Function at 0x180030690
Capabilities:
Check if file exists
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x180070310]
xor rax, rsp
mov qword [rsp + 0x90], rax
imul r12d, ecx, 0x478
mov r14, rdx
mov r15d, ecx
mov edi, ecx
cmp ecx, r12d
ja case.0x180030850.5
mov esi, dword [rsp + 0x70]
xor r13d, r13d
movzx ebp, byte [rsp + 0x70]
lea rdx, [0x180000000]
mov r8d, 0x3a72
cmp edi, 0x2ac0
ja 0x180030951
je 0x1800308fe
cmp edi, 0x32
je 0x1800307b9
cmp edi, 0x4c
je 0x180030754
cmp edi, 0x65
je 0x180030747
cmp edi, 0x1c20
jne 0x180030975
cmp qword [r14 + 0x18], 0x10
mov rcx, r14
jb 0x180030730
mov rcx, qword [r14]
lea rdx, [0x180070400]
call qword [0x1800703f0]
mov qword [rsp + 0x78], rax
jmp 0x180030975
mov rax, qword [r14]
mov qword [rsp + 0x78], rax
jmp 0x180030975
mov qword [rsp + 0x28], r13
lea r8, [0x180032b30]
mov r9, r14
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14], rax
test rax, rax
jne 0x180030975
mov byte [rsp + 0x78], r13b
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800643d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x10f
nop
mov eax, ecx
sub eax, 0x10c
je 0x1800307ed
sub eax, 1
je 0x18003080a
cmp eax, 2
jne 0x1800307f9
cmp qword [0x1800703f8], r13
je 0x180030805
cmp qword [0x1800703f0], r13
je 0x180030805
mov bpl, 1
jmp 0x180030975
cmp dword [r13], 6
mov esi, r13d
setae sil
inc ecx
cmp ecx, 0x112
jb 0x1800307c0
jmp 0x18003081a
xor bpl, bpl
jmp 0x180030823
mov eax, dword [SHChangeNotifyDeregister]
sub eax, esi
mov dword [rsp + 0x70], eax
movzx ebp, al
test bpl, bpl
jne 0x180030975
mov ebx, r13d
nop word [rax + rax]
cmp ebx, 0x82
ja case.0x180030850.6
mov eax, ebx
movzx eax, byte [rdx + rax + 0x309a8]
mov ecx, dword [rdx + rax*4 + 0x3098c]
add rcx, rdx
jmp rcx
movzx eax, word [0x180068429]
mov word [rsp + 0x83], ax
movzx eax, byte [0x18006842b]
mov byte [rsp + 0x85], al
jmp case.0x180030850.6
mov word [rsp + 0x86], r8w
mov byte [rsp + 0x88], r13b
jmp case.0x180030850.6
mov r8d, 3
lea rdx, [0x180068448]
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x1800308db
mov r8d, 3
lea rdx, [0x180068489]
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rsp + 0x8b], 0x67
jmp 0x1800308db
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov qword [rsp + 0x78], r13
lea rdx, [0x180000000]
mov r8d, 0x3a72
add ebx, 0x1a
lea eax, [rbx + 0x100]
cmp eax, 0x19c
jb 0x180030830
jmp 0x180030975
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], r14
xor r9d, r9d
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x48], r13
xor edx, edx
mov dword [rsp + 0x40], 0xc7
xor ecx, ecx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x70], 1
call fcn.18003d3a0
mov byte [rsp + 0x78], 1
jmp 0x180030975
cmp edi, 0x380e
je case.0x180030850.5
cmp edi, 0x38d0
je case.0x180030850.5
cmp edi, 0x5534
je case.0x180030850.5
imul eax, r15d, 0x8f
add edi, eax
cmp edi, r12d
ja case.0x180030850.5
jmp 0x1800306e5