Function at 0x18001a260
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
movdqa xmm0, xmmword [0x180045b50]
xor esi, esi
movdqu xmmword [rbp + 0xa], xmm0
mov edi, ecx
mov r14, rdx
movdqu xmmword [rbp - 0x46], xmm0
mov qword [rbp - 0x10], rsi
lea ecx, [rsi + 0x30]
xorps xmm0, xmm0
mov word [rbp - 8], si
mov byte [rbp - 6], sil
mov qword [rbp - 0x60], rsi
mov word [rbp - 0x58], si
mov byte [rbp - 0x56], sil
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x30], rsi
call fcn.18002867c
xorps xmm0, xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov ebx, 1
mov r15d, edi
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x28], rax
xor eax, eax
mov qword [rbp + 0xf0], rax
mov byte [rbp + 0xf8], al
mov word [rbp + 0x140], ax
movsd qword [rbp + 0x40], xmm2
movsd qword [rbp + 0x138], xmm2
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rsi
mov dword [rbp + 0x58], ebx
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmmword [rbp + 0x90], xmm1
mov qword [rbp + 0xa0], 0xffffffffffffffff
mov dword [rbp + 0xa8], esi
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0x108], rsi
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0x110], 0xf
movups xmmword [rbp + 0xd0], xmm0
mov word [rbp + 0x118], si
movups xmmword [rbp + 0xe0], xmm0
mov dword [rbp + 0x11c], esi
mov qword [rbp + 0x120], rsi
movups xmmword [rbp + 0x128], xmm0
mov byte [rbp + 0x142], al
imul eax, edi, 0x3b1
cmp edi, eax
mov dword [rbp - 0x70], eax
mov edi, dword [rsp + 0x30]
ja 0x18001a844
mov r12d, 0x1bb
lea r13, [0x1800081b0]
lea rcx, [0x18005ce80]
movabs r9, 0x1fffffffffffffff
cmp r15d, 0x2885
ja 0x18001a73e
je 0x18001a5c3
cmp r15d, 0xa40
ja 0x18001a4bb
je 0x18001a466
mov eax, r15d
sub eax, 0x24
je 0x18001ab02
sub eax, 5
je 0x18001a44a
cmp eax, 0x78
jne 0x18001aae2
mov byte [0x18005ceb0], 0
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x30], 6
jmp 0x18001aae2
mov r9d, 0x125
lea rdx, [0x18005c0c0]
xor r8d, r8d
xor ecx, ecx
call fcn.1800085c0
jmp 0x18001aae2
mov r9d, reloc.COMCTL32.dll_MakeDragList
lea rdx, [0x18005c0c8]
xor r8d, r8d
xor ecx, ecx
call fcn.18001f4e0
test al, al
je 0x18001ab63
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.18002d2f8
lea r9, [0x18005c108]
mov word [rbp + 0x1c8], r12w
lea r8, [rbp + 0x1c8]
mov ecx, 0xf9
lea rdx, [rbp - 0x10]
call fcn.18001cb60
jmp 0x18001aae2
cmp r15d, 0x1457
je 0x18001a59a
cmp r15d, 0x1e6e
je 0x18001a546
cmp r15d, 0x2840
jne 0x18001aae2
mov r12, qword [rbp - 0x30]
test r12, r12
je 0x18001a533
nop word [rax + rax]
mov rax, qword [r14]
lea rcx, [rbp + 0x1c8]
lea r14, [rsi + 1]
mov qword [rbp + 0x1c8], rax
mov rdx, r14
mov r8d, 0x7d
call fcn.180010b60
mov rcx, qword [rbp - 0x28]
mov qword [rcx + rsi*8], rax
test rax, rax
je 0x18001ab4b
mov rsi, r14
cmp r14, r12
mov r14, qword [rbp + 0x1b8]
jb 0x18001a4f0
mov byte [0x18005ceb0], bl
xor esi, esi
mov r12d, 0x1bb
jmp 0x18001aae2
mov r9d, 0x10f
lea rcx, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call fcn.18000edc0
mov rdx, qword [rsp + 0x48]
lea rax, [rbp - 0x10]
mov qword [rbp + 0x1c8], rax
cmp rdx, qword [rsp + 0x50]
je 0x18001a584
lea rax, [rbp - 0x10]
mov qword [rdx], rax
add qword [rsp + 0x48], 8
jmp 0x18001aae2
lea r8, [rbp + 0x1c8]
lea rcx, [rsp + 0x40]
call fcn.180001740
jmp 0x18001aae2
lea r9, [0x18005c128]
mov word [rbp + 0x1c8], r12w
lea r8, [rbp - 0x60]
mov edx, 0x35
lea rcx, [rbp + 0x1c8]
call fcn.180025610
jmp 0x18001aae2
mov rax, qword [rsp + 0x48]
cmp rax, qword [rsp + 0x50]
je 0x18001a5e1
lea rcx, [rbp - 0x60]
mov qword [rax], rcx
add qword [rsp + 0x48], 8
jmp 0x18001aae2
mov r13, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov r14, r13
sub r14, rax
sar r14, 3
cmp r14, r9
je 0x18001ab6a
mov rcx, qword [rsp + 0x50]
lea r8, [r14 + 1]
sub rcx, rax
mov qword [rbp + 0x1c8], r8
sar rcx, 3
mov rax, r9
mov rdx, rcx
shr rdx, 1
sub rax, rdx
cmp rcx, rax
jbe 0x18001a62b
mov rax, r8
jmp 0x18001a636
lea rax, [rdx + rcx]
cmp rax, r8
cmovb rax, r8
cmp rax, r9
ja 0x18001ab76
lea r12, [rax*8]
cmp r12, 0x1000
jb 0x18001a67a
lea rcx, [r12 + 0x27]
cmp rcx, r12
jbe 0x18001ab76
call fcn.18002867c
test rax, rax
je 0x18001ab70
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18001a68a
test r12, r12
je 0x18001a68a
mov rcx, r12
call fcn.18002867c
mov rsi, rax
lea rax, [rbp - 0x60]
mov rcx, rsi
mov qword [rsi + r14*8], rax
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
cmp r13, r8
jne 0x18001a6a9
sub r8, rdx
jmp 0x18001a6c7
mov r8, r13
sub r8, rdx
call fcn.180029870
mov r8, qword [rsp + 0x48]
lea rcx, [r14 + 1]
sub r8, r13
lea rcx, [rsi + rcx*8]
mov rdx, r13
call fcn.180029870
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18001a70c
mov rdx, qword [rsp + 0x50]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x18001a707
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab70
call fcn.1800286b8
mov rax, qword [rbp + 0x1c8]
lea r13, [0x1800081b0]
mov qword [rsp + 0x40], rsi
lea rax, [rsi + rax*8]
mov qword [rsp + 0x48], rax
lea rax, [r12 + rsi]
mov qword [rsp + 0x50], rax
xor esi, esi
mov r12d, 0x1bb
jmp 0x18001aae2
cmp r15d, 0x4fdf
ja 0x18001a81d
je 0x18001ab5b
cmp r15d, 0x329c
je 0x18001a7ce
cmp r15d, 0x3cb3
je 0x18001a79a
cmp r15d, 0x46ca
jne 0x18001aae2
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov qword [rbp + 0x1c8], r13
mov edx, 0x90
lea rcx, [rbp + 0x1c8]
call fcn.180005650
jmp 0x18001aae2
mov qword [rsp + 0x28], rsi
lea r9, [rbp + 0x150]
lea r8, [0x18000f740]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
cmp rax, 0
je 0x18001ab63
jmp 0x18001aae2
mov eax, dword [0x18005c150]
lea rdx, [rsp + 0x40]
mov r8d, 0xae
mov dword [rbp + 0x1c8], eax
lea rcx, [rbp + 0x1c8]
call fcn.1800206b0
lea rax, [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov eax, dword [0x18005c150]
mov dword [rbp - 0x18], eax
mov eax, dword [0x18005c154]
mov dword [rbp - 0x14], eax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x150], xmm0
jmp 0x18001aae2
cmp r15d, 0x50e1
je 0x18001aac7
cmp r15d, 0x5af8
je 0x18001aab1
cmp r15d, 0x650f
jne 0x18001aae2
mov ebx, edi
lea rcx, [rbp + 0xa0]
call fcn.180004990
mov rdi, qword [rbp + 0x88]
test rdi, rdi
je 0x18001a8d7
mov rsi, qword [rbp + 0x90]
cmp rdi, rsi
je 0x18001a888
nop word [rax + rax]
mov rcx, rdi
call fcn.180018230
add rdi, 0x20
cmp rdi, rsi
jne 0x18001a870
mov rdi, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x98]
mov rax, rdi
sub rdx, rdi
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x18001a8bb
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab70
mov rcx, rdi
call fcn.1800286b8
xor esi, esi
xorps xmm0, xmm0
mov qword [rbp + 0x88], rsi
movdqa xmmword [rbp + 0x90], xmm0
mov rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x18001a927
mov rdx, qword [rbp + 0x80]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x18001a913
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab70
call fcn.1800286b8
xorps xmm0, xmm0
mov qword [rbp + 0x80], rsi
movdqa xmmword [rbp + 0x70], xmm0
lea rcx, [rbp + 0x28]
call fcn.180004930
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x18001a9c6
mov rsi, qword [rsp + 0x60]
cmp rdi, rsi
je 0x18001a95e
mov rcx, rdi
call fcn.1800048d0
add rdi, 0x28
cmp rdi, rsi
jne 0x18001a948
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
movabs rax, 0x6666666666666667
sub rcx, rdi
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, rdi
lea rdx, [rdx + rdx*4]
shl rdx, 3
cmp rdx, 0x1000
jb 0x18001a9ae
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab70
mov rcx, rdi
call fcn.1800286b8
xor esi, esi
xorps xmm0, xmm0
mov qword [rsp + 0x58], rsi
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18001aa14
mov rdx, qword [rsp + 0x50]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x18001aa01
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab70
call fcn.1800286b8
xorps xmm0, xmm0
mov qword [rsp + 0x50], rsi
movdqa xmmword [rsp + 0x40], xmm0
mov rdx, qword [rbp - 0x3e]
cmp rdx, 0x10
jb 0x18001aa4f
mov rcx, qword [rbp - 0x56]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001aa4a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab70
call fcn.1800286b8
mov rdx, qword [rbp + 0x12]
movdqa xmm0, xmmword [0x180045b50]
mov byte [rbp - 0x56], 0
movdqu xmmword [rbp - 0x46], xmm0
cmp rdx, 0x10
jb 0x18001aa9b
mov rcx, qword [rbp - 6]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001aa96
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001ab70
call fcn.1800286b8
mov eax, ebx
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, [rbp + 0x20]
mov ecx, 0x25
call fcn.1800062b0
mov edi, esi
mov dword [rsp + 0x30], esi
jmp 0x18001aae2
mov r9d, 0x129
lea r8, [0x18005c0c0]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.180020480
imul eax, dword [rbp + 0x1b0], 0x3f
add r15d, eax
cmp r15d, dword [rbp - 0x70]
ja 0x18001a844
mov r14, qword [rbp + 0x1b8]
jmp 0x18001a3e5
mov rsi, qword [rbp + 0x1c0]
xor edx, edx
movzx ecx, byte [rsi]
movzx eax, cl
neg al
movzx eax, al
div ecx
mov ebx, edx
nop word [rax + rax]
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x66]
call fcn.180022310
cmp al, bl
jb 0x18001ab20
movzx ecx, byte [rsi]
xor edx, edx
movzx eax, al
div ecx
xor esi, esi
mov byte [rsp + 0x30], dl
mov ebx, dword [rsp + 0x30]
jmp 0x18001a846
mov byte [rsp + 0x30], 0
xor esi, esi
mov ebx, dword [rsp + 0x30]
jmp 0x18001a846
mov byte [rsp + 0x30], bl
mov ebx, dword [rsp + 0x30]
xor esi, esi
jmp 0x18001a846
call fcn.180018660
int3
call fcn.18002c7c4
int3
call fcn.1800180e0
int3