Function at 0x18000a804
Capabilities:
Create thread
Get common file path
Terminate process

Disassembly:
mov r8, rdx
mov rdx, rcx
lea rcx, vtable.CMainMgr.0
jmp 0x18000a804
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x4d0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov rsi, r8
mov rdi, rdx
xor r13d, r13d
cmp dword [0x18015f570], r13d
je 0x18000a84d
xor eax, eax
jmp 0x18000acf3
lea rdx, str._CMainMgr_:_INIT...
lea rcx, [0x18015f578]
call fcn.1800098e8
call fcn.18000aeec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [section..shared], eax
lea rcx, [0x180162940]
call fcn.1800046dc
lea rcx, [0x180162138]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x180162134]
lea rcx, [0x180162138]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, r13d
jne 0x18000a8be
lea rdx, str.__GENERAL_TRACKING_IS_DISABLED._EXITING_..._
lea rcx, [0x18015f578]
call fcn.1800098e8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r8, str.SBWTCHSINGLE
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x18015f560], rax
call fcn.180030008
lea rcx, [rsp + 0x88]
call qword [sym.imp.ole32.dll_CoCreateGuid]
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x48]
lea rcx, [0x18015f720]
call fcn.1800ceb3c
nop
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax - 8]
lea ecx, [r8 + 1]
movsxd rdx, ecx
add rdx, rdx
mov ecx, dword [rsi]
cmp rcx, rdx
jae 0x18000a956
lea ecx, [r8 + r8 + 2]
mov dword [rsi], ecx
lea rcx, [rax - 0xc]
lea rbp, [0x18015f758]
cmp rcx, rbp
je 0x18000a94c
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx], eax
add eax, edi
cmp eax, r13d
jg 0x18000a94c
call fcn.1800d1434
mov eax, 0x7a
jmp 0x18000acf3
lea rdx, [rsp + 0x48]
lea rcx, [0x18015f568]
call fcn.180003500
mov r11, qword [0x18015f568]
movzx eax, word [r11]
mov word [rdi], ax
add r11, 2
add rdi, 2
cmp ax, r13w
jne 0x18000a96e
cmp dword [0x18015f570], r13d
je 0x18000a9bd
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
lea rbp, [0x18015f758]
cmp rcx, rbp
je 0x18000a9b6
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx], eax
add eax, edi
cmp eax, r13d
jg 0x18000a9b6
call fcn.1800d1434
xor eax, eax
jmp 0x18000acf3
lea rcx, [0x180162840]
call fcn.180001008
lea rcx, vtable.CJobMgr.0
call fcn.18001c560
lea rcx, [0x180162df0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x180162e28], rax
lea rax, [0x180162e30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
lea r9, [0x180162df0]
lea r8, [0x18001711c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180162e20], rax
lea rcx, [0x180162d60]
call fcn.180016410
lea rcx, [0x180162f40]
call fcn.180031b60
mov r12d, eax
lea rcx, vtable.CMainMgr.0
call fcn.18000a6f0
lea rdx, str.initialization
lea rcx, [rsp + 0x38]
call fcn.1800041c0
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001b
xor r8d, r8d
lea rdx, str.SOFTWARESpeedbitSBUpdate_
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rbp, [0x18015f758]
or edi, 0xffffffff
cmp eax, r13d
jne 0x18000ac9a
mov dword [rsp + 0x30], r13d
lea rdx, [0x18010dc3c]
lea rcx, [rsp + 0x70]
call fcn.1800041c0
lea r9, [rsp + 0x30]
mov r8, rax
mov rdx, qword [rsp + 0x40]
lea rcx, [0x180163340]
call fcn.18000b42c
cmp dword [rsp + 0x30], r13d
jne 0x18000ac0d
lea rdx, [rsp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, r13d
je 0x18000aafd
lea rcx, [rsp + 0xa0]
call fcn.18002436c
jmp 0x18000ab00
mov al, r13b
cmp al, r13b
je 0x18000aba9
lea rdx, [rsp + 0x58]
lea rcx, vtable.CEntryInstaller.0
call fcn.180024554
nop
mov rbx, qword [rsp + 0x58]
lea rsi, [rbx - 0xc]
cmp dword [rsi], r13d
jl 0x18000ab34
mov qword [rsp + 0x50], rbx
lock add dword [rsi], 1
jmp 0x18000ab58
mov rax, qword [0x18015f768]
mov qword [rsp + 0x50], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.180003e28
lea rdx, [rsp + 0x50]
lea rcx, vtable.CEntryInstaller.0
call fcn.180023e3c
lea rdx, [rsp + 0x2b0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, r13d
je 0x18000ab8f
lea rcx, [rsp + 0x2b0]
call fcn.180024444
nop
cmp rsi, rbp
je 0x18000aba9
mov eax, edi
lock xadd dword [rsi], eax
add eax, edi
cmp eax, r13d
jg 0x18000aba9
mov rcx, rsi
call fcn.1800d1434
lea rcx, str.first_time
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.first_time
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.180003e28
lea rdx, [rsp + 0x38]
lea rcx, [0x180162ea0]
call fcn.18001b2c0
lea rdx, [0x18010dc3c]
lea rcx, [rsp + 0x80]
call fcn.1800041c0
mov r9d, 1
mov r8, rax
mov rdx, qword [rsp + 0x40]
lea rcx, [0x180163340]
call fcn.18000b3b4
jmp 0x18000ac9a
lea rdx, [0x18010e0a8]
lea rcx, [rsp + 0x78]
call fcn.1800041c0
lea r9, [rsp + 0x30]
mov r8, rax
mov rdx, qword [rsp + 0x40]
lea rcx, [0x180163340]
call fcn.18000b42c
cmp dword [rsp + 0x30], r13d
jne 0x18000ac9a
lea rcx, str.second_time
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.second_time
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.180003e28
lea rdx, [rsp + 0x38]
lea rcx, [0x180162ea0]
call fcn.18001b2c0
lea rdx, [0x18010e0a8]
lea rcx, [rsp + 0x68]
call fcn.1800041c0
mov r9d, 1
mov r8, rax
mov rdx, qword [rsp + 0x40]
lea rcx, [0x180163340]
call fcn.18000b3b4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x18015f570], 1
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x18000acd0
mov eax, edi
lock xadd dword [rcx], eax
add eax, edi
cmp eax, r13d
jg 0x18000acd0
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x18000acf0
mov eax, edi
lock xadd dword [rcx], eax
add eax, edi
cmp eax, r13d
jg 0x18000acf0
call fcn.1800d1434
mov eax, r12d
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.1800d12b0
mov rbx, qword [rsp + 0x500]
add rsp, 0x4d0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret