Function at 0x140002dc0
Capabilities:
Get session user name
Initialize winsock library

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
movaps xmmword [rsp + 0x2b0], xmm6
mov rsi, rdx
mov edi, ecx
mov rax, qword [0x14008ae00]
xor rax, rsp
mov qword [rsp + 0x2a8], rax
lea rcx, [rsp + 0xc8]
call fcn.140003590
movzx edx, byte [0x14008bc00]
movzx eax, byte [rsp + 0xc8]
mov byte [0x14008bc00], al
mov byte [rsp + 0xc8], dl
lea rcx, [rsp + 0xd0]
mov rax, qword [0x14008bc08]
mov r8, qword [rsp + 0xd0]
mov qword [0x14008bc08], r8
mov qword [rsp + 0xd0], rax
call fcn.140021730
cmp byte [0x14008bc00], 1
jne 0x140002e80
mov rcx, qword [0x14008bc08]
lea rdx, str.user
call fcn.140029560
mov rcx, qword [0x14008bc08]
cmp rax, qword [rcx]
je 0x140002e80
cmp byte [0x14008bc00], 1
je 0x140003059
jmp 0x14000308a
mov dword [rsp + 0xdc], 0x100
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0xdc]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
test eax, eax
je 0x140002f12
movaps xmmword [rsp + 0x290], xmm0
movaps xmmword [rsp + 0x280], xmm0
lea rcx, [rsp + 0xe0]
call fcn.14003b4f0
test rax, rax
js 0x14000357c
mov rbx, rax
cmp rax, 0xf
ja 0x140002f34
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], recv
lea rcx, [rsp + 0x280]
lea rdx, [rsp + 0xe0]
mov r8, rbx
call fcn.140055720
add rbx, rsp
add rbx, 0x280
jmp 0x140002fa3
movaps xmmword [rsp + 0x280], xmm0
mov qword [rsp + 0x290], 0
mov qword [rsp + 0x298], recv
jmp 0x140002fa6
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov r15d, socket
cmovae r15, rax
cmp r15, 0xfff
jb 0x140002f69
lea rcx, [r15 + 0x28]
call fcn.14002bc78
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140002f75
lea rcx, [r15 + 1]
call fcn.14002bc78
mov r14, rax
mov qword [rsp + 0x280], r14
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x298], r15
lea rdx, [rsp + 0xe0]
mov rcx, r14
mov r8, rbx
call fcn.140055720
add rbx, r14
mov byte [rbx], 0
lea rbx, [rsp + 0xc0]
mov qword [rsp + 0xb8], 0
mov byte [rsp + 0xb8], 3
mov ecx, 0x20
call fcn.14002bc78
movaps xmm0, xmmword [rsp + 0x280]
movaps xmm1, xmmword [rsp + 0x290]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0xc0], rax
lea r14, [0x14008bc00]
lea rdx, str.user
mov rcx, r14
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0xb8]
mov byte [rax], cl
mov byte [rsp + 0xb8], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0xc0]
mov qword [rax + 8], r8
mov qword [rsp + 0xc0], rcx
mov rcx, rbx
call fcn.140021730
lea rbx, [rsp + 0xa8]
mov rcx, rbx
mov rdx, r14
call fcn.140001eb0
mov rcx, rbx
call fcn.140003950
cmp byte [0x14008bc00], 1
jne 0x14000308a
mov rcx, qword [0x14008bc08]
lea rdx, str.deviceid
call fcn.140029560
mov rcx, qword [0x14008bc08]
cmp rax, qword [rcx]
je 0x14000308a
cmp byte [0x14008bc00], 1
je 0x1400031b2
jmp 0x1400031df
lea rcx, [rsp + 0xe0]
call fcn.140003ca0
lea rbx, [rsp + 0xa0]
mov qword [rsp + 0x98], 0
mov byte [rsp + 0x98], 3
mov ecx, 0x20
call fcn.14002bc78
movups xmm0, xmmword [rsp + 0xe0]
movups xmm1, xmmword [rsp + 0xf0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov qword [rsp + 0xf0], 0
mov qword [rsp + recv8], 0xf
mov byte [rsp + 0xe0], 0
mov qword [rsp + 0xa0], rax
lea rcx, [0x14008bc00]
lea rdx, str.deviceid
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x98]
mov byte [rax], cl
mov byte [rsp + 0x98], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0xa0]
mov qword [rax + 8], r8
mov qword [rsp + 0xa0], rcx
mov rcx, rbx
call fcn.140021730
mov rax, qword [rsp + 0xf8]
cmp rax, 0x10
jb 0x14000318a
mov rcx, qword [rsp + 0xe0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140003185
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140003581
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
lea rdx, [0x14008bc00]
lea rbx, [rsp + 0x88]
mov rcx, rbx
call fcn.140001eb0
mov rcx, rbx
call fcn.140003950
cmp byte [0x14008bc00], 1
jne 0x1400031df
mov rcx, qword [0x14008bc08]
lea rdx, [0x140080585]
call fcn.140029560
mov rcx, qword [0x14008bc08]
cmp rax, qword [rcx]
je 0x1400031df
cmp byte [0x14008bc00], 1
je 0x14000324a
jmp 0x140003269
lea rbx, [rsp + 0x80]
mov qword [rsp + 0x78], 0
lea rcx, str.127.0.0.1
call fcn.140024680
mov qword [rsp + 0x80], rax
lea rcx, [0x14008bc00]
lea rdx, [0x140080585]
call fcn.140001c60
movzx edx, byte [rax]
mov byte [rax], 3
mov byte [rsp + 0x78], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0x80]
mov qword [rax + 8], r8
mov qword [rsp + 0x80], rcx
mov rcx, rbx
call fcn.140021730
cmp byte [0x14008bc00], 1
jne 0x140003269
mov rcx, qword [0x14008bc08]
lea rdx, [0x14008030a]
call fcn.140029560
mov rcx, qword [0x14008bc08]
cmp rax, qword [rcx]
jne 0x1400032b7
lea rbx, [rsp + 0x70]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0xd26
lea rcx, [0x14008bc00]
lea rdx, [0x14008030a]
call fcn.140001c60
movzx edx, byte [rax]
mov byte [rax], 5
mov byte [rsp + 0x68], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0x70]
mov qword [rax + 8], r8
mov qword [rsp + 0x70], rcx
mov rcx, rbx
call fcn.140021730
lea rdx, [rsp + 0xe0]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400032de
lea rcx, str.Failed_to_load_winsock
call fcn.140002d40
jmp 0x1400034af
cmp edi, 2
jl 0x140003483
mov r14d, edi
add rsi, 0x10
dec r14
xor r13d, r13d
lea rdi, str.__install
lea r15, str.__uninstall
lea r12, str.__run
xorps xmm6, xmm6
lea rbp, [0x14008bc00]
jmp 0x140003333
mov r13d, 1
add rsi, 8
dec r14
je 0x1400034dd
mov rbx, qword [rsi - 8]
mov rcx, rdi
mov rdx, rbx
call fcn.14003b470
test eax, eax
je 0x140003320
mov rcx, r15
mov rdx, rbx
call fcn.14003b470
test eax, eax
je 0x140003400
mov rcx, r12
mov rdx, rbx
call fcn.14003b470
test eax, eax
je 0x14000340b
lea rcx, str.__ip
mov rdx, rbx
call fcn.14003b470
test eax, eax
je 0x140003416
lea rcx, str.__port
mov rdx, rbx
call fcn.14003b470
test eax, eax
jne 0x140003326
mov rcx, qword [rsi]
call fcn.140038b68
mov qword [rsp + 0x30], 0
cdqe
mov byte [rsp + 0x30], 5
mov qword [rsp + 0x38], rax
mov rcx, rbp
lea rdx, [0x14008030a]
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov byte [rsp + 0x30], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0x38]
mov qword [rax + 8], r8
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x38]
call fcn.140021730
lea rbx, [rsp + 0x20]
jmp 0x14000346b
mov r13d, 2
jmp 0x140003326
mov r13d, 3
jmp 0x140003326
movaps xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x50], 3
mov rcx, rsi
call fcn.140029660
mov qword [rsp + 0x58], rax
mov rcx, rbp
lea rdx, [0x140080585]
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x50]
mov byte [rax], cl
mov byte [rsp + 0x50], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0x58]
mov qword [rax + 8], r8
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x58]
call fcn.140021730
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov rdx, rbp
call fcn.140001eb0
mov rcx, rbx
call fcn.140003950
jmp 0x140003326
movaps xmm0, xmmword [0x140057010]
movaps xmmword [rsp + 0x290], xmm0
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x280], xmm0
lea rcx, [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
mov rcx, qword [rsp + 0x2a8]
xor rcx, rsp
call fcn.14002bd70
xor eax, eax
movaps xmm6, xmmword [rsp + 0x2b0]
add rsp, 0x2c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp r13d, 1
je 0x1400034f7
cmp r13d, 2
je 0x140003530
cmp r13d, 3
jne 0x1400034af
nop
call fcn.140001060
jmp 0x1400034f0
lea rcx, str.installing
call fcn.14003ac44
mov cl, 1
xor edx, edx
call fcn.14002a180
call fcn.140003e80
call fcn.1400297d0
test al, al
je 0x14000355a
call fcn.140003fc0
lea rcx, str.installed
call fcn.14003ac44
jmp 0x1400034af
lea rcx, str.Uninstalling
call fcn.14003ac44
mov cl, 1
mov dl, 1
call fcn.14002a180
test al, al
je 0x14000356b
lea rcx, str.Uninstalled
call fcn.14003ac44
jmp 0x1400034af
lea rcx, str.install_failed
call fcn.14003ac44
jmp 0x1400034af
lea rcx, str.Uninstall_failed
call fcn.14003ac44
jmp 0x1400034af
call fcn.140004660
call fcn.140038150
int3