Function at 0x180061fc0
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov rax, qword [0x180080a28]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov r13, qword [rbp + 0xc0]
mov rsi, rcx
mov ecx, dword [rbp + 0xc8]
mov r14, r9
imul eax, ecx, 0x32a
mov r10, r8
mov qword [rsp + 0x78], r9
mov r12, rdx
mov r9, qword [rsp + 0x78]
mov r15d, ecx
mov qword [rbp - 0x78], r8
mov qword [rsp + 0x68], r9
mov dword [rsp + 0x60], eax
mov edi, dword [rsp + 0x60]
mov ebx, dword [rsp + 0x60]
cmp ecx, eax
ja 0x18006259f
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x74], eax
lea r11, [0x180082190]
lea r8, str.GcGcGCm
lea rdx, str.SELP_u32rr
cmp r15d, 0x3bf1
ja 0x1800623d2
je 0x180062363
cmp r15d, 0x110
ja 0x1800621f2
je 0x1800621d4
mov eax, r15d
sub eax, 0x50
je 0x1800621c8
sub eax, 0xac
je 0x18006219d
cmp eax, 0x11
jne 0x1800620e5
test r10, r10
jne 0x1800620e5
xor ecx, ecx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdx
mov dword [rbp - 0x70], ecx
mov qword [rsp + 0x38], rcx
lea rdx, [0x180077149]
mov qword [rsp + 0x30], rcx
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
call fcn.18002b8a0
mov r9, qword [rsp + 0x68]
mov ecx, dword [rbp + 0xc8]
mov r10, qword [rbp - 0x78]
imul eax, ecx, 0x36
add r15d, eax
cmp r15d, dword [rsp + 0x60]
jbe 0x180062038
mov r14d, dword [rsp + 0x74]
imul r13d, ecx, 0xab0
mov r15d, ecx
cmp ecx, r13d
ja 0x1800628c5
mov r12, qword [rsp + 0x78]
nop word [rax + rax]
cmp r15d, 0xb6c0
ja 0x180062723
je 0x1800628c5
cmp r15d, 0x117
ja 0x18006268d
je 0x18006263c
mov eax, r15d
sub eax, 0x50
je 0x180062608
sub eax, 0xac
je 0x1800628c5
sub eax, 0x11
je 0x1800625ae
cmp eax, 3
jne 0x18006289b
mov eax, edi
xor r9d, r9d
cdq
mov r8d, SHSetFolderPathA
xor eax, edx
mov rcx, rsi
sub eax, edx
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], eax
call fcn.180057a00
mov dword [rsp + 0x70], 1
jmp 0x180062895
test rsi, rsi
jne 0x1800620e5
xor ecx, ecx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r8
mov dword [rbp - 0x68], ecx
jmp 0x1800620b1
mov qword [0x180080b08], rsi
jmp 0x1800620e5
xor ecx, ecx
lea r8, [rbp - 0x60]
mov dword [rbp - 0x60], ecx
mov rdx, rsi
mov ecx, 0x125
call fcn.180033910
mov rdi, rax
jmp 0x1800620da
cmp r15d, 0x117
je 0x18006234a
cmp r15d, 0x3624
je 0x1800622a8
cmp r15d, 0x39cb
jne 0x1800620e5
test r14, r14
jne 0x180062276
xor ecx, ecx
lea rax, str.IV_NEON_VPD
mov qword [rsp + 0x58], rcx
lea rdx, [0x180077149]
mov qword [rsp + 0x50], rcx
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x48], rcx
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov dword [rbp - 0x58], ecx
call fcn.18002b8a0
mov r9, qword [rsp + 0x68]
mov ecx, dword [rbp + 0xc8]
test r12, r12
jne 0x1800620e5
xor ecx, ecx
lea rax, str.LD1Onev2d_POST
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x50]
mov dword [rbp - 0x50], ecx
jmp 0x1800620b1
test r13, r13
jne 0x180062309
xor ecx, ecx
lea rax, str.m_stopCount
mov qword [rsp + 0x58], rcx
lea rdx, [0x180077149]
mov qword [rsp + 0x50], rcx
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x48], rcx
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov dword [rbp - 0x48], ecx
call fcn.18002b8a0
mov r9, qword [rsp + 0x68]
mov ecx, dword [rbp + 0xc8]
mov r10, qword [rbp - 0x78]
cmp dword [r10], 3
jne 0x180062328
cmp byte [rsi], 1
jne 0x180062328
cmp byte [rsi + 1], 1
jne 0x180062328
movzx eax, byte [rsi + 2]
dec al
cmp al, 0xfd
ja 0x1800620e5
mov eax, 0x87
nop dword [rax]
cmp eax, 0x87
je 0x180062595
add eax, 0x57
cmp eax, 0xde
jb 0x180062330
jmp 0x1800620e5
xorps xmm0, xmm0
mov edx, 0x40
mov rcx, rsi
movups xmmword [rbp - 0x38], xmm0
call fcn.1800555c0
jmp 0x1800620da
xorps xmm0, xmm0
mov r14b, 0x61
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
nop word [rax + rax]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
cmp rdx, rcx
jae 0x1800623ac
lea rax, [rdx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rcx, 0x10
jb 0x1800623a1
mov rax, qword [rsi]
mov byte [rax + rdx], r14b
mov byte [rax + rdx + 1], 0
jmp 0x1800623bf
xor r8d, r8d
movzx r9d, r14b
mov rcx, rsi
lea edx, [r8 + 1]
call fcn.180002d90
inc r14b
cmp r14b, 0x7a
jbe 0x180062380
mov r14, qword [rsp + 0x78]
jmp 0x1800620da
cmp r15d, 0xab47
ja 0x1800624c0
je 0x180062455
cmp r15d, 0x6b4c
je 0x18006243b
cmp r15d, 0x7289
je 0x180062414
cmp r15d, 0x76cb
jne 0x1800620e5
mov dword [rbp - 0x10], 0x30
mov dword [rsp + 0x74], 0
jmp 0x1800620e5
mov eax, dword [rsi]
lea r8, [rbp - 0x40]
xor r9d, r9d
mov dword [rbp - 0x40], eax
xor ecx, ecx
lea edx, [r9 + 0x3a]
call fcn.180022220
mov rbx, rax
test eax, eax
jne 0x1800628c9
jmp 0x1800620da
xor eax, eax
mov dword [rsp + 0x70], 0
cmp byte [rsi + 2], 0xff
sete al
mov dword [r13], eax
jmp 0x1800620e5
movsxd rax, dword [rsi]
shl rax, 7
mov eax, dword [rax + r11 + 0xc]
cmp dword [r12], eax
jae 0x1800624a8
mov ecx, 0x22
nop dword [rax]
mov eax, ecx
sub eax, 0x22
je 0x180062491
sub eax, 1
je 0x180062487
cmp eax, 1
je 0x1800628c5
jmp 0x1800624a1
mov dword [rsp + 0x70], 6
jmp 0x1800624a1
movsxd rax, dword [rsi]
shl rax, 7
mov eax, dword [rax + r11 + 0xc]
mov dword [r12], eax
inc ecx
cmp ecx, 0x25
jb 0x180062470
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rax
mov qword [rsp + 0x68], rax
jmp 0x1800620df
cmp r15d, 0xe405
je 0x180062532
cmp r15d, 0x11cc3
je 0x1800624f4
cmp r15d, 0x15581
jne 0x1800620e5
movsxd rax, dword [rsi]
shl rax, 7
mov eax, dword [rax + r11 + 0xc]
mov dword [r12], eax
jmp 0x1800620e5
movsxd rax, dword [rsi]
mov rdx, r10
mov r8d, dword [r13]
mov rcx, r9
shl rax, 7
call qword [rax + r11 + 0x60]
mov ebx, eax
test eax, eax
jne 0x18006257f
movsxd rax, dword [rsi]
lea r8, [0x180082190]
mov rcx, qword [rsp + 0x68]
mov rdx, r14
shl rax, 7
call qword [rax + r8 + 0x68]
mov ebx, eax
jmp 0x1800620da
test r9, r9
jne 0x180062566
mov ecx, 0xb4
nop dword [rax]
mov eax, ecx
sub eax, 0xb4
je 0x180062554
cmp eax, 1
je 0x1800628c5
jmp 0x18006255c
mov dword [rsp + 0x70], ILFindLastID
inc ecx
cmp ecx, 0xb6
jb 0x180062540
movsxd rax, dword [rsi]
mov rcx, r9
shl rax, 7
call qword [rax + r11 + 0x58]
mov ebx, eax
test eax, eax
je 0x1800620da
mov ecx, dword [rbp + 0xc8]
mov r9, qword [rsp + 0x68]
mov r15d, 0x15581
jmp 0x1800620e5
mov eax, reloc.SHELL32.dll_ILFindLastID
jmp 0x1800628c9
mov r14d, dword [rsp + 0x60]
mov dword [rsp + 0x74], r14d
jmp 0x1800620ff
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], r9
xor r8d, r8d
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], 0
xor ecx, ecx
mov dword [rsp + 0x20], 0x1e8
mov qword [rsp + 0x78], 8
call fcn.180033a80
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180062895
mov qword [rsp + 0x28], 0
lea r8, [0x180022d90]
mov r9, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rsi + 0x80], r10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
jmp 0x180062895
mov r14b, 0x41
nop
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x18006266c
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x180062661
mov rax, qword [rsi]
mov byte [rax + rcx], r14b
mov byte [rax + rcx + 1], 0
jmp 0x18006267f
xor r8d, r8d
movzx r9d, r14b
mov rcx, rsi
lea edx, [r8 + 1]
call fcn.180002d90
inc r14b
cmp r14b, 0x5a
jbe 0x180062640
jmp 0x18006288d
cmp r15d, 0x35c0
je 0x1800626b9
cmp r15d, 0x6b30
je 0x1800628c0
cmp r15d, 0xb4bc
jne 0x18006289b
mov dword [rsp + 0x70], ebx
jmp 0x18006289b
test r12, r12
jne 0x180062714
mov r14d, 0x1d
mov eax, r14d
sub eax, 0x1d
je 0x1800626f1
sub eax, 0x64
je 0x1800626dc
cmp eax, 0x64
je 0x1800628c5
jmp 0x180062701
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_EqualPrefixSid]
mov byte [rsp + 0x70], 0
jmp 0x180062701
xor eax, eax
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], eax
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x38], eax
add r14d, 0x64
cmp r14d, 0x149
jb 0x1800626c4
mov ecx, dword [rbp + 0xc8]
mov rax, r12
xchg qword [0x180080b10], rax
jmp 0x18006289b
cmp r15d, 0x2302e
ja 0x180062808
je 0x1800627b4
cmp r15d, 0xbb74
je 0x18006289b
cmp r15d, 0x1686b
je 0x1800628c5
cmp r15d, 0x175d1
jne 0x18006289b
mov r14b, 0x30
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x18006278c
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x180062781
mov rax, qword [rsi]
mov byte [rax + rcx], r14b
mov byte [rax + rcx + 1], 0
jmp 0x18006279f
xor r8d, r8d
movzx r9d, r14b
mov rcx, rsi
lea edx, [r8 + 1]
call fcn.180002d90
inc r14b
cmp r14b, 0x39
jbe 0x180062760
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
jmp 0x180062895
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x1800627dd
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x1800627d5
mov rax, qword [rsi]
mov word [rax + rcx], 0x2d
jmp 0x1800627ef
xor r8d, r8d
mov r9b, 0x2d
mov rcx, rsi
lea edx, [r8 + 1]
call fcn.180002d90
lea r9, [rbp - 0x80]
mov r8d, r14d
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x38]
call sub.ADVAPI32.dll_LsaOpenPolicy
jmp 0x180062895
cmp r15d, 0x2ea8b
je 0x18006287f
cmp r15d, 0x3a4e8
je 0x180062860
cmp r15d, 0x45f45
jne 0x18006289b
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x18006284c
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x180062844
mov rax, qword [rsi]
mov word [rax + rcx], 0x5f
jmp 0x180062895
xor r8d, r8d
mov r9b, 0x5f
mov rcx, rsi
lea edx, [r8 + 1]
call fcn.180002d90
jmp 0x180062895
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x28]
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x38]
call sub.ADVAPI32.dll_LsaSetForestTrustInformation
jmp 0x180062895
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180062895
call sub.ADVAPI32.dll_LsaClose
mov qword [rbp - 0x80], 0
mov ecx, dword [rbp + 0xc8]
imul eax, ecx, 0xab
add r15d, eax
cmp r15d, r13d
ja 0x1800628c5
mov r9, qword [rsp + 0x68]
mov r10, qword [rbp - 0x78]
mov r14d, dword [rsp + 0x74]
jmp 0x180062120
mov byte [rsp + 0x70], 1
mov eax, dword [rsp + 0x70]
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.180072740
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret