Function at 0x1800087cc
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], r14
xor r14d, r14d
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
call fcn.18000adf0
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.MessageBoxTimeoutA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180035870], rax
lea rsi, [0x180035710]
test rax, rax
jne 0x18000883b
lea edi, [rax + 0x7f]
jmp 0x180008b16
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.1800188a0
mov edi, eax
test eax, eax
jne 0x180008ac6
mov ecx, 0x8007
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.180008b38
mov rcx, qword [0x180035658]
xor edx, edx
mov r8d, 0x878
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180008b1e
xor edx, edx
mov r8d, 0x778
mov rcx, rax
call sub.ntdll.dll_memset
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x180008b1e
lea rcx, [rbx + 0x88]
mov rdx, rsi
call fcn.18001e238
mov edi, eax
test eax, eax
jne 0x180008ac6
movaps xmm0, xmmword [0x180035710]
lea r8, [0x180008c8c]
movups xmmword [rbx + 0x18], xmm0
mov r9, rsi
mov qword [rsp + 0x28], r14
movaps xmm1, xmmword [0x180035720]
xor edx, edx
movups xmmword [rbx + 0x28], xmm1
xor ecx, ecx
mov dword [rsp + 0x20], r14d
movaps xmm0, xmmword [0x180035730]
movups xmmword [rbx + 0x38], xmm0
movaps xmm1, xmmword [0x180035740]
movups xmmword [rbx + 0x48], xmm1
movaps xmm0, xmmword [0x180035750]
movups xmmword [rbx + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180035730]
mov edi, 1
test rax, rax
je 0x1800089d8
cmp dword [rax + 0x16c], r14d
jne 0x18000895a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x180035730]
test rax, rax
jne 0x18000893d
test rax, rax
je 0x1800089d8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x180035730]
cmp dword [rcx + 0x16c], eax
jne 0x1800089d8
mov dword [0x180035768], edi
call fcn.18000add8
cmp eax, 5
jbe 0x180008a52
lea r9, str.Program_Manager
xor edx, edx
lea r8, str.Progman
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
xor r8d, r8d
lea rdx, str.SHELLDLL_DefView
mov rcx, rax
call fcn.18001b940
lea r8, str.FolderView
mov qword [rbx + 0x118], rax
lea rdx, str.SysListView32
mov rcx, rax
call fcn.18001b940
mov qword [rbx + 0x110], rax
jmp 0x180008a52
mov rsi, qword [0x180035690]
test rsi, rsi
jne 0x1800089e9
mov rdi, r14
jmp 0x180008a40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8d, [rdi + rax]
lea ecx, [r8 + r8]
movsxd rdx, ecx
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x180008a10
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.18000a4a0
sub rsp, rax
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r8d
lea rdi, [rsp + 0x30]
mov r8, rsi
mov word [rdi], r14w
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8d, dword [0x18003567c]
mov rdx, rdi
mov rcx, rbx
call fcn.18001a184
xor r8d, r8d
lea rdx, str.Shell_TrayWnd
xor ecx, ecx
call fcn.18001b940
xor r8d, r8d
mov qword [rbx + 0xe8], rax
lea rdx, str.NotifyIconOverflowWindow
xor ecx, ecx
call fcn.18001b940
mov qword [rbx + 0x130], rax
lea rcx, str.UxTheme.dll
mov qword [0x180035760], rbx
mov edi, r14d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180008ab7
lea rdx, str.SetThemeAppProperties
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008ab7
xor ecx, ecx
call rax
call fcn.18001d4e4
mov rcx, rbx
call fcn.18000a0ec
jmp 0x180008b1e
cmp edi, 2
je 0x180008b1e
test rbx, rbx
je 0x180008b16
lea rcx, [rbx + 0x88]
call fcn.18001e3d4
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x180008aeb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x768]
test rcx, rcx
je 0x180008b04
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x768], r14
mov rcx, qword [0x180035658]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call fcn.180018c54
mov rbx, qword [rbp + 0x10]
mov eax, edi
mov rdi, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x18]
mov r14, qword [rbp + 0x28]
mov rsp, rbp
pop rbp
ret