Function at 0x18000b4d4
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x1c8
mov rbx, rcx
xor ecx, ecx
xor edx, edx
and qword [rax - 0x128], rcx
and dword [rsp + 0x68], ecx
mov dword [rsp + 0x6c], ecx
mov rcx, r9
xor edi, edi
mov qword [rsp + 0xd8], r8
xor esi, esi
call fcn.18000aa30
mov ebp, dword [rsp + 0x218]
mov qword [rsp + 0xf8], rax
mov r8, qword [rsp + 0xd8]
xor edx, edx
mov dword [rsp + 0x1f0], edx
lea rcx, [r8 + 4]
mov r8d, dword [r8]
mov dword [rsp + rdx*4 + 0x50], r8d
mov qword [rsp + rdx*8 + 0x90], rcx
add edx, 1
add r8, rcx
cmp edx, 6
mov dword [rsp + 0x1f0], edx
jb 0x18000b538
cmp dword [rsp + 0x50], 1
mov qword [rsp + 0xd8], r8
jbe 0x18000bd3a
mov rcx, qword [rsp + 0x90]
lea r8, [rsp + 0xc8]
lea rdx, [rsp + 0xd0]
call fcn.18000aabc
test rax, rax
je 0x18000b527
cmp dword [rsp + 0xc8], 0
jne 0x18000b527
mov ecx, dword [rsp + 0xd0]
test ecx, ecx
je 0x18000b5c5
cmp dword [rsp + 0x210], 0
je 0x18000b5bc
cmp ecx, 8
je 0x18000b5c5
jmp 0x18000b527
cmp ecx, 7
jne 0x18000b527
mov rdx, qword [rsp + 0xf8]
mov rcx, rax
call fcn.1800162b0
test eax, eax
je 0x18000b527
cmp dword [rsp + 0x64], 1
mov eax, dword [rsp + 0x54]
jbe 0x18000b5f8
cmp dword [rsp + 0x58], 1
ja 0x18000b5f8
cmp eax, 1
jbe 0x18000bc77
cmp eax, 1
jbe 0x18000b527
test rsi, rsi
jne 0x18000b68a
mov rax, qword [rbx]
lea r8d, [rsi + 1]
lea rdx, [rsp + 0x120]
mov rcx, rbx
call qword [rax + 0x60]
mov ebp, dword [rsp + 0x130]
test ebp, ebp
je 0x18000b527
mov rcx, qword [0x180029648]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rsi, rax
je 0x18000b527
and dword [rsp + 0xe0], 0
and dword [rsp + 0xe4], 0
mov rax, qword [rbx]
mov rdx, qword [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [rax + 0x28]
mov r11, qword [rbx]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call qword [r11 + 0x18]
mov eax, dword [rsp + 0x54]
test ebp, ebp
je 0x18000b527
mov rcx, qword [rsp + 0x98]
lea edx, [rax - 1]
call fcn.18001d7e4
xor eax, dword [0x1800298b8]
cmp eax, 0x3b2226c1
je 0x18000bb14
cmp eax, 0x55d8f14b
je 0x18000b527
cmp eax, 0x69c8428c
je 0x18000b92b
cmp eax, 0x7e7bdc0e
je 0x18000b8ca
cmp eax, 0x942539fc
je 0x18000bb57
cmp eax, 0x977704d4
je 0x18000b527
cmp eax, 0xa6eec7ec
je 0x18000b84e
cmp eax, 0xc4a87004
je 0x18000b7dd
cmp dword [rsp + 0x58], 1
jbe 0x18000b527
mov rax, qword [rsp + 0xa0]
mov rcx, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0xa0]
lea r8, [rsp + 0x40]
lea edx, [rax + 1]
xor r9d, r9d
call fcn.18000afd0
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebp
ja 0x18000b77e
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x98]
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x108]
mov edx, ebp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.18000ac74
jmp 0x18000b783
mov eax, 0x57
test eax, eax
jne 0x18000b7b3
mov rcx, qword [0x180029648]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x108]
mov ebp, dword [rsp + 0xcc]
or edi, 8
mov dword [rsp + 0x6c], 1
mov rax, qword [rsp + 0x40]
cmp rax, qword [rsp + 0xa0]
je 0x18000b527
mov r8, rax
mov rcx, qword [0x180029648]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000b527
cmp dword [rsp + 0x58], 1
jb 0x18000b527
cmp dword [rsp + 0x64], 1
jbe 0x18000b80a
mov r8, qword [rsp + 0xb8]
mov edx, ebp
mov rcx, rsi
call fcn.1800164e8
test rax, rax
je 0x18000b527
mov rcx, qword [rsp + 0xa0]
lea rdx, [rsp + 0x110]
mov r8d, 1
call fcn.1800159e8
test eax, eax
je 0x18000b527
xor r9d, r9d
lea rdx, [rsp + 0x110]
mov ecx, 0x127
lea r8d, [r9 + 0x10]
call fcn.18000d868
or edi, 0x40
jmp 0x18000b527
cmp dword [rsp + 0x58], 1
jb 0x18000b527
cmp dword [rsp + 0x64], 1
jbe 0x18000b87b
mov r8, qword [rsp + 0xb8]
mov edx, ebp
mov rcx, rsi
call fcn.1800164e8
test rax, rax
je 0x18000b527
mov rcx, qword [rsp + 0xa0]
lea r8, [rsp + 0x1f0]
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_StrToIntExA]
test eax, eax
je 0x18000b527
cmp dword [rsp + 0x1f0], 0
je 0x18000b527
xor r9d, r9d
lea rdx, [rsp + 0x1f0]
mov ecx, 0x125
lea r8d, [r9 + 4]
call fcn.18000d868
or edi, 0x20
jmp 0x18000b527
cmp dword [rsp + 0x64], 1
jbe 0x18000b8ec
mov r8, qword [rsp + 0xb8]
mov edx, ebp
mov rcx, rsi
call fcn.1800164e8
test rax, rax
je 0x18000b527
lea rax, [rsp + 0x100]
lea r8, [0x18000ab3c]
mov r9d, 0xbb8
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18000b923
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, 4
jmp 0x18000b527
mov rcx, qword [rsp + 0x1f8]
test rcx, rcx
je 0x18000bac1
mov rax, qword [rcx]
lea rdx, [rsp + 0x170]
mov r8d, 1
call qword [rax + 0x60]
mov eax, dword [rsp + 0x180]
mov rcx, qword [0x180029648]
lea r8d, [rbp + rax]
xor edx, edx
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov qword [rsp + 0x40], rax
je 0x18000b527
mov r11, qword [rsp + 0x1f8]
and dword [rsp + 0xe8], 0
and dword [rsp + 0xec], 0
mov rax, qword [r11]
mov rdx, qword [rsp + 0xe8]
xor r9d, r9d
xor r8d, r8d
mov rcx, r11
call qword [rax + 0x28]
mov rax, qword [rsp + 0x1f8]
mov r8d, dword [rsp + 0x48]
mov r11, qword [rax]
mov rdx, qword [rsp + 0x40]
xor r9d, r9d
mov rcx, rax
call qword [r11 + 0x18]
mov r11, qword [rsp + 0x1f8]
xor ecx, ecx
xor eax, eax
mov dword [rsp + 0xf0], ecx
mov dword [rsp + 0xf4], ecx
mov rdx, qword [rsp + 0xf0]
mov dword [rsp + 0x7c], eax
mov rax, qword [r11]
mov dword [rsp + 0x78], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, r11
call qword [rax + 0x28]
mov rax, qword [rsp + 0x1f8]
mov rdx, qword [rsp + 0x78]
mov r11, qword [rax]
mov rcx, rax
call qword [r11 + 0x30]
mov ecx, dword [rsp + 0x48]
mov r8d, ebp
add rcx, qword [rsp + 0x40]
mov rdx, rsi
call sub.ntdll.dll_memcpy
mov r8d, dword [rsp + 0x48]
mov r9, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x40]
xor eax, eax
cmp dword [rsp + 0x58], 1
cmova rax, qword [rsp + 0xa0]
lea rcx, [rsp + 0x88]
add r8d, ebp
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x208]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call fcn.18000b34c
test eax, eax
je 0x18000ba87
or edi, 2
mov r8d, dword [rsp + 0x88]
test r8d, r8d
je 0x18000bab7
mov r11, qword [rsp + 0x1f8]
mov edx, dword [rsp + 0x48]
xor r9d, r9d
mov r10, qword [r11]
add edx, ebp
mov rcx, r11
sub rdx, r8
add rdx, qword [rsp + 0x40]
call qword [r10 + 0x20]
mov r8, qword [rsp + 0x40]
jmp 0x18000b7c9
mov r9, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x208]
xor eax, eax
cmp dword [rsp + 0x58], 1
mov r8d, ebp
mov rdx, rsi
cmova rax, qword [rsp + 0xa0]
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call fcn.18000b34c
test eax, eax
je 0x18000b527
or edi, 2
jmp 0x18000b527
cmp dword [rsp + 0x58], 1
jb 0x18000bb57
cmp dword [rsp + 0x64], 1
jbe 0x18000bb39
mov r8, qword [rsp + 0xb8]
mov edx, ebp
mov rcx, rsi
call fcn.1800164e8
test rax, rax
je 0x18000bb57
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0xa0]
xor r9d, r9d
mov ecx, 0x126
call fcn.18000d868
bts edi, 7
mov rax, qword [rsp + 0xb8]
mov rcx, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0xb8]
lea r8, [rsp + 0x40]
lea edx, [rax + 1]
xor r9d, r9d
call fcn.18000afd0
test eax, eax
je 0x18000b527
lea r8, [rsp + 0x80]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x18000b527
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0xc0]
xor r9d, r9d
call fcn.180003b58
test eax, eax
jne 0x18000bc64
mov rcx, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0xc0]
mov rax, qword [rcx]
xor r9d, r9d
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
and dword [rsp + 0x70], 0
mov rax, qword [rcx]
and dword [rsp + 0x74], 0
mov rdx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
call qword [rax + 0x28]
mov r8, qword [rsp + 0xc0]
mov rcx, qword [0x180029648]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x80]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor edx, edx
call fcn.18000b4d4
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x180029648]
xor edx, edx
or edi, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x18000b527
mov rax, qword [rsp + 0x218]
test rax, rax
je 0x18000bd3a
cmp qword [rax + 8], 0
jne 0x18000bca1
xor edx, edx
mov rcx, rax
call fcn.180010c14
test eax, eax
jne 0x18000bd3a
and dword [rsp + 0x78], 0
xor eax, eax
xor r9d, r9d
and dword [rsp + 0x70], eax
and dword [rsp + 0x74], eax
mov rdx, qword [rsp + 0x70]
mov dword [rsp + 0x7c], eax
mov rax, qword [rbx]
xor r8d, r8d
mov rcx, rbx
call qword [rax + 0x28]
mov r11, qword [rbx]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call qword [r11 + 0x30]
mov rax, qword [rsp + 0x218]
mov r11, qword [rbx]
mov r8d, dword [rax + 0x44]
mov rdx, qword [rax]
xor r9d, r9d
mov rcx, rbx
call qword [r11 + 0x20]
test rsi, rsi
je 0x18000bd0c
mov rcx, qword [0x180029648]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov r9, qword [rsp + 0x218]
mov r8, qword [rsp + 0x200]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
add r9, 0x4c
xor edx, edx
mov rcx, rbx
call fcn.18000b4d4
or eax, 1
or edi, eax
test rsi, rsi
je 0x18000bdb4
mov ecx, dword [rsp + 0x6c]
test ecx, ecx
je 0x18000bda2
and dword [rsp + 0x200], 0
xor eax, eax
xor r9d, r9d
and dword [rsp + 0x218], eax
and dword [rsp + 0x21c], eax
mov rdx, qword [rsp + 0x218]
mov dword [rsp + 0x204], eax
mov rax, qword [rbx]
xor r8d, r8d
mov rcx, rbx
call qword [rax + 0x28]
mov r11, qword [rbx]
mov rdx, qword [rsp + 0x200]
mov rcx, rbx
call qword [r11 + 0x30]
mov r11, qword [rbx]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call qword [r11 + 0x20]
mov rcx, qword [0x180029648]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and dword [rsp + 0x218], 0
and dword [rsp + 0x21c], 0
mov r10, qword [rbx]
mov rdx, qword [rsp + 0x218]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [r10 + 0x28]
mov eax, edi
add rsp, 0x1c8
pop rdi
pop rsi
pop rbp
pop rbx
ret