Function at 0x18000c680
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180068040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
cmp edx, 1
jne 0x18000c9b3
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
mov qword [rsp + 0x30], 0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, dword [0x1800e1148]
mov rdi, rax
mov rax, qword gs:[0x58]
mov edx, 4
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x1800e1a3c], eax
jle 0x18000c72f
lea rcx, [0x1800e1a3c]
call fcn.18005586c
cmp dword [0x1800e1a3c], 0xffffffff
jne 0x18000c72f
lea rcx, [0x180056f10]
mov word [0x1800e1a1d], 0x12b
mov byte [0x1800e1a1c], 0x1e
call fcn.180055c78
lea rcx, [0x1800e1a3c]
call fcn.180055800
cmp byte [0x1800e1a1e], 0
je 0x18000c74d
xor byte [0x1800e1a1c], 0x69
xor byte [0x1800e1a1d], 0x2b
mov byte [0x1800e1a1e], 0
mov eax, dword [rbx]
cmp dword [0x1800e1a14], eax
jle 0x18000c7a7
lea rcx, [0x1800e1a14]
call fcn.18005586c
cmp dword [0x1800e1a14], 0xffffffff
jne 0x18000c7a7
lea rcx, [0x180056f20]
mov word [0x1800e1a37], 0x19c
mov dword [0x1800e1a30], 0x7c55642a
mov word [0x1800e1a34], 0x2201
mov byte [0x1800e1a36], 0x9e
call fcn.180055c78
lea rcx, [0x1800e1a14]
call fcn.180055800
cmp byte [0x1800e1a38], 0
je 0x18000c7ef
xor byte [0x1800e1a30], 0x69
xor byte [0x1800e1a31], 0x2b
xor byte [0x1800e1a32], 0x1b
xor byte [0x1800e1a33], 0x33
xor byte [0x1800e1a34], 0x54
xor byte [0x1800e1a35], 0x76
xor byte [0x1800e1a36], 0xba
xor byte [0x1800e1a37], 0x9c
mov byte [0x1800e1a38], 0
mov r9, rdi
lea r8, [0x1800e1a1c]
lea rdx, [0x1800e1a30]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
cmp qword [rsp + 0x30], 0
je 0x18000c9d5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, rax
mov eax, dword [rbx]
cmp dword [0x1800e1a18], eax
jle 0x18000c86c
lea rcx, [0x1800e1a18]
call fcn.18005586c
cmp dword [0x1800e1a18], 0xffffffff
jne 0x18000c86c
lea rcx, [0x180056ef0]
mov word [0x1800e1a45], 0x12b
mov byte [0x1800e1a44], 0x1e
call fcn.180055c78
lea rcx, [0x1800e1a18]
call fcn.180055800
cmp byte [0x1800e1a46], 0
je 0x18000c88a
xor byte [0x1800e1a44], 0x69
xor byte [0x1800e1a45], 0x2b
mov byte [0x1800e1a46], 0
mov eax, dword [rbx]
cmp dword [0x1800e1a40], eax
jle 0x18000c8e4
lea rcx, [0x1800e1a40]
call fcn.18005586c
cmp dword [0x1800e1a40], 0xffffffff
jne 0x18000c8e4
lea rcx, [0x180056f00]
mov word [0x1800e1a27], 0x19c
mov dword [0x1800e1a20], 0x7c55642a
mov word [0x1800e1a24], 0x2201
mov byte [0x1800e1a26], 0x9e
call fcn.180055c78
lea rcx, [0x1800e1a40]
call fcn.180055800
cmp byte [0x1800e1a28], 0
je 0x18000c92c
xor byte [0x1800e1a20], 0x69
xor byte [0x1800e1a21], 0x2b
xor byte [0x1800e1a22], 0x1b
xor byte [0x1800e1a23], 0x33
xor byte [0x1800e1a24], 0x54
xor byte [0x1800e1a25], 0x76
xor byte [0x1800e1a26], 0xba
xor byte [0x1800e1a27], 0x9c
mov byte [0x1800e1a28], 0
mov r9, rdi
lea r8, [0x1800e1a44]
lea rdx, [0x1800e1a20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
cmp qword [rsp + 0x30], 0
je 0x18000c9d5
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x18000c980
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetSystemMenu]
test rax, rax
je 0x18000c980
xor r8d, r8d
mov edx, 0xf060
mov rcx, rax
call qword [sym.imp.USER32.dll_DeleteMenu]
mov qword [rsp + 0x28], 0
lea r8, [0x18000c520]
mov r9, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18000c9b3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800557e0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
xor eax, eax
jmp 0x18000c9b8