Function at 0x18001ff80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
imul eax, edx, 0xcb
mov r10, r9
mov r11d, edx
mov r9, rcx
mov r13d, edx
mov dword [rbp - 0x20], eax
cmp edx, eax
ja 0x180020565
mov r12, qword [rbp + 0x68]
lea r14, [0x180000000]
xor ebx, ebx
cmp r13d, 0xd7a
ja 0x180020179
je 0x18002014d
mov eax, r13d
sub eax, 0x73
je 0x180020124
sub eax, 0x16
je 0x18002005c
cmp eax, 4
jne 0x180020402
mov eax, dword [r9]
cmp eax, dword [r12]
je 0x180020555
imul eax, dword [r8]
lea rcx, [rbp - 0x10]
xor r9d, r9d
xor edx, edx
imul eax, dword [r10]
lea r8d, [r9 + 0x54]
mov qword [rbp - 0x10], rax
call fcn.180066300
mov qword [rbp - 0x18], rax
cmp rax, 0
jne 0x1800203fe
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
lea r9, str.outofmem
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.180041b10
mov rax, rbx
jmp 0x180020569
mov rdi, qword [rbp + 0x70]
mov ecx, dword [rdi]
cmp ecx, 9
jbe 0x1800200da
nop word [rax + rax]
mov r8, qword [r12 + 0x18]
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
mov rdx, qword [r12 + 0x10]
add eax, eax
sub ecx, eax
cmp rdx, r8
jae 0x1800200b0
lea rax, [rdx + 1]
mov qword [r12 + 0x10], rax
mov rax, r12
cmp r8, 0x10
jb 0x1800200a6
mov rax, qword [r12]
mov byte [rax + rdx], cl
mov byte [rax + rdx + 1], 0
jmp 0x1800200c3
xor r8d, r8d
movzx r9d, cl
mov rcx, r12
lea edx, [r8 + 1]
call fcn.18000e630
mov eax, 0xcccccccd
mul dword [rdi]
mov ecx, edx
shr ecx, 3
mov dword [rdi], ecx
cmp ecx, 9
ja 0x180020070
mov r11d, dword [rbp + 0x50]
mov rdx, qword [r12 + 0x10]
mov r8, qword [r12 + 0x18]
cmp rdx, r8
jae 0x18002010c
lea rax, [rdx + 1]
mov qword [r12 + 0x10], rax
mov rax, r12
cmp r8, 0x10
jb 0x1800200ff
mov rax, qword [r12]
mov byte [rax + rdx], cl
mov byte [rax + rdx + 1], 0
jmp 0x180020402
xor r8d, r8d
movzx r9d, cl
mov rcx, r12
lea edx, [r8 + 1]
call fcn.18000e630
jmp 0x1800203fe
mov rdi, qword [rbp + 0x70]
lea r8, [0x18001c660]
mov r9, rdi
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi], rax
jmp 0x1800203fe
mov rdi, qword [rbp + 0x70]
cmp qword [rdi], 0
je 0x18002055b
mov r8d, 0x10f
mov dword [rbp - 0x38], 1
lea rdx, [rbp - 0x38]
mov rcx, rdi
call fcn.1800205f0
jmp 0x1800203fe
cmp r13d, 0x1086
je 0x1800201af
cmp r13d, 0x1a81
je 0x180020561
cmp r13d, 0x207f
jne 0x180020402
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rbp - 0x18]
jmp 0x180020569
cmp dword [r10], 0
mov r15d, ebx
jle 0x180020402
mov rbx, qword [rbp + 0x70]
mov ecx, 0x7e
mov eax, ecx
sub eax, 0x7e
je 0x1800201e0
cmp eax, 1
jne 0x1800203de
mov r13d, 0x1086
jmp 0x1800203de
mov r8d, dword [r8]
mov esi, r8d
mov edx, dword [r12]
mov edi, r8d
imul edi, dword [r9]
imul esi, edx
lea eax, [rdx*8 - 0xa]
add eax, dword [r9]
imul edi, r15d
imul esi, r15d
add rdi, qword [rbp - 0x18]
add rsi, rbx
cmp eax, 0x19
ja case.0x180020223.3
cdqe
mov ecx, dword [r14 + rax*4 + 0x2057c]
add rcx, r14
jmp rcx
lea ecx, [r8 - 1]
test ecx, ecx
js case.0x180020223.3
nop dword [rax]
nop word [rax + rax]
sub ecx, 1
movzx eax, byte [rsi]
mov byte [rdi], al
lea rsi, [rsi + 1]
mov byte [rdi + 1], 0xff
lea rdi, [rdi + 2]
jns 0x180020240
jmp case.0x180020223.3
lea ecx, [r8 - 1]
test ecx, ecx
js case.0x180020223.3
nop word [rax + rax]
sub ecx, 1
movzx eax, byte [rsi]
mov byte [rdi + 2], al
lea rsi, [rsi + 1]
mov byte [rdi + 1], al
mov byte [rdi], al
lea rdi, [rdi + 3]
jns 0x180020270
jmp case.0x180020223.3
lea ecx, [r8 - 1]
test ecx, ecx
js case.0x180020223.3
nop dword [rax]
sub ecx, 1
movzx eax, byte [rsi]
mov byte [rdi + 2], al
lea rsi, [rsi + 1]
mov byte [rdi + 1], al
mov byte [rdi], al
mov byte [rdi + 3], 0xff
lea rdi, [rdi + 4]
jns 0x1800202a0
jmp case.0x180020223.3
lea ecx, [r8 - 1]
test ecx, ecx
js case.0x180020223.3
nop dword [rax]
sub ecx, 1
movzx eax, byte [rsi]
mov byte [rdi], al
lea rdi, [rdi + 1]
lea rsi, [rsi + 2]
jns 0x1800202d0
jmp case.0x180020223.3
lea ecx, [r8 - 1]
test ecx, ecx
js case.0x180020223.3
nop dword [rax]
nop word [rax + rax]
sub ecx, 1
movzx eax, byte [rsi]
mov byte [rdi + 2], al
lea rsi, [rsi + 2]
mov byte [rdi + 1], al
mov byte [rdi], al
lea rdi, [rdi + 3]
jns 0x180020300
jmp case.0x180020223.3
lea ecx, [r8 - 1]
test ecx, ecx
js case.0x180020223.3
nop dword [rax]
sub ecx, 1
movzx eax, byte [rsi]
mov byte [rdi + 2], al
lea rsi, [rsi + 2]
mov byte [rdi + 1], al
mov byte [rdi], al
lea rdi, [rdi + 4]
movzx eax, byte [rsi - 1]
mov byte [rdi - 1], al
jns 0x180020330
jmp case.0x180020223.3
lea ecx, [r8 - 1]
test ecx, ecx
js case.0x180020223.3
nop dword [rax]
sub ecx, 1
movzx eax, byte [rsi]
mov byte [rdi], al
lea rdi, [rdi + 4]
movzx eax, byte [rsi + 1]
lea rsi, [rsi + 3]
mov byte [rdi - 3], al
movzx eax, byte [rsi - 1]
mov byte [rdi - 2], al
mov byte [rdi - 1], 0xff
jns 0x180020360
jmp case.0x180020223.3
lea r14d, [r8 - 1]
test r14d, r14d
js 0x1800203ce
nop
movzx eax, byte [rsi + 2]
lea r9, [rbp - 0x38]
mov dword [rbp - 0x38], eax
lea r8, [rbp - 0x30]
movzx eax, byte [rsi + 1]
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x30], eax
mov edx, 0x44
movzx eax, byte [rsi]
mov dword [rbp - 0x28], eax
call fcn.180011480
sub r14d, 1
mov byte [rdi], al
lea rdi, [rdi + 1]
lea rsi, [rsi + 3]
jns 0x180020390
mov r9, qword [rbp + 0x48]
lea r14, [0x180000000]
mov r8, qword [rbp + 0x58]
mov ecx, 0x7e
inc ecx
cmp ecx, 0x80
jb 0x1800201c5
mov r10, qword [rbp + 0x60]
inc r15d
cmp r15d, dword [r10]
jl 0x1800201c0
xor ebx, ebx
mov r11d, dword [rbp + 0x50]
imul eax, r11d, 0x1d
add r13d, eax
cmp r13d, dword [rbp - 0x20]
ja 0x180020565
mov r9, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
mov r10, qword [rbp + 0x60]
jmp 0x18001ffd0
lea r14d, [r8 - 1]
test r14d, r14d
js 0x1800203ce
nop dword [rax]
movzx eax, byte [rsi + 2]
lea r9, [rbp - 0x28]
mov dword [rbp - 0x28], eax
lea r8, [rbp - 0x30]
movzx eax, byte [rsi + 1]
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x30], eax
mov edx, 0x44
movzx eax, byte [rsi]
mov dword [rbp - 0x38], eax
call fcn.180011480
sub r14d, 1
mov byte [rdi], al
mov byte [rdi + 1], 0xff
lea rdi, [rdi + 2]
lea rsi, [rsi + 3]
jns 0x180020430
jmp 0x1800203ca
lea r14d, [r8 - 1]
test r14d, r14d
js 0x1800203ce
movzx eax, byte [rsi + 2]
lea r9, [rbp - 0x28]
mov dword [rbp - 0x28], eax
lea r8, [rbp - 0x30]
movzx eax, byte [rsi + 1]
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x30], eax
mov edx, 0x44
movzx eax, byte [rsi]
mov dword [rbp - 0x38], eax
call fcn.180011480
sub r14d, 1
mov byte [rdi], al
lea rdi, [rdi + 1]
lea rsi, [rsi + 4]
jns 0x180020480
jmp 0x1800203ca
lea r14d, [r8 - 1]
test r14d, r14d
js 0x1800203ce
nop dword [rax]
movzx eax, byte [rsi + 2]
lea r9, [rbp - 0x28]
mov dword [rbp - 0x28], eax
lea r8, [rbp - 0x30]
movzx eax, byte [rsi + 1]
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x30], eax
mov edx, 0x44
movzx eax, byte [rsi]
mov dword [rbp - 0x38], eax
call fcn.180011480
sub r14d, 1
mov byte [rdi], al
movzx eax, byte [rsi + 3]
lea rsi, [rsi + 4]
mov byte [rdi + 1], al
lea rdi, [rdi + 2]
jns 0x1800204d0
jmp 0x1800203ca
lea ecx, [r8 - 1]
test ecx, ecx
js case.0x180020223.3
nop dword [rax]
nop word [rax + rax]
sub ecx, 1
movzx eax, byte [rsi]
mov byte [rdi], al
lea rdi, [rdi + 3]
movzx eax, byte [rsi + 1]
lea rsi, [rsi + 4]
mov byte [rdi - 2], al
movzx eax, byte [rsi - 2]
mov byte [rdi - 1], al
jns 0x180020530
jmp case.0x180020223.3
mov rax, qword [rbp + 0x70]
jmp 0x180020569
mov byte [rbp - 0x20], 0
jmp 0x180020565
mov byte [rbp - 0x20], 1
mov rax, qword [rbp - 0x20]
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret