Function at 0x14000d8c0
Capabilities:
Accept command line arguments
Create thread
Reference google public dns server

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x260
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400b0178]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x70], sendto
xor r15d, r15d
mov qword [rbp + 0x68], r15
mov byte [rbp + 0x58], r15b
xor r8d, r8d
lea rdx, [0x1400985da]
lea rcx, [rbp + 0x58]
call fcn.140007880
mov qword [rbp + 0x50], sendto
mov qword [rbp + 0x48], r15
mov byte [rbp + 0x38], r15b
xor r8d, r8d
lea rdx, [0x1400985da]
lea rcx, [rbp + 0x38]
call fcn.140007880
mov qword [rbp + 0x90], sendto
mov qword [rbp + 0x88], r15
mov byte [rbp + 0x78], r15b
xor r8d, r8d
lea rdx, [0x1400985da]
lea rcx, [rbp + 0x78]
call fcn.140007880
mov qword [rbp + 0x10], sendto
mov qword [rbp + 8], r15
mov byte [rbp - 8], r15b
xor r8d, r8d
lea rdx, [0x1400985da]
lea rcx, [rbp - 8]
call fcn.140007880
lea rcx, str.COMPUTERNAME
call fcn.140062fcc
mov qword [rbp + 0x30], sendto
mov qword [rbp + 0x28], r15
mov byte [rbp + 0x18], r15b
cmp byte [rax], r15b
jne 0x14000d9b7
mov r8d, r15d
jmp 0x14000d9c9
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x14000d9c0
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140007880
lea r14, [rbp + 0x18]
mov r8, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
cmovae r14, r8
lea rcx, [rbp + 0x18]
cmovae rcx, r8
mov rax, qword [rbp + 0x28]
add rax, rcx
lea rsi, [rbp + 0x18]
cmp rdx, 0x10
cmovae rsi, r8
mov rdi, rax
sub rdi, rsi
cmp rsi, rax
cmova rdi, r15
test rdi, rdi
je 0x14000da35
mov rbx, r15
nop dword [rax]
movsx ecx, byte [rsi + rbx]
call fcn.14006347c
mov byte [r14 + rbx], al
inc rbx
cmp rbx, rdi
jne 0x14000da20
mov qword [rbp - 0x50], sendto
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x68], r15b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x68]
call fcn.1400079b0
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x48]
call fcn.14000fb70
mov rdx, rax
lea r8, [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.14000f9a0
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.1400075e0
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x14000dad8
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, 0x1000
jb 0x14000dad3
test cl, 0x1f
je 0x14000daa6
call fcn.140062e60
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000dab5
call fcn.140062e60
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000dac4
call fcn.140062e60
int3
cmp rcx, 0x27
jbe 0x14000dad0
call fcn.140062e60
int3
mov rcx, rax
call fcn.140025800
mov qword [rbp - 0x50], sendto
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x68], r15b
mov r8d, 1
lea rdx, [0x14009ade8]
lea rcx, [rbp - 0x68]
call fcn.140007880
lea r8, [rbp - 0x68]
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x40]
call fcn.14000ff10
mov rax, qword [rsp + 0x40]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14000dd50
lea rdx, [rbx + 0x28]
mov qword [rbp - 0x30], sendto
mov qword [rbp - 0x38], r15
mov byte [rbp - 0x48], r15b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 0x48]
call fcn.1400079b0
mov r9d, 8
xor r8d, r8d
lea rdx, str._server
lea rcx, [rbp - 0x48]
call fcn.14000a740
cmp rax, 0xffffffffffffffff
je 0x14000dbb7
mov r9d, 8
xor r8d, r8d
lea rdx, str._server
lea rcx, [rbp - 0x48]
call fcn.14000a740
mov qword [rsp + 0x20], r15
lea r9, [0x1400985da]
mov r8d, 8
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140008750
lea rcx, [rbp + 0x58]
cmp rcx, rax
je 0x14000dbb7
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.1400079b0
mov r9d, 4
xor r8d, r8d
lea rdx, str._id
lea rcx, [rbp - 0x48]
call fcn.14000a740
cmp rax, 0xffffffffffffffff
je 0x14000dc29
mov r9d, 4
xor r8d, r8d
lea rdx, str._id
lea rcx, [rbp - 0x48]
call fcn.14000a740
mov qword [rsp + 0x20], r15
lea r9, [0x1400985da]
mov r8d, 4
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140008750
lea rcx, [rbp + 0x38]
cmp rcx, rax
je 0x14000dc29
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.1400079b0
mov r9d, 5
xor r8d, r8d
lea rdx, str._dns
lea rcx, [rbp - 0x48]
call fcn.14000a740
cmp rax, 0xffffffffffffffff
je 0x14000dc9b
mov r9d, 5
xor r8d, r8d
lea rdx, str._dns
lea rcx, [rbp - 0x48]
call fcn.14000a740
mov qword [rsp + 0x20], r15
lea r9, [0x1400985da]
mov r8d, 5
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140008750
lea rcx, [rbp + 0x78]
cmp rcx, rax
je 0x14000dc9b
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.1400079b0
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x14000dcdd
inc rax
mov rcx, qword [rbp - 0x48]
cmp rax, 0x1000
jb 0x14000dcd8
test cl, 0x1f
jne 0x14000dd4a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000dd44
sub rcx, rax
cmp rcx, 8
jb 0x14000dd3e
cmp rcx, 0x27
ja 0x14000dd38
mov rcx, rax
call fcn.140025800
cmp byte [rbx + 0x19], r15b
jne 0x14000dd2e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], r15b
jne 0x14000dd0e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r15b
jne 0x14000dd2e
nop dword [rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r15b
je 0x14000dd00
jmp 0x14000dd2e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], r15b
jne 0x14000dd2b
cmp rbx, qword [rax + 0x10]
jne 0x14000dd2b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], r15b
je 0x14000dd18
mov rbx, rax
cmp rbx, qword [rsp + 0x40]
jmp 0x14000db1b
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
mov qword [rbp + 0xb0], sendto
mov qword [rbp + 0xa8], r15
mov byte [rbp + 0x98], r15b
xor r8d, r8d
lea rdx, [0x1400985da]
lea rcx, [rbp + 0x98]
call fcn.140007880
cmp dword [rsp + 0x30], 1
jle 0x14000de87
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xc0], rax
mov r8d, 3
mov rdx, qword [rdi + 8]
lea rcx, [rbp + 0xc0]
call fcn.14000e8b0
mov qword [rbp - 0x50], sendto
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x68], r15b
mov rdx, qword [rbp + 0xc0]
cmp byte [rdx], r15b
jne 0x14000dde6
mov r8, r15
jmp 0x14000ddf9
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], r15b
jne 0x14000ddf0
lea rcx, [rbp - 0x68]
call fcn.140007880
lea rax, [rbp + 0xc8]
mov rcx, qword [rbp + 0xc0]
cmp rcx, rax
je 0x14000de1a
call fcn.140061de8
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x98]
call fcn.1400079b0
mov rax, qword [rbp - 0x50]
cmp rax, 0x10
jb 0x14000de87
inc rax
mov rcx, qword [rbp - 0x68]
cmp rax, 0x1000
jb 0x14000de82
test cl, 0x1f
je 0x14000de55
call fcn.140062e60
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000de64
call fcn.140062e60
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000de73
call fcn.140062e60
int3
cmp rcx, 0x27
jbe 0x14000de7f
call fcn.140062e60
int3
mov rcx, rax
call fcn.140025800
lea rdx, [0x1400985da]
lea rcx, [rbp + 0x98]
call fcn.140007430
test eax, eax
je 0x14000e424
mov qword [rbp - 0x50], sendto
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x68], r15b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x68]
call fcn.1400079b0
lea rdx, [rbp + 0x98]
lea rcx, [rsp + 0x78]
call fcn.14000fb70
mov rdx, rax
lea r8, [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.14000f9a0
mov rbx, rax
lea rax, [rbp - 8]
cmp rax, rbx
je 0x14000df6a
mov rcx, qword [rbp + 0x10]
cmp rcx, 0x10
jb 0x14000df4d
inc rcx
mov rdx, qword [rbp - 8]
cmp rcx, 0x1000
jb 0x14000df45
test dl, 0x1f
je 0x14000df18
call fcn.140062e60
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x14000df27
call fcn.140062e60
int3
sub rdx, rax
cmp rdx, 8
jae 0x14000df36
call fcn.140062e60
int3
cmp rdx, 0x27
jbe 0x14000df42
call fcn.140062e60
int3
mov rdx, rax
mov rcx, rdx
call fcn.140025800
mov qword [rbp + 0x10], sendto
mov qword [rbp + 8], r15
mov byte [rbp - 8], 0
mov rdx, rbx
lea rcx, [rbp - 8]
call fcn.140007d70
nop
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x14000dfc0
inc rax
mov rcx, qword [rbp - 0x28]
cmp rax, 0x1000
jb 0x14000dfbb
test cl, 0x1f
je 0x14000df8e
call fcn.140062e60
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000df9d
call fcn.140062e60
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000dfac
call fcn.140062e60
int3
cmp rcx, 0x27
jbe 0x14000dfb8
call fcn.140062e60
int3
mov rcx, rax
call fcn.140025800
mov qword [rbp - 0x50], sendto
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x68], 0
mov r8d, 1
lea rdx, [0x14009ade8]
lea rcx, [rbp - 0x68]
call fcn.140007880
lea r8, [rbp - 0x68]
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x48]
call fcn.14000ff10
mov r8, qword [rbp - 0x48]
mov rbx, qword [r8]
cmp rbx, r8
je 0x14000e407
lea rdx, [rbx + 0x28]
mov qword [rbp - 0x10], sendto
mov qword [rbp - 0x18], r15
mov byte [rbp - 0x28], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 0x28]
call fcn.1400079b0
mov r9d, 8
xor r8d, r8d
lea rdx, str._server
lea rcx, [rbp - 0x28]
call fcn.14000a740
cmp rax, 0xffffffffffffffff
je 0x14000e11e
mov r9d, 8
xor r8d, r8d
lea rdx, str._server
lea rcx, [rbp - 0x28]
call fcn.14000a740
mov qword [rsp + 0x20], r15
lea r9, [0x1400985da]
mov r8d, 8
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140008750
mov qword [rbp - 0x50], sendto
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x68], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.1400079b0
lea rdx, [0x1400985da]
lea rcx, [rbp - 0x68]
call fcn.140007430
test eax, eax
je 0x14000e0d0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x58]
call fcn.1400079b0
mov rax, qword [rbp - 0x50]
cmp rax, 0x10
jb 0x14000e11e
mov rcx, qword [rbp - 0x68]
inc rax
cmp rax, 0x1000
jb 0x14000e119
test cl, 0x1f
jne 0x14000e3b9
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000e3b3
sub rcx, rax
cmp rcx, 8
jb 0x14000e3ad
cmp rcx, 0x27
ja 0x14000e3a7
mov rcx, rax
call fcn.140025800
mov r9d, 4
xor r8d, r8d
lea rdx, str._id
lea rcx, [rbp - 0x28]
call fcn.14000a740
cmp rax, 0xffffffffffffffff
je 0x14000e211
mov r9d, 4
xor r8d, r8d
lea rdx, str._id
lea rcx, [rbp - 0x28]
call fcn.14000a740
mov qword [rsp + 0x20], r15
lea r9, [0x1400985da]
mov r8d, 4
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140008750
mov qword [rbp - 0x50], sendto
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x68], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.1400079b0
lea rdx, [0x1400985da]
lea rcx, [rbp - 0x68]
call fcn.140007430
test eax, eax
je 0x14000e1c3
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x38]
call fcn.1400079b0
mov rax, qword [rbp - 0x50]
cmp rax, 0x10
jb 0x14000e211
mov rcx, qword [rbp - 0x68]
inc rax
cmp rax, 0x1000
jb 0x14000e20c
test cl, 0x1f
jne 0x14000e3d1
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000e3cb
sub rcx, rax
cmp rcx, 8
jb 0x14000e3c5
cmp rcx, 0x27
ja 0x14000e3bf
mov rcx, rax
call fcn.140025800
mov r9d, 5
xor r8d, r8d
lea rdx, str._dns
lea rcx, [rbp - 0x28]
call fcn.14000a740
cmp rax, 0xffffffffffffffff
je 0x14000e304
mov r9d, 5
xor r8d, r8d
lea rdx, str._dns
lea rcx, [rbp - 0x28]
call fcn.14000a740
mov qword [rsp + 0x20], r15
lea r9, [0x1400985da]
mov r8d, 5
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140008750
mov qword [rbp - 0x50], sendto
mov qword [rbp - 0x58], r15
mov byte [rbp - 0x68], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.1400079b0
lea rdx, [0x1400985da]
lea rcx, [rbp - 0x68]
call fcn.140007430
test eax, eax
je 0x14000e2b6
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x78]
call fcn.1400079b0
mov rax, qword [rbp - 0x50]
cmp rax, 0x10
jb 0x14000e304
mov rcx, qword [rbp - 0x68]
inc rax
cmp rax, 0x1000
jb 0x14000e2ff
test cl, 0x1f
jne 0x14000e3e9
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000e3e3
sub rcx, rax
cmp rcx, 8
jb 0x14000e3dd
cmp rcx, 0x27
ja 0x14000e3d7
mov rcx, rax
call fcn.140025800
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x14000e352
mov rcx, qword [rbp - 0x28]
inc rax
cmp rax, 0x1000
jb 0x14000e34d
test cl, 0x1f
jne 0x14000e401
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000e3fb
sub rcx, rax
cmp rcx, 8
jb 0x14000e3f5
cmp rcx, 0x27
ja 0x14000e3ef
mov rcx, rax
call fcn.140025800
cmp byte [rbx + 0x19], 0
jne 0x14000e39e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14000e37e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14000e39e
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14000e370
jmp 0x14000e39e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000e39b
cmp rbx, qword [rax + 0x10]
jne 0x14000e39b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000e388
mov rbx, rax
mov r8, qword [rbp - 0x48]
jmp 0x14000dffe
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
call fcn.140062e60
int3
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x48]
call fcn.140007df0
mov rcx, qword [rbp - 0x48]
call fcn.140025800
lea rdx, [0x1400985da]
lea rcx, [rbp + 0x58]
call fcn.140007430
test eax, eax
je 0x14000e56c
lea rdx, [0x1400985da]
lea rcx, [rbp + 0x38]
call fcn.140007430
test eax, eax
je 0x14000e56c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [0x1400b68a0], 0
mov dword [0x1400b68a4], 0xea60
lea rdx, [rbp + 0x58]
lea rcx, [0x1400b6928]
call fcn.140007ae0
lea rdx, [rbp + 0x38]
lea rcx, [0x1400b6908]
call fcn.140007520
lea rdx, str.8.8.8.8
lea rcx, [0x1400b6968]
call fcn.140007500
lea rdx, [rbp + 0x78]
lea rcx, [0x1400b68e8]
call fcn.140007520
lea rdx, [0x14009ae18]
lea rcx, [0x1400b69a8]
call fcn.140007500
lea rcx, [0x1400b6ab0]
call fcn.1400073d0
mov qword [rsp + 0x50], rax
lea rax, [0x14000e5e0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000e4ff
call fcn.14000e870
cmp dword [rsp + 0x30], 2
jg 0x14000e56c
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140001de0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140006780]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000e530
lea rcx, [rbp + 0x98]
call fcn.140007550
lea rcx, [rsp + 0x40]
call fcn.140002a50
lea rcx, [rbp + 0x18]
call fcn.140007550
lea rcx, [rbp - 8]
call fcn.140007550
lea rcx, [rbp + 0x78]
call fcn.140007550
lea rcx, [rbp + 0x38]
call fcn.140007550
lea rcx, [rbp + 0x58]
call fcn.140007550
mov eax, 1
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140037e50
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret