Function at 0x180028f90
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rax - 0x258]
sub rsp, 0x330
movdqa xmm0, xmmword [0x1800ed990]
xor ebx, ebx
mov qword [rax + 0x10], r12
mov qword [rax - 0x30], r13
mov r13, rdx
movdqu xmmword [rbp + 0x2a], xmm0
lea ecx, [rbx + 0x30]
mov qword [rax - 0x38], r15
movdqu xmmword [rbp - 0x1e], xmm0
mov qword [rbp + 0x10], rbx
xorps xmm0, xmm0
mov word [rbp + 0x18], bx
mov byte [rbp + 0x1a], bl
mov qword [rbp - 0x38], rbx
mov word [rbp - 0x30], bx
mov byte [rbp - 0x2e], bl
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x50], rbx
call fcn.1800ac960
xorps xmm0, xmm0
lea r9, [0x18000bfb0]
xorps xmm2, xmm2
lea rdx, [0x180000000]
xorps xmm1, xmm1
mov edi, 1
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0x48], rax
mov eax, dword [rbp + 0x290]
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0x58], rbx
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x68], rbx
lea r12d, [rax - 0xd]
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x70], rbx
movups xmmword [rbp + 0x110], xmm0
mov dword [rbp + 0x78], edi
movdqa xmm0, xmmword [0x1800ed990]
movdqa xmmword [rbp + 0x130], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x150], xmm0
movsd qword [rbp + 0x60], xmm2
movsd qword [rbp + 0x1f0], xmm2
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmmword [rbp + 0xb0], xmm1
mov qword [rbp + 0xc0], 0xffffffffffffffff
mov dword [rbp + 0xc8], ebx
mov byte [rbp + 0x120], bl
mov word [rbp + 0x140], bx
mov dword [rbp + 0x144], ebx
mov qword [rbp + 0x148], rbx
mov dword [rbp + 0x160], ebx
mov qword [rbp + 0x178], rbx
mov qword [rbp + 0x180], 0xf
mov byte [rbp + 0x168], bl
mov qword [rbp + 0x198], rbx
mov qword [rbp + 0x1a0], 0xf
mov byte [rbp + 0x188], bl
mov qword [rbp + 0x1b8], rbx
mov qword [rbp + 0x1c0], 0xf
mov byte [rbp + 0x1a8], bl
mov qword [rbp + 0x1c8], rbx
mov qword [rbp + 0x1d0], 0xffffffffffffffff
mov qword [rbp + 0x1d8], rbx
mov qword [rbp + 0x1e0], rbx
mov qword [rbp + 0x1e8], rbx
mov word [rbp + 0x1f8], bx
mov byte [rbp + 0x1fa], bl
mov r15, qword [rbp + 0x280]
mov r8d, 0x1bb
mov r14d, dword [rsp + 0x40]
mov ebx, dword [rsp + 0x40]
cmp eax, r12d
jbe 0x1800293e9
lea esi, [rax - 0x11]
cmp esi, 0x36
ja case.0x1800291bc.13
movzx eax, byte [rdx + rsi + 0x29924]
mov ecx, dword [rdx + rax*4 + 0x298ec]
add rcx, rdx
jmp rcx
mov rcx, qword [r15 + 0x50]
test rcx, rcx
je 0x1800291cc
call fcn.1800b16dc
mov rcx, qword [r15 + 0x60]
test rcx, rcx
je case.0x1800291bc.13
call fcn.1800b16dc
jmp case.0x1800291bc.13
movzx eax, word [r13]
mov dword [r15 + 0x18], eax
jmp case.0x1800291bc.13
mov r9d, 0x10b
lea r8, [0x1801061c0]
xor edx, edx
xor ecx, ecx
call fcn.18002c4d0
jmp case.0x1800291bc.13
mov rax, qword [rbp + 0x278]
lea rdx, [rsp + 0x58]
mov r9d, SHGetNewLinkInfoA
lea rcx, [rsp + 0x60]
mov r8, r13
mov eax, dword [rax]
mov dword [rsp + 0x48], eax
mov rax, qword [rbp + 0x288]
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
mov rax, qword [rbp + 0x260]
mov eax, dword [rax]
mov dword [rsp + 0x58], eax
mov rax, qword [rbp + 0x298]
mov eax, dword [rax]
mov dword [rsp + 0x60], eax
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x270]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.180099900
mov r14d, eax
bt eax, 0xc
jb 0x18002961f
mov r9, qword [rbp - 0x40]
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], 0
lea edx, [r8 + 0x1a]
call fcn.1800102d0
mov r14d, eax
jmp case.0x1800291bc.13
xor r9d, r9d
lea rdx, [0x1801061c8]
mov r8d, 0xc5
xor ecx, ecx
call fcn.1800a1bd0
test al, al
je 0x180029665
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1800b1e0c
mov eax, 0x1bb
mov dword [rsp + 0x20], 0x11d
lea r9, [0x180106208]
mov word [rsp + 0x48], ax
lea r8, [rsp + 0x48]
xor ecx, ecx
lea rdx, [rbp + 0x10]
call fcn.18001ce10
jmp case.0x1800291bc.13
mov r14d, 0x1000
test r15, r15
je 0x180029320
test r13, r13
jne case.0x1800291bc.13
mov r14d, 0x1102
jmp 0x18002961f
mov rcx, qword [r15 + 0x70]
test rcx, rcx
je 0x180029339
call fcn.1800b16dc
mov rcx, qword [r15 + 0x88]
test rcx, rcx
je case.0x1800291bc.13
call fcn.1800b16dc
jmp case.0x1800291bc.13
mov rdx, qword [r15 + 8]
lea r9, [rbp - 0x40]
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov dword [rsp + 0x28], 0xde
mov qword [rsp + 0x20], rax
call fcn.180038890
mov r14d, eax
jmp case.0x1800291bc.13
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x180029385
call fcn.1800b16dc
mov rcx, qword [r15 + 0x18]
test rcx, rcx
je 0x180029393
call fcn.1800b16dc
mov rcx, qword [r15 + 0x40]
test rcx, rcx
je case.0x1800291bc.13
call fcn.1800b16dc
jmp case.0x1800291bc.13
mov ebx, dword [rsp + 0x40]
jmp case.0x1800291bc.13
movss xmm0, dword [r15]
movss dword [rsp + 0x40], xmm0
jmp case.0x1800291bc.13
bt r14d, 0xc
jb 0x18002961f
dec esi
lea rdx, [0x180000000]
lea eax, [rsi + 0x11]
cmp eax, r12d
ja 0x1800291a1
mov eax, dword [rbp + 0x290]
lea r9, [0x18000bfb0]
mov r8d, 0x1bb
mov esi, eax
add eax, 0xfffffff4
cmp esi, eax
jbe case.0x180029414.20
lea eax, [rsi - 0x12]
cmp eax, 0x35
ja case.0x180029414.30
movzx eax, byte [rdx + rax + 0x29990]
mov ecx, dword [rdx + rax*4 + 0x2995c]
add rcx, rdx
jmp rcx
mov r9d, 0x10b
lea r8, [rbp + 0x40]
xor edx, edx
xor ecx, ecx
call fcn.18008aa80
xor ebx, ebx
jmp case.0x180029414.30
mov rcx, qword [r15 + 0xa0]
test rcx, rcx
je case.0x180029414.30
call fcn.1800b16dc
jmp case.0x180029414.30
xor r12d, r12d
mov word [rsp + 0x48], r8w
mov qword [rsp + 0x30], r12
lea r9, [rbp - 0x38]
mov dword [rsp + 0x28], 0xc2
lea r8, [rsp + 0x48]
lea rdx, [0x180106228]
mov qword [rsp + 0x20], r12
xor ecx, ecx
call fcn.180038890
lea r9d, [r12 + 0x22]
xor r8d, r8d
lea rdx, [rsp + 0x70]
xor ecx, ecx
call fcn.180039470
mov rdx, qword [rsp + 0x78]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
cmp rdx, qword [rbp - 0x80]
je 0x1800294b6
lea rax, [rbp + 0x10]
mov qword [rdx], rax
add qword [rsp + 0x78], 8
jmp case.0x180029414.30
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.180001860
jmp case.0x180029414.30
xor eax, eax
lea r9, [rbp + 0x200]
mov qword [rsp + 0x28], rax
lea r8, [0x1800163a0]
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180029665
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x180029414.30
mov eax, 0x9c
nop dword [rax]
cmp eax, 0x9c
je 0x180029648
add eax, 0x51
cmp eax, 0xed
jb 0x180029510
lea rax, [rbp - 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x78]
cmp rax, qword [rbp - 0x80]
je 0x18002954b
lea rcx, [rbp - 0x38]
mov qword [rax], rcx
add qword [rsp + 0x78], 8
jmp case.0x180029414.30
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.180001860
jmp case.0x180029414.30
mov eax, dword [0x180106250]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x40], eax
mov edx, 0x106
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x70]
call fcn.1800102d0
lea rax, [rsp + 0x70]
mov qword [rbp], rax
mov eax, dword [0x180106250]
mov dword [rbp + 8], eax
mov eax, dword [0x180106254]
mov dword [rbp + 0xc], eax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x200], xmm0
jmp case.0x180029414.30
xor r14d, r14d
jmp 0x18002961f
xor r12d, r12d
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], r12
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xa5
call fcn.1800180e0
lea rax, [rbp + 0x40]
mov r8d, 0x115
mov qword [rsp + 0x28], rax
lea r9, [0x1801061c0]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], r12
lea rcx, [rbp + 0x210]
call fcn.1800851a0
jmp case.0x180029414.30
bt r14d, 0xc
jae case.0x180029414.30
mov esi, 0x2c
mov ebx, r14d
mov eax, dword [rbp + 0x290]
lea rdx, [0x180000000]
dec esi
lea r9, [0x18000bfb0]
mov r8d, 0x1bb
jmp 0x1800293eb
mov rcx, qword [r15 + 0xa8]
test rcx, rcx
je 0x180029659
call fcn.1800b16dc
mov rcx, r15
call fcn.1800b16dc
jmp case.0x180029414.20
mov edi, ebx
mov ebx, edi
lea rcx, [rbp + 0x168]
call fcn.180004b30
lea rcx, [rbp + 0xc0]
call fcn.180004cf0
mov rdi, qword [rbp + 0xa8]
mov r15, qword [rsp + 0x320]
mov r13, qword [rsp + 0x328]
mov r12, qword [rsp + 0x368]
test rdi, rdi
je 0x18002971a
mov rsi, qword [rbp + 0xb0]
cmp rdi, rsi
je 0x1800296c8
nop
mov rcx, rdi
call fcn.180021bf0
add rdi, 0x20
cmp rdi, rsi
jne 0x1800296b0
mov rdi, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xb8]
mov rax, rdi
sub rdx, rdi
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x1800296fb
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800298e5
mov rcx, rdi
call fcn.1800ac99c
xor r14d, r14d
xorps xmm0, xmm0
mov qword [rbp + 0xa8], r14
movdqa xmmword [rbp + 0xb0], xmm0
jmp 0x18002971d
xor r14d, r14d
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x180029773
mov rdx, qword [rbp + 0xa0]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x18002975c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800298e5
call fcn.1800ac99c
xorps xmm0, xmm0
mov qword [rbp + 0xa0], r14
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x48]
call fcn.180004c90
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x18002980a
mov rsi, qword [rbp - 0x70]
cmp rdi, rsi
je 0x1800297a7
mov rcx, rdi
call fcn.180004c30
add rdi, 0x28
cmp rdi, rsi
jne 0x180029792
mov rdi, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x68]
movabs rax, 0x6666666666666667
sub rcx, rdi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, rdi
lea rdx, [rdx + rdx*4]
shl rdx, 3
cmp rdx, 0x1000
jb 0x1800297f6
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800298e5
mov rcx, rdi
call fcn.1800ac99c
xorps xmm0, xmm0
mov qword [rbp - 0x78], r14
movdqa xmmword [rbp - 0x70], xmm0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180029856
mov rdx, qword [rbp - 0x80]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x180029844
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800298e5
call fcn.1800ac99c
xorps xmm0, xmm0
mov qword [rbp - 0x80], r14
movdqa xmmword [rsp + 0x70], xmm0
mov rdx, qword [rbp - 0x16]
cmp rdx, 0x10
jb 0x18002988d
mov rcx, qword [rbp - 0x2e]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029888
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800298e5
call fcn.1800ac99c
mov rdx, qword [rbp + 0x32]
movdqa xmm0, xmmword [0x1800ed990]
mov byte [rbp - 0x2e], 0
movdqu xmmword [rbp - 0x1e], xmm0
cmp rdx, 0x10
jb 0x1800298d5
mov rcx, qword [rbp + 0x1a]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800298d0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800298e5
call fcn.1800ac99c
mov eax, ebx
add rsp, 0x330
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800b0d14
int3