Function at 0x180014c3c
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rbx, rcx
cmp byte [rcx], 1
jne 0x180014c66
xor al, al
jmp 0x180015112
mov byte [rcx], 1
call fcn.180037ad8
mov rdi, rax
xor ebp, ebp
cmp rax, rbp
je 0x180014cad
mov dword [rsp + 0x38], 0x28
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], ebp
lea r9, str.Global9b4fbe25_a961_4ae3_a6c8_8d951d55df03
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
mov rcx, rdi
call fcn.180037c5c
jmp 0x180014cb0
mov rsi, rbp
mov qword [rbx + 8], rsi
mov ecx, 0x50
call fcn.18003c23c
mov rdi, rax
mov qword [rsp + 0x80], rax
mov r12d, 8
cmp rax, rbp
je 0x180014d33
lea rax, vtable.CPatchScanner.0
mov qword [rdi], rax
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c23c
cmp rax, rbp
je 0x180014cfc
mov qword [rax], rsi
jmp 0x180014cff
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.180010184
mov qword [rsi + 0x30], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rsi + 0x30]
mov qword [rax], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x10], rax
mov qword [rsi + 0x38], rbp
mov byte [rdi + 8], bpl
jmp 0x180014d36
mov rdi, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.18001566c
mov r15d, 0x10
mov rcx, r15
call fcn.18003c23c
cmp rax, rbp
je 0x180014d64
lea rcx, vtable.CGuestScanner.0
mov qword [rax], rcx
mov byte [rax + 8], bpl
jmp 0x180014d67
mov rax, rbp
mov rdx, rax
mov rcx, rbx
call fcn.18001566c
mov rcx, r15
call fcn.18003c23c
cmp rax, rbp
je 0x180014d8b
lea rcx, vtable.CFirewallScanner.0
mov qword [rax], rcx
jmp 0x180014d8e
mov rax, rbp
mov rdx, rax
mov rcx, rbx
call fcn.18001566c
mov ecx, 0x90
call fcn.18003c23c
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x180014e61
lea rax, vtable.CServicesScanner.0
mov qword [rdi], rax
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c23c
cmp rax, rbp
je 0x180014ddf
mov qword [rax], rsi
jmp 0x180014de2
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.180010184
mov qword [rsi + 0x30], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rsi + 0x30]
mov qword [rax], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x10], rax
mov qword [rsi + 0x38], rbp
lea rsi, [rdi + 0x50]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c23c
cmp rax, rbp
je 0x180014e2e
mov qword [rax], rsi
jmp 0x180014e31
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.180010184
mov qword [rsi + 0x30], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rsi + 0x30]
mov qword [rax], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x10], rax
mov qword [rsi + 0x38], rbp
jmp 0x180014e64
mov rdi, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.18001566c
mov ecx, 0x50
call fcn.18003c23c
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x180014ee4
lea rax, vtable.CNetScanner.0
mov qword [rdi], rax
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c23c
cmp rax, rbp
je 0x180014eb1
mov qword [rax], rsi
jmp 0x180014eb4
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.18000d79c
mov qword [rsi + 0x30], rax
mov byte [rax + 0x1d], 1
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rsi + 0x30]
mov qword [rax], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x10], rax
mov qword [rsi + 0x38], rbp
jmp 0x180014ee7
mov rdi, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.18001566c
mov ecx, 0x90
call fcn.18003c23c
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x180014f13
mov rcx, rax
call fcn.18001113c
jmp 0x180014f16
mov rax, rbp
mov rdx, rax
mov rcx, rbx
call fcn.18001566c
mov ecx, 0x80
call fcn.18003c23c
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x180014fb3
lea rax, vtable.CSoftwareScanner.0
mov qword [rdi], rax
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c23c
cmp rax, rbp
je 0x180014f63
mov qword [rax], rsi
jmp 0x180014f66
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.18001e79c
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rbp
lea rsi, [rdi + 0x48]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c23c
cmp rax, rbp
je 0x180014f97
mov qword [rax], rsi
jmp 0x180014f9a
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.18001e79c
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rbp
mov byte [rdi + 8], bpl
jmp 0x180014fb6
mov rdi, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.18001566c
mov ecx, 0x78
call fcn.18003c23c
mov rdi, rax
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x18001504f
lea rax, vtable.CAntivirusScanner.0
mov qword [rdi], rax
lea rsi, [rdi + 8]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c23c
cmp rax, rbp
je 0x180015003
mov qword [rax], rsi
jmp 0x180015006
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.18001826c
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rbp
lea rsi, [rdi + 0x40]
mov qword [rsp + 0x88], rsi
mov rcx, r12
call fcn.18003c23c
cmp rax, rbp
je 0x180015037
mov qword [rax], rsi
jmp 0x18001503a
mov rax, rbp
mov qword [rsi], rax
mov rcx, rsi
call fcn.18001e79c
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rbp
jmp 0x180015052
mov rdi, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.18001566c
mov rcx, r15
call fcn.18003c23c
cmp rax, rbp
je 0x180015076
lea rcx, vtable.CPwdScanner.0
mov qword [rax], rcx
jmp 0x180015079
mov rax, rbp
mov rdx, rax
mov rcx, rbx
call fcn.18001566c
mov ecx, 0x40
call fcn.18003c23c
mov rsi, rax
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x1800150de
lea rax, vtable.CADDomainScanner.0
mov qword [rsi], rax
lea rdi, [rsi + 8]
mov qword [rsp + 0x88], rdi
mov rcx, r12
call fcn.18003c23c
cmp rax, rbp
je 0x1800150c6
mov qword [rax], rdi
jmp 0x1800150c9
mov rax, rbp
mov qword [rdi], rax
mov rcx, rdi
call fcn.18000d978
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rbp
jmp 0x1800150e1
mov rsi, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.18001566c
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8, [0x180017198]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x80], rax
mov al, 1
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret