Function at 0x18001dc70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov dword [rbp + 0x67], 0
mov rbx, qword [rcx + 8]
cmp byte [rcx], 0
lea rcx, [rbp + 0xf]
je 0x18001dcb5
call fcn.18001f730
jmp 0x18001dcba
call fcn.18001f6e0
mov rdx, rax
mov rcx, rbx
call fcn.18001f4a0
mov r13, rax
mov qword [rsp + 0x20], r14
mov r9, rax
mov r8, rdi
mov rcx, r15
cmp byte [r15], 0
je 0x18001dced
lea rdx, [rbp - 9]
call fcn.18001e240
nop
mov ebx, 1
jmp 0x18001dcfb
lea rdx, [rbp - 0x21]
call fcn.18001e060
mov ebx, 2
mov rsi, qword [rax + 0x10]
xor edx, edx
mov qword [rax + 0x10], rdx
mov r12, qword [rax + 8]
mov qword [rax + 8], rdx
mov rdi, qword [rax]
mov qword [rax], rdx
mov qword [rbp + 0xf], rdi
mov qword [rbp + 0x17], r12
mov qword [rbp + 0x1f], rsi
or ebx, 4
test bl, 2
je 0x18001dd72
and ebx, 0xfffffffd
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x18001dd72
mov rdx, qword [rbp - 0x11]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dd5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e03b
call fcn.1800d95dc
xor edx, edx
mov qword [rbp - 0x21], rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
test bl, 1
je 0x18001ddbf
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x18001ddbf
mov rdx, qword [rbp + 7]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ddac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e041
call fcn.1800d95dc
xor edx, edx
mov qword [rbp - 9], rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
mov rax, qword [r15 + 8]
mov qword [rbp + 0x67], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rdx
sub r12, rdi
je 0x18001de15
movabs rax, 0x7fffffffffffffff
cmp r12, rax
ja 0x18001e047
mov rdx, r12
lea rcx, [rbp - 0x39]
call fcn.18000a780
mov r8, r12
mov rdx, rdi
mov rbx, qword [rbp - 0x39]
mov rcx, rbx
call fcn.18010b0a0
lea rax, [r12 + rbx]
mov qword [rbp - 0x31], rax
mov rax, qword [rbp + 0x67]
lea rdx, [rbp - 0x39]
mov rcx, rax
call fcn.18001f4a0
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [r15 + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x18001de66
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x18001df04
test rdi, rdi
je 0x18001de9f
sub rsi, rdi
cmp rsi, 0x1000
jb 0x18001de93
mov rcx, qword [rdi - 8]
sub rdi, rcx
add rsi, 0x27
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x18001e029
mov rdi, rcx
mov rdx, rsi
mov rcx, rdi
call fcn.1800d95dc
nop
mov rcx, qword [r14]
test rcx, rcx
je 0x18001dee7
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x18001ded7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001e035
mov rcx, r8
call fcn.1800d95dc
mov qword [r14], r12
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
xor eax, eax
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [r15 + 8]
mov r8, r13
lea rdx, [rbp - 0x39]
cmp byte [r15], r12b
je 0x18001df5c
mov r9d, 8
call fcn.18001f380
mov rcx, qword [rax]
mov rbx, qword [rcx]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x18001dfa8
mov rdx, qword [rbp - 0x29]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dfa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e02f
jmp 0x18001dfa2
mov r9d, 4
call fcn.18001f380
mov rcx, qword [rax]
movsxd rbx, dword [rcx]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x18001dfa8
mov rdx, qword [rbp - 0x29]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001dfa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e04d
call fcn.1800d95dc
nop
test rdi, rdi
je 0x18001dfdd
sub rsi, rdi
cmp rsi, 0x1000
jb 0x18001dfd1
add rsi, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x18001e029
mov rdi, rcx
mov rdx, rsi
mov rcx, rdi
call fcn.1800d95dc
nop
mov rcx, qword [r14]
test rcx, rcx
je 0x18001e021
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x18001e011
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x18001e035
mov rcx, r8
call fcn.1800d95dc
mov qword [r14], r12
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
mov rax, rbx
jmp 0x18001dee9
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.1800e5940
nop
call fcn.180008710
int3
call fcn.1800e5940
int3