Function at 0x1800ead48
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rbx, rcx
cmp edx, 1
jne 0x1800eb04b
and dword [rbp + 0x6f], 0
lea r9d, [rdx + 3]
lea r8d, [rdx + 0x3f]
mov rdx, rcx
lea rax, [rbp + 0x6f]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1800ead9e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
test rbx, rbx
je 0x1800eadd9
lea rax, [rbp + 0x6f]
mov r9d, 4
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x20], rax
mov rdx, rbx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1800eadd9
xor edx, edx
mov r8d, pe_nt_image_headers64
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
movabs rax, 0x800b1743fae65bb7
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x49], rax
movabs rax, 0x2f3b3d8560610e35
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x41], rax
movabs rax, 0xba04f85c16d9ceb4
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x39], rax
movabs rax, 0x80e47a5393f40d96
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x31], rax
movabs rax, 0x2295b7562cf09370
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x29], rax
movabs rax, 0x2c99a0cfb540fc0f
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x21], rax
movabs rax, 0xac74f0822af32fc7
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x19], rax
movabs rax, 0xa4d2f9ec6d5ecee6
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x11], rax
movabs rax, 0x4298c765a7d5c810
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 9], rax
movabs rax, 0xe0e4f05c4b6dc9b8
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 1], rax
movabs rax, 0x806f1722fa895bfb
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 7], rax
movabs rax, 0x2f6b3d8f60050e50
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0xf], rax
movabs rax, 0xba61f82816aaced5
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x17], rax
movabs rax, 0x80967a3593d40df2
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x1f], rax
movabs rax, 0x22c6b7762c9d931f
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x27], rax
movabs rax, 0x2cf0a0a3b539fc64
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x2f], rax
movabs rax, 0xac7ef0ac2a962fa9
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x37], rax
movabs rax, 0xa4a1f9896d2cceb6
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x3f], rax
movabs rax, 0x42f6c70aa7f5c863
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x47], rax
movabs rax, 0xe0e4f0174b22c998
mov qword [rbp + 0x7f], rax
mov rax, qword [rbp + 0x7f]
movdqa xmm0, xmmword [rbp - 0x49]
mov qword [rbp + 0x4f], rax
pxor xmm0, xmmword [rbp + 7]
lea rdx, [rbp - 0x49]
movdqa xmm1, xmmword [rbp - 0x39]
xor r9d, r9d
pxor xmm1, xmmword [rbp + 0x17]
xor r8d, r8d
movdqa xmmword [rbp - 0x49], xmm0
xor ecx, ecx
movdqa xmm0, xmmword [rbp - 0x29]
pxor xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [rbp - 9]
pxor xmm0, xmmword [rbp + 0x47]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [rbp - 0x19]
pxor xmm1, xmmword [rbp + 0x37]
movdqa xmmword [rbp - 9], xmm0
movdqa xmmword [rbp - 0x19], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
and qword [rsp + 0x28], 0
lea r8, [0x1800a1fe4]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
and qword [rsp + 0x28], 0
lea r8, [0x1800eaa04]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
and qword [rsp + 0x28], 0
lea r8, [0x1800bc710]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0xe0]
mov al, 1
add rsp, 0xd0
pop rbp
ret