Function at 0x18002fcd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
lea eax, [r8 + 0xa]
mov r13, r9
mov dword [rsp + 0x6c], eax
mov r12d, r8d
mov rbp, rdx
mov r15, rcx
cmp r8d, eax
jae case.0x18002fd3d.199
mov r14, qword [rsp + 0x70]
lea r8, [0x180000000]
mov edi, dword [rsp + 0xf0]
xor edx, edx
lea eax, [r12 - 0xc1]
cmp eax, 0xc
ja case.0x18002fd3d.200
mov ecx, dword [r8 + rax*4 + 0x30150]
add rcx, r8
jmp rcx
movzx eax, word [r14 + 2]
test ax, ax
je 0x18003012e
lea rcx, [rax*8]
shl rax, 4
mov qword [rsp + 0x88], rax
add rax, rcx
mov qword [rsp + 0x78], rcx
cmp qword [r15], rax
jae case.0x18002fd3d.200
mov eax, 0x70004
jmp 0x180030103
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x60]
xor edx, edx
mov r9d, 0x2e
xor ecx, ecx
call fcn.18002b910
mov word [r14 + 2], ax
xor edx, edx
jmp 0x1800300e7
mov qword [rsp + 0x28], rdx
lea r8, [0x1800168a0]
mov dword [rsp + 0x20], edx
mov r9, r13
mov qword [0x180059258], r13
xor edx, edx
xor ecx, ecx
mov qword [r13 + 0x80], rbp
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180030124
xchg qword [0x180059260], rax
xor edx, edx
jmp 0x1800300e7
mov ebx, dword [rsp + 0x68]
test ebx, ebx
je 0x18003012e
lea ecx, [rbx + 4]
cmp rcx, qword [r15]
ja 0x18002fd72
lea rax, [rbx + rbp]
mov qword [rsp + 0x20], rdx
xor edx, edx
mov qword [rsp + 0x60], rax
mov r9d, 0x2e
lea r8, [rsp + 0x60]
xor ecx, ecx
call fcn.18002b910
mov word [r14], ax
xor edx, edx
jmp 0x1800300e7
mov byte [rsp + 0xf0], 1
jmp case.0x18002fd3d.200
mov eax, dword [r13 + 0xc]
lea r14, [r13 + 0xa8]
mov dword [rsp + 0x68], eax
jmp case.0x18002fd3d.200
mov dword [rsp + 0xf0], edx
jmp case.0x18002fd3d.200
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x80]
mov r8d, 0x4c
mov qword [rsp + 0x80], rax
mov rdx, r13
call fcn.180025620
mov qword [r14 + 8], rax
test rax, rax
je 0x180030146
mov rax, qword [rsp + 0x88]
lea rcx, [rsp + 0x90]
mov r8d, 0x4c
mov qword [rsp + 0x90], rax
mov rdx, r13
call fcn.180025620
xor edx, edx
mov qword [r14 + 0x10], rax
test rax, rax
je 0x180030132
movzx eax, word [r14 + 2]
movzx esi, dx
cmp dx, ax
jae 0x18002ff4a
nop dword [rax + rax]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x60]
xor edx, edx
mov r9d, 0x2e
xor ecx, ecx
call fcn.18002b910
movzx ecx, si
lea r8, [rsp + 0x60]
xor edx, edx
lea rbx, [rcx*8]
mov rcx, qword [r14 + 8]
mov word [rbx + rcx], ax
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x2e]
call fcn.18002b910
mov rcx, qword [r14 + 8]
lea r8, [rsp + 0x60]
xor edx, edx
xor r9d, r9d
mov word [rcx + rbx + 2], ax
lea ecx, [rdx + 0x44]
call fcn.180027b80
mov rcx, qword [r14 + 8]
inc si
mov edx, 0
mov dword [rcx + rbx + 4], eax
movzx eax, word [r14 + 2]
cmp si, ax
jb 0x18002fed0
movzx esi, dx
cmp dx, ax
jae 0x1800300e7
nop word [rax + rax]
mov ebx, 0x81
nop word [rax + rax]
cmp ebx, 0x81
je 0x1800300a6
cmp ebx, 0x28d1
je 0x18003009a
cmp ebx, 0x5121
je 0x180030071
cmp ebx, 0x7971
je 0x18002ffb3
cmp ebx, 0xa1c1
jne 0x1800300c2
mov r12d, 0xc5
jmp 0x1800300c2
movzx r8d, si
shl r8, 4
add r8, qword [r14 + 0x10]
movzx eax, word [r8]
test ax, ax
je 0x180030035
cmp ax, 4
jne 0x18003006a
mov rax, qword [r15]
lea ecx, [rdi + 2]
mov qword [rsp + 0xa0], rax
xor r9d, r9d
lea rax, [rsp + 0x98]
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x50], rax
xor ecx, ecx
mov qword [rsp + 0x48], r8
xor r8d, r8d
mov dword [rsp + 0x40], 0x11b
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0xa0]
call fcn.1800339b0
mov ebx, 0x7971
jmp 0x1800300c2
mov rax, qword [r15]
lea ecx, [rdi + 2]
mov qword [rsp + 0xa8], rcx
lea r9, [rsp + 0xa8]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
mov rdx, r13
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x20], 0x10a
call fcn.18003b290
mov ebx, 0x7971
jmp 0x1800300c2
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x60]
xor edx, edx
mov r9d, 0x2e
xor ecx, ecx
call fcn.18002b910
mov rcx, qword [r14 + 0x10]
movzx edx, si
add rdx, rdx
mov word [rcx + rdx*8], ax
jmp 0x1800300c2
mov eax, edi
add rax, rbp
mov qword [rsp + 0x60], rax
jmp 0x1800300c2
mov rax, qword [r14 + 8]
mov edi, dword [rsp + 0x68]
movzx ecx, si
mov ecx, dword [rax + rcx*8 + 4]
add edi, ecx
mov eax, edi
cmp qword [r15], rax
jbe 0x18002fd72
add ebx, 0x2850
mov edx, 0
cmp ebx, 0xc990
jbe 0x18002ff70
inc si
cmp si, word [r14 + 2]
jb 0x18002ff60
lea r8, [0x180000000]
inc r12d
cmp r12d, dword [rsp + 0x6c]
jb 0x18002fd21
mov eax, dword [rsp + 0xf0]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov byte [rsp + 0xf0], 0
jmp case.0x18002fd3d.199
mov eax, edx
jmp 0x180030103
mov r9, r13
mov qword [r14 + 8], rax
xor r8d, r8d
mov ecx, SHTestTokenMembership
call fcn.180040cc0
mov eax, 0x70001
jmp 0x180030103