Function at 0x1800d9524
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rbx, rcx
cmp edx, 1
jne 0x1800d9827
and dword [rbp + 0x6f], 0
lea r9d, [rdx + 3]
lea r8d, [rdx + 0x3f]
mov rdx, rcx
lea rax, [rbp + 0x6f]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1800d957a
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
test rbx, rbx
je 0x1800d95b5
lea rax, [rbp + 0x6f]
mov r9d, 4
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x20], rax
mov rdx, rbx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1800d95b5
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
movabs rax, 0x96217801fa10bc5b
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x49], rax
movabs rax, 0xa7bfebfb65a10d71
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x41], rax
movabs rax, 0xf99f4a8a336e03b8
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x39], rax
movabs rax, 0xba760469ec1ad1f2
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x31], rax
movabs rax, 0x52f3097cbd8effe4
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x29], rax
movabs rax, 0xd0a6a641595daeb3
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x21], rax
movabs rax, 0x2a74ef9442c19393
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x19], rax
movabs rax, 0x2efd873e8e1216ba
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x11], rax
movabs rax, 0xeb92f1d7ac63a7ac
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 9], rax
movabs rax, 0xd436ec822796067c
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 1], rax
movabs rax, 0x96457860fa7fbc17
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 7], rax
movabs rax, 0xa7efebf165c50d14
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0xf], rax
movabs rax, 0xf9fa4afe331d03d9
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x17], rax
movabs rax, 0xba04040fec3ad196
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x1f], rax
movabs rax, 0x52a0095cbde3ff8b
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x27], rax
movabs rax, 0xd0cfa62d5924aed8
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x2f], rax
movabs rax, 0x2a7eefba42a493fd
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x37], rax
movabs rax, 0x2e8e875b8e6016ea
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x3f], rax
movabs rax, 0xebfcf1b8ac43a7df
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x47], rax
movabs rax, 0xd436ecc927d9065c
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
movdqa xmm0, xmmword [rbp - 0x49]
mov qword [rbp + 0x4f], rax
pxor xmm0, xmmword [rbp + 7]
lea rdx, [rbp - 0x49]
movdqa xmm1, xmmword [rbp - 0x39]
xor r9d, r9d
pxor xmm1, xmmword [rbp + 0x17]
xor r8d, r8d
movdqa xmmword [rbp - 0x49], xmm0
xor ecx, ecx
movdqa xmm0, xmmword [rbp - 0x29]
pxor xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [rbp - 9]
pxor xmm0, xmmword [rbp + 0x47]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [rbp - 0x19]
pxor xmm1, xmmword [rbp + 0x37]
movdqa xmmword [rbp - 9], xmm0
movdqa xmmword [rbp - 0x19], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
and qword [rsp + 0x28], 0
lea r8, [0x18009fc54]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
and qword [rsp + 0x28], 0
lea r8, [0x1800d91e0]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
and qword [rsp + 0x28], 0
lea r8, [0x1800ba360]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0xe0]
mov al, 1
add rsp, 0xd0
pop rbp
ret