Function at 0x180002a20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180058040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
cmp edx, 1
jne 0x180002d53
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
mov qword [rsp + 0x30], 0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, dword [0x1800d1148]
mov rdi, rax
mov rax, qword gs:[0x58]
mov edx, 4
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x1800d145c], eax
jle 0x180002acf
lea rcx, [0x1800d145c]
call fcn.1800478bc
cmp dword [0x1800d145c], 0xffffffff
jne 0x180002acf
lea rcx, [0x180048f40]
mov word [0x1800d143d], 0x12b
mov byte [0x1800d143c], 0x1e
call fcn.180047cc8
lea rcx, [0x1800d145c]
call fcn.180047850
cmp byte [0x1800d143e], 0
je 0x180002aed
xor byte [0x1800d143c], 0x69
xor byte [0x1800d143d], 0x2b
mov byte [0x1800d143e], 0
mov eax, dword [rbx]
cmp dword [0x1800d1434], eax
jle 0x180002b47
lea rcx, [0x1800d1434]
call fcn.1800478bc
cmp dword [0x1800d1434], 0xffffffff
jne 0x180002b47
lea rcx, [0x180048f50]
mov word [0x1800d1457], 0x19c
mov dword [0x1800d1450], 0x7c55642a
mov word [0x1800d1454], 0x2201
mov byte [0x1800d1456], 0x9e
call fcn.180047cc8
lea rcx, [0x1800d1434]
call fcn.180047850
cmp byte [0x1800d1458], 0
je 0x180002b8f
xor byte [0x1800d1450], 0x69
xor byte [0x1800d1451], 0x2b
xor byte [0x1800d1452], 0x1b
xor byte [0x1800d1453], 0x33
xor byte [0x1800d1454], 0x54
xor byte [0x1800d1455], 0x76
xor byte [0x1800d1456], 0xba
xor byte [0x1800d1457], 0x9c
mov byte [0x1800d1458], 0
mov r9, rdi
lea r8, [0x1800d143c]
lea rdx, [0x1800d1450]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
cmp qword [rsp + 0x30], 0
je 0x180002d75
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, rax
mov eax, dword [rbx]
cmp dword [0x1800d1438], eax
jle 0x180002c0c
lea rcx, [0x1800d1438]
call fcn.1800478bc
cmp dword [0x1800d1438], 0xffffffff
jne 0x180002c0c
lea rcx, [0x180048f20]
mov word [0x1800d1465], 0x12b
mov byte [0x1800d1464], 0x1e
call fcn.180047cc8
lea rcx, [0x1800d1438]
call fcn.180047850
cmp byte [0x1800d1466], 0
je 0x180002c2a
xor byte [0x1800d1464], 0x69
xor byte [0x1800d1465], 0x2b
mov byte [0x1800d1466], 0
mov eax, dword [rbx]
cmp dword [0x1800d1460], eax
jle 0x180002c84
lea rcx, [0x1800d1460]
call fcn.1800478bc
cmp dword [0x1800d1460], 0xffffffff
jne 0x180002c84
lea rcx, [0x180048f30]
mov word [0x1800d1447], 0x19c
mov dword [0x1800d1440], 0x7c55642a
mov word [0x1800d1444], 0x2201
mov byte [0x1800d1446], 0x9e
call fcn.180047cc8
lea rcx, [0x1800d1460]
call fcn.180047850
cmp byte [0x1800d1448], 0
je 0x180002ccc
xor byte [0x1800d1440], 0x69
xor byte [0x1800d1441], 0x2b
xor byte [0x1800d1442], 0x1b
xor byte [0x1800d1443], 0x33
xor byte [0x1800d1444], 0x54
xor byte [0x1800d1445], 0x76
xor byte [0x1800d1446], 0xba
xor byte [0x1800d1447], 0x9c
mov byte [0x1800d1448], 0
mov r9, rdi
lea r8, [0x1800d1464]
lea rdx, [0x1800d1440]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
cmp qword [rsp + 0x30], 0
je 0x180002d75
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x180002d20
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetSystemMenu]
test rax, rax
je 0x180002d20
xor r8d, r8d
mov edx, 0xf060
mov rcx, rax
call qword [sym.imp.USER32.dll_DeleteMenu]
mov qword [rsp + 0x28], 0
lea r8, [0x1800028c0]
mov r9, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002d53
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180047830
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
xor eax, eax
jmp 0x180002d58