Function at 0x1400069d0
Capabilities:
Encode data using xor
Enumerate files on windows
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x290
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x87c
mov eax, dword [rcx + rdi]
mov ebx, 0x8c0
add rbx, rdi
test al, 1
jne 0x140006a5e
or eax, 1
mov dword [rcx + rdi], eax
mov word [rbx + 7], 0x1e9
mov dword [rbx], 0x832d1532
mov word [rbx + 4], 0xe7f0
mov byte [rbx + 6], 0xf4
lea rcx, [0x14000b9b0]
call fcn.14000944c
nop
mov r12d, dword [0x140010018]
movdqa xmm7, xmmword [0x14000c740]
movdqa xmm8, xmmword [0x14000c700]
movdqa xmm9, xmmword [reloc.WS2_32.dll_connect]
movdqa xmm10, xmmword [0x14000c6e0]
movdqa xmm11, xmmword [0x14000c6d0]
cmp byte [rbx + 8], 0
je 0x140006b81
xor r8d, r8d
cmp r12d, 5
jl 0x140006b4c
movdqa xmm2, xmmword [0x14000cdb0]
movdqa xmm0, xmm11
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm7
movzx eax, word [rbx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx], ax
movdqa xmm0, xmm10
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm7
movzx eax, word [rbx + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 2], ax
movdqa xmm0, xmm9
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm7
movzx eax, word [rbx + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 4], ax
movdqa xmm0, xmm8
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm7
movzx eax, word [rbx + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 6], ax
jmp 0x140006b7d
movabs r9, 0xe9b5b3b1c77d4573
nop word [rax + rax]
movzx ecx, r8b
and cl, 7
shl cl, 3
mov rdx, r9
shr rdx, cl
xor byte [rbx + r8], dl
inc r8
cmp r8, 8
jb 0x140006b60
mov byte [rbx + 8], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140006c70
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movdqa xmm0, xmmword [0x14000cac0]
movdqa xmm1, xmmword [0x14000cb70]
mov dword [rbp - 0x20], 0xd4a101a4
mov dword [rbp - 0x1c], 0x80a19ff1
mov dword [rbp - 0x18], 0xd3b017a9
mov ecx, 0x8b8
mov eax, dword [rcx + rdi]
mov ebx, 0x888
test al, 1
jne 0x140006c39
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rbx + rdi]
mov byte [rcx + 0x2d], 1
lea rax, [rcx + 0x2c]
lea rdx, [rbp - 0x14]
cmp rcx, rdx
ja 0x140006c11
lea rdx, [rbp - 0x40]
cmp rax, rdx
jb 0x140006c11
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rbp - 0x20]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rbp - 0x18]
mov dword [rcx + 0x28], eax
mov byte [rcx + 0x2c], 0x81
jmp 0x140006c2c
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rbp - 0x20]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rbp - 0x18]
mov dword [rcx + 0x28], eax
mov byte [rcx + 0x2c], 0x81
lea rcx, [0x14000b980]
call fcn.14000944c
nop
mov rax, qword gs:[0x58]
mov r11, qword [rax]
add r11, rbx
mov rcx, r11
call fcn.140007500
mov rdx, r11
mov rcx, rsi
call fcn.140006370
lea rdx, [0x140006550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400071a9
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140005f40
nop
movdqa xmm0, xmmword [0x14000cb10]
movdqa xmm1, xmmword [0x14000caf0]
mov dword [rsp + 0x70], 0xa8fd34f6
mov dword [rsp + 0x74], 0xac9fe4e6
mov dword [rsp + 0x78], 0xbdfd32ed
mov word [rsp + 0x7c], 0xe7fe
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x8cc
mov eax, dword [rcx + rdi]
mov ebx, 0x830
test al, 1
jne 0x140006d4e
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rbx + rdi]
mov byte [rcx + 0x2f], 1
lea rax, [rcx + 0x2e]
lea rdx, [rsp + 0x7e]
cmp rcx, rdx
ja 0x140006d1b
lea rdx, [rsp + 0x50]
cmp rax, rdx
jb 0x140006d1b
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rsp + 0x70]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rsp + 0x78]
mov dword [rcx + 0x28], eax
movzx eax, word [rsp + 0x7c]
mov word [rcx + 0x2c], ax
mov byte [rcx + 0x2e], 0xc3
jmp 0x140006d41
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rsp + 0x70]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rsp + 0x78]
mov dword [rcx + 0x28], eax
movzx eax, word [rsp + 0x7c]
mov word [rcx + 0x2c], ax
mov byte [rcx + 0x2e], 0xc3
lea rcx, [0x14000b950]
call fcn.14000944c
nop
lea r11, [rbx + rdi]
mov rcx, r11
call fcn.140007380
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [r11 + rdi], 0
jne 0x140006d61
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140006daa
lea rax, [rdi + rcx]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x60]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x60]
