Function at 0x18001f9f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x18007b358]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r12, r8
mov ebx, edx
mov dword [rsp + 0x50], edx
mov r13, rcx
movdqa xmm0, xmmword [0x1800751f0]
movdqa xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], 0
movdqa xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
movdqa xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], 0
movdqa xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x210], 0
xor ecx, ecx
mov qword [rbp + 0x10], rcx
mov word [rbp + 0x18], cx
movdqu xmmword [rbp + 0x2a], xmm0
mov byte [rbp + 0x1a], cl
mov qword [rbp - 0x20], rcx
mov word [rbp - 0x18], cx
movdqu xmmword [rbp - 6], xmm0
mov byte [rbp - 0x16], cl
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rcx
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], rcx
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rcx
mov ecx, 0x30
call fcn.180069534
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x48], rax
xor r9d, r9d
mov qword [rbp + 0x58], r9
xorps xmm2, xmm2
movsd qword [rbp + 0x60], xmm2
mov qword [rbp + 0x68], r9
mov dword [rbp + 0x70], 1
mov qword [rbp + 0x78], r9
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r9
mov qword [rbp + 0xb8], 0xffffffffffffffff
mov dword [rbp + 0xc0], r9d
xor eax, eax
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], rax
movdqa xmm0, xmmword [0x1800751f0]
movdqa xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], al
mov word [rbp + 0x130], r9w
mov dword [rbp + 0x134], r9d
mov qword [rbp + 0x138], r9
xorps xmm0, xmm0
movaps xmmword [rbp + 0x140], xmm0
movsd qword [rbp + 0x150], xmm2
mov byte [rbp + 0x158], al
mov qword [rbp + 0x15c], r9
mov r8d, ebx
mov dword [rsp + 0x38], ebx
lea edx, [rbx + 0xc]
mov dword [rsp + 0x30], edx
mov r11d, 0x1bb
cmp ebx, edx
jae 0x18001ffd1
lea edx, [rbx - 0x99]
mov dword [rsp + 0x3c], edx
mov ebx, dword [rsp + 0x68]
mov edi, dword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov r15d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
lea r10, [0x180000000]
cmp edx, 0x1b
ja case.default.0x18001fc16
mov ecx, dword [r10 + rdx*4 + 0x2057c]
add rcx, r10
jmp rcx
mov word [rbp + 0x1e0], r11w
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
xor r9d, r9d
lea r8, [rbp + 0x1c0]
xor edx, edx
mov ecx, 0xef
call fcn.18003cdd0
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
jmp case.0x18001fc16.2
mov r8, r12
mov edx, 0x76
lea rcx, [rsp + 0x40]
call fcn.1800348a0
mov rbx, rax
test eax, eax
js 0x18001ffae
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
jmp case.0x18001fc16.2
lea rax, [rbp + 0x230]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18001fc90
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x180]
call fcn.180031290
mov r8d, 1
lea rdx, [0x18006e5ec]
lea rcx, [rbp + 0x1a0]
call fcn.180031290
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
jmp case.0x18001fc16.2
mov word [rbp + 0x23a], 0x7274
jmp case.0x18001fc16.2
mov esi, 0x60
nop word [rax + rax]
mov eax, esi
sub eax, 0x5b
je 0x18001fdbf
sub eax, 5
je 0x18001fd7d
sub eax, 1
je 0x18001fd6f
sub eax, 1
je 0x18001fd4b
cmp eax, 1
jne 0x18001fd98
mov ebx, 0x66
mov eax, ebx
sub eax, 0x66
je 0x18001fd2f
cmp eax, 0x26
jne 0x18001fd3e
mov edi, r15d
mov eax, r15d
jmp 0x18001fdec
cmp r15d, 1
jge 0x18001fd3e
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add ebx, 0x26
cmp ebx, 0xb2
jb 0x18001fd18
jmp 0x18001fd98
mov byte [r14 + 4], 0x20
mov dword [r14 + 8], 0xfffffff9
mov r9, r14
mov r8, r13
mov edx, 0x103
xor ecx, ecx
call fcn.180047ae0
mov r15d, eax
jmp 0x18001fd98
test r14, r14
je 0x18001fda4
mov eax, dword [r12]
mov dword [r14], eax
jmp 0x18001fd98
test r13, r13
je 0x18001fdb6
test r12, r12
je 0x18001fdad
mov edx, 0x28
lea ecx, [rdx - 0x27]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
inc esi
cmp esi, 0x65
jae 0x18001fdbb
jmp 0x18001fcf0
mov edi, 0xfffffffa
mov eax, edi
jmp 0x18001fdec
mov edi, 0xfffffffe
mov eax, edi
jmp 0x18001fdec
mov edi, 0xfffffff6
mov eax, edi
jmp 0x18001fdec
mov dword [rsp + 0x48], 0xa
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x18006b9d8]
xor edx, edx
lea ecx, [rdx + 8]
call fcn.1800374a0
mov edi, eax
mov ebx, eax
cmp eax, 1
jl 0x18001ffae
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
jmp case.0x18001fc16.2
mov dword [rsp + 0x48], 0x10000
mov rax, qword [r13 + 0x60018]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rax
mov r9, r13
xor r8d, r8d
lea edx, [r8 + 0x49]
lea rcx, [rsp + 0x48]
call fcn.1800123b0
movsxd rcx, eax
add rcx, qword [r13 + 0x60018]
mov qword [rsp + 0x60], rcx
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
jmp case.0x18001fc16.2
mov eax, dword [0x180073e3e]
mov dword [rbp + 0x235], eax
movzx eax, byte [0x180073e42]
mov byte [rbp + 0x239], al
mov byte [rbp + 0x23a], 0
jmp case.0x18001fc16.2
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
mov r9d, StrCmpNICW
mov r8, r13
lea rdx, [rsp + 0x40]
xor ecx, ecx
call fcn.180037a80
jmp 0x18001fdec
mov byte [rbp + 0x230], 0
mov r8d, 2
lea rdx, [0x180073ec5]
lea rcx, [rbp + 0x230]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 3
lea rdx, [0x180073f6f]
lea rcx, [rbp + 0x230]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
jmp case.0x18001fc16.2
mov byte [rbp + 0x23c], 0
xor r8d, r8d
lea edx, [r8 + 0x43]
lea rcx, [0x18007b068]
call fcn.1800397e0
test al, al
jne 0x18001ff66
mov esi, 0x44
cmp esi, 0x44
je 0x18001ff4f
cmp esi, 0x1dc0
je 0x18001ff45
cmp esi, 0x3b3c
je 0x18001ff27
cmp esi, 0x58b8
je 0x18002023d
jmp 0x18001ff58
mov dword [rsp + 0x48], 0
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call sub.IMM32.dll_ImmGetConversionStatus
jmp 0x18001ff58
mov dword [rsp + 0x68], 0
jmp 0x18001ff58
mov qword [rsp + 0x58], 0
add esi, 0x1d7c
cmp esi, 0x75f0
jbe 0x18001ff04
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
jmp case.0x18001fc16.2
test r13, r13
je 0x18001ffc4
test r12, r12
je 0x18001ffb7
mov eax, dword [rsp + 0x30]
inc r8d
mov dword [rsp + 0x38], r8d
inc edx
mov dword [rsp + 0x3c], edx
xor r9d, r9d
cmp r8d, eax
jae 0x18001ffd5
mov r11d, 0x1bb
jmp 0x18001fbfb
mov dword [rsp + 0x60], eax
jmp case.0x18001fc16.1
mov dword [rsp + 0x60], 0xfffffffe
jmp case.0x18001fc16.1
mov dword [rsp + 0x60], 0xfffffff6
jmp case.0x18001fc16.1
mov ebx, dword [rsp + 0x68]
mov r12d, dword [rsp + 0x50]
mov edi, r12d
lea r15d, [r12 + r12*8]
shl r15d, 8
cmp r12d, r15d
ja case.0x18001fc16.1
lea r13, [0x1800100b0]
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x58]
nop
cmp edi, 0x26b65
ja 0x1800202dc
je 0x1800201d7
cmp edi, 0xf825
ja 0x18002015b
je 0x18002011c
mov eax, edi
sub eax, 0xa5
je 0x1800200a6
sub eax, 0xc
je 0x180020054
cmp eax, 0x7bb4
jne 0x180020374
mov r8d, 0x49
lea rdx, [rsp + 0x70]
xor ecx, ecx
call fcn.180024850
jmp 0x180020374
mov eax, 0xc
nop dword [rax]
cmp eax, 0xc
je 0x180020070
cmp eax, 0x48
je case.0x18001fc16.1
jmp 0x180020074
mov dword [rsp + 0x60], ebx
add eax, 0x3c
cmp eax, 0x78
jbe 0x180020060
lea rax, [rbp - 0x20]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x78]
cmp rax, qword [rbp - 0x80]
je 0x18002019c
lea rcx, [rbp - 0x20]
mov qword [rax], rcx
add qword [rsp + 0x78], 8
jmp 0x1800201b0
mov qword [rsp + 0x28], r9
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x180]
xor edx, edx
mov ecx, 0xb5
call fcn.180014f60
mov eax, 0x1bb
mov word [rsp + 0x30], ax
lea r9, [0x18007b0c8]
mov r8d, 0xb8
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x30]
call fcn.18002f120
mov eax, 0x1bb
mov word [rsp + 0x30], ax
lea r9, [rsp + 0x30]
mov r8d, 0x16
lea rdx, [rbp - 0x20]
lea rcx, [0x18007b0e8]
call fcn.1800256e0
jmp 0x180020374
lea rax, [rbp + 0x10]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x78]
cmp rax, qword [rbp - 0x80]
je 0x180020142
lea rcx, [rbp + 0x10]
mov qword [rax], rcx
add qword [rsp + 0x78], 8
jmp 0x180020374
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.1800077a0
jmp 0x180020374
cmp edi, 0x173e5
je 0x18002007c
cmp edi, 0x1efa5
jne 0x180020374
lea rax, [rsp + 0x70]
mov qword [rbp - 0x40], rax
mov eax, dword [0x18007b110]
mov dword [rbp - 0x38], eax
mov eax, dword [0x18007b114]
mov dword [rbp - 0x34], eax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x30], xmm0
jmp 0x180020374
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.1800077a0
mov eax, dword [0x18007b110]
mov dword [rsp + 0x50], eax
mov r9d, reloc.SHELL32.dll_ILRemoveLastID
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.180018bd0
jmp 0x180020374
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], r9d
lea r9, [rbp - 0x30]
lea r8, [0x1800253f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
test rax, rax
jne 0x180020374
mov edx, 0x1d
nop word [rax + rax]
mov ecx, edx
sub ecx, 0x1d
je 0x1800202ca
sub ecx, 1
je 0x1800202be
cmp ecx, 1
jne 0x1800202cc
lea rdx, [rbp + 0x170]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_RectInRegion]
mov dword [rsp + 0x60], 1
lea rcx, [rbp + 0xb8]
call fcn.180009820
mov rbx, qword [rbp + 0xa0]
test rbx, rbx
je 0x18002038e
mov rdi, qword [rbp + 0xa8]
cmp rbx, rdi
je 0x180020288
nop dword [rax]
mov rcx, rbx
call fcn.180030d40
add rbx, 0x20
cmp rbx, rdi
jne 0x180020270
mov rbx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.180032680
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xa0], xmm0
xor esi, esi
mov qword [rbp + 0xb0], rsi
jmp 0x180020390
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
jmp 0x1800202cc
xor esi, esi
inc edx
cmp edx, 0x20
jb 0x180020210
jmp 0x180020374
cmp edi, 0x2e725
je 0x18002036b
cmp edi, 0x362e5
je 0x180020336
cmp edi, 0x3dea5
je 0x180020315
cmp edi, 0x45a65
je 0x18002030e
cmp edi, 0x4d625
je case.0x18001fc16.1
jmp 0x180020374
mov dword [rsp + 0x60], r9d
jmp 0x180020374
mov qword [rsp + 0x20], r9
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
lea rcx, [rbp + 0x40]
call fcn.180038850
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
jmp 0x180020374
mov qword [rsp + 0x58], r13
xor r9d, r9d
lea r8d, [r9 + 0x6f]
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.180067f50
lea r9, [0x18007b060]
mov r8d, reloc.SHELL32.dll_SHSetInstanceExplorer
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x40]
call fcn.18000c1d0
jmp 0x180020374
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [r12 + r12*2]
shl eax, 6
add edi, eax
cmp edi, r15d
ja case.0x18001fc16.1
xor r9d, r9d
jmp 0x180020000
xor esi, esi
mov rdx, qword [rbp + 0x88]
test rdx, rdx
je 0x1800203c8
mov r8, qword [rbp + 0x98]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x88]
call fcn.1800325e0
mov qword [rbp + 0x88], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x48]
call fcn.180009750
nop
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x180020463
mov rdi, qword [rbp - 0x70]
cmp rbx, rdi
je 0x1800203fd
mov rcx, rbx
call fcn.180009060
add rbx, 0x28
cmp rbx, rdi
jne 0x1800203e8
mov rbx, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x68]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x18002044f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002044f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180069570
mov qword [rbp - 0x78], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x18002048f
mov r8, qword [rbp - 0x80]
sub r8, rdx
sar r8, 3
lea rcx, [rsp + 0x70]
call fcn.180032590
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov rdx, qword [rbp + 2]
cmp rdx, 0x10
jb 0x1800204cd
inc rdx
mov rcx, qword [rbp - 0x16]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800204c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800204c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180069570
movdqa xmm0, xmmword [0x1800751f0]
movdqu xmmword [rbp - 6], xmm0
mov byte [rbp - 0x16], 0
mov rdx, qword [rbp + 0x32]
cmp rdx, 0x10
jb 0x18002051c
inc rdx
mov rcx, qword [rbp + 0x1a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180020517
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180020517
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180069570
movdqa xmm0, xmmword [0x1800751f0]
movdqu xmmword [rbp + 0x2a], xmm0
mov byte [rbp + 0x1a], 0
lea rcx, [rbp + 0x1f0]
call fcn.1800093c0
nop
lea rcx, [rbp + 0x180]
call fcn.180009470
mov rax, qword [rsp + 0x60]
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.180069d20
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret