Function at 0x140005d70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x1400d76b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, qword [0x1400d86f0]
mov rbx, qword [rsi + 0x4008]
cmp byte [rbx + 0xc3], 0
jne 0x140006283
movsxd rcx, dword [rbx + 0x100]
xor edx, edx
mov rax, qword [rbx + 0x108]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, str.tabs
call fcn.14000e7a0
mov rcx, qword [rbx]
mov ebp, eax
cmp dword [rcx + 0x4054], eax
jne 0x140005def
lea r8, str.tabs
mov edx, ntohs
mov ecx, eax
call fcn.140027700
lea rcx, [rsi + 0x4e28]
mov edx, ebp
call fcn.14000ee00
mov rcx, rax
movsxd rax, dword [rax]
cmp eax, 0xffffffff
je 0x140005e19
lea rcx, [rax + rax*4]
shl rcx, 5
add rcx, qword [rsi + 0x4e20]
jmp 0x140005e30
mov eax, dword [rsi + 0x4e38]
mov dword [rcx], eax
lea rcx, [rsi + 0x4e18]
call fcn.1400485f0
mov rcx, rax
movss xmm2, dword [rbx + 0x114]
lea rdx, [rsp + 0x30]
movss xmm0, dword [rbx + 0x110]
movss xmm1, dword [rsi + 0x3930]
movss dword [rsp + 0x30], xmm0
addss xmm1, xmm1
movss xmm0, dword [rbx + 0x230]
movss dword [rsp + 0x38], xmm0
movss dword [rsp + 0x34], xmm2
addss xmm2, dword [rsi + 0x3d40]
mov dword [rcx + 0x14], ebp
movss xmm0, dword [rbx + 0x58]
mulss xmm0, dword [0x1400c9544]
addss xmm2, xmm1
movss xmm1, dword [rcx + 0x2c]
cvttss2si eax, xmm0
movss dword [rsp + 0x3c], xmm2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
movss dword [rcx + 0x64], xmm1
movss xmm2, dword [rbx + 0x58]
mulss xmm2, dword [0x1400c9544]
cvttss2si eax, xmm2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm0, dword [rcx + 0x34]
movss dword [rcx + 0x68], xmm0
call fcn.140045360
mov rbp, qword [rsp + 0x60]
test al, al
je 0x14000627e
lea rcx, str.Auto_Cleaner
call fcn.140047160
test al, al
je 0x140005f33
call fcn.1400062a0
mov rdx, qword [0x1400d86f0]
mov rax, qword [rdx + 0x4008]
cmp byte [rax + 0xc3], 0
jne 0x140005f33
mov r8, qword [rdx + 0x4e10]
test r8, r8
je 0x140005f33
movsx rax, word [r8 + 0x78]
imul rcx, rax, 0x2c
mov rax, qword [r8 + 8]
test byte [rcx + rax + 4], 8
jne 0x140005f33
mov rax, qword [rdx + 0x4008]
dec dword [rax + 0x100]
lea rcx, str.Cleaner
call fcn.140047160
test al, al
je 0x140005f8c
call fcn.1400065c0
mov rdx, qword [0x1400d86f0]
mov rax, qword [rdx + 0x4008]
cmp byte [rax + 0xc3], 0
jne 0x140005f8c
mov r8, qword [rdx + 0x4e10]
test r8, r8
je 0x140005f8c
movsx rax, word [r8 + 0x78]
imul rcx, rax, 0x2c
mov rax, qword [r8 + 8]
test byte [rcx + rax + 4], 8
jne 0x140005f8c
mov rax, qword [rdx + 0x4008]
dec dword [rax + 0x100]
movsxd rax, dword [0x1400d8644]
lea rsi, [0x140000000]
imul rcx, rax, 0x198
mov rcx, qword [rcx + rsi + 0xc1c68]
call fcn.140047160
test al, al
je 0x140005ffb
call fcn.140007660
mov rdx, qword [0x1400d86f0]
mov rax, qword [rdx + 0x4008]
cmp byte [rax + 0xc3], 0
jne 0x140005ffb
mov r8, qword [rdx + 0x4e10]
test r8, r8
je 0x140005ffb
movsx rax, word [r8 + 0x78]
imul rcx, rax, 0x2c
mov rax, qword [r8 + 8]
test byte [rcx + rax + 4], 8
jne 0x140005ffb
mov rax, qword [rdx + 0x4008]
dec dword [rax + 0x100]
movsxd rax, dword [0x1400d8644]
imul rcx, rax, 0x198
mov rcx, qword [rcx + rsi + 0xc1c78]
call fcn.140047160
test al, al
je 0x140006216
mov rcx, qword [0x1400d86f0]
xor edx, edx
movss xmm0, dword [0x1400d7ae0]
movss xmm1, dword [0x1400d7adc]
subss xmm0, dword [0x1400c95f4]
mov rax, qword [rcx + 0x4008]
subss xmm1, dword [0x1400c9618]
mov byte [rax + 0xc0], 1
mov rbx, qword [rcx + 0x4008]
movss dword [rsp + 0x30], xmm0
movss dword [rsp + 0x34], xmm1
movsxd rcx, dword [rbx + 0x100]
mov rax, qword [rbx + 0x108]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, str.network
call fcn.14000e7a0
mov r8, qword [rbx]
mov edi, eax
cmp dword [r8 + 0x4054], eax
jne 0x1400060a8
lea r8, str.network
mov edx, ntohs
mov ecx, eax
call fcn.140027700
xor ebx, ebx
lea r8, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
mov edx, edi
lea rcx, str.network
call fcn.140016fd0
test al, al
je 0x1400061d3
movsxd rax, dword [0x1400d8644]
imul rcx, rax, 0x198
mov rcx, qword [rcx + rsi + 0xc2778]
call fcn.14003c7b0
mov rax, qword [0x1400d86f0]
mov r8, qword [rax + 0x4008]
cmp byte [r8 + 0xc3], bl
jne 0x14000612b
mov edx, dword [r8 + 0x1c4]
mov eax, edx
neg eax
sbb ecx, ecx
add ecx, 2
cmp qword [r8 + 0x1b8], rbx
je 0x14000611e
neg edx
sbb ecx, ecx
add ecx, 6
movss xmm1, dword [0x1400c9580]
call fcn.14003ebd0
movsxd rax, dword [0x1400d8644]
lea rdx, [rsp + 0x30]
imul rcx, rax, 0x198
mov qword [rsp + 0x30], rbx
mov rcx, qword [rcx + rsi + 0xc2780]
call fcn.14003d050
test al, al
je 0x1400061ce
mov qword [rsp + 0x28], rbx
lea r9, str.ipconfig__flushdns
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140006183
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r9, str.netsh_winsock_reset
lea r8, [0x140001060]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400061b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x40
lea r8, str.DNS_Flush
lea rdx, str.Sucessfully_reset_the_Winsock_and_DNS_Cache__you_need_to_restart_the_machine_in_order_to_complete_the_reset.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140017380
mov rdx, qword [0x1400d86f0]
mov rax, qword [rdx + 0x4008]
cmp byte [rax + 0xc3], bl
jne 0x140006216
mov r8, qword [rdx + 0x4e10]
test r8, r8
je 0x140006216
movsx rax, word [r8 + 0x78]
imul rcx, rax, 0x2c
mov rax, qword [r8 + 8]
test byte [rcx + rax + 4], 8
jne 0x140006216
mov rax, qword [rdx + 0x4008]
dec dword [rax + 0x100]
movsxd rax, dword [0x1400d8644]
imul rcx, rax, 0x198
mov rcx, qword [rcx + rsi + 0xc1c80]
call fcn.140047160
test al, al
je 0x14000627e
call fcn.1400070b0
mov rdx, qword [0x1400d86f0]
mov rax, qword [rdx + 0x4008]
cmp byte [rax + 0xc3], 0
jne 0x14000627e
mov r8, qword [rdx + 0x4e10]
test r8, r8
je 0x14000627e
movsx rax, word [r8 + 0x78]
imul rcx, rax, 0x2c
mov rax, qword [r8 + 8]
test byte [rcx + rax + 4], 8
jne 0x14000627e
mov rax, qword [rdx + 0x4008]
dec dword [rax + 0x100]
mov rdi, qword [rsp + 0x68]
call fcn.140045750
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140092770
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret