Function at 0x180012f90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov r12, qword [rbp + 0x240]
mov rsi, rdx
mov r13, qword [rbp + 0x230]
lea edx, [rcx - 0xb]
mov dword [rsp + 0x38], ecx
mov rbx, r9
mov dword [rsp + 0x34], edx
mov r15, r8
lea r9, [0x180000000]
mov eax, ecx
mov r8d, ecx
cmp ecx, edx
jbe 0x180013419
movsxd r11, dword [rbp + 0x200]
lea edx, [rcx - 0x45]
mov rcx, qword [rsp + 0x58]
mov r14, r11
mov eax, dword [rsp + 0x34]
mov edi, 0x222c
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x48], edx
lea r9, [0x18009e8c0]
mov r10d, 0x25
cmp edx, 0x3d
ja case.default.0x18001304d
lea rcx, [0x180000000]
movzx eax, byte [rcx + rdx + 0x13894]
mov ecx, dword [rcx + rax*4 + 0x13864]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.18005c7f0
mov rbx, qword [rbp + 0x238]
lea r8, [0x18004ab20]
mov rdi, rax
mov qword [rsp + 0x58], rax
mov rax, qword [rbp + 0x228]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rdi + 8], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov qword [rdi], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
mov r11d, dword [rsp + 0x30]
mov edi, 0x222c
mov edx, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x38]
jmp case.0x18001304d.2
mov rax, qword [rbp + 0x228]
xor edi, edi
cmp dword [rax], edi
jbe 0x18001317f
mov r14, qword [rbp + 0x238]
nop dword [rax + rax]
mov rax, qword [rbp + 0x220]
movsx eax, word [rax]
test ax, ax
js 0x180013135
mov r10d, eax
mov r8d, edi
lea r11, [r14 + rdi*2]
movzx ecx, byte [rdi + r11]
movzx r9d, byte [rdi + r11 + 1]
mov eax, ecx
sub eax, r9d
cdq
xor eax, edx
sub eax, edx
cmp eax, r10d
jg 0x180013135
movzx r11d, byte [rdi + r11 + 2]
sub ecx, r11d
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, r10d
jg 0x180013135
sub r9d, r11d
mov eax, r9d
cdq
xor eax, edx
sub eax, edx
cmp eax, r10d
jg 0x180013135
mov rbx, r15
cmp r15, rsi
je 0x18001313b
mov rax, r12
jmp 0x18001313e
mov rbx, rsi
mov r8d, edi
mov rax, r13
mov eax, dword [rax]
lea r9, [rbp - 0x70]
mov dword [rbp - 0x70], eax
mov rdx, rbx
lea rax, [r14 + r8*2]
mov ecx, 0x10c
add r8, rax
call fcn.180020150
movsxd rcx, eax
inc edi
mov rax, qword [rbp + 0x228]
add rcx, rcx
inc dword [rbx + rcx*8 + 8]
cmp edi, dword [rax]
jb 0x1800130d0
mov edx, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x38]
xor r11d, r11d
mov edi, 0x222c
mov dword [rsp + 0x30], r11d
xor r14d, r14d
jmp case.0x18001304d.2
mov word [rsp + 0x40], di
mov byte [rsp + 0x42], 0
jmp case.0x18001304d.2
mov rax, qword [rbp + 0x238]
test rax, rax
jne 0x1800131dd
lea r9, [rbp - 0x68]
mov dword [rbp - 0x68], eax
mov r8d, 0x8c
lea rdx, [0x18008f048]
lea rcx, str._s_s__d___
call fcn.1800064b0
mov rax, qword [rbp + 0x238]
lea r9, [0x18009e8c0]
xor ebx, ebx
nop
lea rcx, [rbx + rbx*4]
mov r8d, VarR8FromCy
shl rcx, 4
mov rdx, rax
add rcx, r9
call fcn.18005e380
test eax, eax
jne 0x1800133f6
mov rax, qword [rbp + 0x238]
lea r9, [0x18009e8c0]
inc ebx
cmp ebx, 0x20
jl 0x1800131e0
jmp 0x180013098
mov r9, qword [rbp + 0x238]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea edx, [r8 + 0xf]
call fcn.180006740
test eax, eax
jne 0x180013849
mov r11d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x38]
jmp case.0x18001304d.2
xor r9d, r9d
cmp dword [r13], r9d
jbe 0x1800132d5
lea r10, [r14 + 1]
lea r10, [r14 + r10*2]
lea r10, [rbx + r10*4]
nop dword [rax]
mov r8d, r9d
add r8, r8
cmp dword [rsi + r8*8 + 8], 0
je 0x1800132c7
mov rdx, qword [rsi + r8*8]
inc r14
movsxd rax, r11d
inc r11d
lea rcx, [rax + rax*2]
movzx eax, word [rdx]
mov word [rbx + rcx*4], ax
movzx eax, byte [rdx + 2]
mov byte [rbx + rcx*4 + 2], al
mov rcx, qword [rsi + r8*8]
movzx edx, byte [rcx + 1]
movzx eax, byte [rcx]
shl eax, 0x10
shl edx, 8
add edx, eax
movzx eax, byte [rcx + 2]
add edx, eax
mov dword [r10 - 4], edx
mov eax, dword [rsi + r8*8 + 8]
mov dword [r10], eax
add r10, 0xc
inc r9d
cmp r9d, dword [r13]
jb 0x180013270
mov dword [rsp + 0x30], r11d
xor r9d, r9d
cmp dword [r12], r9d
jbe 0x180013355
lea r10, [r14 + 1]
lea r10, [r14 + r10*2]
lea r10, [rbx + r10*4]
nop word [rax + rax]
mov r8d, r9d
add r8, r8
cmp dword [r15 + r8*8 + 8], 0
je 0x180013347
mov rdx, qword [r15 + r8*8]
inc r14
movsxd rax, r11d
inc r11d
lea rcx, [rax + rax*2]
movzx eax, word [rdx]
mov word [rbx + rcx*4], ax
movzx eax, byte [rdx + 2]
mov byte [rbx + rcx*4 + 2], al
mov rcx, qword [r15 + r8*8]
movzx edx, byte [rcx + 1]
movzx eax, byte [rcx]
shl eax, 0x10
shl edx, 8
add edx, eax
movzx eax, byte [rcx + 2]
add edx, eax
mov dword [r10 - 4], edx
mov eax, dword [r15 + r8*8 + 8]
mov dword [r10], eax
add r10, 0xc
inc r9d
cmp r9d, dword [r12]
jb 0x1800132f0
mov dword [rsp + 0x30], r11d
movsxd rdx, r11d
lea r9, [0x18002ce80]
mov r8d, SafeArrayGetDim
mov rcx, rbx
call fcn.180064d50
mov r11d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x38]
jmp case.0x18001304d.2
mov r8, qword [rbp + 0x228]
mov ecx, VarI2FromDisp
mov rdx, qword [rbp + 0x238]
call fcn.1800029a0
mov r11d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x38]
mov dword [rsp + 0x3c], eax
jmp case.0x18001304d.2
mov eax, 0x2e75
mov word [rsp + 0x60], r10w
mov word [rsp + 0x61], ax
jmp case.0x18001304d.2
mov eax, 0x252e
mov word [rsp + 0x63], r10w
mov word [rsp + 0x68], ax
mov dword [rsp + 0x64], 0x75252e75
mov eax, dword [rsp + 0x34]
dec r8d
dec edx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x48], edx
cmp r8d, eax
jbe 0x180013431
mov rbx, qword [rbp + 0x218]
jmp 0x180013017
lea rcx, [rbx + rbx*4]
add rcx, rcx
lea rdx, [0x18009e8c0]
xor eax, eax
mov qword [rdx + rcx*8], rax
jmp 0x180013849
mov eax, 1
jmp 0x180013849
mov r8, qword [rsp + 0x58]
mov r11d, dword [rbp + 0x200]
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x30], r11d
jmp 0x18001343e
mov eax, dword [rbp + 0x200]
lea r9, [0x180000000]
lea r14d, [rax + 0xc]
cmp eax, r14d
jae case.0x18001348e.1
movzx r12d, byte [rbp + 0x200]
lea esi, [rax - 0x46]
movzx r13d, byte [rbp + 0x200]
mov edx, 0x322e
movzx r15d, byte [rbp + 0x200]
mov r8d, 0x75
cmp esi, 0x3e
ja case.0x18001348e.12
movzx eax, byte [r9 + rsi + 0x13908]
mov ecx, dword [r9 + rax*4 + 0x138d4]
add rcx, r9
jmp rcx
mov rax, qword [rbp + 0x238]
mov byte [rax + 0xc], 1
jmp case.0x18001348e.12
mov rax, qword [rbp + 0x238]
lea rdx, [rsp + 0x60]
movzx ecx, r15b
movzx r9d, r13b
movzx r8d, r12b
movzx eax, byte [rax]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rbp - 0x58]
call fcn.180051950
mov r11d, dword [rsp + 0x30]
mov edx, 0x322e
mov r8d, 0x75
jmp case.0x18001348e.12
mov rax, qword [rbp + 0x238]
mov word [rsp + 0x6a], r8w
mov r15d, dword [rax]
mov r12d, r15d
mov r13d, r15d
shr r12d, 0x18
shr r13d, 0x10
shr r15d, 8
jmp case.0x18001348e.12
lea rax, [rbp - 0x60]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x180013513
mov r8, qword [rbp + 0x228]
mov rdx, qword [r8 + 0x18]
mov rcx, qword [r8 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x180013576
lea rax, [rcx + rdi]
mov qword [r8 + 0x10], rax
mov rax, r8
cmp rdx, 0x10
jb 0x18001354a
