Function at 0x180001010
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
test edx, edx
je 0x1800010a5
cmp edx, 1
jne 0x18000126c
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rcx, str.windir
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov rsi, rax
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x20], xmm0
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rdi, rax
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jae 0x18000127c
cmp rdi, 7
ja 0x1800010b7
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 7
lea r8, [rdi + rdi]
lea rcx, [rbp - 0x30]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rdi*2 - 0x30]
add rax, rbp
jmp 0x180001141
mov rcx, qword [0x1800125a0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x18000126c
mov rax, rdi
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x180001281
cmp rax, 0xb
mov r14d, 0xa
cmovae r14, rax
lea rcx, [r14 + r14]
cmp r14, 0x7ff
jb 0x180001116
movabs rax, 0x7fffffffffffffec
cmp r14, rax
jae 0x180001281
add rcx, 0x29
call fcn.18000a4d0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180001122
add rcx, 2
call fcn.18000a4d0
mov rbx, rax
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], r14
lea r8, [rdi + rdi]
mov rcx, rbx
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbx + rdi*2]
mov word [rax], 0
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov rdx, rcx
sub rdx, rax
cmp rdx, 0x1c
jae 0x180001185
mov qword [rsp + 0x20], 0x1c
lea r9, str.System32D3DCompiler_43.dll
lea rcx, [rbp - 0x30]
mov edx, 0x1c
call fcn.180009900
cmp qword [rbp - 0x18], 8
jb 0x1800011dd
mov rcx, qword [rbp - 0x30]
jmp 0x1800011e1
lea rdx, [rax + 0x1c]
mov qword [rbp - 0x20], rdx
cmp rcx, 8
jb 0x180001199
mov rcx, qword [rbp - 0x30]
jmp 0x18000119d
lea rcx, [rbp - 0x30]
movups xmm0, xmmword [0x18000df62]
movups xmmword [rcx + rax*2 + 0x20], xmm0
movups xmm0, xmmword [0x18000df52]
movups xmmword [rcx + rax*2 + 0x10], xmm0
movups xmm0, xmmword [str.System32D3DCompiler_43.dll]
movups xmmword [rcx + rax*2], xmm0
movabs rdx, 0x6c006c0064002e
mov qword [rcx + rax*2 + 0x30], rdx
mov word [rcx + rax*2 + 0x38], 0
cmp qword [rbp - 0x18], 8
jae 0x18000117f
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1800125a0], rax
lea rdx, [0x18000dd4b]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180012598], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x180001330]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [rbp - 0x18]
cmp rax, 8
jb 0x18000126c
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x180001267
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180001286
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.18000a514
mov eax, 1
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.180003bb0
call fcn.180003bd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3