Function at 0x14002f658
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x268
mov r14d, 0xa000000
mov rbx, r9
mov ecx, r14d
mov rdi, r8
xor r12d, r12d
call fcn.140037e70
xor esi, esi
mov qword [rbp - 0x70], rax
xor r13d, r13d
mov dword [rsp + 0x60], esi
mov r8d, r14d
mov qword [rbp - 0x78], r13
xor edx, edx
mov rcx, rax
call fcn.14003a5c0
lea r14, [0x14009d600]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.140004d8c
xor r8d, r8d
mov rdx, r14
mov rcx, rbx
call fcn.140004d8c
mov rcx, qword [rbp + 0x1d0]
xor r8d, r8d
mov rdx, r14
call fcn.140004d8c
mov rcx, qword [rbp + 0x1d8]
xor r8d, r8d
mov rdx, r14
call fcn.140004d8c
mov rcx, qword [rbp + 0x1e0]
xor r8d, r8d
mov rdx, r14
call fcn.140004d8c
mov rcx, qword [rbp + 0x1e8]
xor r8d, r8d
mov rdx, r14
call fcn.140004d8c
mov rcx, qword [rbp + 0x1f0]
xor r8d, r8d
mov rdx, r14
call fcn.140004d8c
call fcn.14001fc90
lea rax, str.PCInfoApp.log
mov qword [rbp], rax
lea r15d, [r12 + 1]
lea rax, str.PCInfoDrv_DrvList.Log
mov qword [rbp + 8], rax
lea r14, [rbp + 8]
lea rax, str.PCInfoDrv_File.Log
mov qword [rbp + 0x10], rax
lea rax, str.PCInfoDrv_Image.Log
mov qword [rbp + 0x18], rax
lea rax, [0x1400a18a8]
mov qword [rbp + 0x20], rax
lea rax, str.PCInfoDrv_Proc.Log
mov qword [rbp + 0x28], rax
lea rax, str.PCInfoDrv_ProcCPU.Log
mov qword [rbp + 0x30], rax
lea rax, str.PCRecord.Log
mov qword [rbp + 0x38], rax
lea rax, str.PCNetConn.Log
mov qword [rbp + 0x40], rax
lea rax, [0x1400a1910]
mov qword [rbp + 0x48], rax
lea rax, [0x1400a1920]
mov qword [rbp + 0x50], rax
mov rbx, qword [r14]
xor edi, edi
mov qword [rbp - 0x30], reloc.WSOCK32.dll_ntohs
mov qword [rbp - 0x38], rdi
mov byte [rbp - 0x48], dil
cmp byte [rbx], dil
jne 0x14002f7dc
mov eax, edi
jmp 0x14002f7e4
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rbp - 0x48]
mov rdx, rbx
call fcn.140004d8c
mov rbx, qword [0x1400c5200]
mov qword [rbp - 0x80], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x78], rdi
mov byte [rsp + 0x68], dil
cmp byte [rbx], dil
jne 0x14002f816
mov rax, rdi
jmp 0x14002f81e
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rsp + 0x68]
mov rdx, rbx
call fcn.140004d8c
lea rcx, str.ADH_
call fcn.140045e50
mov r8, rax
lea rdx, str.ADH_
lea rcx, [rsp + 0x68]
call fcn.140004b2c
mov rdx, rax
mov qword [rbp - 0x10], reloc.WSOCK32.dll_ntohs
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x18], rdi
mov byte [rbp - 0x28], dil
call fcn.140004354
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x68]
call fcn.140001330
mov rdx, qword [rbp - 0x10]
mov ebx, 1
cmp rdx, 0x10
jb 0x14002f899
mov rcx, qword [rbp - 0x28]
inc rdx
mov r8d, ebx
call fcn.140004554
mov rdx, qword [rbp - 0x80]
mov qword [rbp - 0x10], reloc.WSOCK32.dll_ntohs
mov qword [rbp - 0x18], rdi
mov byte [rbp - 0x28], dil
cmp rdx, 0x10
jb 0x14002f8c3
mov rcx, qword [rsp + 0x68]
inc rdx
mov r8, rbx
call fcn.140004554
mov rdx, qword [rbp - 0x30]
mov qword [rbp - 0x80], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x78], rdi
mov byte [rsp + 0x68], dil
cmp rdx, 0x10
jb 0x14002f8ee
mov rcx, qword [rbp - 0x48]
inc rdx
mov r8, rbx
call fcn.140004554
cmp qword [rbp - 0x50], 0x10
lea rcx, [rbp - 0x68]
cmovae rcx, qword [rbp - 0x68]
xor r8d, r8d
xor edx, edx
call fcn.140019348
mov edi, eax
test eax, eax
je 0x14002f96f
add esi, eax
cmp esi, 0xa000000
jae 0x14002f99b
cmp qword [rbp - 0x50], 0x10
lea rcx, [rbp - 0x68]
mov ebx, dword [rsp + 0x60]
mov r8d, eax
cmovae rcx, qword [rbp - 0x68]
xor r9d, r9d
add rbx, qword [rbp - 0x70]
and dword [rsp + 0x20], r12d
mov rdx, rbx
call fcn.140021484
xor eax, eax
test edi, edi
je 0x14002f966
test al, 1
jne 0x14002f952
add byte [rbx], 5
jmp 0x14002f955
add byte [rbx], 0x14
cmp byte [rbx], r12b
jne 0x14002f95d
mov byte [rbx], 0x20
inc eax
inc rbx
cmp eax, edi
jb 0x14002f949
mov dword [rsp + 0x60], esi
mov ebx, 1
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14002f988
mov rcx, qword [rbp - 0x68]
mov r8, rbx
inc rdx
call fcn.140004554
add r15d, ebx
add r14, 8
cmp r15d, 0xb
jb 0x14002f7be
jmp 0x14002f9b4
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14002f9b4
mov rcx, qword [rbp - 0x68]
inc rdx
mov r8, rbx
call fcn.140004554
call fcn.14002d148
test eax, eax
jne 0x14002f9d0
lea rdx, str.zccm_LogSearch:_GetLsKeywordInfo_failed__r_n
mov ecx, ebx
call fcn.1400191e0
jmp 0x14002fe2a
mov r8, qword [0x1400c52d8]
movabs rsi, 0x6666666666666667
mov rax, rsi
mov rcx, qword [r8 + 8]
sub rcx, qword [r8]
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x14002fdff
xor r9d, r9d
mov r8, qword [r8]
lea rdi, [r9 + r9*4]
add r8, 0x20
shl rdi, 5
add r8, rdi
lea rdx, [0x1400a46f0]
lea rcx, [rbp - 0x48]
call fcn.1400055fc
lea rcx, [0x1400a46f0]
mov rbx, rax
call fcn.140045e50
mov r8, rax
lea rdx, [0x1400a46f0]
mov rcx, rbx
call fcn.140004b2c
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x68]
mov rdx, rax
mov qword [rbp - 0x80], reloc.WSOCK32.dll_ntohs
mov byte [rsp + 0x68], 0
call fcn.140004354
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14002fa84
mov rcx, qword [rbp - 0x48]
inc rdx
mov r8d, 1
call fcn.140004554
cmp qword [rbp - 0x80], 0x10
lea r8, [rsp + 0x68]
mov r9d, dword [rsp + 0x78]
cmovae r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov rcx, qword [rbp - 0x70]
call fcn.1400148e0
test rax, rax
je 0x14002fda8
mov rax, qword [0x1400c52d8]
mov rcx, qword [rax]
lea rsi, [rcx + 0x20]
lea rbx, [rcx + 0x40]
add rsi, r12
mov ecx, 0x800
add rbx, rdi
call fcn.140037e70
mov qword [rbp - 0x78], rax
mov rax, qword [0x1400c52d8]
mov r14, qword [rax]
add r14, r12
lea r15, [r14 + 0x80]
cmp qword [r15 + 0x18], 0x10
jb 0x14002faf3
mov r15, qword [r15]
cmp qword [r14 + 0x18], 0x10
jb 0x14002fafd
mov r14, qword [r14]
cmp qword [rsi + 0x18], 0x10
mov rax, qword [rsi + 0x10]
jb 0x14002fb0b
mov rsi, qword [rsi]
mov r8d, eax
lea rcx, [rbp - 0x48]
mov rdx, rsi
call fcn.14001e210
mov rsi, rax
cmp qword [rax + 0x18], 0x10
jb 0x14002fb27
mov rsi, qword [rax]
mov edx, 0xa
xor ecx, ecx
call fcn.14001fd08
mov r8, qword [rbp + 0x1b0]
mov edx, eax
mov r9, qword [0x1400c51e8]
add r9, 0x268
movsx eax, byte [r8 + 2]
movsx ecx, byte [r8]
add edx, eax
movsx eax, byte [r8 + 1]
add ecx, 0x4d2
add edx, eax
lea rax, [0x14009d600]
add edx, ecx
mov dword [rsp + 0x50], edx
lea rdx, str.http:___s_index.php_client_get_data_upload_log_search_result_agent_name_smac_scname_skeyword_skwey1keyword_id_slogdate_stype_stststs_d
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rsi
mov rsi, qword [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], r8
lea r8, str.yun2.adhunter.cn
call fcn.1400055a4
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14002fbca
mov rcx, qword [rbp - 0x48]
inc rdx
mov r8d, 1
call fcn.140004554
mov r14d, 0x100
lea rcx, [rbp + 0x60]
mov r8d, r14d
xor edx, edx
call fcn.14003a5c0
and qword [rsp + 0x38], 0
lea rax, [rbp + 0x60]
mov dword [rsp + 0x30], r14d
lea r8, [0x14009e988]
mov qword [rsp + 0x28], rax
mov edx, 0x50
and dword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, rsi
call fcn.14001687c
test eax, eax
jne 0x14002fc21
lea rdx, str.ZCCM:_LogSearch:_upload_log_search_record_failed__n
lea ecx, [rax + 4]
call fcn.1400191e0
mov rax, qword [0x1400c52d8]
lea rdx, [0x14009d380]
mov rcx, qword [rax]
add rcx, 0x60
add rcx, rdi
call fcn.140004f04
test eax, eax
jne 0x14002fc5a
mov rax, qword [rbp + 0x1c0]
cmp rax, rbx
je 0x14002fd9e
mov rcx, rax
jmp 0x14002fd8f
mov rax, qword [0x1400c52d8]
lea rdx, [0x14009d3e8]
mov rcx, qword [rax]
add rcx, 0x60
add rcx, rdi
call fcn.140004f04
test eax, eax
jne 0x14002fc84
mov rax, qword [rbp + 0x1c8]
jmp 0x14002fc49
mov rax, qword [0x1400c52d8]
lea rdx, [0x14009d444]
mov rcx, qword [rax]
add rcx, 0x60
add rcx, rdi
call fcn.140004f04
test eax, eax
jne 0x14002fcbe
cmp qword [rbp + 0x1d0], rbx
je 0x14002fd9e
mov rcx, qword [rbp + 0x1d0]
jmp 0x14002fd8f
mov rax, qword [0x1400c52d8]
lea rdx, [0x14009d314]
mov rcx, qword [rax]
add rcx, 0x60
add rcx, rdi
call fcn.140004f04
test eax, eax
jne 0x14002fcf8
cmp qword [rbp + 0x1d8], rbx
je 0x14002fd9e
mov rcx, qword [rbp + 0x1d8]
jmp 0x14002fd8f
mov rax, qword [0x1400c52d8]
lea rdx, [0x1400a4eec]
mov rcx, qword [rax]
add rcx, 0x60
add rcx, rdi
call fcn.140004f04
test eax, eax
jne 0x14002fd2b
cmp qword [rbp + 0x1e0], rbx
je 0x14002fd9e
mov rcx, qword [rbp + 0x1e0]
jmp 0x14002fd8f
mov rax, qword [0x1400c52d8]
lea rdx, [0x1400a4ef0]
mov rcx, qword [rax]
add rcx, 0x60
add rcx, rdi
call fcn.140004f04
test eax, eax
jne 0x14002fd5e
cmp qword [rbp + 0x1e8], rbx
je 0x14002fd9e
mov rcx, qword [rbp + 0x1e8]
jmp 0x14002fd8f
mov rax, qword [0x1400c52d8]
lea rdx, [0x1400a4ef4]
mov rcx, qword [rax]
add rcx, 0x60
add rcx, rdi
call fcn.140004f04
test eax, eax
jne 0x14002fd9e
cmp qword [rbp + 0x1f0], rbx
je 0x14002fd9e
mov rcx, qword [rbp + 0x1f0]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
call fcn.140004c64
movabs rsi, 0x6666666666666667
mov rdx, qword [rbp - 0x80]
mov ebx, 1
cmp rdx, 0x10
jb 0x14002fdc7
mov rcx, qword [rsp + 0x68]
inc rdx
mov r8d, ebx
call fcn.140004554
mov r8, qword [0x1400c52d8]
add r13d, ebx
mov rax, rsi
movsxd r9, r13d
add r12, 0xa0
mov rcx, qword [r8 + 8]
sub rcx, qword [r8]
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r9, rdx
jb 0x14002fa05
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1b0]
call fcn.140030050
xor r8d, r8d
lea rcx, [0x1400309b8]
xor edx, edx
call fcn.1400604a4
mov r13, qword [rbp - 0x78]
mov r12d, ebx
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x14002fe3e
mov rdx, rbx
mov rcx, rax
call fcn.140037e68
test r13, r13
je 0x14002fe4e
mov rdx, rbx
mov rcx, r13
call fcn.140037e68
mov eax, r12d
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret