Function at 0x140004720
Capabilities:
Check for time delay via gettickcount
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x5f8
mov rax, qword [0x14000d018]
xor rax, rsp
mov qword [rsp + 0x5e0], rax
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x390]
lea rcx, [0x14000ab00]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x250
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
lea rdx, [rsp + 0xd0]
mov cx, 0x102
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rax, qword [rsp + 0x610]
mov byte [rax + 0x4d], 0
mov rax, qword [rsp + 0x610]
mov byte [rax + 1], 0
mov rax, qword [rsp + 0x610]
mov byte [rax], 0
mov rax, qword [rsp + 0x610]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x610]
mov byte [rax + 0x54], 1
mov rax, qword [rsp + 0x610]
mov byte [rax + 0x56], 1
mov rax, qword [rsp + 0x610]
mov byte [rax + 0x55], 0
mov rax, qword [rsp + 0x610]
mov byte [rax + 2], 0
mov dword [rsp + 0x30], 0
jmp 0x140004801
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x15
jge 0x14000482f
mov eax, dword [rsp + 0x30]
add eax, 0x1d
cdqe
movzx eax, byte [rsp + rax + 0x390]
sub eax, 2
mov ecx, dword [rsp + 0x30]
add ecx, 0x1d
movsxd rcx, ecx
mov byte [rsp + rcx + 0x390], al
jmp 0x1400047f7
lea rax, [rsp + 0x3ad]
mov rcx, qword [rsp + 0x610]
add rcx, 0x64
mov r8, rax
mov edx, socket
call fcn.1400063d0
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
mov dword [rsp + 0xb0], reloc.WS2_32.dll_recv
mov dword [rsp + 0x34], 0
jmp 0x140004888
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x15
jge 0x1400048b6
mov eax, dword [rsp + 0x34]
add eax, 0x1d
cdqe
movzx eax, byte [rsp + rax + 0x390]
add eax, 2
mov ecx, dword [rsp + 0x34]
add ecx, 0x1d
movsxd rcx, ecx
mov byte [rsp + rcx + 0x390], al
jmp 0x14000487e
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
mov rax, qword [rsp + 0x610]
mov dword [rax + 0x40], 0
mov ecx, 0x1e
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rsp + 0x610]
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + 0x610]
mov rdi, qword [rax + 0x28]
xor eax, eax
mov ecx, 0x1d
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x610]
mov rax, qword [rax + 0x28]
lea rcx, str.auth.rf_cheats.ru
mov rdi, rax
mov rsi, rcx
mov ecx, send
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
mov rax, qword [rsp + 0x610]
mov dword [rax + 0x48], 0
mov rax, qword [rsp + 0x610]
mov dword [rax + 0x3c], 0
mov rax, qword [rsp + 0x610]
mov dword [rax + 0x50], 0
mov rcx, qword [rsp + 0x610]
call fcn.140005860
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x1400049a7
mov rax, qword [rsp + 0x610]
mov rdi, qword [rax + 0x28]
xor eax, eax
mov ecx, 0x1d
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
mov rax, qword [rsp + 0x610]
mov dword [rax + 0x30], 0
mov rax, qword [rsp + 0x610]
mov dword [rax + 0x34], 0
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
mov rax, qword [rsp + 0x610]
mov byte [rax + 2], 1
lea rax, [rsp + 0xbc]
lea rax, [rsp + 0xbc]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
xor r9d, r9d
mov r8d, 0xc7
lea rdx, str.GET__AALogin.dat_HTTP_1.1_r_nHost:_auth.rf_cheats.ru_r_nUser_Agent:_XC_bypass_v1.0b__account_verification__r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9___q0.8_r_nConnection:_close_r_n_r_n
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_send]
mov ecx, 0x9c6
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rsp + 0x610]
mov qword [rcx + 0x18], rax
mov dword [rsp + 0x70], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
xor eax, eax
cmp eax, 1
je 0x140004b53
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x610]
add rax, qword [rcx + 0x18]
xor r9d, r9d
mov r8d, 0x9c5
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x4c]
cmp eax, 0xea60
jbe 0x140004ae7
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp dword [rsp + 0x38], 0
jne 0x140004af0
jmp 0x140004b53
cmp dword [rsp + 0x38], 0xffffffff
jne 0x140004afb
jmp 0x140004a97
cmp dword [rsp + 0x38], 0
jle 0x140004b4e
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add eax, 0x9c6
mov eax, eax
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rdx, rax
mov rax, qword [rsp + 0x610]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rcx, qword [rsp + 0x610]
mov qword [rcx + 0x18], rax
jmp 0x140004a97
jmp 0x140004a97
mov rax, qword [rsp + 0x610]
mov rcx, qword [rsp + 0x610]
mov rcx, qword [rcx + 0x18]
mov qword [rax + 0x20], rcx
mov r8d, 4
lea rdx, str._r_n_r_n
mov rax, qword [rsp + 0x610]
mov rcx, qword [rax + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004baa
mov rax, qword [rsp + 0x610]
mov rax, qword [rax + 0x20]
inc rax
mov rcx, qword [rsp + 0x610]
mov qword [rcx + 0x20], rax
jmp 0x140004b6b
mov rax, qword [rsp + 0x610]
mov rax, qword [rax + 0x20]
add rax, 4
mov rcx, qword [rsp + 0x610]
mov qword [rcx + 0x20], rax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x610]
mov rcx, qword [rcx + 0x18]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x610]
sub rax, qword [rcx + 0x20]
mov rcx, qword [rsp + 0x610]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 4]
mov ecx, dword [rsp + 0x20]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x610]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 8]
add eax, 2
mov eax, eax
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rsp + 0x610]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 8]
inc eax
cdqe
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x610]
mov rdi, qword [rcx + 0x10]
xor eax, eax
mov rcx, qword [rsp + 0x78]
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x610]
movsxd rax, dword [rax + 8]
mov rcx, qword [rsp + 0x610]
mov rdx, qword [rsp + 0x610]
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rdx + 0x18]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x610]
mov dword [rax + 0x44], 0x93b9ff
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 4]
cdq
and edx, 7
add eax, edx
and eax, 7
sub eax, edx
test eax, eax
je 0x140004cc5
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rax, [rsp + 0x270]
lea rcx, str.v1.0b
mov rdi, rax
mov rsi, rcx
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x278]
lea rcx, str.Freeware_P3riod
mov rdi, rax
mov rsi, rcx
mov ecx, send
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 4]
add eax, 2
mov eax, eax
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x74], 0
lea rax, [rsp + 0x290]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
lea rcx, [rsp + 0x290]
call fcn.1400052a0
movzx eax, al
test eax, eax
je 0x140004d82
mov rax, qword [rsp + 0x610]
movsxd rax, dword [rax + 4]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x610]
mov rdi, qword [rcx + 0x20]
xor eax, eax
mov rcx, qword [rsp + 0x80]
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x610]
movsxd rax, dword [rax + 4]
mov rcx, qword [rsp + 0x610]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rcx + 0x20]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
lea rax, [rsp + 0x290]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
cmp byte [rax + rcx], 0
jne 0x140004dd6
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x610]
mov dword [rcx + 0x40], eax
mov rax, qword [rsp + 0x610]
mov dword [rax + 0x3c], 0
jmp 0x140004e27
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 0x3c]
inc eax
mov rcx, qword [rsp + 0x610]
mov dword [rcx + 0x3c], eax
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 4]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov rcx, qword [rsp + 0x610]
cmp dword [rcx + 0x3c], eax
jge 0x140004e78
mov rax, qword [rsp + 0x610]
add rax, 0x64
mov rcx, qword [rsp + 0x610]
mov ecx, dword [rcx + 0x3c]
shl ecx, 2
movsxd rcx, ecx
mov rdx, qword [rsp + 0x28]
lea rcx, [rdx + rcx*2]
mov rdx, rax
call fcn.140005a90
jmp 0x140004e0f
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
mov rax, qword [rsp + 0x610]
mov rcx, qword [rsp + 0x610]
mov ecx, dword [rcx + 4]
mov dword [rax + 0x38], ecx
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 4]
dec eax
cdqe
mov rcx, qword [rsp + 0x28]
movsx eax, byte [rcx + rax]
cmp eax, 0xa
jne 0x140004ef6
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 4]
dec eax
cdqe
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax], 0
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 4]
dec eax
mov rcx, qword [rsp + 0x610]
mov dword [rcx + 4], eax
jmp 0x140004ea7
mov dword [rsp + 0x3c], 0
jmp 0x140004f0a
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 4]
cmp dword [rsp + 0x3c], eax
jge 0x140004f3b
movsxd rax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x28]
movsx eax, byte [rcx + rax]
xor eax, 8
movsxd rcx, dword [rsp + 0x3c]
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx], al
jmp 0x140004f00
mov dword [rsp + 0x40], 0
jmp 0x140004f4f
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
lea rcx, [rsp + 0x270]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x60], 0xffffffffffffffff
inc qword [rsp + 0x60]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x60]
cmp byte [rcx + rdx], 0
jne 0x140004f6d
mov rcx, qword [rsp + 0x60]
cmp rax, rcx
jae 0x140004fad
movsxd rax, dword [rsp + 0x40]
movsx eax, byte [rsp + rax + 0x270]
xor eax, 8
movsxd rcx, dword [rsp + 0x40]
mov byte [rsp + rcx + 0x270], al
jmp 0x140004f45
mov dword [rsp + 0x44], 0
jmp 0x140004fc1
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
lea rcx, [rsp + 0x278]
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x68], 0xffffffffffffffff
inc qword [rsp + 0x68]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x68]
cmp byte [rcx + rdx], 0
jne 0x140004fdf
mov rcx, qword [rsp + 0x68]
cmp rax, rcx
jae 0x14000501f
movsxd rax, dword [rsp + 0x44]
movsx eax, byte [rsp + rax + 0x278]
xor eax, 8
movsxd rcx, dword [rsp + 0x44]
mov byte [rsp + rcx + 0x278], al
jmp 0x140004fb7
lea rdx, [rsp + 0x270]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x140005044
mov rax, qword [rsp + 0x610]
mov byte [rax + 0x4c], 1
jmp 0x140005050
mov rax, qword [rsp + 0x610]
mov byte [rax + 0x4c], 0
lea rdx, [rsp + 0x278]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140005075
mov rax, qword [rsp + 0x610]
mov byte [rax + 0x4d], 1
jmp 0x140005081
mov rax, qword [rsp + 0x610]
mov byte [rax + 0x4d], 0
mov rax, qword [rsp + 0x610]
cmp dword [rax + 0x40], 4
jge 0x14000509e
mov rax, qword [rsp + 0x610]
mov dword [rax + 0x40], 0x3a0
mov rax, qword [rsp + 0x610]
mov dword [rax + 0x50], 2
jmp 0x1400050c7
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 0x50]
inc eax
mov rcx, qword [rsp + 0x610]
mov dword [rcx + 0x50], eax
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 4]
add eax, 2
mov rcx, qword [rsp + 0x610]
sub eax, dword [rcx + 0x40]
mov rcx, qword [rsp + 0x610]
cmp dword [rcx + 0x50], eax
jge 0x140005171
mov rax, qword [rsp + 0x610]
movsxd rax, dword [rax + 0x40]
mov rcx, qword [rsp + 0x610]
movsxd rcx, dword [rcx + 0x50]
mov rdx, qword [rsp + 0x28]
add rdx, rcx
mov rcx, rdx
mov r8, rax
lea rdx, [rsp + 0x290]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140005143
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 0x44]
add eax, 3
mov rcx, qword [rsp + 0x610]
mov dword [rcx + 0x44], eax
jmp 0x14000516c
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
mov eax, edx
mov rcx, qword [rsp + 0x610]
mov ecx, dword [rcx + 0x50]
sub ecx, 2
movsxd rcx, ecx
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx], al
jmp 0x1400050af
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
mov rax, qword [rsp + 0x610]
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0xa0], rax
mov rdi, qword [rsp + 0x28]
xor eax, eax
mov rcx, qword [rsp + 0xa0]
rep stosb byte [rdi], al
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x290], 0x36
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 0x40]
sub eax, 2
cdqe
mov byte [rsp + rax + 0x290], reloc.WS2_32.dll_listen
mov rax, qword [rsp + 0x610]
mov eax, dword [rax + 0x40]
dec eax
cdqe
mov byte [rsp + rax + 0x290], 0xa
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
mov rax, qword [rsp + 0x610]
movsxd rax, dword [rax + 0x40]
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x290]
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0xa8]
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x610]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rax, qword [rsp + 0x610]
movzx eax, byte [rax + 0x55]
inc al
mov rcx, qword [rsp + 0x610]
mov byte [rcx + 0x55], al
mov rax, qword [rsp + 0x610]
mov rcx, qword [rsp + 0x5e0]
xor rcx, rsp
call fcn.140006cf0
add rsp, 0x5f8
pop rdi
pop rsi
ret