Function at 0x180004be0
Capabilities:
Delete file
Get common file path
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x348], rbx
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov qword [rsp + 0x30], r8
mov r15, rdx
mov rbx, rcx
xor esi, esi
mov qword [rbp - 0x80], send
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x68], sil
mov qword [rbp - 0x58], send
mov qword [rbp - 0x60], rsi
mov byte [rbp - 0x70], sil
mov byte [rbp - 0x40], sil
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp - 0x3f]
call fcn.18014af80
mov byte [rbp + 0xd0], sil
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0xd1]
call fcn.18014af80
lea rdx, [rbp - 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x40]
repne scasb al, byte [rdi]
not rcx
cmp byte [rbp + rcx - 0x42], 0x5c
je 0x180004ca6
mov byte [rbp + rcx - 0x41], 0x5c
lea rdi, [rbp - 0x40]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.snap.exe]
mov qword [rdi - 1], rax
movzx eax, byte [0x180364aa8]
mov byte [rdi + 7], al
lea r8, [rbp - 0x40]
lea rdx, str._s.jpg
lea rcx, [rbp + 0xd0]
call fcn.180147ef4
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rbp - 0x40]
mov ecx, 0x69
call fcn.180009160
test eax, eax
je 0x180004ee5
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x40]
call fcn.1800046a0
test eax, eax
je 0x180004ecc
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x40]
call fcn.180004a30
nop
mov ecx, 0x7851
call fcn.1801474a8
mov rdi, rax
test rax, rax
je 0x180004ea0
xor edx, edx
mov r8d, 0x7851
mov rcx, rax
call fcn.18014af80
lea rcx, [rdi + 8]
mov r8d, 0x3f
mov rdx, rbx
call fcn.180147d90
mov r11d, reloc.WS2_32.dll_socket
mov word [rdi], r11w
mov r12d, esi
lea r14, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov eax, 0x88888889
imul ebx
add edx, ebx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ecx, edx
imul ecx, ecx, 0x7800
mov eax, ebx
sub eax, ecx
test eax, eax
jle 0x180004db3
inc edx
mov word [rdi + 6], dx
test ebx, ebx
jle 0x180004e96
nop
xor edx, edx
mov r8d, 0x7801
lea rcx, [rdi + 0x48]
call fcn.18014af80
mov edx, ebx
sub edx, r12d
mov eax, 0x7800
cmp edx, eax
cmovg edx, eax
mov word [rdi + 2], dx
movsxd r9, r12d
add r9, r14
movsx rdx, dx
lea r8, [0x180364674]
lea rcx, [rdi + 0x48]
call fcn.180148b60
movsx edx, word [rdi + 2]
add r12d, edx
inc word [rdi + 4]
mov edx, 0x7849
lea rcx, str.ReportScr_sendto_len:_d._n
call fcn.18000b040
movsx r8, word [rdi + 2]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
add r8d, 0x49
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.WS2_32.dll_sendto]
movsx r9d, word [rdi + 2]
movsx r8d, word [rdi + 6]
movsx edx, word [rdi + 4]
cmp eax, 0xffffffff
je 0x180004e82
mov esi, 1
lea rcx, str.ReportScr_sendto___d__d__len:_d_success._n
call fcn.18000b040
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, ebx
sub edx, r12d
test edx, edx
jg 0x180004dc0
jmp 0x180004e96
mov dword [rsp + 0x20], 0xffffffff
lea rcx, str.ReportScr_sendto____d__d__len:_d_failed:_d._n
call fcn.18000b040
mov rcx, rdi
call fcn.18014777c
jmp 0x180004eb8
lea r8, [rbp + 0xd0]
lea rdx, [rbp - 0x40]
lea rcx, str.ReportScr_GetSnapshot___s__s__failed._n
call fcn.18000b040
nop
cmp qword [rsp + 0x58], 0x10
jb 0x180004ef6
mov rcx, qword [rsp + 0x40]
call fcn.18000c5fc
jmp 0x180004ef6
lea r8, [rbp + 0xd0]
lea rdx, [rbp - 0x40]
lea rcx, str.ReportScr_GetSnapshot___s__s__failed._n
call fcn.18000b040
jmp 0x180004ef6
lea rdx, [rbp - 0x40]
lea rcx, str.ReportScr_ResourceRelease___s__failed._n
call fcn.18000b040
nop
mov eax, esi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.180146c80
mov rbx, qword [rsp + 0x348]
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret