Function at 0x18002fdec
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
test byte [rsp + 0xf8], 1
mov ebx, r9d
mov rsi, rcx
jne 0x1800301be
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov r13d, ebx
mov byte [rsp + 0x31], 1
mov rbx, qword [rsi + 0x20]
xor cl, cl
sub rbx, qword [rsi + 0x18]
sar rbx, 5
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], cl
call fcn.180040888
test al, al
je 0x1800301be
cmp rbx, 1
jne 0x18002fe7d
mov rcx, qword [rsi + 0x18]
cmp qword [rcx + 0x18], 8
jb 0x18002fe6b
mov rcx, qword [rcx]
call fcn.180026dd4
test al, al
jne 0x18002fe7d
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x31], al
test byte [rsp + 0xf8], 2
je 0x18002fe93
cmp rbx, 1
jne 0x18002fe93
lea r12d, [rbx + 2]
jmp 0x18002fe96
xor r12d, r12d
mov cl, 1
call fcn.18002a260
mov r14, qword [rsp + 0x38]
lea rdi, str.Trusted_Application
xor ebp, ebp
mov r15d, r12d
bts r15d, 0xa
mov rcx, qword [rdi]
call fcn.18002a02c
mov r9d, r13d
mov r8d, r15d
mov edx, ebp
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.USER32.dll_InsertMenuW]
inc r13d
lea rdi, [rdi + 8]
inc ebp
cmp ebp, 2
jb 0x18002feb3
lea rax, [0x1800abcc4]
mov r9d, r13d
mov r8d, 0xc00
mov qword [rsp + 0x20], rax
mov edx, ebp
mov rcx, r14
mov edi, r13d
call qword [sym.imp.USER32.dll_InsertMenuW]
inc r13d
lea rcx, str.Not_Trusted
mov ebx, r13d
call fcn.18002a02c
mov r8d, r15d
mov r9d, r13d
lea edx, [rbp + 1]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov r15, r14
call qword [sym.imp.USER32.dll_InsertMenuW]
mov bl, byte [rsp + 0x30]
add edi, 2
mov r14d, dword [rsp + 0xe0]
xor r13d, r13d
test bl, bl
je 0x1800300cb
cmp qword [0x1800dcbe0], r13
jne 0x18002ff5e
lea rcx, [0x1800dcc00]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1800dcc00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebp, dword [rsp + 0xe8]
mov dword [0x1800dcc30], ebp
mov qword [0x1800dcc28], r15
mov dword [0x1800dcc34], r12d
mov rdx, qword [rsi + 0x18]
cmp qword [rdx + 0x18], 8
jb 0x18002ff94
mov rdx, qword [rdx]
mov rcx, qword [0x1800dcc6c]
call fcn.18007f9bc
test eax, eax
jne 0x18002ffe8
mov rcx, qword [0x1800dcc6c]
lea r9, [rsp + 0x38]
xor r8d, r8d
xor edx, edx
call fcn.18002685c
mov r8d, 8
lea rdx, [rsp + 0x38]
lea rcx, [0x1800dcc38]
call fcn.180046770
test eax, eax
jne 0x18002ffda
mov bl, r13b
jmp 0x18003004f
mov rax, qword [rsp + 0x38]
mov qword [0x1800dcc38], rax
jmp 0x180030036
mov rbx, qword [rsi + 0x18]
cmp qword [rbx + 0x18], 8
jb 0x18002fff6
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180030000
mov eax, r13d
jmp 0x180030008
mov rcx, rbx
call fcn.18005380c
mov r8d, eax
lea rcx, [0x1800dcc6c]
mov rdx, rbx
call fcn.1800301dc
mov rcx, qword [0x1800dcc6c]
lea r9, [0x1800dcc38]
xor r8d, r8d
xor edx, edx
call fcn.18002685c
mov bl, byte [rsp + 0x30]
or dword [0x1800dcc68], 0xffffffff
lea rcx, [0x1800dcc40]
xor edx, edx
lea r8d, [rdx + 0x20]
call fcn.180046390
lea rcx, [0x1800dcc00]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x180030090
call fcn.180030358
lea r9, [0x1800dcc00]
mov qword [rsp + 0x28], r13
lea r8, [0x180030390]
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1800dcbe0], rax
jmp 0x1800300d2
cmp dword [0x1800dcc68], 0xffffffff
je 0x1800300d2
mov rdx, qword [0x1800dcc60]
lea r8, [0x1800dcc40]
mov rcx, qword [0x1800dcc6c]
call fcn.18003db0c
mov r9d, r12d
mov dword [0x1800dcc68], eax
mov r8d, ebp
mov rdx, r15
mov ecx, eax
call fcn.1800302dc
jmp 0x1800300d2
mov ebp, dword [rsp + 0xe8]
xor edx, edx
mov dword [rsp + 0x40], 0x50
lea rcx, [rsp + 0x44]
lea r8d, [rdx + 0x4c]
call fcn.180046390
mov dword [rsp + 0x50], edi
lea rcx, str.Trust_Level
mov dword [rsp + 0x44], 0x46
inc edi
mov qword [rsp + 0x58], r15
call fcn.18002a02c
mov r15, qword [rsp + 0xd8]
lea r9, [rsp + 0x40]
mov rcx, r15
mov qword [rsp + 0x78], rax
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_InsertMenuItemW]
cmp qword [rsi + 0x10], r13
jne 0x180030147
call fcn.18003fa30
test al, al
je 0x180030147
mov rax, qword [0x1800dd208]
mov qword [rsi + 0x10], rax
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x180030167
mov r8d, 0x400
mov qword [rsp + 0x20], r13
mov edx, r14d
mov rcx, r15
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
cmp byte [rsp + 0x31], r13b
je 0x1800301b8
lea rcx, str.Manage_Whitelist
call fcn.18002a02c
mov r9d, edi
lea edx, [r14 + 1]
mov r8d, 0x400
mov qword [rsp + 0x20], rax
mov rcx, r15
call qword [sym.imp.USER32.dll_InsertMenuW]
mov r9, qword [rsi + 0x10]
inc edi
test r9, r9
je 0x1800301b8
mov r8d, 0x400
mov qword [rsp + 0x20], r13
lea edx, [r14 + 1]
mov rcx, r15
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
sub edi, ebp
mov eax, edi
jmp 0x1800301c0
xor eax, eax
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret