Function at 0x1800a9100
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
imul eax, ecx, 0xa6e
mov r12, r9
mov r9, rdx
mov dword [rsp + 0x58], ecx
mov rdx, qword [rsp + 0x40]
xor ebx, ebx
mov r15d, ecx
mov qword [rsp + 0x38], rdx
mov edi, ecx
mov dword [rsp + 0x88], eax
cmp ecx, eax
ja 0x1800a96eb
mov rax, qword [rsp + 0x40]
mov r13d, dword [rsp + 0xf0]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov ebp, dword [rsp + 0xf0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x48], eax
cmp edi, 0x9d53
ja 0x1800a9502
je 0x1800a94c0
cmp edi, 0xe1
ja 0x1800a9457
je 0x1800a9235
mov eax, edi
sub eax, 0x1d
je 0x1800a920c
sub eax, 0x47
je 0x1800a91e2
cmp eax, 0x49
jne 0x1800a9667
mov qword [rsp + 0x28], rbx
lea r8, [0x18002bf80]
mov r9, r12
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r12], rax
jmp 0x1800a9652
mov r8, r12
mov dword [rsp + 0x68], 1
mov edx, 0x75
lea rcx, [rsp + 0x68]
call fcn.1800d2280
mov r9, rbx
mov qword [rsp + 0xf8], rbx
jmp 0x1800a965a
mov ecx, 0x30
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x38], rax
mov rdx, rax
test rax, rax
je 0x1800a96e3
mov r9, qword [rsp + 0xf8]
jmp 0x1800a965f
mov eax, dword [r12 + 0x7b4]
lea ecx, [rax + rax*2]
cmp ecx, dword [r12 + 0x7b0]
jb 0x1800a942a
mov eax, 0x5e
mov dword [rsp + 0x50], eax
sub eax, 0x5c
je 0x1800a92a5
sub eax, 1
je 0x1800a927b
cmp eax, 1
jne 0x1800a9403
mov eax, dword [r12 + 0x7b0]
lea r13d, [rax + rax]
jmp 0x1800a9403
lea eax, [r13*8]
xor r9d, r9d
mov r8d, 0x97
mov dword [rsp + 0x70], eax
lea rdx, [rsp + 0x70]
mov rcx, r12
call fcn.18002e320
mov r14, rax
jmp 0x1800a9403
test r14, r14
je 0x1800a9403
mov edi, 0x68
mov dword [rsp + 0x60], edi
cmp edi, 0x68
je 0x1800a93e5
cmp edi, 0x103
je 0x1800a93bc
cmp edi, 0x19e
je 0x1800a92f5
cmp edi, 0x239
jne 0x1800a93ed
mov qword [r12 + 0x7a0], r14
mov dword [r12 + 0x7b0], r13d
jmp 0x1800a93ed
mov r15d, ebx
cmp dword [r12 + 0x7b4], ebx
jbe 0x1800a93a4
nop word [rax + rax]
mov edi, 0xee
cmp edi, 0xee
je 0x1800a9355
cmp edi, 0x6f90
je 0x1800a9339
cmp edi, 0xde32
jne 0x1800a9381
mov eax, ebp
mov qword [r14 + rax*8], rsi
mov rsi, qword [rsi + 0x68]
jmp 0x1800a9381
mov eax, ebp
lea rcx, [r14 + rax*8]
mov rax, qword [r14 + rax*8]
mov qword [rsi + 0x58], rax
mov rax, qword [rcx]
test rax, rax
je 0x1800a9381
mov qword [rax + 0x60], rsi
jmp 0x1800a9381
mov eax, dword [rsi + 0x50]
lea r8, [rsp + 0x78]
xor r9d, r9d
mov dword [rsp + 0x78], eax
mov edx, 0xcd
mov qword [rsi + 0x60], rbx
xor ecx, ecx
mov qword [rsi + 0x58], rbx
call fcn.180046ed0
mov rbp, rax
lea ecx, [r13 - 1]
and ebp, ecx
add edi, 0x6ea2
cmp edi, 0x14be6
jbe 0x1800a9315
inc r15d
cmp r15d, dword [r12 + 0x7b4]
jb 0x1800a9310
mov edi, dword [rsp + 0x60]
mov rcx, qword [r12 + 0x7a0]
mov r8d, IsCharSpaceW
mov rdx, r12
call fcn.1800825b0
jmp 0x1800a93ed
lea eax, [r13*8]
mov r9, r14
xor r8d, r8d
mov dword [rsp + 0x80], eax
mov edx, 0xd5
lea rcx, [rsp + 0x80]
call fcn.1800c77c0
jmp 0x1800a93ed
mov rsi, qword [r12 + 0x7a8]
add edi, 0x9b
mov dword [rsp + 0x60], edi
cmp edi, 0x2d4
jb 0x1800a92b7
mov eax, dword [rsp + 0x50]
dec eax
mov dword [rsp + 0x50], eax
cmp eax, 0x5b
ja 0x1800a9257
mov edi, dword [rsp + 0x58]
mov r15d, dword [rsp + 0xf0]
mov r9, qword [rsp + 0xf8]
mov eax, dword [r9 + 0x50]
lea r8, [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x50], eax
mov edx, 0xcd
xor ecx, ecx
call fcn.180046ed0
mov ebp, dword [r12 + 0x7b0]
dec ebp
and ebp, eax
jmp 0x1800a9652
cmp edi, 0x10e
je 0x1800a9622
cmp edi, 0x1447
je 0x1800a94ad
cmp edi, 0x78f7
jne 0x1800a9667
cmp qword [r12], rbx
jne 0x1800a9667
mov eax, 0x73
cmp eax, 0x73
je 0x1800a9498
cmp eax, 0x4f10
je case.0x1800a96e1.9
jmp 0x1800a949c
mov byte [rsp + 0x40], bl
add eax, 0x4e9d
cmp eax, 0x9d3a
jbe 0x1800a9486
jmp 0x1800a9667
mov rax, qword [r9]
mov qword [rdx + 8], rax
mov rax, qword [r8]
mov qword [rdx + 0x10], rax
jmp 0x1800a9667
mov r10, qword [rsp + 0x30]
mov eax, ebp
lea rdx, [rax*8]
mov rax, qword [r12 + 0x7a0]
mov rcx, qword [rdx + rax]
mov qword [r9 + 0x58], rcx
mov rax, qword [r12 + 0x7a0]
mov rcx, qword [rdx + rax]
mov rdx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800a966c
mov qword [rcx + 0x60], r9
jmp 0x1800a966c
cmp edi, 0x1698b
ja 0x1800a95e7
je 0x1800a95dd
cmp edi, 0xbcca
je 0x1800a95d4
cmp edi, 0xf141
je 0x1800a95a5
cmp edi, 0x139c5
jne 0x1800a9667
mov rax, qword [r12 + 0x7a0]
mov ecx, ebp
mov qword [rax + rcx*8], r9
cmp qword [r12 + 0x7a8], rbx
jne 0x1800a9559
mov qword [r12 + 0x7a8], r9
jmp 0x1800a9667
mov ecx, 0x106
nop
cmp ecx, 0x106
je 0x1800a957a
cmp ecx, 0x76b8
jne 0x1800a9592
mov qword [r12 + 0x7a8], r9
jmp 0x1800a9592
mov rax, qword [r12 + 0x7a8]
mov qword [r9 + 0x68], rax
mov rax, qword [r12 + 0x7a8]
mov qword [rax + 0x70], r9
add ecx, 0x75b2
cmp ecx, 0xeb64
jbe 0x1800a9560
jmp 0x1800a9667
mov dword [rsp + 0x58], 1
lea rdx, [rsp + 0x58]
mov ecx, 0x4b
cmp ecx, 0x4b
jne 0x1800a95c3
mov eax, dword [rdx]
xchg dword [r12 + 0xc], eax
dec ecx
cmp ecx, 0x49
ja 0x1800a95b7
mov rdx, qword [rsp + 0x38]
jmp 0x1800a9667
mov dword [rsp + 0x48], ebx
jmp 0x1800a9667
mov byte [rsp + 0x40], 1
jmp 0x1800a9667
cmp edi, 0x17886
je 0x1800a963b
cmp edi, 0x1d637
je 0x1800a9631
cmp edi, 0x272a9
jne 0x1800a9667
mov ecx, 1
mov eax, ecx
sub eax, 1
je 0x1800a9616
cmp eax, 0xd
je case.0x1800a96e1.9
jmp 0x1800a961a
mov dword [rsp + 0x40], ebx
add ecx, 0xd
cmp ecx, 0x1b
jb 0x1800a9604
lea r10, [r12 + 0x730]
mov qword [rsp + 0x30], r10
jmp 0x1800a966c
inc dword [r12 + 0x7b4]
jmp 0x1800a9667
mov r9, r12
lea r8, [rsp + 0x90]
mov edx, 0x16
xor ecx, ecx
call fcn.1800ce010
mov r9, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x100]
mov r10, qword [rsp + 0x30]
imul eax, r15d, 0xb2
add edi, eax
mov dword [rsp + 0x58], edi
cmp edi, dword [rsp + 0x88]
jbe 0x1800a9183
mov edi, dword [rsp + 0x48]
mov r14d, dword [rsp + 0xf0]
add r15d, 0xf
cmp r14d, r15d
jae case.0x1800a96e1.9
mov rsi, qword [rsp + 0x40]
lea r11, [0x180000000]
mov rbp, qword [rsp + 0x40]
add r14d, 0xffffffe3
mov r13d, 0x20
nop word [rax + rax]
cmp r14d, 0xf4
ja case.0x1800a96e1.13
movzx eax, byte [r11 + r14 + 0xa98fc]
mov ecx, dword [r11 + rax*4 + 0xa98c4]
add rcx, r11
jmp rcx
mov rax, rbx
jmp 0x1800a98a6
mov r10, qword [rsp + 0x40]
mov edi, dword [rsp + 0xf0]
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x48], edi
jmp 0x1800a968a
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x1800a9725
mov r8, qword [r10 + 8]
mov rcx, qword [rsp + 0x98]
call qword [r10]
mov r10, qword [rsp + 0x30]
mov dword [rsp + 0x48], eax
mov rdx, qword [rsp + 0x38]
lea rax, [0x1800a78b0]
cmp qword [r10], rax
je case.0x1800a96e1.13
mov ecx, dword [rsp + 0xa0]
add dword [r12 + 0x728], ecx
jmp case.0x1800a96e1.13
mov qword [rsi], rdx
jmp case.0x1800a96e1.13
mov qword [rdx + 0x20], rbx
jmp case.0x1800a96e1.13
mov rax, qword [r8]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], r9
lea r8, [rsp + 0x90]
mov r9d, 0xcf
mov qword [rsp + 0x88], rax
xor edx, edx
call fcn.180070eb0
mov r10, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
jmp case.0x1800a96e1.13
inc dword [r12 + 0x10]
jmp case.0x1800a96e1.13
mov qword [rdx + 0x28], rbx
mov rbp, rbx
jmp case.0x1800a96e1.13
mov qword [rsp + 0x40], rdx
jmp case.0x1800a96e1.13
cmp qword [r12], 0
mov rsi, r12
je case.0x1800a96e1.13
mov rbx, qword [rsp + 0x100]
mov edi, 0x11d
mov eax, edi
sub eax, 0x11d
je 0x1800a9806
cmp eax, 1
jne 0x1800a9809
mov rdx, qword [rsi]
mov rcx, qword [rbx]
mov rdx, qword [rdx + 0x10]
call qword [r12 + 8]
mov rsi, qword [rsi]
mov ecx, 0x28
test eax, eax
cmovs rcx, r13
add rsi, rcx
jmp 0x1800a9809
mov rbp, qword [rsi]
inc edi
cmp edi, 0x11f
jb 0x1800a97d6
cmp qword [rsi], 0
jne 0x1800a97d1
mov r10, qword [rsp + 0x30]
xor ebx, ebx
mov rdx, qword [rsp + 0x38]
jmp case.0x1800a96e1.13
mov r9d, 0x107
lea rcx, [rsp + 0x90]
xor r8d, r8d
xor edx, edx
call fcn.18007f710
mov r10, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov dword [rsp + 0x40], edi
jmp case.0x1800a96e1.13
mov r8, rdx
mov r9d, 0x10b
mov rdx, r12
xor ecx, ecx
call fcn.1800d3d70
mov r10, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
jmp case.0x1800a96e1.13
mov dword [rdx], ebx
jmp case.0x1800a96e1.13
mov qword [rdx + 0x18], rbp
mov r8, qword [rsp + 0x100]
lea r11, [0x180000000]
mov r9, qword [rsp + 0xf8]
inc r14d
mov edi, dword [rsp + 0x48]
lea eax, [r14 + 0x1d]
cmp eax, r15d
jb 0x1800a96c0
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret