Function at 0x18005e838
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x170
lea rbp, [rsp + 0x40]
mov qword [rsp], rax
mov rax, 0x16c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x18005e850
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x128], rsi
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x140], rcx
mov qword [rbp + 0x148], rdx
mov qword [rbp + 0x150], r8
mov qword [rbp + 0x158], r9
mov qword [rbp + 0x50], 0
mov dword [rbp + 8], 0
mov dword [rbp + 0x14], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov qword [rbp + 0xe0], rcx
mov ecx, eax
mov rax, qword [rbp + 0xe0]
call rax
mov dword [rbp + 0x28], eax
mov rax, qword [rbp + 0x140]
mov rdx, qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rcx, rax
call rdx
mov dword [rbp + 0x2c], eax
mov eax, dword [rbp + 0x2c]
lea rdx, [rbp + 0x14]
mov rcx, qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov qword [rbp + 0xe8], rcx
mov ecx, eax
mov rax, qword [rbp + 0xe8]
call rax
mov dword [rbp + 0x30], eax
mov eax, dword [rbp + 8]
mov edx, dword [rbp + 0x14]
cmp eax, edx
je 0x18005ecb2
mov qword [rbp + 0x58], 0
mov byte [rbp + 0x20], 0
call fcn.180010939
mov dword [rbp + 0x34], eax
mov eax, dword [rbp + 0x34]
and eax, 0xffff0000
cmp eax, 0x6000000
ja 0x18005ea3a
lea rax, [0x1801050d6]
mov rdx, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
call rdx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
lea rdx, [0x1801050e3]
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xf0], rcx
mov rcx, rax
mov rax, qword [rbp + 0xf0]
call rax
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x78], rax
mov dword [rbp + 0x3c], 0
mov eax, dword [rbp + 0x3c]
cmp eax, 0x300
jl 0x18005e9c9
jmp 0x18005ec0c
mov eax, 1
add eax, dword [rbp + 0x3c]
mov dword [rbp + 0x3c], eax
mov eax, 1
add rax, qword [rbp + 0x78]
mov qword [rbp + 0x78], rax
jmp 0x18005e9a0
mov rax, qword [rbp + 0x78]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x3d80
jne 0x18005e9af
mov eax, 7
add rax, qword [rbp + 0x78]
mov edx, 2
add rdx, qword [rbp + 0x78]
mov edx, dword [rdx]
add rax, rdx
mov edx, 1
mov rcx, qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
mov qword [rbp + 0xf8], rcx
mov rcx, rax
mov rax, qword [rbp + 0xf8]
call rax
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
test eax, eax
jne 0x18005e9af
mov eax, 7
add rax, qword [rbp + 0x78]
mov edx, 2
add rdx, qword [rbp + 0x78]
mov edx, dword [rdx]
add rax, rdx
mov qword [rbp + 0x58], rax
jmp 0x18005ec0c
call fcn.180010939
mov dword [rbp + 0x38], eax
mov eax, dword [rbp + 0x38]
and eax, 0xffff0000
cmp eax, 0x6010000
jne 0x18005eb15
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
lea rax, [0x1801050f6]
mov rdx, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
call rdx
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
lea rdx, [0x180105105]
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x100], rcx
mov rcx, rax
mov rax, qword [rbp + 0x100]
call rax
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
test rax, rax
je 0x18005ec0c
mov rax, qword [rbp + 0x88]
call rax
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
test rax, rax
je 0x18005ec0c
mov eax, 0x5c
add rax, qword [rbp + 0x80]
mov qword [rbp + 0x58], rax
jmp 0x18005ec0c
call fcn.180010939
mov dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x40]
and eax, 0xffff0000
cmp eax, 0x6020000
je 0x18005eb47
call fcn.180010939
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x44]
and eax, 0xffff0000
cmp eax, 0x6030000
jne 0x18005ebfc
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
lea rax, [0x18010511d]
mov rdx, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
call rdx
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
lea rdx, [0x18010512c]
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x108], rcx
mov rcx, rax
mov rax, qword [rbp + 0x108]
call rax
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
test rax, rax
je 0x18005ec0c
mov rax, qword [rbp + 0xa8]
call rax
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
test rax, rax
je 0x18005ec0c
mov eax, 4
add rax, qword [rbp + 0xa0]
mov qword [rbp + 0x58], rax
jmp 0x18005ec0c
mov eax, gethostbyname
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x18005eca0
mov rax, qword [rbp + 0x58]
movzx eax, byte [rax]
mov byte [rbp + 0x20], al
mov rax, qword [rbp + 0x58]
mov byte [rax], 1
mov rax, qword [rbp + 0x140]
mov edx, 0
mov ecx, 0
mov rbx, qword [rbp + 0x148]
mov rsi, qword [rbp + 0x150]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 0
mov rsi, qword [rbp + 0x158]
mov qword [rsp + 0x30], rsi
mov rsi, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x110], rcx
mov rcx, rax
mov rax, qword [rbp + 0x110]
mov r8, rax
mov r9, rbx
call rsi
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x58]
movzx edx, byte [rbp + 0x20]
mov byte [rax], dl
jmp 0x18005ed16
mov eax, 0x7f
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
jmp 0x18005ed16
mov rax, qword [rbp + 0x140]
mov edx, 0
mov ecx, 0
mov rbx, qword [rbp + 0x148]
mov rsi, qword [rbp + 0x150]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 0
mov rsi, qword [rbp + 0x158]
mov qword [rsp + 0x30], rsi
mov rsi, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x118], rcx
mov rcx, rax
mov rax, qword [rbp + 0x118]
mov r8, rax
mov r9, rbx
call rsi
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0xd8], rax
lea rax, reloc.WS2_32.dll_bind
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0xd8]
mov rbx, qword [rbp + 0x120]
mov rsi, qword [rbp + 0x128]
lea rsp, [rbp + 0x130]
pop rbp
ret