Function at 0x1000c220
Capabilities:
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x178
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x150], rax
cmp edx, 3
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov esi, edx
mov rbp, rcx
jg 0x1000c258
mov eax, 0xffffffff
jmp 0x1000c484
lea eax, [rdx + 8]
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x168], rdi
movsxd rdi, eax
mov rcx, rdi
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rbx, rax
je 0x1000c46f
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.MSVCR80.dll_memset
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call fcn.10004db0
cmp eax, esi
jne 0x1000c467
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea eax, [rcx - 3]
lea rdi, [rcx - 1]
cmp eax, 0x101
ja 0x1000c467
lea rcx, [rsp + 0x40]
mov rdx, rbx
sub rcx, rbx
nop
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1000c2e0
movsxd rax, edi
cmp byte [rsp + rax + 0x3f], 0x5c
je 0x1000c303
mov byte [rsp + rax + 0x40], 0x5c
mov byte [rsp + rax + 0x41], 0
lea eax, [rsi + 0x104]
movsxd rdi, eax
mov rcx, rdi
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
mov rsi, rax
je 0x1000c467
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.MSVCR80.dll_memset
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx + rbx]
mov rcx, rsi
nop
nop
nop
movzx eax, byte [rdx]
add rcx, 1
add rdx, 1
test al, al
mov byte [rcx - 1], al
jne 0x1000c350
mov edx, 0x2f
mov rcx, rsi
call qword [sym.imp.MSVCR80.dll_strrchr]
test rax, rax
mov r11, rax
jne 0x1000c38c
lea edx, [rax + 0x2f]
mov rcx, rsi
call qword [sym.imp.MSVCR80.dll_strrchr]
test rax, rax
mov r11, rax
je 0x1000c3c2
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r11
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x40]
not rcx
lea rdx, [rcx - 1]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
add rdx, rcx
cmp rdx, 0x104
jb 0x1000c3dc
mov rcx, rsi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, 1
jmp 0x1000c474
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [r11 + rcx + 1]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1000c3f0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
not rcx
add rcx, rsi
nop
nop
movzx eax, byte [rdx]
add rcx, 1
add rdx, 1
test al, al
mov byte [rcx - 1], al
jne 0x1000c420
lea rax, [rsp + 0x30]
lea r8, [0x1000c1b0]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, 1
jmp 0x1000c474
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x178
ret