Function at 0x140007210
Capabilities:
Create thread
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov esi, ecx
mov rax, qword [0x140062cc0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rcx, qword [0x140062d78]
test rcx, rcx
je 0x140007259
inc dword [0x140062d90]
mov dword [0x140062d94], 0x27388020
test si, si
je 0x140007263
mov word [0x140063614], si
movsx eax, si
or eax, 0xaa550000
jmp 0x140007265
mov esi, 0xffffdcd8
jmp 0x140007356
xor eax, eax
mov dword [0x140062d8c], eax
lea rdx, [0x140062d88]
lea rax, [0x1400635a8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], recvfrom
mov r8d, recvfrom
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
mov dword [rsp + 0x3c], recvfrom
mov rcx, qword [0x140062d78]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [0x140063198]
mov r8d, 0x400
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
mov rcx, qword [0x140062d80]
test rcx, rcx
je 0x1400072ed
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [0x140062d80], 0
test si, si
je 0x140007317
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140007090]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
js 0x140007351
mov eax, dword [0x1400631a4]
mov esi, 0xffffdcdc
cmp eax, dword [0x140062d94]
jne 0x140007356
mov eax, dword [0x1400631a0]
xor ecx, ecx
cmp eax, dword [0x140062d90]
mov esi, 0xffffdcdd
cmove esi, ecx
jmp 0x140007356
mov esi, 0xffffdcdb
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14003af70
mov eax, esi
add rsp, 0x58
pop rdi
pop rsi
ret
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x10], xmm6
mov qword [rbp + 8], 0xfffffffffffffffe
mov eax, dword [rcx + 0x288]
cmp rax, 4
ja case.0x14002bfe4.3
mov rsi, rcx
lea rcx, [0x1400416fc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rcx, [rsi + 0x2e68]
call fcn.140004d30
test eax, eax
jne case.0x14002bfe4.3
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [0x14004aa4c]
lea r8, [0x14004aa60]
mov rcx, rax
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov byte [rsi + 0x98], 0
jmp case.0x14002bfe4.3
mov dword [rsi + 0x2e70], 0
movaps xmm0, xmmword [0x1400405b0]
movups xmmword [rsi + 0x2e78], xmm0
mov dword [rsi + 0x2e88], 0
mov qword [rsi + 0x2e90], 0
jmp case.0x14002bfe4.3
lea rdi, [rbp - 0x40]
mov rcx, rdi
call fcn.14002dd00
cmp qword [rbp - 0x30], 0
je 0x14002c18f
cmp qword [rbp - 0x28], 8
jb 0x14002c07a
mov rdi, qword [rbp - 0x40]
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp - 0x20], xmm6
test eax, eax
js 0x14002c343
mov edi, eax
movsxd rbx, eax
cmp eax, 0xf
ja 0x14002c1bb
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], recvfrom
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
lea r14, [rbx + rbp]
add r14, 0xffffffffffffffe0
jmp 0x14002c21b
cmp qword [rsi + 0x3f0], 0x10
jb 0x14002c101
mov r8, qword [rsi + 0x3d8]
jmp 0x14002c108
lea r8, [rsi + 0x3d8]
mov rax, qword [rsi + 0x3b0]
cmp qword [rsi + 0x3d0], 0x10
jb 0x14002c12f
mov rdx, qword [rsi + 0x3b8]
cmp rax, 0x10
jae 0x14002c13c
lea rcx, [rsi + 0x398]
jmp 0x14002c143
lea rdx, [rsi + 0x3b8]
cmp rax, 0x10
jb 0x14002c126
mov rcx, qword [rsi + 0x398]
call fcn.140006980
test eax, eax
je 0x14002c173
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.KMNET
lea r8, [0x14004aa60]
mov rcx, rax
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov byte [rsi + 0x98], 0
mov cx, 1
movaps xmm6, xmmword [rbp + 0x10]
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp 0x140007210
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.gb0R2N
lea r8, [0x14004aa60]
mov rcx, rax
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov byte [rsi + 0x98], 0
jmp 0x14002c2ed
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov r15d, socket
cmovae r15, rax
cmp r15, 0xfff
jb 0x14002c1f3
lea rcx, [r15 + 0x28]
call fcn.14003ae80
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14002c1ff
lea rcx, [r15 + 1]
call fcn.14003ae80
mov r14, rax
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], r15
mov rcx, r14
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
add r14, rbx
mov byte [r14], 0
cmp qword [rbp - 8], 0x10
lea rbx, [rbp - 0x20]
mov rax, rbx
jb 0x14002c231
mov rax, qword [rbp - 0x20]
cmp qword [rbp - 0x28], 8
jb 0x14002c23e
mov r8, qword [rbp - 0x40]
jmp 0x14002c242
lea r8, [rbp - 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp qword [rbp - 8], 0x10
jb 0x14002c271
mov rbx, qword [rbp - 0x20]
lea rcx, [rsi + 0x2e98]
mov r8d, dword [rsi + 0x260]
mov rdx, rbx
call fcn.140001010
test al, al
jne 0x14002c2b2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.kmbox
lea r8, [0x14004aa60]
mov rcx, rax
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov byte [rsi + 0x98], 0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x14002c2ed
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002c2e8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002c348
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14003aec4
mov rax, qword [rbp - 0x28]
cmp rax, 8
jb case.0x14002bfe4.3
mov rcx, qword [rbp - 0x40]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14002c32a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002c348
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14003aec4
movaps xmm6, xmmword [rbp + 0x10]
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.140001d10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3