Function at 0x140008be0
Capabilities:
Create thread
Encode data using xor
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x140087118]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [0x140087798], 1
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140009680]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, [rbx + 0x20]
lea rcx, [0x1400877a8]
cmp rcx, rdx
je 0x140008c61
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140008c5b
mov rdx, qword [rdx]
call fcn.140003080
nop
cmp dword [0x140087784], 0
jne 0x1400095e5
mov qword [rsp + 0xc8], rdi
movdqa xmm0, xmmword [0x14006abc0]
movdqu xmmword [rsp + 0xd8], xmm0
mov byte [rsp + 0xc8], 0
mov ecx, 8
call fcn.140066880
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140008cac
mov rcx, rax
call fcn.14000fb50
nop
call fcn.140005130
mov byte [0x140087610], 0
xor r8d, r8d
lea rdx, [0x14006ace3]
lea rcx, [0x140087618]
call fcn.140003080
mov ecx, 0x1024
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x140087758], rax
xor edx, edx
mov r8d, 0x1024
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.140018740
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140008d12
mov rcx, qword [rax]
mov rdx, qword [0x140087758]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 1]
test al, al
jne 0x140008d20
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140008d71
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008d6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
mov ecx, 0x1024
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
xor edx, edx
mov r8d, 0x1024
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x160a1e1d
mov dword [rsp + 0x44], 0x100e4f6
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x140008db0
mov byte [rsp + 0x47], 0
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x88], 6
mov qword [rsp + 0x90], reloc.WS2_32.dll_ntohs
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x78], eax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x7c], ax
mov byte [rsp + 0x7e], 0
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.140011210
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x140008e15
mov r8, qword [rax]
mov dword [rsp + 0x50], 0x160a1e1d
mov dword [rsp + 0x54], 0x100efef
mov rcx, rdi
nop dword [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 6
jb 0x140008e30
mov byte [rsp + 0x57], 0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc8]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140008e98
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e93
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
movdqa xmm0, xmmword [0x14006abc0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
mov rdx, qword [rsp + 0x90]
cmp rdx, 0x10
jb 0x140008eee
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ee9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ee9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x98]
call fcn.140002860
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.140015c60
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x140008f1e
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x130e0d1d
mov dword [rsp + 0x44], 0xf7e3e2e9
mov dword [rsp + 0x48], 0xd8e8eaed
mov dword [rsp + 0x4c], 0x100ede1
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xe
jb 0x140008f50
mov byte [rsp + 0x4f], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc8]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140008fb8
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008fb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008fb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
lea rdx, [0x140087698]
lea rcx, [rsp + 0x98]
call fcn.140002860
mov r8, rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.140015c60
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x140008feb
mov r8, qword [rax]
mov dword [rsp + 0x40], 0xf091511
mov word [rsp + 0x44], 0xe4
mov byte [rsp + 0x46], 1
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 5
jb 0x140009010
mov byte [rsp + 0x46], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc8]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140009078
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009073
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
mov dword [rsp + 0x40], 0xd1b0e09
mov dword [rsp + 0x44], 0xe6efe0ee
mov word [rsp + 0x48], 0x100
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 8
jb 0x1400090a0
mov byte [rsp + 0x49], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400090e0
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400025a0
nop
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rdi
lea r14, [rsp + 0x58]
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x70]
cmp r13, 0x10
cmovae r14, r15
movabs rdi, 0x7fffffffffffffff
mov rsi, qword [rsp + 0x68]
cmp rsi, rdi
ja 0x140009616
mov qword [rsp + 0x90], reloc.WS2_32.dll_ntohs
cmp rsi, 0x10
jae 0x14000916b
mov qword [rsp + 0x88], rsi
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
lea rcx, [rsp + 0x78]
call sub.VCRUNTIME140.dll_memmove
jmp 0x1400091b8
mov rax, rsi
or rax, 0xf
cmp rax, rdi
ja 0x140009186
mov rdi, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rdi, rcx
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x78]
call fcn.140001d30
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.140015c60
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400091dc
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x1e07120e
mov dword [rsp + 0x44], 0xf0f7deec
mov dword [rsp + 0x48], 0x100f7e1
xor edi, edi
mov ecx, edi
nop dword [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x140009200
mov byte [rsp + 0x4b], dil
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc8]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0x10
jb 0x14000926f
inc rdx
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009269
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009269
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
nop
cmp r13, 0x10
jb 0x1400092a9
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400092a1
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400092a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400668bc
mov rdx, qword [0x140087758]
mov qword [rsp + 0x58], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x1400092c1
lea rcx, [rsp + 0x58]
call fcn.1400025a0
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.140011210
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400092f2
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x1e07120e
mov word [rsp + 0x44], 0xec
mov byte [rsp + 0x46], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 5
jb 0x140009310
mov byte [rsp + 0x46], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc8]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0x90]
cmp rdx, 0x10
jb 0x14000937b
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009376
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009376
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
movdqa xmm0, xmmword [0x14006abc0]
movdqu xmmword [rsp + 0x88], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400093d1
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400093cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400093cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
lea rcx, [rsp + 0xc8]
call fcn.14000edc0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400093f0
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400025a0
mov dword [rsp + 0x40], 0x50170d1d
mov word [rsp + 0x44], 0x100
mov rcx, rdi
nop dword [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 4
jb 0x140009420
mov byte [rsp + 0x45], 0
movdqa xmm0, xmmword [0x14006ad80]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x88], 1
mov rcx, rdi
nop
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x78], al
inc rcx
cmp rcx, 0xf
jb 0x140009450
mov byte [rsp + 0x88], 0
xor eax, eax
mov word [rsp + 0x50], ax
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9, r12
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.14000bd00
test al, al
jne 0x1400094e9
mov byte [0x140087611], 1
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x1400094e2
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400095d5
call fcn.1400668bc
xor al, al
jmp 0x1400095e9
lea rax, str.Req_IDNF
cmp r12, rax
jne 0x140009546
mov byte [0x140087611], 1
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x14000953f
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000953a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400095d5
call fcn.1400668bc
xor al, al
jmp 0x1400095e9
xor edx, edx
mov r8d, 0x1024
mov rcx, qword [0x140087760]
call sub.VCRUNTIME140.dll_memset
mov rdx, r12
mov r8, qword [0x140087760]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [r8], al
lea rdx, [rdx + 1]
lea r8, [r8 + 1]
test al, al
jne 0x140009570
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x38]
call fcn.1400063c0
inc dword [0x140087784]
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x1400095e1
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400095dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400095dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
mov al, 1
jmp 0x1400095e9
mov al, 1
jmp 0x1400095e9
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140066950
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140001ab0
int3