Function at 0x14005a250
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor esi, esi
lea r14, [0x1401600a8]
movabs r15, 0xcccccccccccccccd
call fcn.1400667f0
movsxd rdi, eax
test eax, eax
je 0x14005a291
cmp edi, 1
je 0x14005a291
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1401600c0], 0x10
jb 0x14005a2e4
mov rbx, qword [0x1401600a8]
mov qword [0x1401600b8], 0x10
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.Searching_Memory
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x10], 0
jmp 0x14005a2fa
lea r9, str.Searching_Memory
xor r8d, r8d
lea edx, [r8 + 0x10]
mov rcx, r14
call fcn.1400576a0
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14015fdd0], rax
mov rcx, rdi
lea r10, [rbp + 0x3c]
test edi, edi
jns 0x14005a360
neg rcx
nop
dec r10
mov rax, r15
mul rcx
shr rdx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov rcx, rdx
test rdx, rdx
jne 0x14005a320
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14005a38b
dec r10
mov rax, r15
mul rcx
shr rdx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov rcx, rdx
test rdx, rdx
jne 0x14005a360
lea r9, [rbp - 9]
lea r8, [rbp + 0x3c]
mov rdx, r10
lea rcx, [rbp + 7]
call fcn.140056dd0
nop
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1401600c0]
cmp rax, 0xc
jb 0x14005a3ed
mov rbx, r14
cmp rax, 0x10
cmovae rbx, qword [0x1401600a8]
mov qword [0x1401600b8], 0xc
mov r8d, recv
lea rdx, str.Memory_Found
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xc], 0
jmp 0x14005a403
lea r9, str.Memory_Found
xor r8d, r8d
lea edx, [r8 + 0xc]
mov rcx, r14
call fcn.1400576a0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1401600c0]
cmp rax, 0xe
jb 0x14005a450
mov rbx, r14
cmp rax, 0x10
cmovae rbx, qword [0x1401600a8]
mov qword [0x1401600b8], 0xe
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Reading_Memory
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xe], 0
jmp 0x14005a466
lea r9, str.Reading_Memory
xor r8d, r8d
lea edx, [r8 + 0xe]
mov rcx, r14
call fcn.1400576a0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14015fdb0], 0
jne 0x14005a5d9
mov rax, qword [0x1401600c0]
cmp rax, 0x1c
jb 0x14005a4c0
mov rbx, r14
cmp rax, 0x10
cmovae rbx, qword [0x1401600a8]
mov qword [0x1401600b8], 0x1c
mov r8d, Ordinal_33
lea rdx, str.Bypass_Succesfull_to_Global.
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1c], 0
jmp 0x14005a4d6
lea r9, str.Bypass_Succesfull_to_Global.
xor r8d, r8d
lea edx, [r8 + 0x1c]
mov rcx, r14
call fcn.1400576a0
cmp dword [0x14015fdac], 0
jle 0x14005a5aa
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x29]
call fcn.140063790
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], reloc.WS2_32.dll_send
mov qword [rbp - 0x11], Ordinal_33
movups xmm0, xmmword [str.Bypass_Done_Global_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400f9798]
mov word [rax + 0x10], cx
movzx ecx, byte [reloc.WLDAP32.dll_Ordinal_33]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
mov rax, qword [0x1401604e8]
cmp rax, qword [0x1401604f0]
je 0x14005a555
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.1400583a0
add qword [0x1401604e8], 0x20
jmp 0x14005a569
lea r8, [rbp - 0x29]
mov rdx, rax
lea rcx, [0x1401604e0]
call fcn.140057270
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14005a5a4
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a59f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005aa97
call fcn.1400c911c
mov dword [0x14015fdac], esi
cmp byte [0x140160308], 0
jne 0x14005a5d9
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14005ab40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x14015fdb0], 1
jne 0x14005a735
mov rax, qword [0x1401600c0]
cmp rax, 0x1c
jb 0x14005a628
mov rbx, r14
cmp rax, 0x10
cmovae rbx, qword [0x1401600a8]
mov qword [0x1401600b8], 0x1c
mov r8d, Ordinal_33
lea rdx, str.Bypass_Succesfull_to_Vietnam
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1c], 0
jmp 0x14005a63e
lea r9, str.Bypass_Succesfull_to_Vietnam
xor r8d, r8d
lea edx, [r8 + 0x1c]
mov rcx, r14
call fcn.1400576a0
cmp dword [0x14015fdac], 0
jle 0x14005a706
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x29]
call fcn.140063790
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], reloc.WS2_32.dll_sendto
mov qword [rbp - 0x11], Ordinal_33
movups xmm0, xmmword [str.Bypass_Done_Vietnam_]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400f97d0]
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], 0
mov rax, qword [0x1401604e8]
cmp rax, qword [0x1401604f0]
je 0x14005a6b1
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.1400583a0
add qword [0x1401604e8], 0x20
jmp 0x14005a6c5
lea r8, [rbp - 0x29]
mov rdx, rax
lea rcx, [0x1401604e0]
call fcn.140057270
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14005a700
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a6fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005aa97
call fcn.1400c911c
mov dword [0x14015fdac], esi
cmp byte [0x140160308], 0
jne 0x14005a735
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14005ab40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x14015fdb0], 2
jne 0x14005a891
mov rax, qword [0x1401600c0]
cmp rax, 0x1b
jb 0x14005a784
mov rbx, r14
cmp rax, 0x10
cmovae rbx, qword [0x1401600a8]
mov qword [0x1401600b8], 0x1b
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str.Bypass_Succesfull_to_Taiwan
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1b], 0
jmp 0x14005a79a
lea r9, str.Bypass_Succesfull_to_Taiwan
xor r8d, r8d
lea edx, [r8 + 0x1b]
mov rcx, r14
call fcn.1400576a0
cmp dword [0x14015fdac], 0
jle 0x14005a862
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x29]
call fcn.140063790
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], reloc.WS2_32.dll_sendto
mov qword [rbp - 0x11], Ordinal_33
movups xmm0, xmmword [str.Bypass_Done_Vietnam_]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400f97d0]
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], 0
mov rax, qword [0x1401604e8]
cmp rax, qword [0x1401604f0]
je 0x14005a80d
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.1400583a0
add qword [0x1401604e8], 0x20
jmp 0x14005a821
lea r8, [rbp - 0x29]
mov rdx, rax
lea rcx, [0x1401604e0]
call fcn.140057270
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14005a85c
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a857
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005aa97
call fcn.1400c911c
mov dword [0x14015fdac], esi
cmp byte [0x140160308], 0
jne 0x14005a891
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14005ab40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x14015fdb0], 3
jne 0x14005a9ef
mov rax, qword [0x1401600c0]
cmp rax, 0x1a
jb 0x14005a8e0
mov rbx, r14
cmp rax, 0x10
cmovae rbx, qword [0x1401600a8]
mov qword [0x1401600b8], 0x1a
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.Bypass_Succesfull_to_India
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1a], 0
jmp 0x14005a8f6
lea r9, str.Bypass_Succesfull_to_India
xor r8d, r8d
lea edx, [r8 + 0x1a]
mov rcx, r14
call fcn.1400576a0
cmp dword [0x14015fdac], 0
jle 0x14005a9c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x29]
call fcn.140063790
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], reloc.WS2_32.dll_select
mov qword [rbp - 0x11], Ordinal_33
movups xmm0, xmmword [str.Bypass_Done_India_]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400f9828]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
mov rax, qword [0x1401604e8]
cmp rax, qword [0x1401604f0]
je 0x14005a96b
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.1400583a0
add qword [0x1401604e8], 0x20
jmp 0x14005a97f
lea r8, [rbp - 0x29]
mov rdx, rax
lea rcx, [0x1401604e0]
call fcn.140057270
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14005a9ba
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a9b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005aa97
call fcn.1400c911c
mov dword [0x14015fdac], esi
cmp byte [0x140160308], 0
jne 0x14005a9ef
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14005ab40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], rsi
mov r8d, Ordinal_33
lea rdx, str.sc_stop_Void__sc_delete_Void
lea rcx, [rbp - 0x29]
call fcn.140057130
lea rcx, [rbp - 0x29]
call fcn.1400653a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], rsi
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.del__F_C:Void.sys
lea rcx, [rbp - 0x29]
call fcn.140057130
lea rcx, [rbp - 0x29]
call fcn.1400653a0
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14005a291
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005aa8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005aa9e
call fcn.1400c911c
jmp 0x14005a291
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3