Function at 0x140006bb4
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rdi, rdx
mov esi, ecx
lea rdx, [rbp + 0xe0]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r13d, r13d
mov ebx, eax
test eax, eax
je 0x140006c1e
lea rcx, str.Fatal:_Could_not_initialize_Windows_sockets__Error:__d_._n
mov edx, eax
call fcn.140003e6c
mov eax, ebx
mov rbx, qword [rsp + 0x3c0]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov byte [0x14000faed], r13b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.msvcrt.dll_srand]
mov rdx, rdi
mov ecx, esi
call fcn.140005390
movsxd r14, dword [0x14000fcbc]
mov r12b, r13b
cmp r14d, esi
jge 0x140006c59
mov rcx, qword [rdi + r14*8]
mov qword [0x14000fe88], rcx
jmp 0x140006c5c
mov r12b, 1
lea r15d, [rsi - 1]
cmp r14d, r15d
jge 0x140006ca2
mov ebx, esi
lea rdx, [rdi + r14*8]
sub ebx, r14d
mov ecx, ebx
call fcn.140005390
cmp dword [0x14000fcbc], ebx
jge 0x140006ca2
mov r9, qword [rdi]
lea rdx, str.1113__built_2020_03_28_17:29:45_UTC
lea rcx, str.vlmcs__s__n_nUsage:__s__options_____host__:_port____._domain________options__n_nOptions:_n_n___v_Be_verbose_n___l__app__n___4_Force_V4_protocol_n___5_Force_V5_protocol_n___6_Force_V6_protocol_n___i__IpVersion__Use_IP_protocol__4_or_6__n___j__file__Load_external_KMS_data_file__file__n___e_Show_some_valid_examples_n___x_Show_valid_Apps_n___d_no_DNS_names__use_Netbios_names__no_effect_if__w_is_used__n___V_show_version_information_and_exit_n_nAdvanced_options:_n_n___a__AppGUID__Use_custom_Application_GUID_n___s__ActGUID__Use_custom_Activation_Configuration_GUID_n___k__KmsGUID__Use_custom_KMS_GUID_n___c__ClientGUID__Use_custom_Client_GUID._Default:_Use_random_n___o__PreviousClientGUID__Use_custom_Prevoius_Client_GUID._Default:_ZeroGUID_n___K__ProtocolVersion__Use_a_specific__possibly_invalid__protocol_version_n___w__Workstation__Use_custom_workstation_name._Default:_Use_random_n___r__RequiredClientCount__Fake_required_clients_n___n__Requests__Fixed__of_requests__Default:_Enough_to_charge__n___m_Pretend_to_be_a_virtual_machine_n___G__file__Get_ePID_HwId_data_and_write_to__file_._Cant_be_used_with__l___4___5___6___a___s___k___r_and__n_n___T_Use_a_new_TCP_connection_for_each_request._n___N__01__disable_or_enable_NDR64._Default:_1_n___B__01__disable_or_enable_RPC_bind_time_feature_negotiation._Default:_1_n___t__LicenseStatus__Use_specfic_license_status__0___T___6__n___g__BindingExpiration__Use_a_specfic_binding_expiration_time_in_minutes._Default_43200_n___P_Ignore_priority_and_weight_in_DNS_SRV_records_n___p_Dont_use_multiplexed_RPC_bind_n_n_port_:_t_tTCP_port_name_of_the_KMS_to_use._Default_1688._n_host_:_t_thost_name_of_the_KMS_to_use._Default_127.0.0.1_n._domain_:_tfind_KMS_server_in__domain__via_DNS_n_app_:_t_t_Type__s__x_to_see_a_list_of_valid_apps__n_n
mov r8, r9
call fcn.140003e6c
mov ecx, 0x57
call qword [sym.imp.msvcrt.dll_exit]
int3
call fcn.14000242c
mov rax, qword [0x14000fd10]
cmp dword [rax + 0xc], r13d
je 0x140006e92
cmp dword [rax + 0x14], r13d
je 0x140006e92
cmp dword [rax + 0x10], r13d
je 0x140006e92
mov rdx, rdi
mov ecx, esi
call fcn.1400053e8
cmp dword [0x14000fcbc], r15d
jge 0x140006ced
mov ecx, esi
lea rdx, [rdi + r14*8]
sub ecx, r14d
call fcn.1400053e8
mov rcx, qword [rdi]
mov r8, rdi
mov edx, esi
call fcn.14000559c
cmp dword [0x14000fcbc], r15d
jge 0x140006d14
mov rcx, qword [rdi]
sub esi, r14d
lea r8, [rdi + r14*8]
mov edx, esi
call fcn.14000559c
test r12b, r12b
je 0x140006d39
cmp dword [0x14000fd44], 0x17
lea rcx, [0x14000b054]
lea rax, str.127.0.0.1
cmove rax, rcx
mov qword [0x14000fe88], rax
cmp qword [0x14000fd70], r13
je 0x140006d4c
call fcn.1400066c8
jmp 0x140006e8b
mov eax, dword [0x14000fd50]
or qword [rbp + 0x2d8], 0xffffffffffffffff
mov esi, 1
cmp eax, esi
lea ecx, [rax - 1]
mov ebx, r13d
cmove ecx, esi
mov dword [0x14000fcb4], ecx
test ecx, ecx
je 0x140006e8b
lea rax, [rbp + 0x2d0]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x2d8]
mov qword [rsp + 0x20], rax
call fcn.1400060a4
mov edx, dword [0x14000fd54]
test edx, edx
je 0x140006db6
mov ecx, edx
sub ecx, ebx
sub ecx, esi
mov dword [0x14000fcb4], ecx
jmp 0x140006dbc
mov ecx, dword [0x14000fcb4]
test eax, eax
je 0x140006df4
lea r9d, [rcx + 1]
lea edi, [rbx + 1]
lea rcx, [rbp + 0x2d8]
add r9d, ebx
mov r8d, edi
mov edx, eax
call fcn.1400061b8
cmp dword [0x14000fd54], r13d
jne 0x140006e7c
mov dword [0x14000fcb4], r13d
jmp 0x140006e7c
test edx, edx
jne 0x140006e32
cmp dword [0x14000fd5c], r13d
mov edx, dword [0x14000fd50]
je 0x140006e25
mov eax, edx
sub eax, dword [rbp - 0x20]
cmp eax, ecx
jl 0x140006e25
lea rcx, str._nThe_KMS_server_does_not_increment_its_active_clients._Aborting..._n
call fcn.140003e6c
mov dword [0x14000fcb4], r13d
jmp 0x140006e32
sub edx, dword [rbp - 0x20]
cmovs edx, r13d
mov dword [0x14000fcb4], edx
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x60]
call qword [sym.imp.msvcrt.dll_fflush]
mov r8d, dword [0x14000fcb4]
lea edi, [rbx + 1]
inc r8d
lea rcx, str._i_of__i
mov edx, edi
add r8d, ebx
call qword [sym.imp.msvcrt.dll_printf]
mov ecx, dword [rbp + 0x2d0]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
call fcn.140005a80
mov dword [0x14000fd5c], esi
cmp dword [0x14000fcb4], r13d
mov ebx, edi
jne 0x140006d78
xor eax, eax
jmp 0x140006c03
lea rcx, str.Fatal:_Incomplete_KMS_data_file_n
call fcn.140003e6c
mov ecx, 0x57
call qword [sym.imp.msvcrt.dll_exit]
int3