Function at 0x180007070
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800764a0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
cmp dword [0x18007a728], ebx
jne 0x18000732c
mov dword [0x18007a728], 1
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
lea r8d, [rbx + 0x1a]
lea rdx, str._SystemRoot_explorer.exe
lea rcx, [rsp + 0x38]
call fcn.18000a4d0
nop
lea rcx, [rsp + 0x38]
call fcn.180003d60
nop
cmp qword [rsp + 0x58], 8
jb 0x1800070ec
mov rcx, qword [rsp + 0x40]
call fcn.180041070
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
mov r8d, 0x1a
lea rdx, str._SystemRoot__svchost.exe
lea rcx, [rsp + 0x38]
call fcn.18000a4d0
nop
lea rcx, [rsp + 0x38]
call fcn.180003d60
nop
cmp qword [rsp + 0x58], 8
jb 0x180007134
mov rcx, qword [rsp + 0x40]
call fcn.180041070
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
mov r8d, 0x21
lea rdx, str._SystemRoot_System32_spoolsv.exe
lea rcx, [rsp + 0x38]
call fcn.18000a4d0
nop
lea rcx, [rsp + 0x38]
call fcn.180003d60
nop
cmp qword [rsp + 0x58], 8
jb 0x18000717c
mov rcx, qword [rsp + 0x40]
call fcn.180041070
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
mov r8d, 0x22
lea rdx, str._SystemRoot_System32_services.exe
lea rcx, [rsp + 0x38]
call fcn.18000a4d0
nop
lea rcx, [rsp + 0x38]
call fcn.180003d60
nop
cmp qword [rsp + 0x58], 8
jb 0x1800071c4
mov rcx, qword [rsp + 0x40]
call fcn.180041070
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
mov r8d, 0x21
lea rdx, str._SystemRoot_System32wininit.exe
lea rcx, [rsp + 0x38]
call fcn.18000a4d0
nop
lea rcx, [rsp + 0x38]
call fcn.180003d60
nop
cmp qword [rsp + 0x58], 8
jb 0x18000720c
mov rcx, qword [rsp + 0x40]
call fcn.180041070
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
mov r8d, 0x1f
lea rdx, str._SystemRoot__system32csrss.exe
lea rcx, [rsp + 0x38]
call fcn.18000a4d0
nop
lea rcx, [rsp + 0x38]
call fcn.180003d60
nop
cmp qword [rsp + 0x58], 8
jb 0x180007254
mov rcx, qword [rsp + 0x40]
call fcn.180041070
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
mov r8d, 0x22
lea rdx, str._SystemRoot_System32winlogon.exe
lea rcx, [rsp + 0x38]
call fcn.18000a4d0
nop
lea rcx, [rsp + 0x38]
call fcn.180003d60
nop
cmp qword [rsp + 0x58], 8
jb 0x18000729c
mov rcx, qword [rsp + 0x40]
call fcn.180041070
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
mov r8d, 0x14
lea rdx, str._SystemRoot_projone
lea rcx, [rsp + 0x38]
call fcn.18000a4d0
nop
lea rcx, [rsp + 0x38]
call fcn.180003d60
nop
cmp qword [rsp + 0x58], 8
jb 0x1800072e4
mov rcx, qword [rsp + 0x40]
call fcn.180041070
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
mov r8d, 0x14
lea rdx, str._SystemRoot__termmgr
lea rcx, [rsp + 0x38]
call fcn.18000a4d0
nop
lea rcx, [rsp + 0x38]
call fcn.180003d60
nop
cmp qword [rsp + 0x58], 8
jb 0x18000732c
mov rcx, qword [rsp + 0x40]
call fcn.180041070
mov byte [0x18007a228], 1
call fcn.1800068f0
lea rcx, [rsp + 0x38]
call fcn.180004140
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call fcn.180033fa4
nop
cmp qword [rsp + 0x58], 8
jb 0x18000736c
mov rcx, qword [rsp + 0x40]
call fcn.180041070
xor ecx, ecx
call fcn.180004390
cmp qword [0x18007a230], 0
jne 0x1800073b1
lea rcx, str.doc_guard_start
call fcn.180037d10
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x180006ea0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x18007a230], rax
mov al, 1
jmp 0x1800073b3
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180040bb0
add rsp, 0x70
pop rbx
ret