Function at 0x18000f72c
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xffd8]
mov eax, 0x10168
call fcn.18001a710
sub rsp, rax
xor eax, eax
xor r12d, r12d
mov rdi, rcx
mov qword [rbp - 0x7f], rax
mov qword [rbp - 0x77], rax
mov qword [rbp - 0x6f], rax
mov dword [rbp - 0x67], eax
mov word [rbp - 0x63], ax
mov byte [rbp - 0x61], al
lea esi, [rax + 1]
mov rax, qword [rcx + 8]
mov rcx, qword [rcx + 0x28]
mov byte [rbp - 0x80], r12b
mov r14, qword [rax + 0x60]
mov ebx, r12d
mov qword [rbp - 0x60], r14
mov qword [rbp + 0x10038], r12
call fcn.1800126f4
lea rcx, str._TCP_PACKET_RECEIVE__reading_in_the_header
call fcn.18000f064
mov rcx, qword [r14]
mov r8d, 0x20
mov eax, ebx
lea rdx, [rbp - 0x80]
xor r9d, r9d
sub r8d, ebx
add rdx, rax
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x18000fdf8
add ebx, eax
cmp ebx, 0x20
cmove esi, r12d
test esi, esi
jne 0x18000f7a7
cmp ebx, 0x20
je 0x18000f7f0
lea rcx, str._TCP__we_didnt_get_enough_header_bytes
call fcn.18000f064
jmp 0x18000f9db
movzx eax, byte [rbp - 0x7d]
movzx r9d, byte [rbp - 0x7e]
movzx r8d, byte [rbp - 0x7f]
movzx edx, byte [rbp - 0x80]
lea rcx, str._TCP__the_XOR_key_is:__02x_02x_02x_02x
mov dword [rsp + 0x20], eax
call fcn.18000f064
movzx eax, byte [rbp - 0x61]
movzx ecx, byte [rbp - 0x62]
mov dword [rsp + 0x100], eax
movzx eax, byte [rbp - 0x6c]
movzx r10d, byte [rbp - 0x63]
movzx r11d, byte [rbp - 0x64]
movzx ebx, byte [rbp - 0x65]
movzx edi, byte [rbp - 0x66]
movzx esi, byte [rbp - 0x67]
movzx r14d, byte [rbp - 0x68]
movzx r15d, byte [rbp - 0x69]
movzx r12d, byte [rbp - 0x6a]
movzx r13d, byte [rbp - 0x6b]
movzx r9d, byte [rbp - 0x7e]
movzx r8d, byte [rbp - 0x7f]
movzx edx, byte [rbp - 0x80]
mov dword [rsp + 0xf8], ecx
mov dword [rsp + 0xf0], r10d
mov dword [rsp + 0xe8], r11d
mov dword [rsp + 0xe0], ebx
mov dword [rsp + 0xd8], edi
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], r14d
mov dword [rsp + 0xc0], r15d
mov dword [rsp + 0xb8], r12d
mov dword [rsp + 0xb0], r13d
mov dword [rsp + 0xa8], eax
movzx eax, byte [rbp - 0x6d]
lea rcx, str._TCP__Packet_header:__0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_
mov dword [rsp + 0xa0], eax
movzx eax, byte [rbp - 0x6e]
mov dword [rsp + 0x98], eax
movzx eax, byte [rbp - 0x6f]
mov dword [rsp + 0x90], eax
movzx eax, byte [rbp - 0x70]
mov dword [rsp + 0x88], eax
movzx eax, byte [rbp - 0x71]
mov dword [rsp + 0x80], eax
movzx eax, byte [rbp - 0x72]
mov dword [rsp + 0x78], eax
movzx eax, byte [rbp - 0x73]
mov dword [rsp + 0x70], eax
movzx eax, byte [rbp - 0x74]
mov dword [rsp + 0x68], eax
movzx eax, byte [rbp - 0x75]
mov dword [rsp + 0x60], eax
movzx eax, byte [rbp - 0x76]
mov dword [rsp + 0x58], eax
movzx eax, byte [rbp - 0x77]
mov dword [rsp + 0x50], eax
movzx eax, byte [rbp - 0x78]
mov dword [rsp + 0x48], eax
movzx eax, byte [rbp - 0x79]
mov dword [rsp + 0x40], eax
movzx eax, byte [rbp - 0x7a]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbp - 0x7b]
mov dword [rsp + 0x30], eax
movzx eax, byte [rbp - 0x7c]
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp - 0x7d]
mov dword [rsp + 0x20], eax
call fcn.18000f064
xor r12d, r12d
cmp byte [rbp - 0x7d], r12b
jne 0x18000fa39
mov ebx, dword [rbp - 0x80]
lea rcx, str._TCP__discovered_a_length_header__assuming_its_metsrv_of_length__d
mov edx, ebx
call fcn.18000f064
add ebx, 0xffffffe4
test ebx, ebx
jle 0x18000f9c2
mov rsi, qword [rbp - 0x60]
mov edi, 0xffff
mov rcx, qword [rsi]
movsxd rax, ebx
mov r8d, ebx
cmp rax, rdi
lea rdx, [rbp - 0x30]
cmova r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jns 0x18000fa2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
je 0x18000fa30
mov ecx, 0x490
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jg 0x18000f9d4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [rbp + 0x10028]
mov qword [rdx], r12
mov rdi, qword [rbp + 0x10020]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._TCP__Freeing_stuff_up
mov ebx, eax
call fcn.18000f064
mov rax, qword [rbp + 0x10038]
test rax, rax
je 0x18000fa03
mov rcx, rax
call fcn.180018f58
mov rcx, qword [rdi + 0x28]
call fcn.180012714
lea rcx, str._TCP__Packet_receive_finished
call fcn.18000f064
mov eax, ebx
add rsp, 0x10168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
sub ebx, eax
test ebx, ebx
jle 0x18000f9c2
jmp 0x18000f981
lea rcx, str._TCP__XOR_key_looks_fine__moving_on
call fcn.18000f064
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
mov r8d, 0x20
call fcn.180019130
lea rdx, [rbp - 0x7c]
lea rcx, [rbp - 0x80]
mov r8d, 0x1c
call fcn.180007568
movzx eax, byte [rbp - 0x61]
movzx ecx, byte [rbp - 0x62]
mov dword [rsp + 0x100], eax
movzx eax, byte [rbp - 0x6c]
movzx r10d, byte [rbp - 0x63]
movzx r11d, byte [rbp - 0x64]
movzx ebx, byte [rbp - 0x65]
movzx edi, byte [rbp - 0x66]
movzx esi, byte [rbp - 0x67]
movzx r14d, byte [rbp - 0x68]
movzx r15d, byte [rbp - 0x69]
movzx r12d, byte [rbp - 0x6a]
movzx r13d, byte [rbp - 0x6b]
movzx r9d, byte [rbp - 0x7e]
movzx r8d, byte [rbp - 0x7f]
movzx edx, byte [rbp - 0x80]
mov dword [rsp + 0xf8], ecx
mov dword [rsp + 0xf0], r10d
mov dword [rsp + 0xe8], r11d
mov dword [rsp + 0xe0], ebx
mov dword [rsp + 0xd8], edi
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0xc8], r14d
mov dword [rsp + 0xc0], r15d
mov dword [rsp + 0xb8], r12d
mov dword [rsp + 0xb0], r13d
mov dword [rsp + 0xa8], eax
movzx eax, byte [rbp - 0x6d]
lea rcx, str._TCP__Packet_header:__0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X___0x_02X_0x_02X_0x_02X_0x_02X_
mov dword [rsp + 0xa0], eax
movzx eax, byte [rbp - 0x6e]
mov dword [rsp + 0x98], eax
movzx eax, byte [rbp - 0x6f]
mov dword [rsp + 0x90], eax
movzx eax, byte [rbp - 0x70]
mov dword [rsp + 0x88], eax
movzx eax, byte [rbp - 0x71]
mov dword [rsp + 0x80], eax
movzx eax, byte [rbp - 0x72]
mov dword [rsp + 0x78], eax
movzx eax, byte [rbp - 0x73]
mov dword [rsp + 0x70], eax
movzx eax, byte [rbp - 0x74]
mov dword [rsp + 0x68], eax
movzx eax, byte [rbp - 0x75]
mov dword [rsp + 0x60], eax
movzx eax, byte [rbp - 0x76]
mov dword [rsp + 0x58], eax
movzx eax, byte [rbp - 0x77]
mov dword [rsp + 0x50], eax
movzx eax, byte [rbp - 0x78]
mov dword [rsp + 0x48], eax
movzx eax, byte [rbp - 0x79]
mov dword [rsp + 0x40], eax
movzx eax, byte [rbp - 0x7a]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbp - 0x7b]
mov dword [rsp + 0x30], eax
movzx eax, byte [rbp - 0x7c]
