Function at 0x14000ec60
Capabilities:
Connect socket
Delete file
Enumerate files on windows
Get common file path
Initialize winsock library
Move file
Terminate process

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x8d0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x8c0], rbx
mov qword [rbp + 0x8d0], rsi
mov rax, qword [0x140056010]
xor rax, rbp
mov qword [rbp + 0x890], rax
mov rsi, rdx
cmp ecx, 2
jne 0x14000ed9d
mov r8, qword [rdx + 8]
lea rax, [0x140047fb4]
mov rbx, 0xffffffffffffffff
xor edx, edx
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov ecx, 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000ed1a
xor edi, edi
lea rbx, [0x140056ac0]
mov edx, dword [rbx + 4]
mov ecx, dword [rbx]
call fcn.140002a80
mov edx, dword [rbx]
lea rcx, [0x1400507e8]
mov r9d, dword [rbx + 4]
mov r8d, edx
mov dword [rsp + 0x20], r9d
call fcn.140001820
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 0x208]
cmp edi, 0x1c1
jb 0x14000ecd5
jmp 0x14000f65a
mov r8, qword [rsi + 8]
lea rax, [0x140050808]
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000ed4f
lea rcx, [0x140050840]
jmp 0x14000f655
xor edi, edi
lea rbx, [0x140056ac4]
nop dword [rax + rax]
mov rcx, qword [rsi + 8]
mov r14d, dword [rbx - 4]
call fcn.14001b550
cmp r14d, eax
jne 0x14000ed87
mov edx, dword [rbx]
mov ecx, r14d
call fcn.140002a80
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
add rbx, 0x208
cmp edi, 0x1c1
jb 0x14000ed60
jmp 0x14000f65a
cmp ecx, 3
jne 0x14000f472
mov r8, qword [rdx + 8]
lea rax, [0x140050900]
mov rbx, 0xffffffffffffffff
xor edx, edx
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov ecx, 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000edf7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rsi + 0x10]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x14000f65a
mov r8, qword [rsi + 8]
lea rax, str._del
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000ee2f
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14000f65a
mov r8, qword [rsi + 8]
lea rax, str._loadlib
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000ee97
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdx, qword [rsi + 0x10]
lea rcx, [0x1400484b4]
mov rbx, rax
call fcn.140001030
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x14000f65a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14000f65a
mov r8, qword [rsi + 8]
lea rax, str._start
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000eee3
mov rcx, qword [rsi + 0x10]
lea edx, [rax + 0xe]
call fcn.140010310
test rax, rax
je 0x14000f65a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f65a
mov r8, qword [rsi + 8]
lea rax, str._read
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000ef1a
mov rcx, qword [rsi + 0x10]
call fcn.140001090
jmp 0x14000f65a
mov r8, qword [rsi + 8]
lea rax, str._inject
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000ef83
lea edx, [rax + 0xe]
lea rcx, str.notepad.exe
call fcn.140010310
mov rdx, qword [rsi + 0x10]
mov rcx, rax
mov rbx, rax
call fcn.140010670
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test rbx, rbx
je 0x14000f65a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f65a
mov r8, qword [rsi + 8]
lea rax, str._class
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
xor edx, edx
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov ecx, 0x800
cmp eax, 2
jne 0x14000f28f
mov r8, qword [rsi + 0x10]
lea rax, str.registry
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000f043
xor edi, edi
lea rbx, [0x140056ac0]
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rbx]
mov eax, ecx
and eax, 0xff000000
cmp eax, 0x1000000
jne 0x14000f02d
mov edx, dword [rbx + 4]
call fcn.140002a80
mov edx, dword [rbx]
lea rcx, [0x140050968]
mov r9d, dword [rbx + 4]
mov r8d, edx
mov dword [rsp + 0x20], r9d
call fcn.140001820
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
add rbx, 0x208
cmp edi, 0x1c1
jb 0x14000eff0
jmp 0x14000f65a
mov r8, qword [rsi + 0x10]
lea rax, str.file
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000f0d3
xor edi, edi
lea rbx, [0x140056ac0]
nop word [rax + rax]
mov ecx, dword [rbx]
mov eax, ecx
and eax, 0xff000000
cmp eax, 0x2000000
jne 0x14000f0bd
mov edx, dword [rbx + 4]
call fcn.140002a80
mov edx, dword [rbx]
lea rcx, [0x140050998]
mov r9d, dword [rbx + 4]
mov r8d, edx
mov dword [rsp + 0x20], r9d
call fcn.140001820
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
add rbx, 0x208
cmp edi, 0x1c1
jb 0x14000f080
jmp 0x14000f65a
mov r8, qword [rsi + 0x10]
lea rax, str.system
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000f163
xor edi, edi
lea rbx, [0x140056ac0]
nop word [rax + rax]
mov ecx, dword [rbx]
mov eax, ecx
and eax, 0xff000000
cmp eax, 0x3000000
jne 0x14000f14d
mov edx, dword [rbx + 4]
call fcn.140002a80
mov edx, dword [rbx]
lea rcx, [0x1400509c8]
mov r9d, dword [rbx + 4]
mov r8d, edx
mov dword [rsp + 0x20], r9d
call fcn.140001820
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
add rbx, 0x208
cmp edi, 0x1c1
jb 0x14000f110
jmp 0x14000f65a
mov r8, qword [rsi + 0x10]
lea rax, str.process
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000f1f3
xor edi, edi
lea rbx, [0x140056ac0]
nop word [rax + rax]
mov ecx, dword [rbx]
mov eax, ecx
and eax, 0xff000000
cmp eax, 0x4000000
jne 0x14000f1dd
mov edx, dword [rbx + 4]
call fcn.140002a80
mov edx, dword [rbx]
lea rcx, [0x1400509f8]
mov r9d, dword [rbx + 4]
mov r8d, edx
mov dword [rsp + 0x20], r9d
call fcn.140001820
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
add rbx, 0x208
cmp edi, 0x1c1
jb 0x14000f1a0
jmp 0x14000f65a
mov r8, qword [rsi + 0x10]
lea rax, str.network
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000f283
xor edi, edi
lea rbx, [0x140056ac0]
nop word [rax + rax]
mov ecx, dword [rbx]
mov eax, ecx
and eax, 0xff000000
cmp eax, 0x5000000
jne 0x14000f26d
mov edx, dword [rbx + 4]
call fcn.140002a80
mov edx, dword [rbx]
lea rcx, str.BC:__d_0x_x___RID:__d_0x_x__n
mov r9d, dword [rbx + 4]
mov r8d, edx
mov dword [rsp + 0x20], r9d
call fcn.140001820
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
add rbx, 0x208
cmp edi, 0x1c1
jb 0x14000f230
jmp 0x14000f65a
lea rcx, [0x140050a90]
jmp 0x14000f655
mov r8, qword [rsi + 8]
lea rax, [0x140050b50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000f450
xor edx, edx
lea rcx, [rbp + 0x260]
mov r8d, 0x208
call fcn.140013860
xor edx, edx
lea rcx, [rbp + 0x470]
mov r8d, 0x208
call fcn.140013860
lea rdx, [rbp + 0x260]
mov ecx, 0x104
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edx, 0x104
lea rcx, [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8, qword [rsi + 0x10]
lea rax, [0x14004a584]
mov dword [rsp + 0x28], ebx
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000f418
xor edx, edx
lea rcx, [rbp + 0x680]
mov r8d, 0x208
call fcn.140013860
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x250
call fcn.140013860
lea r9, [rbp + 0x260]
mov qword [rbp], rdi
lea r8, str._sMitreAttack.ps1
mov edx, 0x104
lea rcx, [rbp + 0x680]
call fcn.1400017c0
