Function at 0x18005eaf0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x1800e5c38]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov r15, r9
mov ebx, r8d
mov dword [rsp + 0x48], ebx
mov rdi, rcx
mov qword [rbp - 0x70], rcx
mov r11, qword [rbp + 0x340]
mov qword [rbp - 0x68], r11
mov r13, qword [rbp + 0x350]
mov r14d, r8d
imul r12d, r8d, 0x810
xor edx, edx
mov r10d, dword [rsp + 0x40]
mov r9, qword [rsp + 0x70]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x58], r9
cmp r8d, r12d
mov r8d, dword [rsp + 0x40]
mov dword [rsp + 0x34], r8d
ja 0x18005efce
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov rsi, qword [rbp - 0x60]
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x30], al
movabs rcx, 0x4034000000000000
cmp r14d, 0x53f9
ja 0x18005ed19
je 0x18005ed0b
cmp r14d, 0x10a
ja 0x18005ec65
je 0x18005ec4d
mov eax, r14d
sub eax, 0x19
je 0x18005ec45
sub eax, 0x3a
je 0x18005ec38
sub eax, 0x55
je 0x18005ec25
cmp eax, 0x4c
jne 0x18005ed7f
mov r9, r15
mov qword [rsp + 0x58], r15
cmp qword [r11], 0
je 0x18005ed7f
mov ecx, 0x3d
cmp ecx, 0x3d
je 0x18005ec0b
cmp ecx, 0x1a36
jne 0x18005ec12
mov eax, edx
jmp 0x18005f4d6
mov rax, qword [r11]
mov qword [r15 + 8], rax
add ecx, 0x19f9
cmp ecx, 0x33f2
jbe 0x18005ebf7
jmp 0x18005ed7f
mov qword [0x1800e5d18], r13
mov qword [r13 + 0x80], r11
jmp 0x18005ed7f
mov dword [r11 + 0x20], 3
jmp 0x18005ed7f
mov rsi, r13
jmp 0x18005ed7f
mov byte [rsp + 0x30], 1
movups xmm0, xmmword [str.trns_after_IDAT]
movups xmmword [rbp + 0x2d0], xmm0
jmp 0x18005ed7f
cmp r14d, 0xcb2
je 0x18005ec9d
cmp r14d, 0x194b
je 0x18005ed0f
cmp r14d, 0x2a26
jne 0x18005ed7f
mov dword [r11 + 0x24], 3
mov qword [r11 + 0x68], rdx
mov qword [r11 + 0x60], rdx
jmp 0x18005ed7f
mov r8d, dword [r11]
test r8d, r8d
jle 0x18005efc4
xor r11d, r11d
nop dword [rax]
mov edx, 0xc0
mov eax, edx
sub eax, 0xbf
je 0x18005ecf7
cmp eax, 1
jne 0x18005ecfa
movzx eax, byte [rsi]
inc rsi
test al, al
je 0x18005ecfa
mov ecx, 0x97
mov eax, ecx
sub eax, 0x97
je 0x18005ece6
cmp eax, 1
je case.0x18005ede8.0
jmp 0x18005eceb
mov dword [rsp + 0x38], r11d
inc ecx
cmp ecx, 0x99
jb 0x18005ecd2
jmp 0x18005ecfa
dec r8d
dec edx
cmp edx, 0xbe
ja 0x18005ecb5
test r8d, r8d
jg 0x18005ecb0
jmp 0x18005ed78
mov qword [r11 + 0x58], rcx
mov dword [rsp + 0x38], 1
jmp 0x18005ed7f
cmp r14d, 0xf6dc
ja 0x18005ef17
je 0x18005ef0b
cmp r14d, 0x7be8
je 0x18005edea
cmp r14d, 0x7dcc
je case.0x18005ede8.0
cmp r14d, 0x8714
jne 0x18005ed7f
xor r9d, r9d
lea r8d, [r9 + 0x5f]
lea rdx, str.user32.dll
lea rcx, str.CharLowerW
call fcn.18004c8a0
mov qword [rsp + 0x60], rax
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x34]
xor edx, edx
imul eax, ebx, 0x81
add r14d, eax
mov r11, qword [rbp - 0x68]
cmp r14d, r12d
jbe 0x18005eb95
mov r12, qword [rsp + 0x60]
lea r14d, [rbx - 0xf]
cmp ebx, r14d
jbe case.0x18005ede8.0
lea esi, [rbx - 0x19]
lea rcx, [0x180000000]
mov edi, dword [rsp + 0x60]
mov r15, qword [rbp - 0x60]
nop dword [rax]
mov edx, r8d
cmp esi, 0xf1
ja case.default.0x18005ede8
movzx eax, byte [rcx + rsi + 0x5f544]
mov ecx, dword [rcx + rax*4 + 0x5f508]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
cmp qword [rdi], 0
je 0x18005ee26
mov rax, qword [r13]
mov ecx, dword [rax + 0xb8]
mov rdx, qword [r9 + 8]
lea r8, [rdx + 1]
shr rdx, cl
mov rax, r8
shr rax, cl
cmp rdx, rax
jne 0x18005ee1f
mov qword [rsp + 0x68], r8
mov r8d, dword [rsp + 0x34]
jmp 0x18005eef9
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov ebx, 0x94
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x94
je 0x18005ee82
cmp eax, 0x58
jne 0x18005eedc
test r8d, r8d
je 0x18005ee7c
mov eax, 0xaf
nop dword [rax]
cmp eax, 0xaf
je 0x18005ee64
cmp eax, 0x717a
je case.0x18005ede8.0
jmp 0x18005ee70
mov dword [r9 + 0x28], r8d
mov dword [rsp + 0x38], 2
add eax, 0x70cb
cmp eax, 0xe196
jbe 0x18005ee50
inc dword [r9 + 4]
jmp 0x18005eedc
mov rax, qword [r13]
mov ecx, dword [rax + 0xb8]
mov eax, 0xffffffff
shl eax, cl
cdqe
and qword [r9 + 8], rax
mov rax, qword [r9 + 8]
mov qword [rsp + 0x70], rdx
mov qword [rbp - 0x40], rax
mov rax, qword [r13]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x122
lea r8, [rbp - 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.18007ddf0
mov r8d, eax
mov dword [rsp + 0x34], eax
mov r9, qword [rsp + 0x58]
add ebx, 0x58
cmp ebx, 0x144
mov edx, 0
jb 0x18005ee30
mov r10, qword [rsp + 0x50]
mov ebx, dword [rsp + 0x48]
cmp qword [rdi], 0
jl 0x18005ed7d
dec dword [r9]
jmp 0x18005ed7d
mov r8d, edx
mov dword [rsp + 0x34], edx
jmp 0x18005ed7f
cmp r14d, 0x10d1e
je 0x18005ef9a
cmp r14d, 0x19328
je 0x18005ef53
cmp r14d, 0x21932
jne 0x18005ed7f
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8, [rbp + 0x40]
mov edx, 0xed
xor ecx, ecx
call fcn.18005dfc0
jmp 0x18005ed6e
mov rdi, qword [r13 + 8]
mov rbx, qword [r13]
cmp rbx, rdi
je 0x18005ef86
mov rcx, rbx
call fcn.180066130
add rbx, 0x20
cmp rbx, rdi
jne 0x18005ef60
mov rbx, qword [r13]
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x34]
mov r10, qword [rsp + 0x50]
xor edx, edx
mov qword [r13 + 8], rbx
mov dword [rbp - 0x80], edx
mov ebx, dword [rsp + 0x48]
mov rdi, qword [rbp - 0x70]
jmp 0x18005ed7f
lea rax, [rbp + 0x2d0]
mov r10, 0xffffffffffffffff
nop dword [rax + rax]
inc r10
cmp byte [rax + r10], 0
jne 0x18005efb0
mov qword [rsp + 0x50], r10
jmp 0x18005ed7f
mov r8d, dword [rsp + 0x34]
jmp 0x18005ed7f
mov r12, qword [rsp + 0x70]
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x30], al
jmp 0x18005ed9a
cmp dword [r9], 0
jne 0x18005f016
mov ecx, 0x19
nop dword [rax]
mov eax, ecx
sub eax, 0x19
je 0x18005f002
cmp eax, 1
je case.0x18005ede8.0
jmp 0x18005f00a
mov dword [rsp + 0x38], 3
inc ecx
cmp ecx, 0x1b
jb 0x18005eff0
jmp case.0x18005ede8.14
mov eax, 0xc
nop dword [rax + rax]
cmp eax, 0xc
je 0x18005f032
cmp eax, 0x54c
je case.0x18005ede8.0
jmp 0x18005f03a
mov dword [rsp + 0x38], 1
add eax, 0x540
cmp eax, 0xa80
jbe 0x18005f020
jmp case.0x18005ede8.14
test r8d, r8d
je case.0x18005ede8.14
mov eax, 0xaf
nop dword [rax]
cmp eax, 0xaf
je 0x18005f074
cmp eax, 0x5573
je case.0x18005ede8.0
jmp 0x18005f080
mov dword [r9 + 0x28], r8d
mov dword [rsp + 0x38], 2
add eax, 0x54c4
cmp eax, 0xa988
jbe 0x18005f060
jmp case.0x18005ede8.14
mov rax, qword [rsp + 0x68]
mov qword [r9 + 8], rax
mov qword [r11], rax
mov dword [rsp + 0x78], 1
mov qword [rbp - 0x30], rax
mov rax, qword [r13]
mov qword [rbp - 0x38], rax
mov dword [rsp + 0x20], 0x126
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x30]
call fcn.1800773e0
jmp case.0x18005ede8.14
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x80]
mov edx, r10d
lea rcx, [rbp + 0x2d0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov edi, eax
xor eax, eax
mov dword [rsp + 0x40], eax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 0x2b]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.1800ac570
test al, al
je case.0x18005ede8.14
nop dword [rax + rax]
mov ebx, 0xe9
nop word [rax + rax]
mov eax, ebx
sub eax, 0xe9
je 0x18005f1f6
cmp eax, 1
jne 0x18005f1fd
xor eax, eax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], ax
mov rdx, qword [rbp - 0x10]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], ax
jne 0x18005f163
lea rcx, [rbp + 0x18]
call fcn.180068830
nop
mov rdx, qword [r13 + 8]
cmp rdx, qword [r13 + 0x10]
je 0x18005f1a8
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x28]
movups xmmword [rdx + 0x10], xmm1
mov eax, 7
mov qword [rbp + 0x30], rax
xor r11d, r11d
mov word [rbp + 0x18], r11w
add qword [r13 + 8], 0x20
jmp 0x18005f1b8
lea r8, [rbp + 0x18]
mov rcx, r13
call fcn.180049150
mov rax, qword [rbp + 0x30]
cmp rax, 8
jb 0x18005f1fd
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005f1ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005f49e
call fcn.1800cfd58
jmp 0x18005f1fd
mov rcx, qword [rbp - 0x10]
call r12
inc ebx
cmp ebx, 0xeb
jb 0x18005f130
xor eax, eax
mov dword [rsp + 0x40], eax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 0x2b]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.1800ac570
test al, al
jne 0x18005f120
mov ebx, dword [rsp + 0x48]
jmp case.0x18005ede8.14
test r15, r15
jne case.0x18005ede8.14
mov byte [rsp + 0x38], r15b
jmp case.0x18005ede8.0
xor eax, eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x40]
lea edx, [rax + 0x11]
xor ecx, ecx
call fcn.18005e660
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x30]
test edi, edi
cmove ecx, eax
mov byte [rsp + 0x30], cl
jmp case.0x18005ede8.14
mov byte [rsp + 0x38], 1
jmp case.0x18005ede8.14
xor eax, eax
mov qword [rbp - 0x58], rax
jmp case.0x18005ede8.14
cmp byte [rsp + 0x30], 0
je case.0x18005ede8.14
mov ebx, 0xe
mov eax, ebx
sub eax, 0xc
je 0x18005f2db
sub eax, 1
je 0x18005f2d5
cmp eax, 1
jne 0x18005f2ee
xor eax, eax
mov qword [rbp - 0x50], rax
lea r8, [rbp - 0x50]
mov edx, r10d
lea rcx, [rbp + 0x2d0]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov edi, eax
jmp 0x18005f2e9
mov rcx, qword [rbp - 0x58]
jmp 0x18005f2df
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18005f2ee
call sub.RPCRT4.dll_MesHandleFree
mov r10, qword [rsp + 0x50]
dec ebx
cmp ebx, 0xb
ja 0x18005f2a7
mov ebx, dword [rsp + 0x48]
jmp case.0x18005ede8.14
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov r9, r13
lea r8, [0x180063b80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
jmp case.0x18005ede8.14
mov rax, qword [rbp - 0x70]
cmp qword [rax], 0
jg 0x18005f378
mov rdx, qword [r9 + 0x20]
mov dword [rbp - 0x78], 1
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x28], rax
mov rax, qword [r13]
mov rcx, qword [rax + 8]
mov qword [rbp - 0x20], rcx
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x28]
mov edx, 0xec
lea rcx, [rbp - 0x20]
call fcn.18006ff80
mov dword [rsp + 0x34], eax
mov r9, qword [rsp + 0x58]
jmp 0x18005f449
test byte [r9 + 0x1c], 2
jne 0x18005f449
movsxd rcx, dword [r9 + 0x18]
mov dword [rsp + 0x34], edx
test ecx, ecx
je 0x18005f438
mov rax, rcx
add rax, qword [r9 + 0x10]
cmp rax, qword [rsp + 0x68]
jne 0x18005f3b5
cmp ecx, 0x400
jge 0x18005f3b5
inc ecx
mov dword [r9 + 0x18], ecx
mov dword [rsp + 0x34], edx
jmp 0x18005f434
mov ebx, 0xc6
mov dword [rsp + 0x34], edx
nop
cmp ebx, 0xc6
je 0x18005f3d8
cmp ebx, 0x9924
jne 0x18005f41e
xor eax, eax
mov dword [r9 + 0x18], eax
jmp 0x18005f41e
mov eax, dword [r9 + 0x18]
mov dword [rsp + 0x60], eax
mov rax, qword [r9 + 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [r13]
mov qword [rbp - 0x60], rax
xor eax, eax
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x60]
lea ecx, [r9 + 0x6e]
call fcn.1800c8610
mov dword [rsp + 0x34], eax
mov r9, qword [rsp + 0x58]
add ebx, 0x985e
cmp ebx, 0x130bc
jbe 0x18005f3c0
mov ecx, dword [r9 + 0x18]
mov ebx, dword [rsp + 0x48]
test ecx, ecx
jne 0x18005f449
mov rax, qword [rsp + 0x68]
mov qword [r9 + 0x10], rax
mov dword [r9 + 0x18], 1
mov rdx, qword [rbp - 0x70]
cmp qword [rdx], 0
jne case.0x18005ede8.14
mov rax, qword [r13]
mov r8d, dword [rax + 0x28]
xor edx, edx
mov rcx, qword [r9 + 0x20]
call sub.VCRUNTIME140.dll_memset
jmp case.0x18005ede8.14
mov rax, r15
xchg qword [0x1800e5d20], rax
lea rcx, [0x180000000]
dec ebx
mov dword [rsp + 0x48], ebx
dec esi
cmp ebx, r14d
jbe case.0x18005ede8.0
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x34]
mov r10, qword [rsp + 0x50]
mov r11, qword [rbp - 0x68]
jmp 0x18005edc0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 0x39
nop word [rax + rax]
mov eax, ecx
sub eax, 0x39
je 0x18005f4be
cmp eax, 1
je case.0x18005ede8.0
jmp 0x18005f4cb
mov rax, qword [r13 + 8]
cmp qword [r13], rax
setne byte [rsp + 0x38]
inc ecx
cmp ecx, 0x3b
jb 0x18005f4b0
mov eax, dword [rsp + 0x38]
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1800d0500
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret