Function at 0x180001ab0
Capabilities:
Connect socket
Convert ip address from string
Encode data using xor
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x11c0]
mov eax, 0x12c0
call fcn.180073250
sub rsp, rax
mov rax, qword [0x1800a6040]
xor rax, rsp
mov qword [rbp + 0x11b0], rax
xor r14d, r14d
mov ecx, 0x202
lea rdx, [rbp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x180001b0a
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 1
mov edi, 2
lea r8d, [rdx + 5]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180001b38
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov word [rbp], di
movups xmm0, xmmword [str.205.209.104.245]
movups xmmword [rbp + 0x1e0], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.owlgameenhancer.net
lea rcx, [rsp + 0x20]
call fcn.180003eb0
nop
mov qword [rsp + 0x40], r14
mov dword [rbp + 0x10], r14d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov dword [rbp + 0x14], edi
mov dword [rbp + 0x18], 1
mov dword [rbp + 0x1c], 6
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x10]
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x180001c12
lea rdx, str.getaddrinfo_failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180003830
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x180003a00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
xor r8d, r8d
lea rdx, [0x18008fe89]
jmp 0x180001c71
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x20]
add rdx, 4
mov r9d, socket
lea r8, [rbp + 0x1f0]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_ntop]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea rax, [rbp + 0x1f0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x180001c60
lea rdx, [rbp + 0x1f0]
lea rcx, [rsp + 0x60]
call fcn.180003eb0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180001cbc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001cb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001cb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064780
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], send
mov byte [rsp + 0x20], 0
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea r8, [rbp + 4]
lea rdx, [rbp + 0x1e0]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, 0x6ae9
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 2], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x180001d3b
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov ecx, 0x60
call fcn.180064788
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov r8d, socket
lea rdx, str.owlgameenhancerkey.txt
lea rcx, [rbp - 0x40]
call fcn.180003eb0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.180001450
nop
lea rcx, [rbp - 0x80]
call fcn.180001340
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov r8d, 0xa
lea rdx, str.LICENSEKEY
lea rcx, [rsp + 0x20]
call fcn.180003eb0
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180003a40
mov rcx, qword [rax]
add rcx, 0x40
lea rax, [rbp - 0x60]
cmp rcx, rax
je 0x180001e41
mov rbx, qword [rbp - 0x50]
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r9, qword [rbp - 0x60]
mov rax, qword [rcx + 0x18]
cmp rbx, rax
ja 0x180001e38
mov rdi, rcx
cmp rax, 0xf
jbe 0x180001e20
mov rdi, qword [rcx]
mov qword [rcx + 0x10], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x180001e41
mov rdx, rbx
call fcn.180003fb0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180001e81
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001e7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001e7c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064780
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov r8d, 6
lea rdx, str.GAMEID
lea rcx, [rsp + 0x20]
call fcn.180003eb0
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180003a40
mov rcx, qword [rax]
add rcx, 0x40
mov rax, qword [rcx + 0x18]
cmp rax, 7
jb 0x180001eff
mov rbx, rcx
cmp rax, 0xf
jbe 0x180001edc
mov rbx, qword [rcx]
mov qword [rcx + 0x10], 7
mov r8d, 7
lea rdx, str.Tekken8
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
jmp 0x180001f11
lea r9, str.Tekken8
mov edx, 7
call fcn.180003fb0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180001f51
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001f4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001f4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064780
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov r8d, 4
lea rdx, str.HWID
lea rcx, [rsp + 0x20]
call fcn.180003eb0
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180003a40
mov rcx, qword [rax]
add rcx, 0x40
lea rax, [rbp - 0x80]
cmp rcx, rax
je 0x180001fe7
mov rbx, qword [rbp - 0x70]
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r9, qword [rbp - 0x80]
mov rax, qword [rcx + 0x18]
cmp rbx, rax
ja 0x180001fde
mov rdi, rcx
cmp rax, 0xf
jbe 0x180001fc6
mov rdi, qword [rcx]
mov qword [rcx + 0x10], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x180001fe7
mov rdx, rbx
call fcn.180003fb0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180002027
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002022
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002022
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064780
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x20]
call fcn.180001750
nop
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r8, qword [rbp - 0x20]
mov edx, 0x7d0
lea rcx, [rbp + 0x9e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov ecx, 0x7d0
call fcn.1800647cc
mov rdi, rax
add rax, 0x7cf
lea rcx, [rbp + 0x11af]
cmp rdi, rcx
ja 0x180002096
lea rcx, [rbp + 0x9e0]
cmp rax, rcx
jb 0x180002096
lea r8, [rbp + 0x9e0]
sub r8, rdi
mov rax, r14
mov r9, r14
jmp 0x180002118
movdqa xmm2, xmmword [0x18009a3b0]
lea rax, [rdi + 0x10]
lea rcx, [rbp + 0x9f0]
sub rcx, rdi
lea rdx, [rbp + 0xa00]
sub rdx, rdi
lea r8, [rbp + 0x9e0]
sub r8, rdi
mov r9d, 0x1f
nop word [rax + rax]
movdqu xmm0, xmmword [r8 + rax - 0x10]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqu xmm1, xmmword [r8 + rax]
xorps xmm1, xmm2
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rcx + rax]
xorps xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm1, xmmword [rdx + rax]
xorps xmm1, xmm2
movdqu xmmword [rax + 0x20], xmm1
lea rax, [rax + 0x40]
sub r9, 1
jne 0x1800020d0
mov eax, 0x7c0
mov r9d, eax
lea rcx, [rax + rdi]
mov edx, 0x7d0
sub rdx, r9
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor al, 0x4b
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x180002130
xor r9d, r9d
mov r8d, 0x7d0
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov rcx, rdi
call fcn.180064780
test ebx, ebx
jle 0x1800024ca
lea rdx, str.Message_sent:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003830
mov rcx, rax
lea rdx, [rbp + 0x9e0]
call fcn.180003830
lea rdx, [0x180003a00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, str.Server_reply_XD
mov edx, 0x7d0
lea rcx, [rbp + 0x210]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
xor r9d, r9d
mov r8d, 0x7d0
lea rdx, [rbp + 0x210]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
movsxd r8, eax
mov edx, r14d
test eax, eax
jle 0x180002288
cmp r8d, 0x40
jb 0x180002288
mov r9, r14
mov ecx, r8d
and ecx, 0x8000003f
jge 0x1800021fb
dec ecx
or ecx, 0xffffffc0
inc ecx
mov eax, r8d
sub eax, ecx
movsxd rcx, eax
movdqa xmm2, xmmword [0x18009a3b0]
nop dword [rax + rax]
movdqu xmm0, xmmword [rbp + r9 + 0x210]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rbp + r9 + 0x210], xmm1
movdqu xmm0, xmmword [rbp + r9 + 0x220]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rbp + r9 + 0x220], xmm1
movdqu xmm0, xmmword [rbp + r9 + 0x230]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rbp + r9 + 0x230], xmm1
movdqu xmm0, xmmword [rbp + r9 + 0x240]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rbp + r9 + 0x240], xmm1
add edx, 0x40
add r9, 0x40
cmp r9, rcx
jl 0x180002210
movsxd rax, edx
cmp rax, r8
jge 0x1800022a0
xor byte [rbp + rax + 0x210], 0x4b
inc rax
cmp rax, r8
jl 0x180002290
test r8d, r8d
jle 0x1800024ca
lea rdx, str.Response_received:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180003830
mov rcx, rax
lea rdx, [rbp + 0x210]
call fcn.180003830
lea rdx, [0x180003a00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, str.6Y5dC8_Zq5e4__u9FN_D48
lea rcx, [rbp + 0x210]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1800024b6
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x180002343
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000233e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000233e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064780
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], send
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x180002391
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000238c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000238c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064780
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], send
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1800023df
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800023da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800023da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064780
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], send
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x18000242d
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002428
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002428
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064780
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], send
mov byte [rbp - 0x40], 0
lea rcx, [rsp + 0x50]
call fcn.1800024e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x180002488
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002483
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002483
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180064780
mov al, 1
mov rcx, qword [rbp + 0x11b0]
xor rcx, rsp
call fcn.180064760
lea r11, [rsp + 0x12c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, str.Y3_59g_t9U6pTao_3TxVa
lea rcx, [rbp + 0x210]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3