Function at 0x140051b00
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x418]
sub rsp, 0x4f0
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402120d8]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r13d, r8d
mov rbx, rcx
mov qword [rbp + 0x110], rcx
test dl, dl
jne 0x140051c7e
lea rdi, [rcx + 0xe8]
mov ecx, reloc.WSOCK32.dll_recv
call fcn.140157540
mov rsi, rax
mov qword [rbp + 0x110], rax
mov byte [rax], 1
mov dword [rax + 4], r13d
mov qword [rax + 8], rbx
lea rcx, [rdi + 8]
call fcn.140136084
test eax, eax
jne 0x140052604
xor r14d, r14d
mov eax, r14d
xchg byte [rdi + 2], al
mov dword [rdi + 0xb8], 1
xor ecx, ecx
call fcn.140179804
movsxd rcx, dword [rdi + 0xb8]
add rcx, rax
mov qword [rdi + 0xb0], rcx
lea rax, [0x140053c20]
mov qword [rdi + 0xa0], rax
mov qword [rdi + 0xa8], rsi
lea rcx, [rdi + 8]
call fcn.1401360a8
test eax, eax
jne 0x14005260c
lea rcx, [rdi + 8]
call fcn.140136084
test eax, eax
jne 0x140052614
movzx eax, byte [rdi + 1]
test al, al
setne sil
lea rcx, [rdi + 8]
call fcn.1401360a8
test eax, eax
jne 0x14005261c
test sil, sil
jne 0x1400525cc
lea ecx, [rax + 8]
call fcn.140157540
mov qword [rax], rdi
mov qword [rbp + 0x110], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140053da0]
xor edx, edx
xor ecx, ecx
call fcn.14017a9c4
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140052624
cmp dword [rsp + 0x38], r14d
je 0x140052634
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
call fcn.140136184
test eax, eax
jne 0x1400525fc
jmp 0x1400525cc
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14021e5b8], eax
jle 0x140051cd1
lea rcx, [0x14021e5b8]
call fcn.140157410
cmp dword [0x14021e5b8], 0xffffffff
jne 0x140051cd1
xorps xmm0, xmm0
movups xmmword [0x14021e5c0], xmm0
lea rcx, [0x1401ac1a0]
call fcn.140157820
lea rcx, [0x14021e5b8]
call fcn.1401573b0
lea rdx, [rbp + 0x360]
lea rcx, [0x14021e5c0]
call fcn.140078730
nop
cmp qword [rbp + 0x370], 0
je 0x1400525c0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rax
lea rdi, vtable.neb::CJsonObject.0
mov qword [rbp + 0x120], rdi
xor r14d, r14d
mov qword [rbp + 0x128], r14
movdqa xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x158], r14
mov qword [rbp + 0x160], reloc.WSOCK32.dll_ntohs
mov byte [rbp + 0x148], al
mov qword [rbp + 0x168], r14
mov qword [rbp + 0x170], r14
lea ecx, [rax + 0x30]
call fcn.140157540
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x178], r14
mov qword [rbp + 0x180], r14
mov qword [rbp + 0x188], r14
lea ecx, [r14 + 0x48]
call fcn.140157540
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x180], rax
mov rcx, qword [rbp + 0x168]
mov qword [rbp + 0x178], rcx
mov qword [rbp + 0x190], rax
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x120]
call fcn.14008f5b0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
movups xmmword [rbp + 0x300], xmm0
movups xmmword [rbp + 0x310], xmm0
movups xmmword [rbp + 0x320], xmm0
movups xmmword [rbp + 0x330], xmm0
movups xmmword [rbp + 0x340], xmm0
mov qword [rbp + 0x350], rax
lea rcx, [rbp + 0x2e0]
call fcn.14008ec50
nop
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], reloc.WSOCK32.dll_ntohs
mov byte [rbp - 0x60], r14b
lea r8d, [r14 + 4]
lea rdx, str.apps
lea rcx, [rbp - 0x60]
call fcn.140050e90
nop
lea r8, [rbp + 0x2e0]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x120]
call fcn.14008f9a0
nop
lea rcx, [rbp - 0x60]
call fcn.140050e10
mov rax, qword [rbp + 0x2f0]
mov rcx, qword [rbp + 0x2e8]
test rcx, rcx
je 0x140051e96
mov rdx, rcx
jmp 0x140051ea2
test rax, rax
je 0x140052550
mov rdx, rax
test rdx, rdx
je 0x140052550
cmp dword [rdx + 0x18], 6
jne 0x140052550
test rcx, rcx
je 0x140051edc
cmp dword [rcx + 0x18], 6
jne 0x140051eff
mov rax, qword [rcx + 0x10]
mov esi, r14d
test rax, rax
je 0x140051f02
nop dword [rax]
inc esi
mov rax, qword [rax]
test rax, rax
jne 0x140051ed0
jmp 0x140051f02
test rax, rax
je 0x140051eff
cmp dword [rax + 0x18], 6
jne 0x140051eff
mov rax, qword [rax + 0x10]
mov esi, r14d
test rax, rax
je 0x140051f02
inc esi
mov rax, qword [rax]
test rax, rax
jne 0x140051ef3
jmp 0x140051f02
mov esi, r14d
mov r12d, r14d
test esi, esi
jle 0x140052550
nop dword [rax]
mov r15d, r14d
mov qword [rbp + 0x290], r14
mov qword [rbp + 0x298], reloc.WSOCK32.dll_ntohs
mov byte [rbp + 0x280], r15b
mov qword [rbp + 0x1d0], r14
mov qword [rbp + 0x1d8], reloc.WSOCK32.dll_ntohs
mov byte [rbp + 0x1c0], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x250], rax
lea rcx, [rbp + 0x1e0]
call fcn.14008ec50
nop
lea r8, [rbp + 0x1e0]
mov edx, r12d
lea rcx, [rbp + 0x2e0]
call fcn.140090420
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], reloc.WSOCK32.dll_ntohs
mov byte [rsp + 0x40], 0
mov r8d, 3
lea rdx, [0x1401d50c0]
lea rcx, [rsp + 0x40]
call fcn.140050e90
nop
mov rbx, qword [rbp + 0x1e8]
test rbx, rbx
je 0x14005201e
cmp dword [rbx + 0x18], 7
jne 0x14005208d
lea rdi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdi, qword [rsp + 0x40]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140052086
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x140052068
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140052004
jmp 0x140052068
mov rbx, qword [rbp + 0x1f0]
test rbx, rbx
je 0x14005208d
cmp dword [rbx + 0x18], 7
jne 0x14005208d
lea rdi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdi, qword [rsp + 0x40]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140052086
nop word [rax + rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x140052068
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140052050
test rbx, rbx
je 0x140052086
mov eax, dword [rbx + 0x18]
cmp eax, 3
jne 0x14005207b
mov r15d, dword [rbx + 0x28]
jmp 0x140052086
cmp eax, 4
jne 0x140052086
cvttsd2si r15d, qword [rbx + 0x30]
lea rdi, vtable.neb::CJsonObject.0
lea rcx, [rsp + 0x40]
call fcn.140050e10
test r13d, r13d
je 0x1400520de
cmp r13d, r15d
je 0x1400520de
mov qword [rbp + 0x1e0], rdi
lea rcx, [rbp + 0x1e0]
call fcn.14008f6f0
lea rcx, [rbp + 0x240]
call fcn.140058c60
lea rcx, [rbp + 0x228]
call fcn.140090a00
lea rcx, [rbp + 0x208]
call fcn.140050e10
nop
jmp 0x14005252b
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], reloc.WSOCK32.dll_ntohs
mov byte [rsp + 0x60], 0
mov r8d, 4
lea rdx, str.path
lea rcx, [rsp + 0x60]
call fcn.140050e90
nop
mov rbx, qword [rbp + 0x1e8]
test rbx, rbx
je 0x14005215a
cmp dword [rbx + 0x18], 7
jne 0x1400521d7
lea rdi, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdi, qword [rsp + 0x60]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400521d7
nop dword [rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x1400521a8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140052140
jmp 0x1400521a8
mov rbx, qword [rbp + 0x1f0]
test rbx, rbx
je 0x1400521d7
cmp dword [rbx + 0x18], 7
jne 0x1400521d7
lea rdi, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdi, qword [rsp + 0x60]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400521d7
nop word [rax + rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x1400521a8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140052190
test rbx, rbx
je 0x1400521d7
cmp dword [rbx + 0x18], 5
jne 0x1400521d7
mov rdx, qword [rbx + 0x20]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400521c0
lea rcx, [rbp + 0x280]
call fcn.140050e90
nop
lea rcx, [rsp + 0x60]
call fcn.140050e10
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], reloc.WSOCK32.dll_ntohs
mov byte [rbp - 0x80], 0
mov r8d, 5
lea rdx, str.brand
lea rcx, [rbp - 0x80]
call fcn.140050e90
nop
mov rbx, qword [rbp + 0x1e8]
test rbx, rbx
je 0x14005225a
cmp dword [rbx + 0x18], 7
jne 0x1400522c8
lea rdi, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdi, qword [rbp - 0x80]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400522c8
nop dword [rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14005229b
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140052240
jmp 0x14005229b
mov rbx, qword [rbp + 0x1f0]
test rbx, rbx
je 0x1400522c8
cmp dword [rbx + 0x18], 7
jne 0x1400522c8
lea rdi, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdi, qword [rbp - 0x80]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400522c8
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14005229b
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140052283
test rbx, rbx
je 0x1400522c8
cmp dword [rbx + 0x18], 5
jne 0x1400522c8
mov rdx, qword [rbx + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400522b1
lea rcx, [rbp + 0x1c0]
call fcn.140050e90
nop
lea rcx, [rbp - 0x80]
call fcn.140050e10
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x1a0]
call fcn.140089df0
nop
mov edi, 1
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp]
call fcn.140175ab0
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rdx, qword [rbp + 0x1a0]
lea rcx, [rbp]
call fcn.14008dcb0
mov rax, qword [rbp]
movsxd rax, dword [rax + 4]
mov ebx, dword [rbp + rax + 0x10]
lea rcx, [rbp]
call fcn.14006df00
test ebx, ebx
jne 0x140052349
lea rcx, [rbp + 0x1a0]
call fcn.14008b4d0
test al, al
je 0x14005234e
lea edi, [rbx + 2]
jmp 0x14005234e
mov edi, 3
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x3c0]
call fcn.14008bc20
nop
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r14w
mov r8d, reloc.WSOCK32.dll_ntohl
lea rdx, [0x1401dd9b8]
lea rcx, [rbp - 0x40]
call fcn.1400550f0
nop
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x380]
call fcn.14008b0b0
nop
lea rcx, [rbp - 0x40]
call fcn.140050da0
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x2c0]
call fcn.140089ce0
nop
lea rcx, [rbp + 0x380]
call fcn.140050da0
nop
cmp qword [rbp + 0x2d0], 0
jne 0x1400523ef
mov r8d, 7
lea rdx, str.1.0.0.0
lea rcx, [rbp + 0x2c0]
call fcn.140050e90
mov edx, r15d
lea rcx, [rbp + 0x260]
call fcn.140051150
nop
call fcn.140089520
lea r8, [rbp + 0x260]
lea rdx, [rbp + 0x2a0]
mov rcx, rax
call fcn.1400895d0
nop
mov rbx, qword [rbp + 0x110]
mov rcx, qword [rbx + 0x1a8]
test rcx, rcx
je 0x140052445
mov rax, qword [rcx]
lea r9, [rbp + 0x2a0]
mov r8d, edi
lea rdx, [rbp + 0x260]
call qword [rax + reloc.WSOCK32.dll_htonl]
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x260]
lea r8, [rbp + 0x3c0]
lea rdx, [rbp + 0x3a0]
call fcn.1400681b0
nop
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2a0]
mov r8d, edi
lea rdx, [rbp + 0x260]
mov rcx, rbx
call fcn.140052640
nop
lea rcx, [rbp + 0x3a0]
call fcn.140050e10
nop
lea rcx, [rbp + 0x2a0]
call fcn.140050e10
nop
lea rcx, [rbp + 0x260]
call fcn.140050e10
nop
lea rcx, [rbp + 0x2c0]
call fcn.140050e10
nop
lea rcx, [rbp + 0x3c0]
call fcn.140050e10
nop
lea rcx, [rbp + 0x1a0]
call fcn.140050da0
nop
lea rdi, vtable.neb::CJsonObject.0
mov qword [rbp + 0x1e0], rdi
lea rcx, [rbp + 0x1e0]
call fcn.14008f6f0
lea rcx, [rbp + 0x240]
call fcn.140058c60
lea rcx, [rbp + 0x228]
call fcn.140090a00
lea rcx, [rbp + 0x208]
call fcn.140050e10
nop
lea rcx, [rbp + 0x1c0]
call fcn.140050e10
nop
lea rcx, [rbp + 0x280]
call fcn.140050e10
inc r12d
cmp r12d, esi
jl 0x140051f10
mov qword [rbp + 0x2e0], rdi
lea rcx, [rbp + 0x2e0]
call fcn.14008f6f0
lea rcx, [rbp + 0x340]
call fcn.140058c60
lea rcx, [rbp + 0x328]
call fcn.140090a00
lea rcx, [rbp + 0x308]
call fcn.140050e10
nop
mov qword [rbp + 0x120], rdi
lea rcx, [rbp + 0x120]
call fcn.14008f6f0
lea rcx, [rbp + 0x180]
call fcn.140058c60
lea rcx, [rbp + 0x168]
call fcn.140090a00
lea rcx, [rbp + 0x148]
call fcn.140050e10
nop
lea rcx, [rbp + 0x360]
call fcn.140050e10
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.1401571e0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, eax
call fcn.140135d24
nop
mov ecx, eax
call fcn.140135d24
nop
mov ecx, eax
call fcn.140135d24
nop
mov ecx, eax
call fcn.140135d24
nop
mov ecx, eax
call fcn.140135d24
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call fcn.140135d60
nop
mov ecx, 1
call fcn.140135d60
int3