Function at 0x180005ee0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1800737f8]
xor rax, rsp
mov qword [rbp - 8], rax
lea r14d, [r8 + 0xb]
mov r15d, r8d
mov rdi, rdx
mov r12, rcx
cmp r8d, r14d
jae 0x180006075
mov edx, 0x50
lea esi, [r8 - 0x61]
lea r13, [0x180000000]
xor ebx, ebx
lea r9d, [rdx + 4]
lea r10d, [rdx + 0x13]
lea r8d, [rdx - 8]
nop dword [rax]
cmp esi, 0x16
ja case.0x180005f54.7
mov ecx, dword [r13 + rsi*4 + 0x6450]
add rcx, r13
jmp rcx
mov byte [rbp - 0x30], bl
jmp case.0x180005f54.7
lea rcx, [rbp - 0x40]
dec rcx
cmp byte [rcx + 1], bl
lea rcx, [rcx + 1]
jne 0x180005f65
movzx eax, word [0x1800664c4]
mov word [rcx], ax
mov word [rbp - 0x3e], r9w
jmp case.0x180005f54.7
mov word [rbp - 0x3d], dx
jmp case.0x180005f54.7
lea rcx, [rbp - 0x48]
mov dword [rbp - 0x47], 0x736f6c
dec rcx
nop dword [rax]
cmp byte [rcx + 1], bl
lea rcx, [rcx + 1]
jne 0x180005fa0
movzx eax, word [0x180065a90]
mov word [rcx], ax
jmp case.0x180005f54.7
mov r8d, 4
mov word [rbp - 0x3c], reloc.SHELL32.dll_PathMakeUniqueName
lea rdx, [0x1800664c8]
lea rcx, [rbp - 0x3b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edx, 0x50
lea r8d, [rdx - 8]
lea r9d, [rdx + 4]
lea r10d, [rdx + 0x13]
jmp case.0x180005f54.7
mov qword [rsp + 0x28], rbx
lea r8, [0x180009250]
mov r9, r12
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r12], rax
test rax, rax
jne 0x180005fd5
mov byte [rbp - 0x48], bl
jmp 0x180006424
xor r9d, r9d
mov dword [rbp - 0x50], 1
mov r8d, 0x112
lea rdx, [rbp - 0x50]
mov rcx, r12
call fcn.1800198a0
jmp 0x180005fd5
lea rcx, [rbp - 0x10]
mov byte [rbp - 0x10], bl
dec rcx
nop
cmp byte [rcx + 1], bl
lea rcx, [rcx + 1]
jne 0x180006040
mov eax, dword [str.Host]
mov dword [rcx], eax
movzx eax, byte [0x1800664d0]
mov byte [rcx + 4], al
mov word [rbp - 0x48], r10w
jmp case.0x180005f54.7
mov word [rbp - 0x40], r8w
inc esi
lea eax, [rsi + 0x61]
cmp eax, r14d
jb 0x180005f40
lea r14d, [r15 + 0x46d]
cmp r15d, r14d
jae 0x180006424
lea r13, [0x1800737c0]
nop dword [rax]
cmp r15d, 0x264
ja 0x180006278
je 0x18000621c
mov eax, r15d
sub eax, 0x61
je 0x1800061d2
sub eax, 0x67
je 0x1800061c9
sub eax, 0x67
je 0x1800061b9
sub eax, 0x67
je 0x18000618d
cmp eax, 0x67
jne 0x180006417
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x18000612b
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800060fb
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 3
mov rcx, rbx
lea rdx, [0x1800664dc]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x18000614a
mov byte [rbp - 0x48], 1
jmp 0x180006424
mov rax, rbx
jmp 0x180006428
xor r8d, r8d
mov qword [rsp + 0x20], 3
lea r9, [0x1800664dc]
mov rcx, rdi
lea edx, [r8 + 3]
call fcn.180002130
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180006176
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18000616b
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x180006417
mov r9b, 0x20
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180001fd0
jmp 0x180006417
movzx eax, word [0x1800664d4]
mov dword [rbp - 0x1d], 0x412d72
mov word [rbp - 0x1a], ax
movzx eax, word [0x1800664d8]
mov word [rbp - 0x18], ax
movzx eax, byte [0x1800664da]
mov byte [rbp - 0x16], al
jmp 0x180006417
mov byte [rbp - 0x26], 0
mov dword [rbp - 0x20], 0x657355
jmp 0x180006417
mov byte [rbp - 0x27], 0x6e
jmp 0x180006417
mov r8d, 5
lea rdx, [0x1800664ed]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 1
lea rdx, [0x180066514]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 3
lea rdx, [0x180066553]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180006417
cmp qword [r12 + 0x38], 0x10
lea rax, [r12 + 0x20]
jb 0x18000622c
mov rax, qword [rax]
cmp byte [rax], 0x2f
je 0x180006417
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180006261
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180006256
mov rax, qword [rdi]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x180006417
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180001fd0
jmp 0x180006417
mov eax, r15d
sub eax, 0x2cb
je 0x1800063f8
sub eax, 0x67
je 0x180006343
sub eax, 0x67
je 0x180006318
sub eax, 0x67
je 0x1800062e7
cmp eax, 0x67
jne 0x180006417
cmp qword [0x1800737d8], 0x10
mov rdx, r13
mov r8, qword [0x1800737d0]
mov rcx, rdi
cmovae rdx, qword [0x1800737c0]
call fcn.180020030
cmp qword [0x1800737d8], 0x10
mov rdx, r13
mov r8, qword [0x1800737d0]
cmovae rdx, qword [0x1800737c0]
jmp 0x18000640f
xor edx, edx
lea rax, [rbp - 0x30]
lea r9, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea r8d, [rdx + 0x42]
call fcn.18003e630
cmp qword [r12 + 0x58], 0x10
lea r9, [r12 + 0x40]
jb 0x180006312
mov r9, qword [r9]
lea rax, [rbp - 0x20]
jmp 0x18000632b
cmp qword [r12 + 0x18], 0x10
mov r9, r12
jb 0x180006327
mov r9, qword [r12]
lea rax, [rbp - 0x10]
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea r8d, [rdx + 0x42]
call fcn.18003e630
jmp 0x180006417
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18000636c
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180006364
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x18000637e
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180001fd0
lea rax, [rbp - 0x40]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180006390
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x1800063dc
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800063c0
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x1800062c8
lea r9, [rbp - 0x40]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180002130
jmp 0x1800062c8
cmp qword [r12 + 0x38], 0x10
lea rdx, [r12 + 0x20]
jb 0x18000640a
mov rdx, qword [r12 + 0x20]
mov r8, qword [r12 + 0x30]
mov rcx, rdi
call fcn.180020030
add r15d, 0x67
cmp r15d, r14d
jb 0x180006090
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800604b0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret