Function at 0x140189bc0
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x198
lea rdi, [rsp + 0x30]
mov ecx, 0x5a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1b0]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x188], rax
lea rax, [rsp + 0x38]
lea rcx, str.258EAFA5_E914_47DA_95CA_C5AB0DC85B11
mov rdi, rax
mov rsi, rcx
mov ecx, 0x25
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rax + 0x100]
call fcn.140160f50
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 0
jne 0x140189c47
mov eax, 1
jmp 0x140189fdc
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rsp + 0x1b8]
mov dword [rax + 0x150], ecx
mov rax, qword [rsp + 0x1b0]
cmp dword [rax + 0x150], 0
jle 0x140189d57
mov rax, qword [rsp + 0x1b0]
cmp dword [rax + 0x150], 0x1000
jge 0x140189c9c
mov rax, qword [rsp + 0x1b0]
mov eax, dword [rax + 0x150]
mov dword [rsp + 0x170], eax
jmp 0x140189ca7
mov dword [rsp + 0x170], 0x1000
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rsp + 0x170]
mov dword [rax + 0x14c], ecx
mov rax, qword [rsp + 0x1b0]
movsxd rax, dword [rax + 0x14c]
mov r9d, 0x576
lea r8, [0x140569a10]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x178]
mov qword [rax + 0x140], rcx
cmp qword [rsp + 0x178], 0
jne 0x140189d57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x576
lea rdx, [0x140569a60]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x576
lea rdx, [0x140569ab0]
lea rcx, [0x140569af8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
lea r9, [rsp + 0x124]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Sec_WebSocket_Key
mov rcx, qword [rsp + 0x158]
call fcn.140148270
mov qword [rsp + 0x118], rax
movsxd rax, dword [rsp + 0x124]
mov r9d, 0x25
lea r8, [rsp + 0x38]
mov rdx, rax
mov rcx, qword [rsp + 0x118]
call fcn.1401449e0
mov qword [rsp + 0x148], rax
lea rcx, [rsp + 0x80]
call fcn.1401b1ae0
movsxd rax, dword [rsp + 0x124]
add rax, 0x25
mov rdx, rax
mov rcx, qword [rsp + 0x148]
call fcn.140188870
mov r8, rax
mov rdx, qword [rsp + 0x148]
lea rcx, [rsp + 0x80]
call fcn.1401b1b90
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xf8]
call fcn.1401b15f0
nop
mov eax, 1
imul rax, rax, 0x14
mov qword [rsp + 0x168], rax
cmp qword [rsp + 0x168], 0x15
jae 0x140189e21
jmp 0x140189e27
call fcn.14037c0a0
nop
mov rax, qword [rsp + 0x168]
mov byte [rsp + rax + 0xf8], 0
mov edx, 1
mov rcx, qword [rsp + 0x148]
call fcn.1403ba8b0
mov qword [rsp + 0x148], 0
lea r8, [rsp + 0x148]
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0xf8]
call fcn.1401473a0
mov dword [rsp + 0x154], eax
mov rcx, qword [rsp + 0x158]
call fcn.140149f10
mov rcx, qword [rsp + 0x1b0]
mov qword [rcx + 0x160], rax
mov dword [rsp + 0x20], 0
mov r9d, 1
mov r8d, 0x61
lea rdx, str.HTTP_1.1_101_Switching_Protocols_r_nUpgrade:_websocket_r_nConnection:_Upgrade_r_nSec_WebSocket_Accept:
mov rcx, qword [rsp + 0x1b0]
call fcn.14018a5d0
movsxd rax, dword [rsp + 0x154]
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x1b0]
call fcn.14018a5d0
mov dword [rsp + 0x20], 0
mov r9d, 1
mov r8d, 4
lea rdx, [0x140569ba4]
mov rcx, qword [rsp + 0x1b0]
call fcn.14018a5d0
mov rax, qword [rsp + 0x1b0]
mov dword [rax + 0x114], 1
mov rax, qword [rsp + 0x1b0]
mov dword [rax + 0x60], 0x20
mov rax, qword [rsp + 0x1b0]
lea rcx, [fcn.14018a350]
mov qword [rax + 0x48], rcx
mov rax, qword [rsp + 0x1b0]
lea rcx, [0x14018db90]
mov qword [rax + 0x40], rcx
mov rax, qword [rsp + 0x1b0]
lea rcx, [0x14018a6c0]
mov qword [rax + 0x50], rcx
mov rax, qword [rsp + 0x1b0]
cmp qword [rax + 0x20], 0
je 0x140189fa2
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x1b0]
add rax, qword [rcx + 0x20]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rsp + 0x180], rax
jmp 0x140189fae
mov qword [rsp + 0x180], 0
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x20], rax
lea r9, str....WebSession__p__Upgraded_to_WebSocket
mov r8d, 2
mov edx, 0x80
mov rcx, qword [rsp + 0x180]
call fcn.1401589b0
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14043d3d0]
call fcn.14037c300
mov rax, rdi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x198
pop rdi
pop rsi
ret