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp - 0x7d]
mov dword [rsp + 0x20], eax
call fcn.18000f064
mov ecx, dword [rbp - 0x68]
call qword [sym.imp.WS2_32.dll_ntohl]
lea rcx, str._TCP__Payload_length_is__d
lea edi, [rax - 8]
mov edx, edi
call fcn.18000f064
lea ebx, [rdi + 0x20]
mov dword [rbp + 0x10030], ebx
lea rcx, str._TCP__total_buffer_size_for_the_packet_is__d
mov edx, ebx
call fcn.18000f064
mov ecx, ebx
call fcn.180018f98
mov qword [rbp + 0x10038], rax
test rax, rax
jne 0x18000fc0c
lea rcx, str._TCP__Failed_to_create_the_packet_buffer
call fcn.18000f064
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000f9d4
lea rcx, str._TCP__Allocated_packet_buffer_at__p
mov rdx, rax
call fcn.18000f064
mov rbx, qword [rbp + 0x10038]
mov eax, 0x20
lea r8, [rbp - 0x58]
mov r9d, eax
mov edx, eax
mov rcx, rbx
call fcn.18001ad08
lea r15, [rbx + 0x20]
test edi, edi
je 0x18000fc8c
mov rsi, qword [rbp - 0x60]
mov r14d, edi
mov rcx, qword [rsi]
mov eax, edi
mov rdx, r14
sub rdx, rax
xor r9d, r9d
mov r8d, edi
add rdx, r15
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jg 0x18000fc86
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
je 0x18000fc88
test ebx, ebx
jns 0x18000f9d4
mov ecx, 0x490
jmp 0x18000fc01
sub edi, eax
test edi, edi
jne 0x18000fc47
movzx eax, byte [rbp - 0x6d]
movzx ecx, byte [rbp - 0x6e]
movzx r10d, byte [rbp - 0x6f]
movzx r11d, byte [rbp - 0x70]
movzx ebx, byte [rbp - 0x71]
movzx edi, byte [rbp - 0x72]
movzx esi, byte [rbp - 0x73]
movzx r14d, byte [rbp - 0x74]
movzx r15d, byte [rbp - 0x75]
movzx r12d, byte [rbp - 0x76]
movzx r13d, byte [rbp - 0x77]
movzx r9d, byte [rbp - 0x7a]
movzx r8d, byte [rbp - 0x7b]
movzx edx, byte [rbp - 0x7c]
mov dword [rsp + 0x80], eax
movzx eax, byte [rbp - 0x78]
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp - 0x79]
lea rcx, str._TCP__Packet_Session_GUID:__02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X
mov dword [rsp + 0x20], eax
call fcn.18000f064
lea rcx, [rbp - 0x7c]
call fcn.1800075e0
mov rdi, qword [rbp + 0x10020]
xor r12d, r12d
test eax, eax
jne 0x18000fdc2
mov rcx, qword [rdi + 0x20]
lea r8d, [r12 + 0x10]
lea rdx, [rbp - 0x7c]
add rcx, 0x20
call fcn.18001aa60
test eax, eax
je 0x18000fdc2
lea rcx, str._TCP__Session_GUIDs_dont_match__looking_for_a_pivot
call fcn.18000f064
mov rcx, qword [rdi + 0x90]
lea rdx, [rbp - 0x7c]
call fcn.180009718
mov rbx, rax
test rax, rax
je 0x18000fdb6
lea rcx, str._TCP__Pivot_found__dispatching_packet_on_a_thread__to_avoid_main_thread_blocking_
call fcn.18000f064
mov r8d, dword [rbp + 0x10030]
mov rdx, qword [rbp + 0x10038]
mov rcx, rbx
call fcn.1800092bc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [rbp + 0x10028]
mov qword [rbp + 0x10038], r12
mov qword [rdx], r12
jmp 0x18000f9db
lea rcx, str._TCP__Session_GUIDs_dont_match__cant_find_pivot_
jmp 0x18000f7e6
lea rcx, str._TCP__Session_GUIDs_match__or_packet_guid_is_null___decrypting_packet
call fcn.18000f064
mov r9d, dword [rbp + 0x10030]
mov r8, qword [rbp + 0x10038]
mov rdx, qword [rbp + 0x10028]
mov rcx, rdi
call fcn.180007f44
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000f9db
mov ecx, 0x490
jmp 0x18000fded