Function at 0x14001a5d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x228
lea rdi, [rsp + 0x40]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x240]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov dword [rsp + 0x58], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x240]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x110], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x240]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x138], 0
mov dword [rsp + 0x13c], 0
mov dword [rsp + 0x140], 0
mov dword [rsp + 0x154], 0
call fcn.14013a6e0
mov qword [0x140576758], rax
mov rcx, qword [0x140576758]
call fcn.140016120
cmp dword [0x140576750], 0
jne 0x14001a6dd
xor ecx, ecx
call fcn.140158d70
mov qword [0x140576760], rax
lea r8, [0x140018480]
mov edx, 6
mov rcx, qword [0x140576760]
call fcn.140159210
lea r9, str.KVM__SLAVE_:_Child_Processing_Running...
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x140576760]
call fcn.1401589b0
nop
cmp dword [0x14057674c], 0
je 0x14001a708
cmp dword [rsp + 0x58], 0xc8
jge 0x14001a708
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x14001a6dd
cmp dword [rsp + 0x58], 0xc8
jl 0x14001a722
cmp dword [0x14057674c], 0
je 0x14001a722
xor eax, eax
jmp 0x14001b275
mov dword [0x14057674c], 1
mov dword [0x1404dc884], 0
mov dword [0x140576738], 0
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x240]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 0
mov eax, dword [rax + rcx]
mov dword [reloc.WS2_32.dll_accept], eax
cmp dword [0x140576750], 0
jne 0x14001a796
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x1404dc890], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x1404dc898], rax
call fcn.14001baa0
cwde
test eax, eax
jne 0x14001a7cf
cmp dword [0x140576750], 0
jne 0x14001a7c8
lea r9, str.KVM__SLAVE_:_initialize_gdiplus___failed
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x140576760]
call fcn.1401589b0
nop
xor eax, eax
jmp 0x14001b275
cmp dword [0x140576750], 0
jne 0x14001a7f7
lea r9, str.KVM__SLAVE_:_initialize_gdiplus___SUCCESS
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x140576760]
call fcn.1401589b0
nop
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
call fcn.140018e30
cmp dword [0x140576750], 0
jne 0x14001a85e
mov dword [0x1404dc884], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x240]
lea r8, [0x14001a500]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140576730], rax
mov rcx, qword [0x140576730]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rsp + 0x104], 0
jmp 0x14001a87b
mov eax, dword [rsp + 0x104]
inc eax
mov dword [rsp + 0x104], eax
mov eax, dword [0x140576720]
cmp dword [rsp + 0x104], eax
jge 0x14001a8dc
mov dword [rsp + 0x108], 0
jmp 0x14001a8a7
mov eax, dword [rsp + 0x108]
inc eax
mov dword [rsp + 0x108], eax
mov eax, dword [0x14057671c]
cmp dword [rsp + 0x108], eax
jge 0x14001a8da
movsxd rax, dword [rsp + 0x104]
movsxd rcx, dword [rsp + 0x108]
mov rdx, qword [0x140576740]
mov rax, qword [rdx + rax*8]
mov dword [rax + rcx*8], 0xff
jmp 0x14001a897
jmp 0x14001a86b
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
call fcn.140018a20
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp dword [0x1404dc884], 0
jne 0x14001b181
mov dword [rsp + 0x104], 0
jmp 0x14001a927
mov eax, dword [rsp + 0x104]
inc eax
mov dword [rsp + 0x104], eax
mov eax, dword [0x140576720]
cmp dword [rsp + 0x104], eax
jge 0x14001a986
mov dword [rsp + 0x108], 0
jmp 0x14001a953
mov eax, dword [rsp + 0x108]
inc eax
mov dword [rsp + 0x108], eax
mov eax, dword [0x14057671c]
cmp dword [rsp + 0x108], eax
jge 0x14001a984
movsxd rax, dword [rsp + 0x104]
movsxd rcx, dword [rsp + 0x108]
mov rdx, qword [0x140576740]
mov rax, qword [rdx + rax*8]
mov byte [rax + rcx*8 + 4], 0
jmp 0x14001a943
jmp 0x14001a917
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
mov ecx, 1
call fcn.1400191d0
cmp dword [0x1404dc884], 0
je 0x14001a9ae
jmp 0x14001b181
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x138], 0
mov rcx, qword [0x140576758]
call fcn.14013a7a0
mov qword [rsp + 0x120], rax
cmp qword [rsp + 0x120], 0
je 0x14001abf2
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x120]
movzx ecx, word [rcx + rax]
call sub.WS2_32.dll_ntohs
movzx eax, ax
cmp eax, 0x59
jne 0x14001ab90
cmp dword [0x1405766e8], 0
jne 0x14001aa92
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x138], 1
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x120]
mov edx, dword [0x140576700]
mov eax, dword [rcx + rax]
sub eax, edx
mov ecx, 4
imul rcx, rcx, 1
mov dword [rsp + rcx + 0x138], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x120]
mov edx, dword [0x140576704]
mov eax, dword [rcx + rax]
sub eax, edx
mov ecx, 4
imul rcx, rcx, 2
mov dword [rsp + rcx + 0x138], eax
jmp 0x14001ab8e
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x120]
mov edx, dword [0x1405766f0]
cmp dword [rcx + rax], edx
jl 0x14001ab8e
mov eax, 4
imul rax, rax, 1
mov ecx, dword [0x1405766f8]
mov edx, dword [0x1405766f0]
add edx, ecx
mov ecx, edx
mov rdx, qword [rsp + 0x120]
cmp dword [rdx + rax], ecx
jg 0x14001ab8e
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x120]
mov edx, dword [0x1405766f4]
cmp dword [rcx + rax], edx
jl 0x14001ab8e
mov eax, 4
imul rax, rax, 2
mov ecx, dword [0x1405766fc]
mov edx, dword [0x1405766f4]
add edx, ecx
mov ecx, edx
mov rdx, qword [rsp + 0x120]
cmp dword [rdx + rax], ecx
jg 0x14001ab8e
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x138], 1
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x120]
mov edx, dword [0x1405766f0]
mov eax, dword [rcx + rax]
sub eax, edx
mov ecx, 4
imul rcx, rcx, 1
mov dword [rsp + rcx + 0x138], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x120]
mov edx, dword [0x1405766f4]
mov eax, dword [rcx + rax]
sub eax, edx
mov ecx, 4
imul rcx, rcx, 2
mov dword [rsp + rcx + 0x138], eax
jmp 0x14001abdf
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x120]
movzx ecx, word [rcx + rax]
call sub.WS2_32.dll_ntohs
movzx eax, ax
cmp eax, 0x58
jne 0x14001abbc
cmp dword [rsp + 0x154], 0
jne 0x14001abdf
mov r8, qword [rsp + 0x118]
mov rax, qword [rsp + 0x120]
mov edx, dword [rax - 0x18]
mov rcx, qword [rsp + 0x120]
call qword [rsp + 0x110]
nop
mov rcx, qword [rsp + 0x120]
call fcn.140137da0
nop
jmp 0x14001a9cf
mov eax, 4
imul rax, rax, 0
cmp dword [rsp + rax + 0x138], 0
jne 0x14001acef
cmp dword [0x140576564], 0
jne 0x14001ac1f
cmp dword [0x1405766d8], 0
jne 0x14001acef
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x138], 1
lea rax, [rsp + 0x168]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0x168], 0x18
lea rcx, [rsp + 0x168]
call qword [sym.imp.USER32.dll_GetCursorInfo]
cmp dword [0x1405766e8], 0
jne 0x14001acad
mov eax, dword [0x140576700]
mov ecx, dword [rsp + 0x178]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 1
mov dword [rsp + rcx + 0x138], eax
mov eax, dword [0x140576704]
mov ecx, dword [rsp + 0x17c]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 2
mov dword [rsp + rcx + 0x138], eax
jmp 0x14001acef
mov eax, dword [0x1405766f0]
mov ecx, dword [rsp + 0x178]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 1
mov dword [rsp + rcx + 0x138], eax
mov eax, dword [0x1405766f4]
mov ecx, dword [rsp + 0x17c]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 2
mov dword [rsp + rcx + 0x138], eax
mov eax, 4
imul rax, rax, 0
cmp dword [rsp + rax + 0x138], 0
je 0x14001ad7b
cmp dword [rsp + 0x154], 0
jne 0x14001ad79
mov dword [rsp + 0x154], 1
mov cx, 0x58
call sub.WS2_32.dll_htons
mov ecx, 2
imul rcx, rcx, 0
mov word [rsp + rcx + 0x194], ax
mov cx, 5
call sub.WS2_32.dll_htons
mov ecx, 2
imul rcx, rcx, 1
mov word [rsp + rcx + 0x194], ax
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x194], reloc.WS2_32.dll_ntohl
mov r8, qword [rsp + 0x118]
mov edx, 5
lea rcx, [rsp + 0x194]
call qword [rsp + 0x110]
nop
jmp 0x14001adf8
cmp dword [rsp + 0x154], 0
je 0x14001adf8
mov dword [rsp + 0x154], 0
mov cx, 0x58
call sub.WS2_32.dll_htons
mov ecx, 2
imul rcx, rcx, 0
mov word [rsp + rcx + 0x1b4], ax
mov cx, 5
call sub.WS2_32.dll_htons
mov ecx, 2
imul rcx, rcx, 1
mov word [rsp + rcx + 0x1b4], ax
mov eax, 1
imul rax, rax, 4
movzx ecx, byte [reloc.WS2_32.dll_connect]
mov byte [rsp + rax + 0x1b4], cl
mov r8, qword [rsp + 0x118]
mov edx, 5
lea rcx, [rsp + 0x1b4]
call qword [rsp + 0x110]
nop
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x88]
call fcn.14001c330
cmp eax, 1
je 0x14001ae25
cmp qword [rsp + 0x88], 0
jne 0x14001ae5c
cmp dword [0x140576750], 0
jne 0x14001ae4d
lea r9, str.KVM__SLAVE_:_get_desktop_buffer___failed
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x140576760]
call fcn.1401589b0
nop
mov dword [0x1404dc884], 1
jmp 0x14001b120
mov r8d, dword [0x1405766e0]
mov edx, dword [0x1405766dc]
lea rcx, [rsp + 0x1d0]
call fcn.14001ca30
lea rcx, [rsp + 0xc8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x2c
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x104], 0
jmp 0x14001aea8
mov eax, dword [rsp + 0x104]
inc eax
mov dword [rsp + 0x104], eax
mov eax, dword [0x140576720]
cmp dword [rsp + 0x104], eax
jge 0x14001b0ea
mov dword [rsp + 0x108], 0
jmp 0x14001aed8
mov eax, dword [rsp + 0x108]
inc eax
mov dword [rsp + 0x108], eax
mov eax, dword [0x14057671c]
cmp dword [rsp + 0x108], eax
jge 0x14001b0e5
mov eax, dword [0x1405766e0]
imul eax, dword [rsp + 0x104]
mov dword [rsp + 0x58], eax
mov eax, dword [0x1405766dc]
imul eax, dword [rsp + 0x108]
mov dword [rsp + 0x54], eax
cmp dword [0x1404dc884], 0
jne 0x14001af2f
cmp dword [0x140576738], 0
je 0x14001af2f
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x14001af0f
cmp dword [0x1404dc884], 0
jne 0x14001af46
mov eax, dword [0x1404dc880]
cmp dword [0x1404dc87c], eax
je 0x14001af5f
mov eax, dword [0x140576714]
mov dword [rsp + 0x58], eax
mov eax, dword [0x140576710]
mov dword [rsp + 0x54], eax
jmp 0x14001b0e5
movsxd rax, dword [rsp + 0x104]
movsxd rcx, dword [rsp + 0x108]
mov rdx, qword [0x140576740]
mov rax, qword [rdx + rax*8]
movsx eax, byte [rax + rcx*8 + 4]
cmp eax, 1
je 0x14001afa9
movsxd rax, dword [rsp + 0x104]
movsxd rcx, dword [rsp + 0x108]
mov rdx, qword [0x140576740]
mov rax, qword [rdx + rax*8]
movsx eax, byte [rax + rcx*8 + 4]
cmp eax, 3
jne 0x14001afae
jmp 0x14001aec8
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x104]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x68]
mov edx, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x54]
call fcn.14001bcf0
cmp eax, 1
jne 0x14001aff2
jmp 0x14001aec8
cmp qword [rsp + 0x68], 0
je 0x14001b0e0
cmp dword [0x1404dc884], 0
jne 0x14001b0e0
mov r8, qword [rsp + 0x118]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0x110]
mov dword [rsp + 0x200], eax
cmp dword [rsp + 0x200], 0xfffffffc
je 0x14001b0b2
cmp dword [rsp + 0x200], 0
je 0x14001b043
jmp 0x14001b0d0
mov dword [0x140576738], 1
cmp qword [0x140577300], 0
je 0x14001b084
mov eax, 4
imul rax, rax, 2
mov rcx, qword [0x140577300]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rsp + 0x208], rax
jmp 0x14001b090
mov qword [rsp + 0x208], 0
lea r9, str.Agent_KVM:_KVM_PAUSE
mov r8d, 4
mov edx, 0x200
mov rcx, qword [rsp + 0x208]
call fcn.1401589b0
nop
jmp 0x14001b0d0
mov dword [0x1404dc884], 1
mov eax, dword [0x140576714]
mov dword [rsp + 0x58], eax
mov eax, dword [0x140576710]
mov dword [rsp + 0x54], eax
mov edx, 1
mov rcx, qword [rsp + 0x68]
call fcn.1403ba8b0
nop
jmp 0x14001aec8
jmp 0x14001ae98
cmp qword [rsp + 0x88], 0
je 0x14001b108
mov edx, 1
mov rcx, qword [rsp + 0x88]
call fcn.1403ba8b0
nop
mov qword [rsp + 0x88], 0
mov qword [rsp + 0xa8], 0
mov eax, dword [0x140576728]
mov dword [rsp + 0x58], eax
cmp dword [0x1404dc884], 0
jne 0x14001b17c
cmp dword [rsp + 0x58], 0
jle 0x14001b17c
cmp dword [rsp + 0x58], 0x32
jle 0x14001b15a
mov eax, dword [rsp + 0x58]
sub eax, 0x32
mov dword [rsp + 0x58], eax
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x14001b16c
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x58], 0
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepEx]
nop
jmp 0x14001b12a
jmp 0x14001a8fd
cmp qword [0x140576740], 0
je 0x14001b1f3
mov dword [rsp + 0x104], 0
jmp 0x14001b1a8
mov eax, dword [rsp + 0x104]
inc eax
mov dword [rsp + 0x104], eax
mov eax, dword [0x140576720]
cmp dword [rsp + 0x104], eax
jge 0x14001b1d7
movsxd rax, dword [rsp + 0x104]
mov edx, 1
mov rcx, qword [0x140576740]
mov rcx, qword [rcx + rax*8]
call fcn.1403ba8b0
nop
jmp 0x14001b198
mov edx, 1
mov rcx, qword [0x140576740]
call fcn.1403ba8b0
mov qword [0x140576740], 0
call fcn.14001bc60
call fcn.1400164d0
nop
mov rcx, qword [0x140576758]
call fcn.14013a7a0
mov qword [rsp + 0x120], rax
cmp qword [rsp + 0x120], 0
je 0x14001b22d
mov rcx, qword [rsp + 0x120]
call fcn.140137da0
nop
jmp 0x14001b1fe
mov rcx, qword [0x140576758]
call fcn.14013a700
lea r9, str.KVM__SLAVE_:_Process_Exiting...
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x140576760]
call fcn.1401589b0
mov dword [0x14057674c], 0
mov edx, 1
mov rcx, qword [rsp + 0x240]
call fcn.1403ba8b0
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_htons
call fcn.14037c300
mov rax, rdi
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x228
pop rdi
pop rsi
ret