Function at 0x18000e840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xb0
mov r14d, r8d
mov rsi, rdx
mov r13, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], 0
mov qword [rbp - 0x29], 0
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], 0
mov qword [rbp - 0x49], 0
mov eax, 0xf
mov qword [rbp - 0x41], rax
mov byte [rbp - 0x59], 0
lea r15d, [r8 - 0xb]
movzx ebx, byte [rbp + 0x67]
cmp r8d, r15d
jbe 0x18000ea34
lea edi, [r8 - 0xb7]
lea rdx, [0x180000000]
mov r12, qword [rbp - 0x61]
cmp edi, 0x22
ja case.0x18000e8e1.6
movzx eax, byte [rdx + rdi + 0xec0c]
mov ecx, dword [rdx + rax*4 + 0xebe0]
add rcx, rdx
jmp rcx
mov rax, qword [rbp + 0x77]
mov rax, qword [rax]
mov qword [rbp - 1], rax
lea r8, [rbp - 0x59]
mov edx, 0x5c
lea rcx, [rbp - 1]
call fcn.18000c6d0
jmp 0x18000ea17
mov qword [0x180036b28], rsi
mov qword [rsi + 0x80], r13
jmp case.0x18000e8e1.6
mov rax, r12
xchg qword [0x180036b30], rax
jmp case.0x18000e8e1.6
mov bl, 1
jmp case.0x18000e8e1.6
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rsi
lea r8, [0x180014cb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
test rax, rax
jne 0x18000ea17
xor bl, bl
xor r14d, r14d
mov rax, qword [rbp - 0x41]
jmp 0x18000ea37
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax]
test eax, eax
je case.0x18000e8e1.2
cmp qword [rsi + 0x10], 0
je case.0x18000e8e1.2
cmp qword [r13 + 0x10], 0
je case.0x18000e8e1.2
mov dword [rbp + 0x67], eax
lea r8, [rbp + 0x67]
lea rdx, [rbp - 0x39]
mov ecx, 0x98
call fcn.18000b4a0
mov rcx, qword [rsi + 0x10]
cmp qword [r13 + 0x10], rcx
cmovae rcx, qword [r13 + 0x10]
mov qword [rbp + 7], rcx
mov dword [rsp + 0x20], 0x1e
lea r9, [rbp - 0x59]
lea r8, [rbp - 0x39]
lea rdx, [rbp + 7]
mov rcx, r13
call fcn.180010040
mov r9, qword [rbp + 0x6f]
cmp r9, rsi
je 0x18000ea1b
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x18000e9dd
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, r9
call fcn.180017d50
jmp 0x18000ea17
mov dword [rbp - 0x69], 1
lea r8, [rbp - 0x69]
mov rdx, rsi
mov ecx, 0x5c
call fcn.180011590
test rax, rax
je 0x18000ea17
xor r8d, r8d
mov rdx, rax
lea ecx, [r8 + 0x56]
call fcn.180011590
mov r9, qword [rbp + 0x6f]
lea rdx, [0x180000000]
dec r14d
dec edi
cmp r14d, r15d
ja 0x18000e8c6
mov rax, qword [rbp - 0x41]
xor r14d, r14d
cmp rax, 0x10
jb 0x18000ea6f
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ea6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ebd2
call fcn.1800186c0
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 0xf
mov byte [rbp - 0x59], 0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x18000eaba
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000eab5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ebd8
call fcn.1800186c0
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], 0
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x18000eb08
mov rdx, qword [rbp - 9]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000eb03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ebcc
call fcn.1800186c0
movzx eax, bl
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, 0x69
xor r8d, r8d
lea rdx, [rbp - 0x19]
xor ecx, ecx
call fcn.180007260
xor r14d, r14d
test al, al
jne 0x18000eb99
mov edi, 0x35
cmp edi, 0x35
je 0x18000eb81
cmp edi, 0x250f
je 0x18000eb6b
cmp edi, 0x49e9
je 0x18000e964
jmp 0x18000eb8b
mov qword [rbp + 0xf], r14
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor bl, bl
jmp 0x18000eb8b
mov dword [rsi], 1
mov qword [rbp - 0x61], r14
add edi, 0x24da
cmp edi, 0x6e8e
jbe 0x18000eb50
mov dword [rsi], r14d
mov rax, qword [rbp - 0x19]
mov rcx, qword [rbp - 0x11]
cmp rax, rcx
je 0x18000ebc1
nop dword [rax]
cmp dword [rax + 8], 0
jne 0x18000ebb8
inc dword [rsi]
add rax, 0x20
cmp rax, rcx
jne 0x18000ebb0
mov bl, 1
mov rax, qword [rbp - 0x41]
jmp 0x18000ea37
call fcn.18001ced4
nop
call fcn.18001ced4
nop
call fcn.18001ced4
int3