Function at 0x180008f40
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1800a5088]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov r15d, dword [rsp + 0x34]
lea r13, [0x180000000]
mov esi, 0x4c
mov qword [rsp + 0x48], r8
xor r12d, r12d
mov r14d, esi
mov r9d, 0x6461
mov r8d, 0x6570
lea edi, [rsi - 0x41]
lea edx, [rsi + 0x18]
lea ebx, [rsi - 0x1e]
lea r10d, [r12 + 0x6b]
lea r11d, [r12 + 0x32]
nop dword [rax]
cmp edi, 0x1a
ja case.0x180008fc6.12
mov eax, edi
mov ecx, dword [r13 + rax*4 + 0x95f4]
add rcx, r13
jmp rcx
mov r8d, 1
mov word [rbp - 0x3a], r12w
lea rdx, [0x18009056a]
lea rcx, [rbp - 0x40]
call fcn.1800568cc
mov r8d, 1
lea rdx, [0x180090576]
lea rcx, [rbp - 0x38]
call fcn.18005c2b0
mov r8d, 2
mov word [rbp - 0x36], r12w
lea rdx, [0x180090606]
lea rcx, [rbp - 0x40]
call fcn.1800568cc
jmp 0x1800091fa
mov rdx, qword [0x1800af360]
lea r8, [rsp + 0x34]
xor r9d, r9d
mov dword [rsp + 0x34], r12d
mov ecx, 0xae
mov qword [rsp + 0x20], r12
call fcn.1800298d0
test eax, eax
jne 0x1800095c4
mov r15d, dword [rsp + 0x34]
test r15d, r15d
jne 0x1800091fa
lea eax, [r15 + 1]
jmp 0x1800095c4
mov eax, dword [str.Thre]
lea rdx, [rbp - 0x4a]
mov dword [rbp - 0x50], eax
mov r8d, 0xa
movzx eax, word [0x18009063c]
mov word [rbp - 0x4c], ax
movzx eax, byte [0x18009063e]
lea ecx, [r8 + 0x16]
mov byte [rbp - 0x4a], al
call fcn.180058608
mov dword [rbp - 0x48], 0x78654e
jmp 0x1800091fa
mov dword [rbp - 0x7b], 0x657268
mov word [rbp - 0x78], r9w
mov byte [rbp - 0x76], r12b
mov word [rbp - 0x20], r10w
jmp case.0x180008fc6.12
mov dword [rbp - 0x32], 0x2e0032
mov word [rbp - 0x2e], dx
jmp case.0x180008fc6.12
mov dword [rbp - 0x12], 0x2e0032
mov dword [rbp - 0xe], 0x6c0064
jmp case.0x180008fc6.12
mov dword [rbp - 0xa], 0x6c
mov dword [rbp], 0x65726854
mov byte [rbp + 4], r12b
jmp case.0x180008fc6.12
mov dword [rbp - 0x1e], 0x720065
mov dword [rbp - 0x1a], 0x65006e
mov dword [rbp - 0x16], 0x33006c
jmp case.0x180008fc6.12
lea eax, [r15 - 1]
mov qword [rsp + 0x20], r12
mov r9d, 0x14
mov dword [rsp + 0x50], eax
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.180012650
test eax, eax
jne 0x1800095c4
mov eax, dword [r12]
mov ebx, r12d
test eax, eax
je 0x180009177
nop dword [rax + rax]
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x58]
mov eax, ebx
lea rdx, [rsp + 0x40]
mov ecx, dword [rax*4]
mov dword [rsp + 0x58], ecx
mov ecx, 0x14
call fcn.180023d10
test eax, eax
jne 0x1800095c4
mov eax, dword [r12]
inc ebx
cmp ebx, eax
jb 0x180009140
mov dword [rsp + 0x30], r12d
mov ebx, 0x2e
jmp 0x1800091fa
mov word [rbp - 0x7f], r8w
jmp case.0x180008fc6.12
mov r8d, 1
mov word [rbp - 0x2c], r12w
lea rdx, [0x180090648]
lea rcx, [rbp - 0x40]
call fcn.1800568cc
mov eax, 0x4f
mov dword [rbp - 0x2a], 0x6c
mov word [rbp - 0x80], ax
jmp 0x1800091fa
mov eax, dword [0x180090692]
mov dword [rbp - 0x40], eax
movzx eax, word [0x180090696]
mov word [rbp - 0x3c], ax
jmp case.0x180008fc6.12
mov eax, 0x6e
mov word [rbp - 0x7d], ax
mov eax, 0x54
mov word [rbp - 0x7c], ax
jmp case.0x180008fc6.12
mov r8d, 2
lea rdx, [0x18008fc0c]
lea rcx, [rbp - 0x45]
call fcn.18005c310
mov r11d, 0x32
mov r9d, 0x6461
mov r8d, 0x6570
lea r10d, [r11 + 0x39]
lea edx, [r11 + 0x32]
dec r14d
dec edi
cmp r14d, 0x3d
ja 0x180008fb0
mov r13d, dword [rsp + 0x34]
mov ecx, 0x686c
mov r14, qword [rsp + 0x48]
movabs rax, 0x720065006b
movzx edi, byte [rsp + 0x38]
movabs rdx, 0x64002e0032
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x48]
nop word [rax + rax]
cmp esi, 0x3868
ja 0x1800093ed
je 0x1800093dd
cmp esi, 0x1858
ja 0x180009358
je 0x18000934f
cmp esi, 0x4c
je 0x180009300
cmp esi, 0x850
je 0x1800092c7
cmp esi, 0x1054
jne 0x180009599
mov r8d, 4
mov dword [rbp - 0x70], 0x61657243
lea rdx, [0x180090822]
mov byte [rbp - 0x6c], 0
lea rcx, [rbp - 0x70]
call fcn.180062ed0
mov byte [rbp - 0x68], 0x6f
jmp 0x180009580
lea rcx, [rbp + 0x30]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1800092d0
mov eax, dword [0x180090870]
movsd xmm0, qword [str.32.dll]
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
movzx eax, word [0x180090874]
mov word [rcx + 0xc], ax
jmp 0x18000958a
mov r8d, 4
lea rdx, [0x1800906e0]
lea rcx, [rbp]
call fcn.180062ed0
mov r8d, 5
lea rdx, [0x180090720]
lea rcx, [rbp]
call fcn.180062ed0
mov eax, dword [0x180090760]
movsd xmm0, qword [str.kerne]
mov dword [rbp + 0x38], eax
mov eax, 0x6c
mov dword [rbp + 0x3a], eax
movsd qword [rbp + 0x30], xmm0
jmp 0x180009580
mov word [rbp - 0x67], cx
jmp 0x180009599
cmp esi, 0x205c
je 0x1800093a2
cmp esi, 0x2860
je 0x180009399
cmp esi, 0x3064
jne 0x180009599
mov r8d, 1
mov word [rbp - 0x5b], 0x6f68
lea rdx, [0x180090862]
mov byte [rbp - 0x59], 0
lea rcx, [rbp - 0x70]
call fcn.180062ed0
jmp 0x180009580
mov byte [rbp - 0x5b], 0
jmp 0x180009599
movzx eax, word [0x180090769]
lea rdx, [0x1800907a2]
mov word [rbp - 0x65], ax
lea rcx, [rbp - 0x70]
movzx eax, byte [0x18009076b]
mov r8d, 3
mov byte [rbp - 0x63], al
mov byte [rbp - 0x62], 0
call fcn.180062ed0
mov dword [rbp - 0x5f], 0x7370616e
jmp 0x180009580
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x16], 0x6e
jmp 0x180009599
cmp esi, 0x5878
ja 0x1800094ed
je 0x1800094c3
cmp esi, 0x406c
je 0x1800094a9
cmp esi, 0x4870
je 0x180009466
cmp esi, 0x5074
jne 0x180009599
lea r8, [rbp]
mov edx, 0x95
lea rcx, [rbp + 0x30]
call fcn.1800269e0
lea r8, [rbp - 0x70]
mov qword [rsp + 0x58], rax
mov edx, 0x95
lea rcx, [rbp + 0x10]
call fcn.1800269e0
xor edx, edx
lea ecx, [rdx + 4]
call rax
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x180009580
mov byte [rsp + 0x30], 0
jmp case.0x180008fc6.24
mov eax, dword [0x18008faf0]
lea r8, [rbp - 0x50]
mov dword [rbp + 0x24], eax
lea rcx, [rbp - 0x40]
movzx eax, word [0x18008faf4]
mov edx, 0x95
mov word [rbp + 0x28], ax
call fcn.1800269e0
lea r8, [rbp - 0x80]
mov edx, 0x95
lea rcx, [rbp - 0x20]
mov r15, rax
call fcn.1800269e0
mov r12, rax
jmp 0x180009580
mov eax, 0x65
mov qword [rbp + 0x1e], rdx
mov dword [rbp + 0x18], eax
mov eax, dword [0x1800907ec]
mov dword [rbp + 0x1a], eax
jmp 0x18000958f
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x1c
mov rcx, r14
call qword [rsp + 0x58]
mov r13d, eax
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
jmp 0x180009580
cmp esi, 0x607c
je 0x18000951e
cmp esi, 0x6880
je 0x18000950e
cmp esi, 0x7084
je case.0x180008fc6.24
jmp 0x180009599
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x30], dil
jmp 0x180009580
test r13d, r13d
je 0x1800095ad
mov r13, qword [rsp + 0x48]
mov dil, 1
nop
mov eax, dword [r13]
cmp dword [rsp + 0x6c], eax
jne 0x18000956c
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call r12
mov rbx, rax
test rax, rax
je 0x18000956c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne cl
and dil, cl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x60]
mov rcx, r14
call r15
test eax, eax
jne 0x180009530
mov r13d, dword [rsp + 0x34]
movabs rdx, 0x64002e0032
mov ecx, 0x686c
movabs rax, 0x720065006b
add esi, 0x804
cmp esi, 0x783c
jbe 0x180009260
jmp case.0x180008fc6.24
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0x12
sete byte [rsp + 0x30]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.180051f60
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret