Function at 0x18017b9d0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
sub rsp, 0x90
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov rbx, rcx
xor eax, eax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
lea rax, [0x1801801f0]
mov qword [r11 - 0x60], rax
lea rax, [0x1801800f0]
mov qword [r11 - 0x58], rax
lea rax, [0x1801802c0]
mov qword [r11 - 0x50], rax
lea rax, [0x180180310]
mov qword [r11 - 0x48], rax
mov ecx, 0x2c8
call fcn.18011da30
mov qword [rsp + 0xb0], rax
test rax, rax
je 0x18017ba51
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.1800fcd30
mov rcx, rax
jmp 0x18017ba53
xor ecx, ecx
mov qword [rbx + 0x2580], rcx
test rcx, rcx
je 0x18017ba65
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x18017fed0]
xor edx, edx
xor ecx, ecx
call fcn.1802d0f10
mov qword [rbx + 0x50], rax
mov rax, qword [rbx + 0x2578]
mov dword [rax], 1
call fcn.1802b6720
mov rcx, qword [rbx + 0x2578]
mov dword [rcx + 0xc], eax
mov rdx, qword [rbx + 0x2578]
add rdx, 0x10
mov rcx, rbx
call fcn.18017c630
mov rdx, qword [rbx + 0x2568]
mov rcx, rbx
call fcn.18017e6b0
mov rcx, rbx
call fcn.18017c740
mov rcx, rbx
call fcn.18017c0e0
mov rcx, qword [rbx + 0x2570]
mov eax, dword [0x1804009d0]
mov dword [rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rbx + 0x2570]
mov dword [rcx + 4], eax
mov rcx, qword [rbx + 0x38]
mov rax, qword [rbx + 0x2570]
mov qword [rax + 8], rcx
mov rcx, qword [rbx + 0x40]
mov rax, qword [rbx + 0x2570]
mov qword [rax + 0x10], rcx
mov rax, qword [rbx + 0x2570]
mov dword [rax + 0x18], 0x8000
mov rax, qword [rbx + 0x2570]
mov dword [rax + 0x1c], 0x8001
mov rax, qword [rbx + 0x2570]
movups xmm0, xmmword [rbx + 0x1a58]
movups xmmword [rax + 0x20], xmm0
mov rax, qword [rbx + 0x2570]
movups xmm0, xmmword [rbx + 0x1a68]
movups xmmword [rax + 0x30], xmm0
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
test rax, rax
je 0x18017bb8d
mov r8, qword [rbx + 0x2570]
add r8, 0x40
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x20], rcx
mov edx, 2
lea r9d, [rdx + 0x1d]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetUserObjectInformationA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
test rax, rax
je 0x18017bbca
mov r8, qword [rbx + 0x2570]
add r8, 0x60
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x20], rcx
mov edx, 2
lea r9d, [rdx + 0x1d]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetUserObjectInformationA]
mov rax, qword [rbx + 0x2578]
or dword [rax + 0x10], 0x40
mov rax, qword [rbx + 0x2578]
or dword [rax + 0x10], 2
mov rcx, qword [rbx + 0x2578]
add rcx, 0x10
call fcn.180161e90
mov dword [rbx + 0x30], 1
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x18017bc06
call qword [sym.imp.KERNEL32.dll_SetEvent]
call sym.RecordAgent64.dll_InitializeDll
mov rax, qword [rbx + 0x2578]
cmp dword [rax + 0x1c70], 0
je 0x18017bc23
mov rcx, rbx
call fcn.18017ff60
lea rcx, [rbx + 8]
mov rax, qword [rcx]
lea r8, [0x18003a948]
mov edx, 3
call qword [rax + reloc.WSOCK32.dll_recv]
nop dword [rax]
cmp dword [rbx + 0x30], 0
je 0x18017bc9a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x18017bc9a
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.18017eef0
test eax, eax
jne 0x18017bc98
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x18017bc40
lea rcx, [rbx + 8]
mov rax, qword [rcx]
mov r9d, dword [rbx + 0x30]
lea r8, [0x18003a960]
mov edx, 3
call qword [rax + reloc.WSOCK32.dll_recv]
nop
jmp 0x18017bcbf
mov rcx, qword [rbx + 0x2580]
test rcx, rcx
je 0x18017bcf6
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
test eax, eax
je 0x18017bceb
mov rcx, qword [rbx + 0x2580]
test rcx, rcx
je 0x18017bceb
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x2580], 0
mov dword [rbx + 0x30], 0
mov rcx, rbx
call fcn.1801807c0
xor edx, edx
mov r8d, 0x80
mov rcx, qword [rbx + 0x2570]
call fcn.1802c7550
mov rax, qword [rbx + 0x2578]
mov dword [rax], 0
mov rcx, qword [rbx + 0x2578]
add rcx, 0x10
call fcn.180161d30
mov rcx, rbx
call fcn.180180820
mov rcx, rbx
call fcn.1801803e0
mov rcx, rbx
call fcn.18017c570
mov rcx, rbx
call fcn.18017b940
nop
add rsp, 0x90
pop rbx
ret