0x33
je 0x1800228fa
sub eax, 0x22
je 0x180022aa7
cmp eax, 0x4c
jne 0x180022c91
mov byte [rsp + 0x34], 1
jmp 0x180022c91
lea r9, [0x1800590a0]
xor r8d, r8d
mov edx, 0x8e
xor ecx, ecx
call fcn.180005c60
mov r10d, dword [rsp + 0x30]
jmp 0x1800224ce
mov edx, 0x29
lea rcx, [rbp - 0x70]
call fcn.180015270
test al, al
je 0x1800228f0
mov r10d, dword [rsp + 0x30]
jmp 0x1800224ce
lea rdx, [0x1800590a8]
mov ecx, 3
call fcn.180008980
test al, al
jne 0x1800225f6
mov ecx, 0x11c
mov eax, ecx
sub eax, 0x11c
je 0x1800225e4
cmp eax, 1
je case.0x18002219a.171
jmp 0x1800225ec
mov dword [rsp + 0x34], 1
inc ecx
cmp ecx, 0x11e
jb 0x1800225d0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.180029ee4
mov r10d, dword [rsp + 0x30]
jmp 0x1800224ce
mov word [rsp + 0x38], r8w
lea r9, [rbp + 0x10]
lea r8, [rsp + 0x38]
mov edx, 0x11a
lea rcx, [0x180059108]
call fcn.180005c60
mov r10d, dword [rsp + 0x30]
jmp 0x1800224ce
movsd xmm0, qword [str.kern]
movzx eax, word [0x180042060]
movsd qword [rbp + 0x70], xmm0
mov word [rbp + 0x78], ax
jmp case.0x18002219a.183
movups xmm0, xmmword [str.el32.dll]
movzx eax, word [0x180042078]
lea r8, str.GetSystemInfo
mov edx, 0x5b
mov word [rbp + 0x88], ax
lea rcx, [rbp + 0x70]
movups xmmword [rbp + 0x78], xmm0
call fcn.180005a90
mov r10d, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
jmp 0x1800224ce
mov r8d, 2
lea rdx, [0x180042090]
lea rcx, [rsp + 0x50]
call fcn.1800298b0
xor edx, edx
mov r8d, 0xaa
mov rcx, r13
call fcn.18001e4c0
test al, al
jne 0x18002258c
mov ecx, 0x121
nop word [rax + rax]
mov eax, ecx
sub eax, 0x120
je case.0x18002219a.171
cmp eax, 1
jne 0x1800226e7
mov byte [rsp + 0x34], 0
dec ecx
cmp ecx, 0x11f
ja 0x1800226d0
mov r10d, dword [rsp + 0x30]
jmp 0x1800224ce
cmp qword [r13 + 0x28], 0
je case.0x18002219a.183
mov ecx, 0x16
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x16
je 0x180022722
cmp eax, 1
je case.0x18002219a.171
jmp 0x180022727
mov byte [rsp + 0x34], 1
inc ecx
cmp ecx, 0x18
jb 0x180022710
jmp case.0x18002219a.183
lea rcx, [rbp + 0x1e0]
call qword [rsp + 0x48]
mov eax, dword [rbp + 0x200]
mov r10d, dword [rsp + 0x30]
mov dword [r13 + 0x30], eax
jmp 0x1800224ce
mov word [rsp + 0x38], r8w
lea rdx, [0x1800590e8]
lea r8, [rsp + 0x38]
mov r9d, 0xd0
lea rcx, [rbp + 0x40]
call fcn.18000f260
mov r10d, dword [rsp + 0x30]
jmp 0x1800224ce
mov word [rsp + 0x50], r9w
jmp case.0x18002219a.183
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 0x34]
call fcn.180013570
test al, al
je 0x1800228f0
mov r10d, dword [rsp + 0x30]
jmp 0x1800224ce
cmp dword [rbp - 0x70], 2
jb 0x1800227d6
mov eax, 0x7e
cmp eax, 0x7e
je 0x1800227c5
cmp eax, 0x5916
je case.0x18002219a.171
jmp 0x1800227ca
mov byte [rsp + 0x34], 1
add eax, 0x5898
cmp eax, 0xb130
jbe 0x1800227b3
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov edx, 0x82
xor ecx, ecx
call fcn.180010820
mov r10d, dword [rsp + 0x30]
cmp eax, 3
setae byte [rsp + 0x34]
jmp 0x1800224ce
xor edx, edx
lea r8, [rbp - 0x60]
lea ecx, [rdx + 0x48]
call fcn.18001e390
mov rdx, qword [rbp - 0x58]
lea rax, [rbp + 0x40]
mov qword [rbp - 0x80], rax
cmp rdx, qword [rbp - 0x50]
je 0x180022835
mov r10d, dword [rsp + 0x30]
lea rax, [rbp + 0x40]
mov qword [rdx], rax
add qword [rbp - 0x58], 8
jmp 0x1800224ce
lea r8, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.180001740
mov r10d, dword [rsp + 0x30]
jmp 0x1800224ce
mov edx, 0x106
xor ecx, ecx
call fcn.1800175b0
test al, al
jne 0x1800228cb
mov ebx, 0x27
mov eax, ebx
sub eax, 0x27
je 0x1800228bd
sub eax, 1
je 0x1800228b4
cmp eax, 1
jne 0x1800228c4
lea r9, [rbp + 0x90]
xor r8d, r8d
mov edx, 0xa4
xor ecx, ecx
call fcn.180016de0
test al, al
jne 0x1800228c4
mov ecx, reloc.SHELL32.dll_ILAppendID
mov eax, ecx
sub eax, 0x99
je case.0x18002219a.171
cmp eax, 1
jne 0x1800228a8
mov byte [rsp + 0x34], 0
dec ecx
cmp ecx, 0x98
ja 0x180022891
jmp 0x1800228c4
mov qword [rbp + 0x98], r13
jmp 0x1800228c4
mov qword [rbp + 0x90], rsi
inc ebx
cmp ebx, 0x2a
jb 0x180022861
lea rcx, [r13 + 0x50]
mov r9d, reloc.SHELL32.dll_DAD_SetDragImage
xor r8d, r8d
xor edx, edx
call fcn.18000f260
mov r10d, dword [rsp + 0x30]
mov byte [rsp + 0x34], al
jmp 0x1800224ce
mov byte [rsp + 0x34], 0
jmp case.0x18002219a.171
lea rax, [rbp + 0x10]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x58]
cmp rax, qword [rbp - 0x50]
je 0x18002291e
lea rcx, [rbp + 0x10]
mov qword [rax], rcx
add qword [rbp - 0x58], 8
jmp 0x180022c91
mov rdx, qword [rbp - 0x58]
lea r8, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.180001740
jmp 0x180022c91
mov ecx, dword [r13 + 0x30]
mov eax, 0x30
add rcx, rcx
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.18002527c
mov qword [r13 + 0x10], rax
jmp 0x180022c91
mov eax, dword [0x180059130]
lea rdx, [rsp + 0x40]
mov r8d, 0x32
mov dword [rsp + 0x40], eax
lea rcx, [rbp - 0x60]
call fcn.180013570
jmp 0x180022c91
mov eax, esi
sub eax, 0x18f
je 0x1800229e8
sub eax, 0x5d
je 0x180022aa7
cmp eax, 0x33
jne 0x180022c91
lea rax, [rbp - 0x60]
xor edx, edx
mov qword [rbp - 0x80], rax
lea r9, [rbp + 0x1d0]
mov eax, dword [0x180059130]
lea r8, [0x1800157d0]
mov dword [rbp - 0x78], eax
xor ecx, ecx
mov eax, dword [0x180059134]
mov dword [rbp - 0x74], eax
xor eax, eax
movaps xmm0, xmmword [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
movdqa xmmword [rbp + 0x1d0], xmm0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
jmp 0x180022c91
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x1800229f5
mov rcx, qword [r15]
mov rdx, qword [r13 + 0x80]
lea r9, [rbp - 0x10]
mov r8d, 0xbf
call fcn.18000b280
jmp 0x180022c91
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyA]
jmp 0x180022c91
cmp esi, 0x372
ja 0x180022c39
je 0x180022aa7
mov eax, esi
sub eax, 0x2c0
je 0x180022a83
sub eax, 0x11
je 0x180022a69
cmp eax, 0x90
jne 0x180022c91
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], r14
mov ecx, 0x10
call fcn.18000de00
jmp 0x180022c91
lea r8, [rbp - 0x10]
mov edx, 0xf0
mov rcx, r13
call fcn.180007cc0
mov byte [rsp + 0x34], al
jmp 0x180022c91
test rbx, rbx
jne 0x180022c91
mov ecx, 0x11e
mov eax, ecx
sub eax, 0x11e
je 0x180022c21
cmp eax, 1
jne 0x180022c29
xor edi, edi
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x180022ae4
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022adf
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180022cab
call fcn.180025274
lea rcx, [rbp + 0x120]
mov qword [rbp], rdi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
call fcn.180004a70
lea rcx, [rbp + 0x108]
call fcn.180004980
mov rdx, qword [rbp + 0xf0]
test rdx, rdx
je 0x180022b44
mov r8, qword [rbp + 0x100]
lea rcx, [rbp + 0xf0]
sub r8, rdx
sar r8, 4
call fcn.18001f640
xorps xmm0, xmm0
mov qword [rbp + 0x100], rdi
movdqa xmmword [rbp + 0xf0], xmm0
lea rcx, [rbp + 0xa8]
call fcn.180004a10
lea rcx, [rbp - 0x48]
call fcn.18001d680
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x180022b82
mov r8, qword [rbp - 0x50]
lea rcx, [rbp - 0x60]
sub r8, rdx
sar r8, 3
call fcn.18001f5f0
xorps xmm0, xmm0
mov qword [rbp - 0x50], rdi
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rbp + 0x32]
cmp rdx, 0x10
jb 0x180022bbd
mov rcx, qword [rbp + 0x1a]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022bb8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180022cab
call fcn.180025274
mov rdx, qword [rbp + 0x62]
movdqa xmm0, xmmword [0x180043640]
mov byte [rbp + 0x1a], 0
movdqu xmmword [rbp + 0x2a], xmm0
cmp rdx, 0x10
jb 0x180022c09
mov rcx, qword [rbp + 0x4a]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022c04
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180022cab
call fcn.180025274
mov eax, dword [rsp + 0x34]
add rsp, 0x318
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rsp + 0x34], 1
inc ecx
cmp ecx, 0x120
jb 0x180022a91
jmp 0x180022c91
cmp esi, 0x402
je 0x180022c61
cmp esi, 0x4a3
je 0x180022c57
cmp esi, 0x544
je 0x180022aa7
jmp 0x180022c91
mov dword [rsp + 0x34], 0
jmp 0x180022c91
lea r9, [rbp + 0xa0]
mov edx, 0xe0
lea r8, [0x1800590a0]
lea rcx, [rbp - 0x60]
call fcn.180005c60
xor edx, edx
lea r9, [rbp + 0xa0]
xor ecx, ecx
lea r8d, [rdx + 0x57]
call fcn.180013050
add esi, 0xa1
cmp esi, edi
jae 0x180022aa7
mov r8, 0xffffffffffffffff
jmp 0x180022520
call fcn.180029384
int3
call fcn.18001db40
int3