Function at 0x1800098c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create directory
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Set file attributes
Terminate process

Disassembly:
push rdi
sub rsp, 0xa20
mov rax, qword [0x18004a0c0]
xor rax, rsp
mov qword [rsp + 0xa10], rax
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [0x18004ce20]
call fcn.1800029f0
nop
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x68], rax
lea rdx, str.74_40_BA_3A_01_00_00_48_8D_4C_24_68
mov rcx, qword [rsp + 0x58]
call fcn.1800019f0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea rdx, [0x1800437a0]
mov rcx, qword [rsp + 0x68]
call fcn.1800019f0
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
lea rcx, [0x18004ce20]
call fcn.180002b00
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x80], rax
lea rdx, [0x1800437b0]
mov rcx, qword [rsp + 0x80]
call fcn.1800019f0
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [0x18004ce20]
call fcn.180002e50
nop
mov rax, qword [rsp + 0x90]
mov byte [rax], 0xeb
lea rax, [rsp + 0x200]
mov qword [rsp + 0x98], rax
lea rdx, [0x1800437c0]
mov rcx, qword [rsp + 0x98]
call fcn.1800019f0
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0xa0]
lea rcx, [0x18004ce20]
call fcn.180002f70
nop
lea rax, [rsp + 0x220]
mov qword [rsp + 0xa8], rax
lea rdx, str.E8_____04_00_90_48_83_C4_78_C3
mov rcx, qword [rsp + 0xa8]
call fcn.1800019f0
mov qword [rsp + 0xb0], rax
mov r8b, 1
mov rdx, qword [rsp + 0xb0]
lea rcx, [0x18004ce20]
call fcn.180003090
nop
lea rax, [rsp + 0x180]
mov qword [rsp + 0xb8], rax
lea rdx, str.33_C0_EB_0F_48_85_D2_74_1E_38
mov rcx, qword [rsp + 0xb8]
call fcn.1800019f0
mov qword [rsp + 0xc0], rax
xor r8d, r8d
mov rdx, qword [rsp + 0xc0]
lea rcx, [0x18004ce20]
call fcn.180003090
nop
lea rdx, [rsp + 0x670]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x20], rax
lea rcx, [0x180043810]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x500]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
mov eax, 2
mov word [rsp + 0x500], ax
mov cx, 0xd2f
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x502], ax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x504], eax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x500]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x180009b9e
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x28], eax
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180009b92
mov edx, 2
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
cmp eax, 1
je 0x18000a2bf
call fcn.180009720
mov rdx, rax
lea rcx, [rsp + 0x5f0]
call fcn.180007bb0
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0x650]
call fcn.180009650
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xe0], rax
lea r8, [0x18004381c]
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x5d0]
call fcn.18000dbd0
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf8], rax
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0x5b0]
call fcn.18000dc30
nop
lea rcx, [rsp + 0x5d0]
call fcn.180001950
nop
lea rcx, [rsp + 0x650]
call fcn.180001950
nop
lea rcx, [rsp + 0x5f0]
call fcn.180001950
nop
lea rax, [rsp + 0x240]
mov qword [rsp + 0x100], rax
lea rdx, [rsp + 0x5b0]
mov rcx, qword [rsp + 0x100]
call fcn.180003680
mov qword [rsp + 0x108], rax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x590]
call fcn.18000ff60
nop
lea rdx, str.C:WindowsLocalLockEncrypt.sys
lea rcx, [rsp + 0x510]
call fcn.1800019f0
nop
lea rcx, [rsp + 0x510]
call fcn.180003570
mov rcx, rax
call fcn.180009760
test eax, eax
jne 0x180009dec
mov edx, 1
lea rcx, [rsp + 0x3f0]
call fcn.18000ba30
nop
lea rcx, [rsp + 0x510]
call fcn.180003570
mov r9d, 0x40
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0x3f0]
call fcn.18000b8e0
nop
lea rcx, [rsp + 0x3f0]
call fcn.18000b980
movzx eax, al
test eax, eax
je 0x180009dd0
lea rcx, [rsp + 0x590]
call fcn.180001910
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0x590]
call fcn.180003570
mov rcx, qword [rsp + 0x110]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x3f0]
call fcn.18000bb00
lea rcx, [rsp + 0x510]
call fcn.180003570
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x510]
call fcn.180003570
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x510]
call fcn.180003570
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
lea rcx, [rsp + 0x3f0]
call fcn.18000b890
nop
lea rcx, [rsp + 0x3f0]
call fcn.18000a2e0
nop
mov edx, 1
lea rcx, [rsp + 0x2e0]
call fcn.18000a4e0
nop
lea rcx, [rsp + 0x510]
call fcn.180003570
mov r9d, 0x40
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x2e0]
call fcn.18000a3b0
lea rdx, [0x1800433fd]
lea rcx, [rsp + 0x550]
call fcn.1800019f0
nop
mov rax, qword [rsp + 0x2e0]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x2e0]
mov rcx, rax
call fcn.180009290
movzx eax, al
test eax, eax
jne 0x180009ea9
lea rcx, [rsp + 0x570]
call fcn.180001a40
nop
lea rdx, [rsp + 0x570]
lea rcx, [rsp + 0x2e0]
call fcn.18000dc80
lea rdx, [rsp + 0x570]
lea rcx, [rsp + 0x550]
call fcn.18000bda0
nop
lea rcx, [rsp + 0x570]
call fcn.180001950
nop
jmp 0x180009e3d
lea rcx, [rsp + 0x2e0]
call fcn.18000a360
nop
lea rax, [rsp + 0x260]
mov qword [rsp + 0x118], rax
lea rdx, [0x180043840]
mov rcx, qword [rsp + 0x118]
call fcn.1800019f0
mov qword [rsp + 0x120], rax
mov r8, qword [rsp + 0x120]
lea rdx, [rsp + 0x630]
lea rcx, [0x18004ce20]
call fcn.180003220
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x130], rax
mov r8, qword [rsp + 0x130]
lea rdx, [0x180043850]
lea rcx, [rsp + 0x610]
call fcn.18000dce0
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x140], rax
mov rdx, qword [rsp + 0x140]
lea rcx, [rsp + 0x550]
call fcn.18000bda0
nop
lea rcx, [rsp + 0x610]
call fcn.180001950
nop
lea rcx, [rsp + 0x630]
call fcn.180001950
nop
lea rax, [rsp + 0x280]
mov qword [rsp + 0x148], rax
lea rdx, [rsp + 0x550]
mov rcx, qword [rsp + 0x148]
call fcn.180003680
mov qword [rsp + 0x150], rax
mov r8, qword [rsp + 0x150]
mov dx, 0x7530
mov rcx, qword [rsp + 0x20]
call fcn.1800097a0
nop
lea rax, [rsp + 0x810]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rsp + 0x810]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_recv]
nop
lea rdx, [0x180043854]
lea rcx, [rsp + 0x810]
call fcn.180007b10
test rax, rax
je 0x18000a072
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x2c], eax
mov r8d, dword [rsp + 0x2c]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x18000a061
mov edx, 2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [0x180043858]
lea rcx, [rsp + 0x810]
call fcn.180007b10
test rax, rax
je 0x18000a1fc
lea rdx, str.C:Program_Files__x86_Shield_Log
lea rcx, [rsp + 0x530]
call fcn.1800019f0
nop
lea rcx, [rsp + 0x530]
call fcn.180003570
mov rcx, rax
call fcn.180009760
test eax, eax
jne 0x18000a0d6
lea rcx, [rsp + 0x530]
call fcn.180003570
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop
lea rcx, [rsp + 0x530]
call fcn.180003570
mov rcx, rax
call fcn.180009760
cmp eax, 1
jne 0x18000a106
lea rcx, [rsp + 0x530]
call fcn.180003570
mov rcx, rax
call fcn.18001f34c
nop
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x168], rax
lea rdx, [rsp + 0x530]
mov rcx, qword [rsp + 0x158]
call fcn.180003680
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x170], rax
lea rdx, str.MapleStory.exe
mov rcx, qword [rsp + 0x168]
call fcn.1800019f0
mov qword [rsp + 0x178], rax
mov r8, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x178]
lea rcx, [0x18004ce20]
call fcn.1800033b0
nop
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x30], eax
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18000a1e2
mov edx, 2
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x18000a268
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x34], eax
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18000a25c
mov edx, 2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x550]
call fcn.180001950
nop
lea rcx, [rsp + 0x2e0]
call fcn.18000a320
nop
lea rcx, [rsp + 0x510]
call fcn.180001950
nop
lea rcx, [rsp + 0x590]
call fcn.180001950
nop
lea rcx, [rsp + 0x5b0]
call fcn.180001950
nop
jmp 0x180009b9e
xor al, al
mov rcx, qword [rsp + 0xa10]
xor rcx, rsp
call fcn.180015880
add rsp, 0xa20
pop rdi
ret