Function at 0x180050520
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
lea eax, [rcx - 9]
mov r14, r8
mov dword [rsp + 0xb0], eax
mov r13, r9
mov r8, rdx
cmp ecx, eax
jbe case.0x18005059d.1
mov rsi, qword [rsp + 0x68]
lea edx, [rcx - 0x80]
mov rbp, qword [rsp + 0x68]
mov ecx, eax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov dword [rsp + 0x40], edx
xor r9d, r9d
lea r10, [0x180000000]
cmp edx, 0x24
ja case.default.0x18005059d
movzx eax, byte [r10 + rdx + 0x50978]
mov ecx, dword [r10 + rax*4 + 0x50954]
add rcx, r10
jmp rcx
mov qword [0x18009db28], r13
mov qword [r13 + 0x80], r14
jmp case.0x18005059d.8
mov r14, qword [rsp + 0x68]
mov r12d, 0x128
mov r15d, ILFindLastID
cmp r15d, 0xd
ja case.0x1800505db.2
mov eax, r15d
mov ecx, dword [r10 + rax*4 + 0x509a0]
add rcx, r10
jmp rcx
test r14, r14
jne 0x180050610
mov eax, 0xb8
cmp eax, 0xb8
je 0x1800505fb
cmp eax, 0x1fa0
je case.0x1800505db.1
jmp 0x180050604
test r13, r13
je 0x180050604
mov qword [r13], r9
add eax, 0x1ee8
cmp eax, 0x3dd0
jbe 0x1800505e7
test r13, r13
je case.0x1800505db.2
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [r13], rax
xor r9d, r9d
lea r10, [0x180000000]
jmp case.0x1800505db.2
test r13, r13
jne 0x180050637
mov rsi, r9
jmp case.0x1800505db.2
mov rax, qword [r13 + 8]
imul rax, qword [0]
movzx esi, byte [r13 + 1]
add rax, r13
add rsi, rax
jmp case.0x1800505db.2
mov edx, reloc.SHELL32.dll_PathMakeUniqueName
xor ecx, ecx
call sub.VCRUNTIME140.dll_strrchr
mov r14, rax
lea r10, [0x180000000]
xor r9d, r9d
jmp case.0x1800505db.2
test r13, r13
jne 0x180050676
mov rsi, r9
jmp case.0x1800505db.2
movzx esi, byte [r13 + 1]
add rsi, r13
inc r12d
inc r15d
cmp r12d, 0x12e
jb 0x1800505c3
mov qword [rsp + 0x68], r14
mov r14, qword [rsp + 0xc0]
mov qword [rsp + 0x60], rsi
jmp 0x180050907
mov byte [rsp + 0x60], 1
jmp case.0x18005059d.8
mov qword [rsp + 0x28], r9
lea r8, [0x180017900]
mov dword [rsp + 0x20], r9d
xor edx, edx
mov r9, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18005092f
xchg qword [0x18009db30], rax
jmp 0x180050907
mov edx, r9d
nop dword [rax + rax]
cmp edx, 0x12
ja case.0x180050706.1
mov eax, edx
mov ecx, dword [r10 + rax*4 + 0x509d8]
add rcx, r10
jmp rcx
test r14, r14
je 0x1800507ff
mov rax, qword [r14 + 8]
mov qword [rsp + 0x58], rax
jmp case.0x180050706.1
mov eax, 0xbf
cmp eax, 9
je 0x18005078f
cmp eax, 0xbf
je 0x180050741
add eax, 0x8350
cmp eax, 0x106a0
jbe 0x180050724
jmp 0x1800507df
mov ecx, 0x6c
mov eax, ecx
sub eax, 0x6c
je 0x180050762
sub eax, 1
je 0x180050782
cmp eax, 2
jne 0x18005076b
test r14, r14
je 0x18005076b
and byte [r14], 0xfd
jmp 0x18005076b
test r14, r14
je 0x18005077f
mov rdi, qword [r14 + 0x10]
inc ecx
cmp ecx, 0x6f
jb 0x180050746
mov rbx, rdi
mov rax, rdi
mov qword [rsp + 0x50], rbx
jmp 0x1800507e2
mov rdi, r9
mov rbx, rdi
mov rax, rdi
mov qword [rsp + 0x50], rbx
jmp 0x1800507e2
cmp dword [r14 + 8], 1
jne 0x1800507a0
mov dword [rsp + 0x50], 0xffffffff
jmp 0x1800507da
cmp dword [r14], 1
jle 0x1800507b0
mov dword [rsp + 0x50], 1
jmp 0x1800507da
mov rax, qword [r14 + 0x10]
mov ecx, dword [rax]
mov eax, dword [SHChangeNotifyRegister]
cmp ecx, eax
jbe 0x1800507cb
mov dword [rsp + 0x50], 1
jmp 0x1800507da
mov dword [rsp + 0x50], 0xffffffff
jb 0x1800507da
mov dword [rsp + 0x50], r9d
mov rbx, qword [rsp + 0x50]
mov rax, rbx
test rax, rax
sete byte [rsp + 0x58]
dec edx
lea eax, [rdx + 0x11f]
cmp eax, 0x119
ja 0x1800506f0
jmp case.0x180050706.11
mov qword [rsp + 0x58], r9
jmp case.0x180050706.11
mov qword [rsp + 0x28], r9
mov r8, r14
mov qword [rsp + 0x20], r9
xor edx, edx
xor r9d, r9d
mov ecx, 0x114
call fcn.180064610
mov edx, 0x6c
mov ecx, edx
sub ecx, 0x6c
je 0x180050843
sub ecx, 1
je 0x18005085f
cmp ecx, 2
jne 0x18005084c
test r14, r14
je 0x18005084c
and byte [r14], 0xfd
jmp 0x18005084c
test r14, r14
je 0x18005085d
mov rbp, qword [r14 + 0x10]
inc edx
cmp edx, 0x6f
jb 0x180050827
sub rax, rbp
mov qword [rsp + 0x58], rax
jmp case.0x180050706.11
xor ebp, ebp
sub rax, rbp
mov qword [rsp + 0x58], rax
jmp case.0x180050706.11
mov eax, dword [r14]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x48], eax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov r8, r13
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x27]
call fcn.18005f3f0
jmp 0x180050907
test r13, r13
je case.0x18005059d.8
movzx eax, byte [r14]
shl al, 6
xor al, byte [r13]
and al, 0x40
xor byte [r13], al
movzx ecx, byte [r13]
movzx eax, byte [r8]
and cl, 0x7f
shl al, 7
or cl, al
mov byte [r13], cl
jmp case.0x18005059d.8
mov r9, r13
mov r8, r14
xor edx, edx
mov ecx, 0xa4
call fcn.180050520
mov qword [rsp + 0x38], 0
lea rax, [r14 + 4]
mov qword [rsp + 0x30], 0
lea rdx, [r13 + 4]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0xfa
xor ecx, ecx
call fcn.18004e790
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0xb0]
dec edx
mov dword [rsp + 0x40], edx
lea eax, [rdx + 0x80]
cmp eax, ecx
jbe case.0x18005059d.1
mov r8, qword [rsp + 0xb8]
jmp 0x180050576
mov byte [rsp + 0x60], 0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret