Function at 0x140017840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x148
mov rax, qword [0x140325ed8]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov dword [rsp + 0x48], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x160]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x68], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x160]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x118], 0
mov dword [rsp + 0x11c], 0
mov dword [rsp + 0x120], 0
mov dword [rsp + 0x58], 0
call fcn.14011b660
mov qword [0x1403b8c10], rax
mov rcx, qword [0x1403b8c10]
call fcn.140014d20
cmp dword [0x1403b8c64], 0
jne 0x14001792a
xor ecx, ecx
call fcn.140129770
mov qword [0x1403b8c28], rax
lea r8, [0x140015800]
mov edx, 6
mov rcx, qword [0x1403b8c28]
call fcn.140129740
lea r9, str.KVM__SLAVE_:_Child_Processing_Running...
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x1403b8c28]
call fcn.140129b00
cmp dword [0x1403b8c34], 0
je 0x140017954
cmp dword [rsp + 0x48], 0xc8
jge 0x140017954
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001792a
cmp dword [rsp + 0x48], 0xc8
jl 0x14001796e
cmp dword [0x1403b8c34], 0
je 0x14001796e
xor eax, eax
jmp 0x1400183a9
mov dword [0x1403b8c34], 1
mov dword [0x140326ba4], 0
mov dword [0x1403b8c44], 0
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x160]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 0
mov eax, dword [rax + rcx]
mov dword [reloc.WS2_32.dll_accept], eax
cmp dword [0x1403b8c64], 0
jne 0x1400179e2
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x140326da8], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x140326da0], rax
call fcn.14001afd0
cwde
test eax, eax
jne 0x140017a1a
cmp dword [0x1403b8c64], 0
jne 0x140017a13
lea r9, str.KVM__SLAVE_:_initialize_gdiplus___failed
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x1403b8c28]
call fcn.140129b00
xor eax, eax
jmp 0x1400183a9
cmp dword [0x1403b8c64], 0
jne 0x140017a41
lea r9, str.KVM__SLAVE_:_initialize_gdiplus___SUCCESS
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x1403b8c28]
call fcn.140129b00
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.140017250
cmp dword [0x1403b8c64], 0
jne 0x140017aa1
mov dword [0x140326ba4], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x160]
lea r8, [0x1400177a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1403b8c78], rax
mov rcx, qword [0x1403b8c78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0
jmp 0x140017ab5
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [0x1403b8c74]
cmp dword [rsp + 0x40], eax
jge 0x140017b01
mov dword [rsp + 0x44], 0
jmp 0x140017ad5
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
mov eax, dword [0x1403b8c84]
cmp dword [rsp + 0x44], eax
jge 0x140017aff
movsxd rax, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x44]
mov rdx, qword [0x1403b8c58]
mov rax, qword [rdx + rax*8]
mov dword [rax + rcx*8], 0xff
jmp 0x140017acb
jmp 0x140017aab
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.140015d50
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x140326ba4], 0
jne 0x1400182df
mov dword [rsp + 0x40], 0
jmp 0x140017b3c
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [0x1403b8c74]
cmp dword [rsp + 0x40], eax
jge 0x140017b86
mov dword [rsp + 0x44], 0
jmp 0x140017b5c
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
mov eax, dword [0x1403b8c84]
cmp dword [rsp + 0x44], eax
jge 0x140017b84
movsxd rax, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x44]
mov rdx, qword [0x1403b8c58]
mov rax, qword [rdx + rax*8]
mov byte [rax + rcx*8 + 4], 0
jmp 0x140017b52
jmp 0x140017b32
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov ecx, 1
call fcn.1400160b0
cmp dword [0x140326ba4], 0
je 0x140017ba8
jmp 0x1400182df
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x118], 0
mov rcx, qword [0x1403b8c10]
call fcn.14011b740
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140017db6
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x50]
movzx ecx, word [rcx + rax]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
cmp eax, 0x59
jne 0x140017d6a
cmp dword [0x1403b8c20], 0
jne 0x140017c7e
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x118], 1
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x50]
mov edx, dword [0x1403b8c1c]
mov eax, dword [rcx + rax]
sub eax, edx
mov ecx, 4
imul rcx, rcx, 1
mov dword [rsp + rcx + 0x118], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x50]
mov edx, dword [0x1403b8c8c]
mov eax, dword [rcx + rax]
sub eax, edx
mov ecx, 4
imul rcx, rcx, 2
mov dword [rsp + rcx + 0x118], eax
jmp 0x140017d68
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x50]
mov edx, dword [0x1403b8c68]
cmp dword [rcx + rax], edx
jl 0x140017d68
mov eax, 4
imul rax, rax, 1
mov ecx, dword [0x1403b8c6c]
mov edx, dword [0x1403b8c68]
add edx, ecx
mov ecx, edx
mov rdx, qword [rsp + 0x50]
cmp dword [rdx + rax], ecx
jg 0x140017d68
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x50]
mov edx, dword [0x1403b8c54]
cmp dword [rcx + rax], edx
jl 0x140017d68
mov eax, 4
imul rax, rax, 2
mov ecx, dword [0x1403b8c48]
mov edx, dword [0x1403b8c54]
add edx, ecx
mov ecx, edx
mov rdx, qword [rsp + 0x50]
cmp dword [rdx + rax], ecx
jg 0x140017d68
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x118], 1
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x50]
mov edx, dword [0x1403b8c68]
mov eax, dword [rcx + rax]
sub eax, edx
mov ecx, 4
imul rcx, rcx, 1
mov dword [rsp + rcx + 0x118], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x50]
mov edx, dword [0x1403b8c54]
mov eax, dword [rcx + rax]
sub eax, edx
mov ecx, 4
imul rcx, rcx, 2
mov dword [rsp + rcx + 0x118], eax
jmp 0x140017da7
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x50]
movzx ecx, word [rcx + rax]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
cmp eax, 0x58
jne 0x140017d91
cmp dword [rsp + 0x58], 0
jne 0x140017da7
mov r8, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov edx, dword [rax - 0x18]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call fcn.140113b40
jmp 0x140017bc9
mov eax, 4
imul rax, rax, 0
cmp dword [rsp + rax + 0x118], 0
jne 0x140017eb3
cmp dword [0x1403b8ab4], 0
jne 0x140017de3
cmp dword [0x1403b8c18], 0
jne 0x140017eb3
mov eax, 4
imul rax, rax, 0
mov dword [rsp + rax + 0x118], 1
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0x18
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetCursorInfo]
cmp dword [0x1403b8c20], 0
jne 0x140017e71
mov eax, dword [0x1403b8c1c]
mov ecx, dword [rsp + 0xa0]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 1
mov dword [rsp + rcx + 0x118], eax
mov eax, dword [0x1403b8c8c]
mov ecx, dword [rsp + 0xa4]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 2
mov dword [rsp + rcx + 0x118], eax
jmp 0x140017eb3
mov eax, dword [0x1403b8c68]
mov ecx, dword [rsp + 0xa0]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 1
mov dword [rsp + rcx + 0x118], eax
mov eax, dword [0x1403b8c54]
mov ecx, dword [rsp + 0xa4]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 2
mov dword [rsp + rcx + 0x118], eax
mov eax, 4
imul rax, rax, 0
cmp dword [rsp + rax + 0x118], 0
je 0x140017f34
cmp dword [rsp + 0x58], 0
jne 0x140017f32
mov dword [rsp + 0x58], 1
mov cx, 0x58
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 2
imul rcx, rcx, 0
mov word [rsp + rcx + 0x128], ax
mov cx, 5
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 2
imul rcx, rcx, 1
mov word [rsp + rcx + 0x128], ax
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x128], reloc.WS2_32.dll_ntohl
mov r8, qword [rsp + 0x60]
mov edx, 5
lea rcx, [rsp + 0x128]
call qword [rsp + 0x68]
jmp 0x140017fa6
cmp dword [rsp + 0x58], 0
je 0x140017fa6
mov dword [rsp + 0x58], 0
mov cx, 0x58
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 2
imul rcx, rcx, 0
mov word [rsp + rcx + 0x130], ax
mov cx, 5
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 2
imul rcx, rcx, 1
mov word [rsp + rcx + 0x130], ax
mov eax, 1
imul rax, rax, 4
movzx ecx, byte [reloc.WS2_32.dll_connect]
mov byte [rsp + rax + 0x130], cl
mov r8, qword [rsp + 0x60]
mov edx, 5
lea rcx, [rsp + 0x130]
call qword [rsp + 0x68]
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x78]
call fcn.14001a7d0
cmp eax, 1
je 0x140017fcd
cmp qword [rsp + 0x78], 0
jne 0x140018003
cmp dword [0x1403b8c64], 0
jne 0x140017ff4
lea r9, str.KVM__SLAVE_:_get_desktop_buffer___failed
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x1403b8c28]
call fcn.140129b00
mov dword [0x140326ba4], 1
jmp 0x140018280
mov r8d, dword [0x1403b8c4c]
mov edx, dword [0x1403b8c70]
lea rcx, [rsp + 0xb8]
call fcn.14001af20
lea rcx, [rsp + 0xe8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x2c
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x40], 0
jmp 0x140018046
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [0x1403b8c74]
cmp dword [rsp + 0x40], eax
jge 0x140018259
mov dword [rsp + 0x44], 0
jmp 0x14001806a
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
mov eax, dword [0x1403b8c84]
cmp dword [rsp + 0x44], eax
jge 0x140018254
mov eax, dword [0x1403b8c4c]
imul eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
mov eax, dword [0x1403b8c70]
imul eax, dword [rsp + 0x44]
mov dword [rsp + 0x5c], eax
cmp dword [0x140326ba4], 0
jne 0x1400180b7
cmp dword [0x1403b8c44], 0
je 0x1400180b7
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140018098
cmp dword [0x140326ba4], 0
jne 0x1400180ce
mov eax, dword [0x140326c04]
cmp dword [0x140326c1c], eax
je 0x1400180e7
mov eax, dword [0x1403b8c88]
mov dword [rsp + 0x48], eax
mov eax, dword [0x1403b8c38]
mov dword [rsp + 0x5c], eax
jmp 0x140018254
movsxd rax, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x44]
mov rdx, qword [0x1403b8c58]
mov rax, qword [rdx + rax*8]
movsx eax, byte [rax + rcx*8 + 4]
cmp eax, 1
je 0x140018125
movsxd rax, dword [rsp + 0x40]
movsxd rcx, dword [rsp + 0x44]
mov rdx, qword [0x1403b8c58]
mov rax, qword [rdx + rax*8]
movsx eax, byte [rax + rcx*8 + 4]
cmp eax, 3
jne 0x14001812a
jmp 0x140018060
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x80]
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x5c]
call fcn.14001a190
cmp eax, 1
jne 0x14001816b
jmp 0x140018060
cmp qword [rsp + 0x80], 0
je 0x14001824f
cmp dword [0x140326ba4], 0
jne 0x14001824f
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x80]
call qword [rsp + 0x68]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0xfffffffc
je 0x140018224
cmp dword [rsp + 0x70], 0
je 0x1400181b6
jmp 0x140018242
mov dword [0x1403b8c44], 1
cmp qword [0x1403b96c0], 0
je 0x1400181f7
mov eax, 4
imul rax, rax, 2
mov rcx, qword [0x1403b96c0]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rsp + 0x88], rax
jmp 0x140018203
mov qword [rsp + 0x88], 0
lea r9, str.Agent_KVM:_KVM_PAUSE
mov r8d, 4
mov edx, 0x200
mov rcx, qword [rsp + 0x88]
call fcn.140129b00
jmp 0x140018242
mov dword [0x140326ba4], 1
mov eax, dword [0x1403b8c88]
mov dword [rsp + 0x48], eax
mov eax, dword [0x1403b8c38]
mov dword [rsp + 0x5c], eax
mov rcx, qword [rsp + 0x80]
call fcn.14027a7c0
jmp 0x140018060
jmp 0x14001803c
cmp qword [rsp + 0x78], 0
je 0x14001826b
mov rcx, qword [rsp + 0x78]
call fcn.14027a7c0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0xb0], 0
mov eax, dword [0x1403b8c60]
mov dword [rsp + 0x48], eax
cmp dword [0x140326ba4], 0
jne 0x1400182da
cmp dword [rsp + 0x48], 0
jle 0x1400182da
cmp dword [rsp + 0x48], 0x32
jle 0x1400182b9
mov eax, dword [rsp + 0x48]
sub eax, 0x32
mov dword [rsp + 0x48], eax
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400182cb
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x48], 0
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x14001828a
jmp 0x140017b1b
cmp qword [0x1403b8c58], 0
je 0x140018337
mov dword [rsp + 0x40], 0
jmp 0x1400182fd
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [0x1403b8c74]
cmp dword [rsp + 0x40], eax
jge 0x140018320
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [0x1403b8c58]
mov rcx, qword [rcx + rax*8]
call fcn.14027a7c0
jmp 0x1400182f3
mov rcx, qword [0x1403b8c58]
call fcn.14027a7c0
mov qword [0x1403b8c58], 0
call fcn.14001b190
call fcn.140014930
mov rcx, qword [0x1403b8c10]
call fcn.14011b740
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140018366
mov rcx, qword [rsp + 0x50]
call fcn.140113b40
jmp 0x140018341
mov rcx, qword [0x1403b8c10]
call fcn.14011b6b0
lea r9, str.KVM__SLAVE_:_Process_Exiting...
mov r8d, 2
mov edx, 0x200
mov rcx, qword [0x1403b8c28]
call fcn.140129b00
mov dword [0x1403b8c34], 0
mov rcx, qword [rsp + 0x160]
call fcn.14027a7c0
xor eax, eax
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14026d940
add rsp, 0x148
pop rdi
pop rsi
ret