Function at 0x180086030
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1800f6ae8]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov r13, qword [rbp + 0xb8]
mov r10d, edx
mov r14, qword [rbp + 0xc0]
mov r15, r8
mov eax, dword [rsp + 0x68]
mov r12, rcx
mov ecx, dword [rsp + 0x68]
mov r11, r9
lea esi, [r10 + 0x2a3]
mov dword [rbp - 0x7c], edx
mov rdx, qword [rbp + 0xb0]
mov edi, r10d
mov qword [rbp - 0x68], r8
mov r8d, dword [rsp + 0x68]
mov qword [rbp - 0x60], r9
lea r9, [0x180000000]
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x10], r13
mov qword [rbp - 0x48], r14
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x40], ecx
cmp r10d, esi
jae 0x1800864bc
mov eax, dword [rsp + 0x68]
mov r14, qword [rbp - 0x10]
mov r15, qword [rbp - 0x10]
mov rbx, qword [rbp - 0x48]
mov dword [rbp - 0x80], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x44], eax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x58], rax
nop word [rax + rax]
cmp edi, 0x120
ja 0x18008625f
je 0x180086249
lea eax, [rdi - 0xa]
cmp eax, 0xce
ja case.0x180086124.20
movzx eax, byte [r9 + rax + 0x86cc4]
mov ecx, dword [r9 + rax*4 + 0x86c98]
add rcx, r9
jmp rcx
test r14, r14
je 0x180086456
mov rax, r14
xchg qword [0x1800f6bd0], rax
jmp case.0x180086124.20
mov qword [rsp + 0x28], 0
lea r8, [0x18001bb30]
mov r9, r13
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8d, dword [rsp + 0x48]
mov r14, rax
mov r11, qword [rbp - 0x60]
jmp case.0x180086124.20
mov qword [rbp - 0x50], 0
jmp case.0x180086124.20
mov rax, qword [r13]
mov r8d, dword [r12]
imul r8d, dword [r11]
mov rcx, qword [rax + 0x20]
mov eax, dword [rcx + 0x20]
mov ecx, eax
cdq
shr ecx, 3
and edx, 7
add eax, edx
sar eax, 3
cmp r8d, ecx
cmovle eax, r8d
mov r8d, dword [rsp + 0x48]
mov dword [rbp - 0x80], eax
jmp case.0x180086124.20
mov byte [rbp - 0x78], 1
jmp case.0x180086124.20
mov rax, qword [r13]
mov r15, qword [rax + 0x50]
jmp case.0x180086124.20
mov rax, qword [rbp - 0x68]
mov qword [0x1800f6bc8], r13
mov qword [r13 + 0x80], rax
jmp case.0x180086124.20
mov rax, qword [r13]
mov r10d, 1
xor edx, edx
mov rcx, qword [rax + 0x20]
mov rax, qword [rbp - 0x68]
movzx ecx, byte [rcx + 0x174]
mov eax, dword [rax]
shl r10d, cl
div r10d
mov dword [rsp + 0x44], r10d
mov ecx, eax
mov dword [rsp + 0x40], eax
jmp 0x180086436
mov rax, qword [rbp - 0x68]
mov r8, qword [rbx]
add r8, 7
shr r8, 3
mov rcx, qword [rax]
shr rcx, 3
add rcx, qword [r15]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x48]
mov r11, qword [rbp - 0x60]
mov dword [rbp - 0x78], 0
jmp case.0x180086124.20
mov r10d, dword [rsp + 0x44]
xor r9d, r9d
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x58], r9
jmp 0x18008643b
mov eax, edi
sub eax, 0x14d
je 0x1800863b1
sub eax, 0x2d
je 0x180086399
sub eax, 0x2d
je 0x180086351
cmp eax, 0x2d
jne case.0x180086124.20
cmp dword [rdx], 2
jne 0x1800862c6
mov rax, qword [rbp - 0x68]
lea r9, [rbp - 0x30]
mov dword [rbp - 0x30], r8d
lea rcx, [rbp]
mov r8, r13
mov edx, 0x10f
movups xmm0, xmmword [rax]
movaps xmmword [rbp], xmm0
call fcn.18009cd70
test eax, eax
jne 0x180086460
mov r8d, dword [rsp + 0x48]
mov r11, qword [rbp - 0x60]
jmp case.0x180086124.20
mov ebx, 0xb7
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xb6
je 0x18008632a
cmp eax, 1
jne 0x18008633a
mov rax, qword [rbp - 0x48]
lea rdx, [rbp + 0x10]
mov dword [rbp - 0x28], r8d
lea rcx, [rbp + 0x20]
mov r9, r13
mov r8d, 0x1c
movups xmm0, xmmword [rax]
mov rax, qword [rbp - 0x68]
movaps xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
movaps xmmword [rbp + 0x10], xmm1
call fcn.1800c2f20
test eax, eax
je 0x1800868ba
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rbp - 0x58]
jmp 0x18008633a
cmp dword [r13 + 0x38], 8
jne 0x18008633a
cmp dword [rdx], 3
je 0x180086468
dec ebx
cmp ebx, 0xb5
ja 0x1800862d0
mov rbx, qword [rbp - 0x48]
mov r11, qword [rbp - 0x60]
jmp case.0x180086124.20
mov eax, r8d
mov dword [rbp - 0x38], 4
xor edx, edx
lea rcx, [rsp + 0x68]
div dword [r13 + 0x60]
xor r9d, r9d
lea rax, [rbp - 0x38]
mov dword [rsp + 0x68], edx
mov rdx, r13
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x49]
call fcn.1800c1cc0
cmp eax, 0xffffffff
je 0x1800864b0
mov r8d, dword [rsp + 0x48]
mov r11, qword [rbp - 0x60]
jmp case.0x180086124.20
mov rcx, qword [rbp - 0x68]
call qword [r13 + 0x120]
mov r11, qword [rbp - 0x60]
mov r8d, eax
mov dword [rsp + 0x48], eax
jmp case.0x180086124.20
cmp dword [r13 + 0x18], 0
mov dword [rsp + 0x70], 0xffffffff
jne 0x1800863c7
cmp dword [r13 + 0x1c], 0
je case.0x180086124.20
mov eax, 0xc6
nop dword [rax]
cmp eax, 0xc6
je 0x180086419
cmp eax, 0x148
je 0x180086410
cmp eax, 0x1ca
jne 0x180086421
mov rax, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.1800d1090
mov rbx, qword [rsp + 0x198]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbp - 0x78], 0xffffffff
jmp 0x180086421
mov dword [r13 + 0x38], 0xa
add eax, 0x82
cmp eax, 0x24c
jb 0x1800863d0
mov r10d, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
mov r9, qword [rsp + 0x58]
mov rdx, qword [rbp - 0x58]
add edi, 0x2d
cmp edi, esi
jae 0x1800864d8
lea r9, [0x180000000]
jmp 0x1800860f0
mov byte [rbp - 0x78], 0
jmp case.0x180086124.18
mov dword [r13 + 0x38], 5
mov esi, dword [rsp + 0x70]
lea r12, [0x180000000]
mov edi, 0x12b
test esi, esi
jne case.default.0x1800869ee
lea r9d, [rdi - 0x4d]
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.18000b670
mov r14, qword [rbp - 0x48]
inc edi
mov r15, qword [rbp - 0x68]
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x48]
mov r10d, dword [rbp - 0x7c]
jmp 0x1800869c8
mov dword [rbp - 0x78], 0xffffffff
jmp case.0x180086124.18
mov r9, qword [rbp - 0x50]
mov ebx, dword [rsp + 0x68]
mov r10d, dword [rsp + 0x68]
mov qword [rsp + 0x58], r9
mov dword [rbp - 0x80], ebx
mov dword [rsp + 0x44], r10d
jmp 0x1800864e3
mov r14, qword [rbp - 0x48]
mov r15, qword [rbp - 0x68]
mov ebx, dword [rbp - 0x80]
mov edi, dword [rbp - 0x7c]
mov esi, edi
imul eax, edi, 0xa02
mov dword [rsp + 0x68], eax
cmp edi, eax
ja 0x1800869b6
mov r12d, dword [rsp + 0x60]
nop
cmp esi, 0x168c6
ja 0x180086759
je 0x1800866c8
cmp esi, 0x5a90
ja 0x180086637
je 0x180086608
cmp esi, 0xa
je case.0x180086124.18
cmp esi, 0x7e
je 0x180086581
cmp esi, 0x120
jne 0x180086812
mov dword [r13 + 0x38], 0
cmp dword [rdx], 2
je 0x180086812
movups xmm0, xmmword [r15]
xor edx, edx
mov dword [rsp + 0x50], r8d
lea rax, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
movaps xmmword [rbp - 0x20], xmm0
lea ecx, [rdx + 0x18]
mov qword [rsp + 0x20], r13
call fcn.1800606b0
jmp 0x1800867ff
mov rcx, qword [r14]
test rcx, rcx
je 0x18008680e
mov eax, dword [r11]
mov r9d, 0x60
mov dword [rsp + 0x50], eax
xor r8d, r8d
mov rax, qword [rdx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rcx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180080550
test eax, eax
je 0x1800867ff
mov ecx, 0xe4
nop word [rax + rax]
mov eax, ecx
sub eax, 0xe3
je case.0x180086124.18
cmp eax, 1
jne 0x1800865f9
mov rax, qword [r14]
mov qword [rbp - 0x78], rax
dec ecx
cmp ecx, 0xe2
ja 0x1800865e0
jmp 0x1800867ff
mov eax, ecx
lea r9, [rsp + 0x50]
imul eax, r10d
lea r8, [rsp + 0x78]
xor edx, edx
mov dword [rsp + 0x50], eax
lea ecx, [rdx + 9]
mov rax, qword [r13]
mov qword [rsp + 0x78], rax
call fcn.180062890
mov qword [r14], rax
jmp 0x1800867ff
cmp esi, 0xb4a2
je 0x1800866bc
cmp esi, 0xcf00
je 0x18008666b
cmp esi, 0x10eb4
jne 0x180086812
mov rax, qword [r13]
mov ecx, dword [rax + 0x30]
dec ecx
cmp r12d, ecx
cmovbe ecx, r12d
mov r12d, ecx
jmp 0x18008680e
mov rcx, qword [r15 + 8]
add rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x58], rax
mov r9, rax
test rax, rax
jne 0x180086804
mov edx, 0x11b
nop
mov ecx, edx
sub ecx, 0x11b
je 0x1800866a5
cmp ecx, 1
je 0x180086468
jmp 0x1800866ad
mov dword [r13 + 0x38], 4
inc edx
cmp edx, 0x11d
jb 0x180086690
jmp 0x180086804
lea r12d, [r10 - 1]
or r12d, dword [r15]
jmp 0x180086812
mov rax, qword [r13]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov ecx, 0x38
mov dword [rsp + 0x50], r12d
call fcn.180063030
mov rcx, qword [rbp - 0x58]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov rcx, qword [rcx]
mov qword [rbp - 0x20], rcx
mov rcx, qword [r14]
mov qword [rsp + 0x60], rcx
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x40], rcx
mov dword [rsp + 0x50], ebx
mov r8d, 0xd7
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.18005ee40
test eax, eax
jne 0x1800867ff
nop
mov rax, qword [rbp - 0x50]
jmp 0x1800863e9
cmp esi, 0x26ac0
ja 0x18008684d
je 0x180086834
cmp esi, 0x19ce0
je 0x1800867f0
cmp esi, 0x1c2d8
je 0x1800867d0
cmp esi, 0x21cea
jne 0x180086812
mov rax, qword [rdx]
mov qword [rsp + 0x60], rax
mov eax, dword [r11]
mov dword [rsp + 0x50], eax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x40], 0
mov rax, qword [r13]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
jmp 0x18008672e
mov rax, qword [rdx]
mov qword [rsp + 0x60], rax
mov eax, dword [r11]
mov dword [rsp + 0x50], eax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x20], rax
mov rax, qword [r14]
mov qword [rbp - 0x40], rax
jmp 0x1800867a6
mov r8, qword [r15 + 8]
mov rcx, r9
mov rdx, qword [r15]
call sub.VCRUNTIME140.dll_memcpy
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x48]
mov r10d, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
imul eax, edi, 0xb7
add esi, eax
cmp esi, dword [rsp + 0x68]
ja 0x1800869b6
mov rdx, qword [rbp - 0x58]
mov r11, qword [rbp - 0x60]
mov ebx, dword [rbp - 0x80]
jmp 0x180086500
mov r8, qword [r14 + 8]
test r8, r8
je 0x1800869ac
mov rcx, qword [r15 + 8]
mov rdx, qword [r14]
add rcx, r9
jmp 0x1800867fa
cmp esi, 0x276fc
je 0x180086750
cmp esi, 0x338a0
jne 0x180086812
cmp dword [r13 + 0x144], 0
je 0x180086812
mov edi, 0x115
mov eax, edi
sub eax, 0x115
je 0x180086954
cmp eax, 0x2b
jne 0x18008698b
cmp dword [rbp - 0x70], 0
je 0x18008698b
mov ebx, 0x1a
cmp ebx, 0x1a
je 0x180086932
cmp ebx, 0x924
je 0x180086925
cmp ebx, 0x122e
je 0x1800868cf
cmp ebx, 0x1b38
jne 0x180086940
mov esi, dword [rsp + 0x70]
lea r12, [0x180000000]
mov edi, 0x129
jmp case.default.0x1800869ee
mov eax, dword [rbp - 0x70]
lea r8, [rbp + 0x30]
mov r9, r13
mov dword [rsp + 0x50], eax
mov edx, 0x9e
lea rcx, [rsp + 0x50]
call fcn.180018160
cmp eax, 0xffffffff
je 0x180086468
mov r9d, dword [r15 + 8]
mov rcx, r13
mov edx, dword [rbp - 0x70]
mov rax, qword [r13 + 0x130]
add edx, 0x18
add r9d, dword [r14 + 8]
mov r8, qword [rsp + 0x58]
call qword [rax + 8]
cmp eax, 0xffffffff
je 0x180086468
mov r8d, dword [rsp + 0x48]
jmp 0x180086940
mov dword [rbp + 0x40], r8d
mov dword [rbp + 0x44], 0x26011999
jmp 0x180086940
mov eax, dword [r15 + 8]
mov dword [rbp + 0x38], eax
mov eax, dword [r14 + 8]
mov dword [rbp + 0x3c], eax
add ebx, 0x90a
cmp ebx, 0x2428
jbe 0x180086895
jmp 0x18008698b
mov ecx, dword [r15 + 8]
lea r9, [rsp + 0x50]
mov eax, dword [r14 + 8]
lea rdx, [rbp + 0x30]
add eax, 4
mov dword [rsp + 0x60], r8d
add ecx, eax
mov dword [rsp + 0x20], 0x67
mov dword [rsp + 0x50], ecx
mov r8, r13
lea rcx, [rsp + 0x60]
call fcn.1800bd070
mov dword [rbp - 0x70], eax
mov r8d, dword [rsp + 0x48]
add edi, 0x2b
cmp edi, 0x16b
jb 0x180086870
mov r9, qword [rsp + 0x58]
mov edi, dword [rbp - 0x7c]
jmp 0x180086809
mov r8d, dword [rsp + 0x48]
jmp 0x180086812
mov r10d, dword [rbp - 0x7c]
lea r12, [0x180000000]
mov esi, dword [rsp + 0x70]
mov edi, r10d
lea eax, [r10 + 0xe]
cmp edi, eax
jae case.0x180086124.18
lea eax, [rdi - 0x120]
cmp eax, 0xd
ja case.default.0x1800869ee
mov ecx, dword [r12 + rax*4 + 0x86d94]
add rcx, r12
jmp rcx
mov eax, dword [r14 + 8]
mov dword [rbp + 0x3c], eax
mov dword [rbp + 0x40], r8d
jmp case.default.0x1800869ee
cmp dword [rbp - 0x70], 0
je case.0x1800869ee.299
jmp case.default.0x1800869ee
xor edx, edx
lea r9, [rbp + 0x30]
mov eax, r8d
mov rcx, r13
div dword [r13 + 0x60]
lea r8, [rsp + 0x60]
lea edx, [rdx*4 + 0xac]
mov dword [rsp + 0x60], edx
mov edx, 0x10c
call fcn.1800bea70
cmp eax, 0xffffffff
je case.0x1800869ee.299
jmp case.default.0x1800869ee
mov eax, 0xba
nop dword [rax]
cmp eax, 0xba
je 0x180086a64
cmp eax, 0xba0
je case.0x180086124.18
jmp 0x180086a67
mov dword [rbp - 0x78], esi
add eax, 0xae6
cmp eax, 0x15cc
jbe 0x180086a50
mov dword [rbp + 0x44], 0x26011999
jmp case.default.0x1800869ee
mov eax, dword [r15 + 8]
mov dword [rbp + 0x38], eax
jmp case.default.0x1800869ee
mov dword [rsp + 0x50], 0xffffffff
mov r9d, 0x11e
mov dword [rsp + 0x60], 4
lea r8, [rsp + 0x60]
mov rcx, r13
lea rdx, [rsp + 0x50]
call fcn.1800a3b70
jmp case.default.0x1800869ee
test r9, r9
je 0x180086af6
mov r13, qword [rsp + 0x58]
mov ebx, 0xfa
mov eax, ebx
sub eax, 0xf9
je 0x180086ae0
cmp eax, 1
jne 0x180086ae3
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180086ae3
xor r13d, r13d
dec ebx
cmp ebx, 0xf8
ja 0x180086ac7
mov qword [rsp + 0x58], r13
mov r13, qword [rbp - 0x10]
mov eax, dword [rsp + 0x48]
xor edx, edx
div dword [r13 + 0x60]
mov dword [rsp + 0x50], edx
jmp 0x180086a93
mov dword [rsp + 0x70], 0
mov esi, dword [rsp + 0x70]
jmp case.default.0x1800869ee
mov eax, dword [r15 + 8]
lea r8, [rbp + 0x30]
add eax, dword [r14 + 8]
lea rcx, [rsp + 0x60]
mov r9, r13
mov dword [rsp + 0x60], eax
mov edx, 0x101
call fcn.1800bc6c0
mov dword [rbp - 0x70], eax
jmp case.default.0x1800869ee
mov eax, dword [rbp - 0x70]
lea r8, [rbp + 0x30]
mov r9, r13
mov dword [rsp + 0x60], eax
mov edx, 0x9e
lea rcx, [rsp + 0x60]
call fcn.180018160
cmp eax, 0xffffffff
je case.0x1800869ee.299
mov r9d, dword [r15 + 8]
mov rcx, r13
mov edx, dword [rbp - 0x70]
mov rax, qword [r13 + 0x130]
add edx, 0x18
add r9d, dword [r14 + 8]
mov r8, qword [rsp + 0x58]
call qword [rax + 8]
cmp eax, 0xffffffff
je case.0x1800869ee.299
mov eax, dword [rsp + 0x48]
xor edx, edx
div dword [r13 + 0x60]
xor r8d, r8d
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x60]
mov r9, r13
mov qword [rsp + 0x28], rax
xor ecx, ecx
lea rax, [rbp - 0x70]
lea edx, [rdx*4 + 0xac]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edx
lea edx, [r8 + 0x45]
call fcn.1800beeb0
cmp eax, 0xffffffff
jne case.default.0x1800869ee
jmp case.0x1800869ee.299
xor r9d, r9d
mov dword [rsp + 0x60], 4
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], 0xffffffff
mov rdx, r13
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 0x49]
call fcn.1800c1cc0
cmp eax, 0xffffffff
je case.0x1800869ee.299
cmp dword [r13 + 0x144], 0
je case.default.0x1800869ee
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov r8, r13
mov dword [rsp + 0x60], eax
mov edx, 0xf7
call fcn.18007e260
cmp eax, 0xffffffff
jne case.default.0x1800869ee
mov ebx, 0xc
nop dword [rax]
cmp ebx, 0xc
je 0x180086c60
cmp ebx, 0x74
je case.0x1800869ee.299
jmp 0x180086c86
mov r9d, 0x11e
mov dword [rsp + 0x60], 4
lea r8, [rsp + 0x60]
mov dword [rbp - 0x58], 0xffffffff
lea rdx, [rbp - 0x58]
mov rcx, r13
call fcn.1800a3b70
add ebx, 0x68
cmp ebx, 0xdc
jb 0x180086c50
jmp case.default.0x1800869ee