Function at 0x180014a00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0x90
mov rax, qword [0x180106b38]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov esi, dword [rbp + 0x77]
mov r13, r8
mov r12, qword [rbp + 0x7f]
mov rdi, rdx
imul r15d, esi, 0xa9
mov r14, rcx
mov ebx, esi
cmp esi, r15d
ja 0x180014cca
nop dword [rax]
cmp ebx, 0x976
ja 0x180014bf5
je 0x180014baf
cmp ebx, 0xd5
ja 0x180014b3c
je 0x180014b30
mov eax, ebx
sub eax, 0x7c
je 0x180014b06
sub eax, 0x21
je 0x180014ae1
cmp eax, 0x10
jne 0x180014cbc
cmp dword [r14], 3
jne 0x18001504e
cmp qword [rdi + 0x10], 9
jne 0x18001504e
cmp qword [rdi], 0
jne 0x180014cbc
mov qword [rsp + 0x30], rdi
lea rax, [rbp - 0x39]
mov dword [rsp + 0x28], 0xa8
lea rdx, [rbp - 0x31]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8, r12
mov byte [rbp - 0x31], 0
mov rcx, r14
mov byte [rbp - 0x39], 1
call fcn.18007f7d0
jmp 0x180014cbc
movzx eax, word [0x1800f0c74]
mov word [rbp - 0x21], ax
movzx eax, word [0x1800f0c78]
mov word [rbp - 0x1f], ax
movzx eax, byte [0x1800f0c7a]
mov byte [rbp - 0x1d], al
jmp 0x180014cbc
mov qword [rsp + 0x28], 0
mov r9d, 0x115
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov rdx, r12
xor ecx, ecx
call fcn.1800a4d50
jmp 0x180014cbc
mov qword [0x180106c18], r12
jmp 0x180014cbc
cmp ebx, 0x6c8
je 0x180014b9a
cmp ebx, 0x896
jne 0x180014cbc
lea rcx, [rbp - 0x21]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180014b60
movzx eax, word [0x1800f0c6c]
lea rdx, [0x1800f0c70]
mov word [rcx], ax
mov r8d, 3
movzx eax, byte [0x1800f0c6e]
mov byte [rcx + 2], al
lea rcx, [rbp - 0x1b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180014cbc
mov eax, dword [r14]
add dword [r12 + 4], eax
mov eax, dword [r12 + 4]
mov dword [rbp - 0x29], eax
jmp 0x180014cbc
mov r8, qword [rdi]
lea r9, str.image_set
mov qword [rsp + 0x28], 0
mov edx, 0x111
xor ecx, ecx
mov qword [rsp + 0x20], 0
call fcn.180065050
test rax, rax
jne 0x18001504e
mov qword [r12 + 0x98], rax
mov dword [r13], 0x1a0
jmp 0x180014cbc
cmp ebx, 0x1888
ja 0x180014c7a
je 0x180014c63
cmp ebx, 0xd14
je case.0x180014d0d.8
cmp ebx, 0x108f
je 0x180014c28
cmp ebx, 0x123f
jne 0x180014cbc
mov byte [rbp - 0x29], 1
jmp case.0x180014d0d.8
mov r8d, 4
lea rdx, [0x1800f0c64]
lea rcx, [rbp + 7]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x1800c2338]
lea rdx, [0x1800e8414]
mov r8d, 2
mov word [rbp + 0xa], ax
lea rcx, [rbp - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180014cbc
movzx eax, word [0x1800f0c18]
mov word [rbp], ax
movzx eax, byte [0x1800f0c1a]
mov byte [rbp + 2], al
jmp 0x180014cbc
cmp ebx, 0x2081
je 0x180014ca5
cmp ebx, 0x287a
jne 0x180014cbc
movzx eax, word [0x1800f0c32]
mov word [rbp - 0x11], ax
movzx eax, byte [0x1800f0c34]
mov byte [rbp - 0xf], al
mov byte [rbp - 0xe], 0
jmp 0x180014cbc
mov r8d, 2
lea rdx, [0x1800f0c68]
lea rcx, [rbp - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
imul eax, esi, 0xd
add ebx, eax
cmp ebx, r15d
jbe 0x180014a50
lea r15d, [rsi - 0xe]
cmp esi, r15d
jbe case.0x180014d0d.8
add esi, 0xffffff6c
lea r13, [0x180000000]
mov edx, 0x746e
nop dword [rax]
cmp esi, 0x41
ja case.0x180014d0d.12
movzx eax, byte [rsi + r13 + 0x150b0]
mov ecx, dword [r13 + rax*4 + 0x1507c]
add rcx, r13
jmp rcx
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
cmp rcx, rdx
jae 0x180014d38
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180014d30
mov rax, qword [r14]
mov word [rax + rcx], 0x20
jmp 0x180014d4a
xor r8d, r8d
mov r9b, 0x20
mov rcx, r14
lea edx, [r8 + 1]
call fcn.180006930
cmp qword [r12 + 0x38], 0x10
lea rax, [r12 + 0x20]
jb 0x180014d5c
mov rax, qword [r12 + 0x20]
cmp byte [rax], 0x2f
je 0x180014d9c
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
cmp rcx, rdx
jae 0x180014d8a
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180014d82
mov rax, qword [r14]
mov word [rax + rcx], 0x2f
jmp 0x180014d9c
xor r8d, r8d
mov r9b, 0x2f
mov rcx, r14
lea edx, [r8 + 1]
call fcn.180006930
cmp qword [r12 + 0x38], 0x10
lea rdx, [r12 + 0x20]
jb 0x180014dae
mov rdx, qword [r12 + 0x20]
mov r8, qword [r12 + 0x30]
mov rcx, r14
call fcn.180022f20
mov edx, 0x746e
jmp case.0x180014d0d.12
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
cmp rcx, rdx
jae 0x180014dee
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180014de6
mov rax, qword [r14]
mov word [rax + rcx], 0x20
jmp 0x180014e00
xor r8d, r8d
mov r9b, 0x20
mov rcx, r14
lea edx, [r8 + 1]
call fcn.180006930
lea rax, [rbp - 0x21]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180014e10
mov rdx, qword [r14 + 0x18]
mov rcx, qword [r14 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x180014e61
lea rax, [rcx + rdi]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180014e40
mov rax, qword [r14]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp - 0x21]
call sub.VCRUNTIME140.dll_memmove
mov edx, 0x746e
mov byte [rbx + rdi], 0
jmp case.0x180014d0d.12
lea r9, [rbp - 0x21]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call fcn.180006a90
mov edx, 0x746e
jmp case.0x180014d0d.12
cmp qword [0x1800ffee8], 0x10
lea rdx, [0x1800ffed0]
mov r8, qword [0x1800ffee0]
mov rcx, r14
cmovae rdx, qword [0x1800ffed0]
call fcn.180022f20
mov edx, 0x746e
jmp case.0x180014d0d.12
mov qword [rsp + 0x28], 0
lea r8, [0x18001f4f0]
mov r9, r12
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18001504e
xchg qword [0x180106c20], rax
mov edx, 0x746e
jmp case.0x180014d0d.12
mov r8d, 4
mov byte [rbp - 0xd], 0
lea rdx, [0x1800f0c95]
lea rcx, [rbp - 0xd]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edx, 0x746e
jmp case.0x180014d0d.12
cmp qword [r12 + 0x18], 0x10
mov r9, r12
jb 0x180014f25
mov r9, qword [r12]
mov qword [rsp + 0x28], 0
lea rdx, [rbp + 7]
mov r8d, 0xca
mov qword [rsp + 0x20], 0
mov rcx, r14
call fcn.1800083b0
xor ebx, ebx
lea r9, [rbp - 1]
mov qword [rsp + 0x28], rbx
lea rdx, str.Connection
mov r8d, 0xca
mov qword [rsp + 0x20], rbx
mov rcx, r14
call fcn.1800083b0
cmp qword [r12 + 0x58], 0x10
lea r9, [r12 + 0x40]
jb 0x180014f7e
mov r9, qword [r9]
mov qword [rsp + 0x28], rbx
lea rdx, [rbp - 0x11]
mov r8d, 0xca
mov qword [rsp + 0x20], rbx
mov rcx, r14
call fcn.1800083b0
mov edx, 0x746e
jmp case.0x180014d0d.12
mov byte [rbp - 0x29], 1
jmp case.0x180014d0d.12
mov rcx, qword [r14 + 0x10]
mov word [rbp - 9], dx
mov rdx, qword [r14 + 0x18]
mov rax, rdx
mov byte [rbp - 7], 0
sub rax, rcx
cmp rax, 3
jb 0x180015001
lea rax, [rcx + 3]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180014fdd
mov rax, qword [r14]
lea rbx, [rax + rcx]
mov r8d, 3
mov rcx, rbx
lea rdx, [0x1800ec508]
call sub.VCRUNTIME140.dll_memmove
mov edx, 0x746e
mov byte [rbx + 3], 0
jmp case.0x180014d0d.12
xor r8d, r8d
mov qword [rsp + 0x20], 3
lea r9, [0x1800ec508]
mov rcx, r14
lea edx, [r8 + 3]
call fcn.180006a90
mov edx, 0x746e
jmp case.0x180014d0d.12
mov byte [rbp - 0xe], 0x72
jmp case.0x180014d0d.12
mov byte [rbp - 9], 0
jmp case.0x180014d0d.12
mov qword [r12 + 0x80], r14
dec esi
lea eax, [rsi + 0x94]
cmp eax, r15d
ja 0x180014cf0
jmp case.0x180014d0d.8
mov byte [rbp - 0x29], 0
mov eax, dword [rbp - 0x29]
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1800bfc40
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret