Function at 0x180034eb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc8
mov r15d, dword [rbp + 0x6f]
mov esi, r15d
imul r13d, r15d, 0x1c3
cmp r15d, r13d
ja 0x1800354c0
mov rbx, qword [rbp + 0x97]
xor r9d, r9d
movzx r14d, byte [rbp + 0x6f]
mov r12d, dword [rbp + 0x6f]
mov rdi, qword [rbp - 0x69]
nop word [rax + rax]
cmp esi, 0x220b
ja 0x180035046
je 0x180034fb2
mov eax, esi
sub eax, 0x69
je 0x180034f86
sub eax, 0xc
je 0x180034f7e
sub eax, 0x29
je 0x180035458
sub eax, 0x109c
je 0x180034f75
cmp eax, 0x1f8
jne 0x1800350c0
mov ecx, dword [rdi]
mov r12, qword [rbp + 0x7f]
test ecx, ecx
je 0x1800350d4
sub ecx, 1
je 0x1800353bb
cmp ecx, 1
je 0x18003523b
mov dword [rbp - 0x71], 0xb
jmp 0x1800354c0
mov qword [rbp - 0x49], r9
jmp 0x1800350c0
mov rdi, rbx
jmp 0x1800350c0
mov qword [rsp + 0x28], r9
lea r8, [0x180009390]
mov dword [rsp + 0x20], r9d
xor edx, edx
mov r9, rbx
xor ecx, ecx
mov r14b, 1
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
xor r9d, r9d
jmp 0x1800350c0
cmp qword [rbx], 0
je 0x180035484
lea r9, [rbp - 0x49]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r12d, eax
mov dword [rbp - 0x41], 1
mov edx, 0xe2
nop dword [rax + rax]
mov ecx, edx
sub ecx, 0xe2
je 0x18003502f
cmp ecx, 2
jne 0x180035037
mov rax, qword [rbp - 0x41]
lea r8d, [rcx + 0x1d]
mov qword [rbp - 0x31], rax
lea rdx, [rbp - 0x39]
mov rax, qword [rbx]
lea rcx, [rbp - 0x31]
mov qword [rbp - 0x39], rax
call fcn.18001bbf0
xor r9d, r9d
mov qword [rbp - 0x59], rax
mov r8d, 0xaf
lea rdx, [rbp - 0x59]
xor ecx, ecx
call fcn.18001c0a0
xor r9d, r9d
jmp 0x1800350c0
mov eax, 1
xchg dword [rbx + 0xc], eax
inc edx
cmp edx, 0xe4
jb 0x180034fe0
xor r9d, r9d
jmp 0x1800350c0
cmp esi, 0x2f6a
je 0x180035083
cmp esi, 0x32dc
je 0x180035070
cmp esi, 0x43ad
je 0x18003548a
cmp esi, 0x5db3
je 0x1800354c0
jmp 0x1800350c0
movzx eax, r14b
test r12d, r12d
mov ecx, r9d
cmove ecx, eax
movzx r14d, cl
jmp 0x1800350c0
cmp byte [rbx + 0x82], 0
sete al
inc al
mov byte [rbx + 0xa0], al
mov rcx, qword [rbx + 0x88]
mov byte [rbx + 0x82], 0
mov qword [rbx + 0x98], r9
lea rax, [rcx - 1]
shr rax, 8
dec cl
mov byte [rbx + 0xa1], al
mov byte [rbx + 0xa2], cl
imul eax, r15d, 0x29
add esi, eax
cmp esi, r13d
jbe 0x180034f10
jmp 0x1800354c0
mov r13, qword [rbp + 0x8f]
mov ebx, 0xcd
mov r14, qword [rbp - 0x69]
mov r15d, dword [rbp + 0x6f]
mov r8, qword [rbp + 0x57]
nop dword [rax]
cmp ebx, 0xcd
je 0x1800353a2
cmp ebx, 0x61b2
je 0x1800352b2
cmp ebx, 0xc297
je 0x180035127
cmp ebx, 0x1237c
jne 0x1800351ab
mov dword [rdi], 1
jmp 0x1800351ab
cmp r15d, 1
jne 0x1800353b2
mov rax, qword [rdi + 0x50]
lea r9d, [r15 + 0x2a]
lea r8, [rbp - 0x29]
xor edx, edx
mov rcx, qword [rax + 0x10]
mov rax, qword [rdi + 0x58]
mov qword [rbp - 0x21], rcx
lea rcx, [rbp - 0x21]
mov qword [rbp - 0x29], rax
call fcn.18004b730
test al, al
je 0x180035446
mov rax, qword [rdi + 0x50]
lea r9d, [r15 + 0x2a]
lea r8, [rbp - 0x19]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov rax, qword [rdi + 0x60]
mov qword [rbp - 0x11], rcx
lea rcx, [rbp - 0x11]
mov qword [rbp - 0x19], rax
call fcn.18004b730
test al, al
je 0x180035446
mov rcx, qword [rdi + 0x50]
mov rax, qword [rdi + 0x58]
mov qword [rcx + 0x10], rax
mov rcx, qword [rdi + 0x50]
mov rax, qword [rdi + 0x60]
mov qword [rcx + 0x18], rax
mov r8, qword [rbp + 0x57]
add ebx, 0x60e5
cmp ebx, 0x18394
jbe 0x1800350f0
xor r9d, r9d
mov rax, qword [rdi + 0x58]
test al, 3
je 0x180035200
mov rdx, qword [r8]
mov r10, qword [rbp + 0x4f]
nop
cmp rdx, qword [r12]
jae 0x1800352a6
inc rax
mov qword [rdi + 0x58], rax
mov rax, qword [r8]
movzx ecx, byte [rax + r10]
lea rdx, [rax + 1]
mov qword [r8], rdx
test cl, cl
jne 0x180035446
mov rax, qword [rdi + 0x58]
test al, 3
jne 0x1800351d0
mov rax, qword [rdi + 0x50]
mov ecx, dword [rax + 8]
test ecx, ecx
je 0x18003544f
cmp byte [rdi + 0xe0], 0
jne 0x180035235
mov dword [rbp + 0x6f], ecx
lea rdx, [rdi + 0x78]
mov qword [rsp + 0x20], r9
lea r8, [rbp + 0x6f]
mov r9d, 0xd4
xor ecx, ecx
call fcn.180026f20
mov dword [rdi], 2
mov rsi, qword [rbp - 0x69]
mov ebx, 0xe5
cmp ebx, 0xe5
je 0x1800353c4
cmp ebx, 0x8b8c
jne 0x1800353e9
mov rax, qword [r12]
lea rbx, [rdi + 0x70]
mov rcx, qword [rbp + 0x57]
lea r8, [rbp - 0x69]
mov r9, qword [rbp + 0x4f]
mov edx, 0x3e
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x61]
mov qword [rbp - 0x61], rax
mov rax, qword [rdi + 0x50]
add rax, 0x28
mov qword [rbp - 0x69], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.180026b00
cmp qword [rbx], rsi
jae 0x180035407
mov dword [rbp - 0x71], 0
jmp 0x1800354c0
mov rax, qword [rbp + 0x87]
mov r9, qword [rbp + 0x67]
mov rdx, qword [rbp + 0x5f]
mov rcx, qword [rdi + 8]
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
mov rax, qword [rbp + 0x77]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [r12]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r9
mov r9, r8
mov r8, qword [rbp + 0x4f]
mov qword [rsp + 0x20], rax
call qword [rdi + 0x20]
mov rcx, qword [rdi + 0x68]
lea r9, [rdi + 0x58]
mov rsi, qword [r13]
lea r8, [rbp - 0x51]
mov qword [rbp - 0x51], rcx
mov edx, 0x111
mov rcx, qword [rbp + 0x57]
mov r15d, eax
sub rsi, r14
mov rcx, qword [rcx]
sub rcx, qword [rbp - 0x59]
mov qword [rbp - 0x61], rcx
lea rcx, [rbp - 0x61]
call fcn.180004670
test al, al
jne 0x180035446
mov rax, qword [rdi + 0x50]
lea r9, [rdi + 0x60]
lea r8, [rbp - 0x61]
mov qword [rbp - 0x51], rsi
mov edx, 0x111
mov rcx, qword [rax + 0x18]
mov qword [rbp - 0x61], rcx
lea rcx, [rbp - 0x51]
call fcn.180004670
test al, al
jne 0x180035446
cmp byte [rdi + 0xe0], al
jne 0x1800351a7
mov rax, qword [rdi + 0x50]
lea r8, [rdi + 0x78]
mov r9, qword [rbp + 0x67]
mov edx, 0x78
add r9, r14
mov qword [rbp - 0x61], rsi
mov ecx, dword [rax + 8]
lea rax, [rbp + 0x6f]
mov dword [rbp + 0x6f], ecx
lea rcx, [rbp - 0x61]
mov qword [rsp + 0x20], rax
call fcn.18003a540
jmp 0x1800351a7
mov rax, qword [r8]
mov r14, qword [r13]
mov qword [rbp - 0x59], rax
jmp 0x1800351ab
mov dword [rbp - 0x71], r15d
jmp 0x1800354c0
mov r8, qword [rbp + 0x57]
jmp 0x1800351c0
mov rax, qword [rdi + 0x50]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov ecx, dword [rax + 8]
lea rax, [rbp - 0x69]
mov dword [rbp - 0x69], ecx
lea ecx, [rdx + 0x39]
mov qword [rsp + 0x20], rax
call fcn.180007950
mov esi, eax
add ebx, 0x8aa7
cmp ebx, 0x1154e
jbe 0x180035244
mov dword [rbp - 0x71], 0xb
jmp 0x1800354c0
cmp byte [rdi + 0xe0], 0
jne 0x18003544f
mov rax, qword [rdi + 0x50]
lea rdx, [rbp - 0x71]
xor r8d, r8d
mov ecx, dword [rax + 8]
mov dword [rbp - 0x71], ecx
lea ecx, [r8 + 0x57]
call fcn.180027690
test al, al
je 0x18003544f
mov rcx, qword [rdi + 0x50]
lea rdx, [rdi + 0x78]
add rcx, 0x28
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18003544f
mov dword [rbp - 0x71], 9
jmp 0x1800354c0
mov dword [rbp - 0x71], 1
jmp 0x1800354c0
mov qword [rsp + 0x28], r9
lea rax, [0x180014760]
xor r9d, r9d
mov qword [rbp - 0x69], rax
xor r8d, r8d
mov dword [rsp + 0x20], 0xe9
lea rdx, [rbp - 0x69]
mov rcx, rbx
call fcn.180034a40
jmp 0x1800354c4
mov byte [rbp - 0x71], 0
jmp 0x1800354c0
test r14b, r14b
je 0x1800354bc
lea r8, [rbp - 0x71]
mov qword [rbp - 0x71], r9
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1800354ae
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x1800354bc
call sub.RPCRT4.dll_MesHandleFree
mov byte [rbp - 0x71], 1
mov rax, qword [rbp - 0x71]
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret