Function at 0x1800eb29c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rbx, rcx
cmp edx, 1
jne 0x1800eb59f
and dword [rbp + 0x6f], 0
lea r9d, [rdx + 3]
lea r8d, [rdx + 0x3f]
mov rdx, rcx
lea rax, [rbp + 0x6f]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1800eb2f2
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
test rbx, rbx
je 0x1800eb32d
lea rax, [rbp + 0x6f]
mov r9d, 4
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x20], rax
mov rdx, rbx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1800eb32d
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
movabs rax, 0x889f1b8063257ac1
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x49], rax
movabs rax, 0x5a978466591a9ef7
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x41], rax
movabs rax, 0x3175cdefba0ac8fe
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x39], rax
movabs rax, 0xd023c9c8caf3f310
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x31], rax
movabs rax, 0xb5e1faf53ed53cfe
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x29], rax
movabs rax, 0x8f3f943c1d265d1d
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x21], rax
movabs rax, 0xeac07f010b09890d
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x19], rax
movabs rax, 0x584b3ad747682c68
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x11], rax
movabs rax, 0xbb47ab26e616cb26
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 9], rax
movabs rax, 0xa5549d9f3456865a
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 1], rax
movabs rax, 0x88fb1be1634a7a8d
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 7], rax
movabs rax, 0x5ac7846c597e9e92
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0xf], rax
movabs rax, 0x3110cd9bba79c89f
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x17], rax
movabs rax, 0xd051c9aecad3f374
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x1f], rax
movabs rax, 0xb5b2fad53eb83c91
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x27], rax
movabs rax, 0x8f5694501d5f5d76
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x2f], rax
movabs rax, 0xeaca7f2f0b6c8963
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x37], rax
movabs rax, 0x58383ab2471a2c38
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x3f], rax
movabs rax, 0xbb29ab49e636cb55
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x47], rax
movabs rax, 0xa5549dd43419867a
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
movdqa xmm0, xmmword [rbp - 0x49]
mov qword [rbp + 0x4f], rax
pxor xmm0, xmmword [rbp + 7]
lea rdx, [rbp - 0x49]
movdqa xmm1, xmmword [rbp - 0x39]
xor r9d, r9d
pxor xmm1, xmmword [rbp + 0x17]
xor r8d, r8d
movdqa xmmword [rbp - 0x49], xmm0
xor ecx, ecx
movdqa xmm0, xmmword [rbp - 0x29]
pxor xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [rbp - 9]
pxor xmm0, xmmword [rbp + 0x47]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [rbp - 0x19]
pxor xmm1, xmmword [rbp + 0x37]
movdqa xmmword [rbp - 9], xmm0
movdqa xmmword [rbp - 0x19], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
and qword [rsp + 0x28], 0
lea r8, [0x1800a20c4]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
and qword [rsp + 0x28], 0
lea r8, [0x1800eaf58]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
and qword [rsp + 0x28], 0
lea r8, [0x1800bc860]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0xe0]
mov al, 1
add rsp, 0xd0
pop rbp
ret