Function at 0x18000c820
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
movzx ebx, byte [rsp + 0xb0]
lea r13d, [r8 - 8]
mov dword [rsp + 0x38], r13d
mov rsi, r9
mov r15d, r8d
mov r14, rcx
cmp r8d, r13d
jbe case.0x18000c89b.236
movzx r12d, byte [rsp + 0xb0]
lea r8, [0x180000000]
lea r9, [0x180023fb0]
mov qword [rsp + 0x40], rbx
nop dword [rax]
lea eax, [r15 - 0xec]
cmp eax, 0x12
ja case.0x18000c89b.239
mov ecx, dword [r8 + rax*4 + 0xcd0c]
add rcx, r8
jmp rcx
movzx ecx, byte [rdx]
sub ecx, 0xa
je 0x18000cb03
sub ecx, 1
je 0x18000cb63
cmp ecx, 0xa
jne 0x18000cb63
mov rbx, qword [rsp + 0x50]
mov ebp, 0xc8
mov dword [rsp + 0x30], ebp
nop dword [rax]
cmp ebp, 0xc8
je 0x18000ca88
cmp ebp, 0x23f0
je 0x18000ca81
cmp ebp, 0x4718
jne 0x18000cad3
mov r15, qword [rbx + 8]
mov r13d, 8
nop
mov ebp, 0x9d
nop word [rax + rax]
mov eax, ebp
sub eax, 0x9d
je 0x18000ca17
sub eax, 0x64
je 0x18000c9ad
sub eax, 0x64
je 0x18000c96f
sub eax, 0x64
je 0x18000c941
cmp eax, 0x64
jne 0x18000ca54
inc r12b
jmp 0x18000ca54
mov r9, r14
mov byte [rsp + 0xb0], 0x18
mov r8, r15
mov qword [rsp + 0x20], rsi
mov edx, 0x36
lea rcx, [rsp + 0xb0]
call fcn.1800088e0
add r15, 0x18
jmp 0x18000ca54
mov edi, 0x17
mov eax, edi
sub eax, 0x14
je 0x18000c99b
sub eax, 1
je 0x18000c996
cmp eax, 2
jne 0x18000c9a1
xor r9d, r9d
mov r8b, 1
movzx edx, al
mov rcx, r14
call qword [rsi + reloc.SHELL32.dll_ILFindLastID]
jmp 0x18000c9a1
mov qword [r14], rsi
jmp 0x18000c9a1
mov rax, qword [r14]
mov qword [rsi], rax
inc edi
cmp edi, 0x1a
jb 0x18000c974
jmp 0x18000ca54
mov r9d, 0x68
mov byte [rsp + 0xb0], 0x3e
mov r8, r14
lea rcx, [rsp + 0xb0]
mov rdx, rsi
call fcn.180043f50
movzx eax, r12b
lea rcx, [rsp + 0xb0]
or al, 0x80
mov r9d, 0x68
mov r8, r14
mov byte [rsp + 0xb0], al
mov rdx, rsi
call fcn.180043f50
mov r9d, 0x68
mov byte [rsp + 0xb0], 0x80
mov r8, r14
lea rcx, [rsp + 0xb0]
mov rdx, rsi
call fcn.180043f50
jmp 0x18000ca54
mov edi, 0x17
nop dword [rax]
mov eax, edi
sub eax, 0x14
je 0x18000ca47
sub eax, 1
je 0x18000ca42
cmp eax, 2
jne 0x18000ca4d
xor r9d, r9d
xor r8d, r8d
movzx edx, al
mov rcx, r14
call qword [rsi + reloc.SHELL32.dll_ILFindLastID]
jmp 0x18000ca4d
mov qword [r14], rsi
jmp 0x18000ca4d
mov rax, qword [r14]
mov qword [rsi], rax
inc edi
cmp edi, 0x1a
jb 0x18000ca20
add ebp, 0x64
cmp ebp, 0x291
jb 0x18000c910
sub r13, 1
jne 0x18000c900
xor r9d, r9d
xor r8d, r8d
mov dl, 3
mov rcx, r14
call qword [rsi + reloc.SHELL32.dll_ILFindLastID]
mov ebp, dword [rsp + 0x30]
jmp 0x18000cad3
movzx r12d, byte [rbx + 2]
jmp 0x18000cad3
mov rbx, qword [rsi + 8]
mov edi, 0x17
mov eax, edi
sub eax, 0x14
je 0x18000cab8
sub eax, 1
je 0x18000cab3
cmp eax, 2
jne 0x18000cabe
xor r9d, r9d
xor r8d, r8d
movzx edx, al
mov rcx, r14
call qword [rsi + reloc.SHELL32.dll_ILFindLastID]
jmp 0x18000cabe
mov qword [r14], rsi
jmp 0x18000cabe
mov rax, qword [r14]
mov qword [rsi], rax
inc edi
cmp edi, 0x1a
jb 0x18000ca91
xor r9d, r9d
mov r8b, 1
mov dl, 3
mov rcx, r14
call qword [rsi + reloc.SHELL32.dll_ILFindLastID]
add ebp, 0x2328
mov dword [rsp + 0x30], ebp
cmp ebp, 0x6978
jbe 0x18000c8d0
mov r13d, dword [rsp + 0x38]
mov r15d, 0xf6
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x40]
jmp 0x18000cccb
mov edi, 0x21
cmp edi, 0x21
je 0x18000cb17
cmp edi, 0xc3
je 0x18000cb63
jmp 0x18000cb55
xor r9d, r9d
mov byte [rsp + 0xb0], 3
lea rax, [rsp + 0xb0]
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x2b]
call fcn.180036b60
mov r9, r14
lea rcx, [0x18005c720]
mov r8, rsi
mov edx, 0xeb
call fcn.18002d9c0
add edi, 0xa2
cmp edi, 0x165
jb 0x18000cb08
mov r15d, 0xf6
jmp 0x18000cccb
mov qword [rsp + 0x58], r9
lea rcx, [rsp + 0x58]
xor r9d, r9d
mov dword [rsp + 0x28], 0x102
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
call fcn.18001d9a0
mov qword [rsp + 0x48], rax
jmp 0x18000cccb
mov rsi, qword [rsp + 0x48]
xor ebp, ebp
nop word [rax + rax]
mov edi, 0x9a
cmp edi, 0x9a
jne 0x18000cbf9
mov r9, rsi
mov dword [rsp + 0xb0], ebp
lea r8d, [rdi + 0x59]
xor ecx, ecx
lea rdx, [rsp + 0xb0]
call fcn.180052110
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8, rsi
mov dword [rsp + 0x20], 0x30
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.1800408d0
add edi, 0x49fe
cmp edi, 0x93fc
jbe 0x18000cbb5
inc ebp
cmp ebp, 0x14
jb 0x18000cbb0
mov r8, qword [rsp + 0x48]
xor r9d, r9d
mov rsi, qword [rsp + 0xb8]
mov edx, 0xfc
xor ecx, ecx
mov qword [rsp + 0x20], 0
call fcn.180013230
jmp 0x18000cccb
mov r9d, SHSetFolderPathW
mov dword [rsp + 0xb0], 1
xor r8d, r8d
lea rcx, [rsp + 0xb0]
mov rdx, r14
call fcn.180012490
mov bl, 1
mov qword [rsp + 0x40], rbx
jmp 0x18000cccb
movzx eax, byte [rdx]
mov r9, rsi
mov byte [rsp + 0xb0], al
lea rdx, [rsp + 0xb0]
mov rax, qword [rsp + 0xc0]
mov r8, r14
mov ecx, 0xb9
mov qword [rsp + 0x20], rax
call fcn.1800070b0
mov rbx, rax
mov qword [rsp + 0x40], rax
jmp 0x18000cccb
mov qword [rsp + 0x28], 0
lea r8, [0x18000c570]
mov r9, r14
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14], rax
test rax, rax
je 0x18000cd08
mov rdx, qword [rsp + 0xa8]
lea r9, [0x180023fb0]
lea r8, [0x180000000]
dec r15d
cmp r15d, r13d
ja 0x18000c880
movzx eax, bl
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
jmp 0x18000ccf0