add rbx, rcx
mov r8, rdi
mov rdx, r11
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x140006dbe
mov qword [rsp + 0x20], rdi
mov r9, r11
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.140007680
mov rsi, qword [rbp - 0x50]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 2
jb 0x1400071e8
lea r15, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r15, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea r14, [rsi + 2]
mov edi, send
lea rbx, [rbp - 0x80]
cmp r14, rdi
jbe 0x140006e84
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x140006e47
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400094f0
test rax, rax
je 0x140006ef2
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140006e80
mov eax, socket
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140006e60
xor ebx, ebx
jmp 0x140006e80
cmp rcx, 0x1000
jb 0x140006e78
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400071ee
jmp 0x140006e28
call fcn.1400094f0
mov rbx, rax
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], rdi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], 0x2a5c
mov byte [rbx + r14], 0
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140006efe
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ef9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ef9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000939c
movdqa xmm0, xmmword [0x14000c720]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
cmp r14, 0xffffffffffffffff
jne 0x140006fda
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movdqa xmm0, xmmword [0x14000c780]
mov dword [rsp + 0x40], 0x18c62b66
mov dword [rsp + 0x44], 0x1627a2e1
mov ecx, 0x880
mov eax, dword [rcx + rdi]
mov ebx, 0x860
test al, 1
jne 0x140006fae
or eax, 1
mov dword [rcx + rdi], eax
lea rax, [rbx + rdi]
mov byte [rax + 0x19], 1
lea rcx, [rax + 0x18]
lea rdx, [rsp + 0x48]
cmp rax, rdx
ja 0x140006f8f
lea rdx, [rsp + 0x30]
cmp rcx, rdx
jb 0x140006f8f
movups xmmword [rax], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], recv
jmp 0x140006fa1
movups xmmword [rax], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], recv
lea rcx, [0x14000b920]
call fcn.14000944c
nop
lea r11, [rbx + rdi]
mov rcx, r11
call fcn.140007200
mov rdx, r11
mov rcx, rsi
call fcn.140006370
lea rdx, [0x140006550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000716b
mov r13d, 0x820
mov ebx, r13d
mov ecx, 0x81c
movabs r15, 0xfd4ff1bda37d1fd3
movdqa xmm6, xmmword [0x14000cec0]
nop word [rax + rax]
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov eax, dword [rcx + rdi]
test al, 1
jne 0x140007040
or eax, 1
mov dword [rdi + rcx], eax
mov dword [rdi + rbx + 0xc], 0x14fd187
mov dword [rdi + rbx], 0xd11c6b80
mov dword [rdi + rbx + 4], 0xdd3f84c9
mov dword [rdi + rbx + 8], 0xce186bba
lea rcx, [0x14000b8f0]
call fcn.14000944c
nop
lea rdx, [rdi + rbx]
cmp byte [rdx + 0xf], 0
je 0x140007123
xor eax, eax
cmp r12d, 5
jl 0x140007100
movdqa xmm0, xmm11
psllq xmm0, 3
vpsrlvq xmm1, xmm6, xmm0
pshufb xmm1, xmm7
movzx eax, word [rdx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdx], ax
movdqa xmm0, xmm10
psllq xmm0, 3
vpsrlvq xmm1, xmm6, xmm0
pshufb xmm1, xmm7
movzx eax, word [rdx + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdx + 2], ax
movdqa xmm0, xmm9
psllq xmm0, 3
vpsrlvq xmm1, xmm6, xmm0
pshufb xmm1, xmm7
movzx eax, word [rdx + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdx + 4], ax
movdqa xmm0, xmm8
psllq xmm0, 3
vpsrlvq xmm1, xmm6, xmm0
pshufb xmm1, xmm7
movzx eax, word [rdx + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdx + 6], ax
mov eax, 8
nop dword [rax]
movzx ecx, al
and cl, 7
shl cl, 3
mov r8, r15
shr r8, cl
xor byte [rdx + rax], r8b
inc rax
cmp rax, 0xf
jb 0x140007100
mov byte [rdx + 0xf], 0
mov rbx, r13
mov rcx, rsi
call fcn.140006370
mov rcx, rax
lea rdx, [rbp + 0x1c]
call fcn.140006370
lea rdx, [0x140006550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp - 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
mov ecx, 0x81c
jne 0x140007000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x1400071a9
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400071a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000939c
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140005bd0
nop
call fcn.140005b30
int3