Function at 0x140005720
Capabilities:
Connect socket
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push rbx
push rdi
sub rsp, 0x168
mov rax, qword [0x1400213f8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rdx
call fcn.14000def0
mov rbx, rax
test rax, rax
je 0x140005e16
movzx ecx, di
sub ecx, 1
je 0x140005821
sub ecx, 1
je 0x140005814
sub ecx, 0xe
je 0x14000579c
cmp ecx, 0x10
jne 0x140005e16
mov rcx, rax
call fcn.140005480
mov rax, qword [0x140021978]
test rax, rax
je 0x140005e16
lea rdx, [0x1400197d8]
mov rcx, rbx
call rax
jmp 0x140005e16
shr rdi, 0x10
test di, di
je 0x140005805
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
cmp rax, qword [rbx + 0x8e0]
jge 0x1400057d5
mov rcx, qword [rbx + 0x8c8]
lea rdx, [rbx + 0x8d0]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
jmp 0x140005e16
cmp dword [rbx + 0x8a0], 0
je 0x1400057e8
mov dword [rbx + 0x8a0], 8
mov rcx, rbx
call fcn.140005480
lea rdx, [0x1400197d8]
mov rcx, rbx
call qword [0x140021978]
jmp 0x140005e16
mov dword [rax + 0x910], 1
jmp 0x140005e16
mov rcx, rbx
call fcn.140005f00
jmp 0x140005e16
mov rcx, qword [rax + 0x8c8]
lea r8, [rsp + 0x30]
mov edx, 0x4004667f
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x140005e16
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140005e16
mov ecx, eax
mov qword [rsp + 0x198], r12
add rcx, qword [rbx + 0x900]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
test rax, rax
je 0x140005e0e
mov rdx, qword [rbx + 0x900]
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
add rdx, rax
mov rcx, qword [rbx + 0x8c8]
call qword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [rsp + 0x30]
cmp eax, ecx
jne 0x140005e05
mov r8, qword [rbx + 0x900]
mov qword [rsp + 0x160], r13
xor r13d, r13d
mov qword [rsp + 0x150], r15
test r8, r8
je 0x1400058f1
mov rdx, qword [rbx + 0x8f8]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rbx + 0x900]
add dword [rsp + 0x30], eax
mov rcx, qword [rbx + 0x8f8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x8f8], r13
mov qword [rbx + 0x900], r13
mov ecx, dword [rsp + 0x30]
mov r15d, r13d
test ecx, ecx
je 0x140005df5
mov qword [rsp + 0x188], rbp
mov r8d, 0x3a
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x158], r14
nop word [rax + rax]
movzx ebp, byte [rbx + 0x8e8]
sub ecx, r15d
mov edx, 0xa
mov esi, ecx
mov edi, r15d
add rdi, r12
test bpl, bpl
cmovne edx, r8d
mov r8d, ecx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140005db3
inc r15d
mov ecx, eax
sub ecx, edi
add r15d, ecx
test bpl, bpl
je 0x140005a58
mov edx, 0x30
lea ecx, [rdx - 0x2f]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
je 0x140005a4c
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rbx + rax + 0x8e8], r13b
jne 0x140005990
inc eax
movsxd rcx, eax
mov dword [rdi + 0x18], eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x1400059c9
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x8e8], r13b
jmp 0x140005d9e
movsxd r8, dword [rdi + 0x18]
lea rdx, [rbx + 0x8e8]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x10]
movsxd rcx, dword [rdi + 0x18]
mov byte [rcx + rax - 1], 0xa
mov qword [rdi + 0x20], r13
mov dword [rdi + 0x28], r13d
mov rax, qword [rbx + 0x908]
test rax, rax
je 0x140005a36
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x908]
mov rcx, qword [rax]
mov qword [rdi], rcx
mov qword [rcx + 8], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rdi
cmp qword [rbx + 0x908], rdi
jne 0x140005a4c
mov rcx, rbx
call fcn.140005f00
mov byte [rbx + 0x8e8], r13b
jmp 0x140005d9e
mov qword [rdi], rdi
mov rcx, rbx
mov qword [rdi + 8], rdi
mov qword [rbx + 0x908], rdi
call fcn.140005f00
mov byte [rbx + 0x8e8], r13b
jmp 0x140005d9e
mov byte [rax - 1], r13b
cmp byte [rdi], 0x3e
jne 0x140005ca6
inc rdi
lea rdx, str.LOG:
mov rcx, rdi
mov r8d, 4
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005a9b
mov rax, qword [0x140021998]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 4]
jmp 0x140005d99
mov r8d, 6
lea rdx, str.STATE:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005ace
mov rax, qword [0x1400219b0]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 6]
jmp 0x140005d99
mov r8d, 5
lea rdx, str.HOLD:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005b01
mov rax, qword [0x140021990]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 5]
jmp 0x140005d99
mov r8d, 9
lea rdx, str.PASSWORD:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005b34
mov rax, qword [0x1400219a0]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 9]
jmp 0x140005d99
mov r8d, 6
lea rdx, str.PROXY:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005b67
mov rax, qword [0x1400219a8]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 6]
jmp 0x140005d99
mov r8d, 5
lea rdx, str.INFO:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005ba3
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x140021970]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 5]
jmp 0x140005d99
mov r8d, 8
lea rdx, str.NEED_OK:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005bd6
mov rax, qword [0x1400219b8]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 8]
jmp 0x140005d99
mov r8d, 9
lea rdx, str.NEED_STR:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005c09
mov rax, qword [0x1400219c0]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 9]
jmp 0x140005d99
mov r8d, 5
lea rdx, str.ECHO:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005c3c
mov rax, qword [0x140021988]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 5]
jmp 0x140005d99
mov r8d, 0xa
lea rdx, str.BYTECOUNT:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005c6f
mov rax, qword [0x140021980]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 0xa]
jmp 0x140005d99
mov r8d, 8
lea rdx, str.INFOMSG:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005d9e
mov rax, qword [0x1400219d0]
test rax, rax
je 0x140005d9e
lea rdx, [rdi + 8]
jmp 0x140005d99
mov rsi, qword [rbx + 0x908]
test rsi, rsi
je 0x140005d9e
mov r8d, 8
lea rdx, str.SUCCESS:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005cf3
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x140005d83
lea rdx, [rdi + 9]
mov rcx, rbx
call rax
mov rcx, rbx
call fcn.140005f70
jmp 0x140005d9e
mov r8d, 6
lea rdx, str.ERROR:
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140005d5b
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea r8, str._lld_N_Previous_command_sent_to_management_failed:__s
mov qword [rsp + 0x20], rdi
mov r9, rax
lea rcx, [rsp + 0x40]
mov edx, 0x100
call fcn.140006070
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [0x140021998]
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x140005d51
xor edx, edx
mov rcx, rbx
call rax
mov rcx, rbx
call fcn.140005f70
jmp 0x140005d9e
mov rcx, r13
lea rdx, [0x1400198b0]
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140005d8d
cmp rcx, 4
jne 0x140005d70
mov rcx, rbx
call fcn.140005f70
jmp 0x140005d9e
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x140005d9e
mov rdx, rdi
mov rcx, rbx
call rax
mov ecx, dword [rsp + 0x30]
mov r8d, 0x3a
cmp r15d, ecx
jb 0x140005920
jmp 0x140005ddd
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx + 0x8f8], rax
test rax, rax
je 0x140005ddd
mov r8, rsi
mov qword [rbx + 0x900], rsi
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov r14, qword [rsp + 0x158]
mov rbp, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x190]
mov r13, qword [rsp + 0x160]
mov r15, qword [rsp + 0x150]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140016590
add rsp, 0x168
pop rdi
pop rbx
ret