test eax, eax
js 0x14000f444
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x680]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000f444
nop dword [rax + rax]
lea r8, [rbp]
lea rdx, [0x14003a3a4]
lea rcx, [rbp + 0x3c]
call fcn.14001b968
mov rcx, rax
call fcn.14001b550
mov ebx, eax
lea ecx, [rax - 0x3e9]
cmp ecx, 0x3e6
ja 0x14000f3fc
lea r8, [rbp + 0x260]
mov ecx, eax
lea rdx, [rbp + 0x470]
call fcn.14000eba0
lea rcx, str.JYTestTool.exe__tid__d_n
mov edi, eax
mov edx, ebx
test eax, eax
je 0x14000f3f7
lea rcx, str.JYTestTool.exe__tid__d_Failed__n
call fcn.140001030
lea rdx, [rbp + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000f3a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14000f43c
mov rcx, qword [rsi + 0x10]
call fcn.14001b550
test eax, eax
je 0x14000f444
lea r8, [rbp + 0x260]
mov ecx, eax
lea rdx, [rbp + 0x470]
call fcn.14000eba0
mov edi, eax
test edi, edi
je 0x14000f65a
lea rcx, [0x140050bd0]
jmp 0x14000f655
mov rcx, qword [rsi + 0x10]
call fcn.14001b550
mov rcx, qword [rsi + 8]
mov ebx, eax
call fcn.14001b550
mov ecx, eax
mov edx, ebx
call fcn.140002a80
jmp 0x14000f65a
cmp ecx, 4
jne 0x14000f612
mov r8, qword [rdx + 8]
lea rax, str._connect
mov rbx, 0xffffffffffffffff
xor edx, edx
mov dword [rsp + 0x28], ebx
mov r9d, ebx
mov ecx, 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000f65a
mov rdx, qword [rsi + 0x10]
test rdx, rdx
jne 0x14000f4c0
xor edi, edi
jmp 0x14000f517
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14000f4c0
inc ebx
cmp ebx, 0x3fffffff
jle 0x14000f4d8
xor edi, edi
jmp 0x14000f517
movsxd rax, ebx
lea r8d, [rbx + rbx]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000f4f5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x30]
call fcn.140001b70
mov rdi, rax
mov rcx, qword [rsi + 0x18]
call fcn.14001b550
lea r8, str.ConnectTo_0_
mov edx, 0x80
lea rcx, [0x140090f60]
mov esi, eax
call fcn.14001b57c
mov r14d, 2
lea rdx, [rbp + 0x260]
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000f576
lea r8, str.WSAStartup
mov r9d, eax
lea rdx, [0x140090f60]
lea rcx, str.error______s___s_failed._ErrorCode__d__n
call fcn.140001030
jmp 0x14000f65a
mov edx, 1
mov ecx, r14d
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000f5a0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.socket
jmp 0x14000f55b
xor eax, eax
movzx ecx, si
mov qword [rbp], rax
mov word [rbp], r14w
mov qword [rbp + 8], rax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, rdi
mov word [rbp + 2], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r8d, sendto
lea rdx, [rbp]
mov rcx, rbx
mov dword [rbp + 4], eax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x14000f602
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
lea r8, str.connect
lea rdx, [0x140090f60]
lea rcx, str.error______s___s_failed._ErrorCode__d__n
call fcn.140001030
test rbx, rbx
je 0x14000f65a
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x14000f65a
lea rcx, str._nUsage__nJYTestTool.exe__BC__:
call fcn.140001030
lea rcx, str.JYTestTool.exe__BC___RID__:
call fcn.140001030
lea rcx, str.JYTestTool.exe__class__class_name__registry_file_system_process_network____n:
call fcn.140001030
lea rcx, [0x140050e30]
call fcn.140001030
lea rcx, [0x140050e80]
call fcn.140001030
lea rcx, str.JYTestTool.exe__tid__a_:_TID
call fcn.140001030
xor eax, eax
mov rcx, qword [rbp + 0x890]
xor rcx, rbp
call fcn.140011970
mov rbx, qword [rbp + 0x8c0]
mov rsi, qword [rbp + 0x8d0]
lea rsp, [rbp + 0x8a0]
pop r14
pop rdi
pop rbp
ret