mov rax, qword [r8]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp - 0x60]
call fcn.18005d880
mov r11d, dword [rsp + 0x30]
mov edx, 0x322e
mov r8d, 0x75
mov byte [rdi + rbx], 0
jmp case.0x18001348e.12
lea r9, [rbp - 0x60]
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, r8
call fcn.180052b90
mov r11d, dword [rsp + 0x30]
mov edx, 0x322e
mov r8d, 0x75
jmp case.0x18001348e.12
lea rax, [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1800135b0
mov r8, qword [rbp + 0x228]
mov rdx, qword [r8 + 0x18]
mov rcx, qword [r8 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x180013601
lea rax, [rcx + rdi]
mov qword [r8 + 0x10], rax
mov rax, r8
cmp rdx, 0x10
jb 0x1800135e7
mov rax, qword [r8]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rsp + 0x40]
call fcn.18005d880
mov byte [rdi + rbx], 0
jmp 0x180013616
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, r8
call fcn.180052b90
mov rax, qword [rbp + 0x238]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
movsd xmm2, qword [rax]
movq r8, xmm2
call fcn.1800519b0
mov ebx, 0xca
nop dword [rax]
mov eax, ebx
sub eax, 0xca
je 0x180013712
sub eax, 1
je 0x1800136e2
sub eax, 1
je 0x1800136a6
sub eax, 1
je 0x180013683
cmp eax, 1
jne 0x18001373b
mov r8, qword [sym.imp.RPCRT4.dll_MesInqProcEncodingId]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.180001170
jmp 0x18001373b
mov r8d, 5
lea rdx, str.ngId
lea rcx, [rsp + 0x70]
call fcn.1800666b0
mov dword [rbp - 0x7b], 0xa7025
jmp 0x18001373b
movzx eax, word [0x18008f558]
lea rdx, [0x18008fb98]
mov word [rsp + 0x7b], ax
lea rcx, [rsp + 0x70]
movzx eax, word [0x18008fb94]
mov r8d, 2
mov word [rsp + 0x7c], ax
movzx eax, byte [0x18008fb96]
mov byte [rsp + 0x7e], al
call fcn.1800666b0
jmp 0x18001373b
mov r8d, 1
lea rdx, [0x18008f13c]
lea rcx, [rsp + 0x70]
call fcn.1800666b0
mov r8d, 2
lea rdx, [0x18008fb90]
lea rcx, [rsp + 0x70]
call fcn.1800666b0
jmp 0x18001373b
mov eax, dword [0x18008fb9c]
mov dword [rsp + 0x70], 0x73654d
mov dword [rsp + 0x73], eax
movzx eax, word [0x18008fba0]
mov word [rsp + 0x76], ax
movzx eax, byte [0x18008fba2]
mov byte [rsp + 0x78], al
inc ebx
cmp ebx, 0xcf
jb 0x180013640
mov r11d, dword [rsp + 0x30]
mov edx, 0x322e
mov r8d, 0x75
jmp case.0x18001348e.12
movzx eax, word [0x18008fbbe]
mov word [rsp + 0x42], ax
movzx eax, byte [0x18008fbc0]
mov byte [rsp + 0x44], al
mov byte [rsp + 0x45], 0
mov word [rsp + 0x50], 0x25
jmp case.0x18001348e.12
lea rax, [rbp - 0x58]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180013791
mov rcx, qword [rbp + 0x228]
lea rdx, [rbp - 0x58]
call fcn.180051100
mov r11d, dword [rsp + 0x30]
mov edx, 0x322e
mov r8d, 0x75
jmp case.0x18001348e.12
mov dword [rsp + 0x51], 0x66322e
jmp case.0x18001348e.12
mov rax, qword [rbp + 0x238]
mov rcx, qword [rax]
test rcx, rcx
je 0x18001382a
mov eax, dword [rax + 8]
lea r9, [rbp + 0x200]
mov qword [rsp + 0x48], rcx
lea rdx, [rsp + 0x48]
xor ecx, ecx
mov dword [rbp + 0x200], eax
mov r8d, VarNeg
call fcn.18001aa40
mov r11d, dword [rsp + 0x30]
mov edx, 0x322e
mov r8d, 0x75
jmp case.0x18001348e.12
mov dword [rsp + 0x3c], r11d
inc esi
lea eax, [rsi + 0x46]
cmp eax, r14d
jae case.0x18001348e.1
lea r9, [0x180000000]
jmp 0x180013471
mov rcx, qword [rsp + 0x58]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.18005c7e8
mov byte [rsp + 0x3c], 0
jmp case.0x18001348e.1
mov byte [rsp + 0x3c], 1
mov eax, dword [rsp + 0x3c]
mov rbx, qword [rsp + 0x308]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret