Function at 0x18003a440
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
lea ebx, [r8 + 0x2ec]
mov edi, r8d
mov dword [rbp + 0x1e0], ebx
mov r14, rdx
mov rsi, rcx
cmp r8d, ebx
jae 0x18003a79a
mov ebx, dword [rbp + 0x1e0]
movzx r15d, byte [rbp + 0x1e0]
mov r12d, dword [rbp + 0x1e0]
mov r13, qword [rbp + 0x1e8]
mov eax, dword [rbp + 0x1e0]
cmp edi, 0x136
ja 0x18003a5bb
je 0x18003a59c
mov eax, edi
sub eax, 0x26
je 0x18003a56f
sub eax, 0x44
je 0x18003a550
sub eax, 0x44
je 0x18003a50e
sub eax, 0x44
je 0x18003a501
cmp eax, 0x1e
jne 0x18003a780
mov r9, r14
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x44]
mov ecx, 0xd5
call fcn.18004f750
mov r12d, eax
cmp eax, 0xffffffff
je 0x18003a7bb
jmp 0x18003a780
mov dword [rsp + 0x40], 0
jmp 0x18003a780
mov qword [rsp + 0x28], 0
lea r8, [0x1800239b0]
mov r9, r14
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14], rax
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18003a542
jmp 0x18003a780
movzx eax, word [0x180082ca8]
mov r15b, 1
mov word [rsp + 0x3a], ax
movzx eax, byte [0x180082caa]
mov byte [rsp + 0x3c], al
jmp 0x18003a780
movzx eax, word [0x180082ce0]
mov word [rsp + 0x30], ax
movzx eax, word [0x180082ce4]
mov dword [rsp + 0x34], 0x45676e
mov word [rsp + 0x32], ax
mov dword [rsp + 0x37], 0x6f636e
jmp 0x18003a780
cmp qword [r14], 0
je 0x18003a793
mov qword [rsp + 0x78], 0
lea r13, [0x180052897]
jmp 0x18003a786
mov eax, edi
sub eax, 0x154
je 0x18003a676
sub eax, 0x26
je 0x18003a608
sub eax, 0x1e
je 0x18003a79a
sub eax, 0x26
je 0x18003a5e9
cmp eax, 0x44
je 0x18003a79a
jmp 0x18003a780
mov r8, r13
lea rdx, str.RegisterMediaTypes__p_n
lea rcx, [rbp - 0x70]
call fcn.180052790
mov byte [rbp + 0x1e8], 1
jmp 0x18003a780
lea r9, [rsp + 0x78]
mov edx, ebx
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov byte [r14 + 0xc], 1
test eax, eax
je 0x18003a62f
xor r15b, r15b
jmp 0x18003a780
test r15b, r15b
je 0x18003a780
lea r8, [rbp - 0x80]
mov qword [rbp - 0x80], 0
mov edx, ebx
lea rcx, [rsp + 0x30]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18003a65f
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x18003a780
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18003a780
mov eax, dword [rsp + 0x44]
test eax, eax
jne 0x18003a6a9
mov eax, dword [rsp + 0x68]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x48], eax
mov rdx, rsi
mov qword [rsp + 0x20], 0
mov ecx, 0xae
call fcn.180019dc0
jmp 0x18003a779
cmp eax, 2
jne 0x18003a6e2
cmp dword [rsi + 4], 0
jne 0x18003a6d3
mov eax, dword [rsp + 0x68]
lea r8, [rsp + 0x50]
mov r9, qword [rsp + 0x70]
mov rdx, rsi
mov ecx, 0x2e
mov dword [rsp + 0x50], eax
call fcn.18001b7b0
mov rcx, qword [rsp + 0x70]
call fcn.18005932c
jmp 0x18003a779
cmp eax, 1
jne 0x18003a752
cmp qword [rsi + 0x28], 0
jne 0x18003a746
mov rcx, qword [rsp + 0x68]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18003a700
inc rax
lea r8, [rbp - 0x78]
mov edx, 0xb9
mov qword [rbp - 0x78], rax
xor ecx, ecx
call fcn.1800372a0
mov rdx, qword [rsp + 0x68]
mov qword [rsi + 0x28], rax
nop dword [rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x18003a730
mov eax, dword [rsi]
mov dword [rsi + 4], eax
mov rcx, qword [rsp + 0x68]
call fcn.18005932c
jmp 0x18003a779
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
lea r8, [0x180081054]
mov dword [rsp + 0x60], eax
lea rdx, [rsp + 0x60]
mov ecx, 0xe4
call fcn.1800188a0
mov dword [rbp + 0x1e8], r12d
mov eax, dword [rbp + 0x1e0]
add edi, 0x44
cmp edi, eax
jb 0x18003a4a0
jmp 0x18003a79a
mov byte [rbp + 0x1e8], 0
mov eax, dword [rbp + 0x1e8]
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, 0xfffffffe
lea rdx, [0x180081054]
lea rcx, str.Error_in_call_to_upack
call fcn.180037360
int3