Function at 0x140005c70
Capabilities:
Encode data using xor
Enumerate files on windows
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x290
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x76c
mov eax, dword [rcx + rdi]
mov ebx, 0x7b0
add rbx, rdi
test al, 1
jne 0x140005cfe
or eax, 1
mov dword [rcx + rdi], eax
mov word [rbx + 7], 0x1e9
mov dword [rbx], 0x832d1532
mov word [rbx + 4], 0xe7f0
mov byte [rbx + 6], 0xf4
lea rcx, [0x140009f60]
call fcn.140007e04
nop
mov r12d, dword [0x14000f018]
movdqa xmm7, xmmword [0x14000b700]
movdqa xmm8, xmmword [0x14000b6c0]
movdqa xmm9, xmmword [reloc.WS2_32.dll_connect]
movdqa xmm10, xmmword [0x14000b6a0]
movdqa xmm11, xmmword [0x14000b690]
cmp byte [rbx + 8], 0
je 0x140005e21
xor r8d, r8d
cmp r12d, 5
jl 0x140005dec
movdqa xmm2, xmmword [0x14000bcf0]
movdqa xmm0, xmm11
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm7
movzx eax, word [rbx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx], ax
movdqa xmm0, xmm10
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm7
movzx eax, word [rbx + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 2], ax
movdqa xmm0, xmm9
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm7
movzx eax, word [rbx + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 4], ax
movdqa xmm0, xmm8
psllq xmm0, 3
vpsrlvq xmm1, xmm2, xmm0
pshufb xmm1, xmm7
movzx eax, word [rbx + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 6], ax
jmp 0x140005e1d
movabs r9, 0xe9b5b3b1c77d4573
nop word [rax + rax]
movzx ecx, r8b
and cl, 7
shl cl, 3
mov rdx, r9
shr rdx, cl
xor byte [rbx + r8], dl
inc r8
cmp r8, 8
jb 0x140005e00
mov byte [rbx + 8], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140005f10
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movdqa xmm0, xmmword [0x14000b9a0]
movdqa xmm1, xmmword [0x14000ba80]
mov dword [rbp - 0x20], 0xd4a101a4
mov dword [rbp - 0x1c], 0x80a19ff1
mov dword [rbp - 0x18], 0xd3b017a9
mov ecx, 0x7a8
mov eax, dword [rcx + rdi]
mov ebx, 0x778
test al, 1
jne 0x140005ed9
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rbx + rdi]
mov byte [rcx + 0x2d], 1
lea rax, [rcx + 0x2c]
lea rdx, [rbp - 0x14]
cmp rcx, rdx
ja 0x140005eb1
lea rdx, [rbp - 0x40]
cmp rax, rdx
jb 0x140005eb1
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rbp - 0x20]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rbp - 0x18]
mov dword [rcx + 0x28], eax
mov byte [rcx + 0x2c], 0x81
jmp 0x140005ecc
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rbp - 0x20]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rbp - 0x18]
mov dword [rcx + 0x28], eax
mov byte [rcx + 0x2c], 0x81
lea rcx, [0x140009f30]
call fcn.140007e04
nop
mov rax, qword gs:[0x58]
mov r11, qword [rax]
add r11, rbx
mov rcx, r11
call fcn.1400067a0
mov rdx, r11
mov rcx, rsi
call fcn.140005610
lea rdx, [0x1400057f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006449
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.1400051e0
nop
movdqa xmm0, xmmword [0x14000ba10]
movdqa xmm1, xmmword [0x14000b9d0]
mov dword [rsp + 0x70], 0xa8fd34f6
mov dword [rsp + 0x74], 0xac9fe4e6
mov dword [rsp + 0x78], 0xbdfd32ed
mov word [rsp + 0x7c], 0xe7fe
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x7bc
mov eax, dword [rcx + rdi]
mov ebx, 0x720
test al, 1
jne 0x140005fee
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rbx + rdi]
mov byte [rcx + 0x2f], 1
lea rax, [rcx + 0x2e]
lea rdx, [rsp + 0x7e]
cmp rcx, rdx
ja 0x140005fbb
lea rdx, [rsp + 0x50]
cmp rax, rdx
jb 0x140005fbb
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rsp + 0x70]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rsp + 0x78]
mov dword [rcx + 0x28], eax
movzx eax, word [rsp + 0x7c]
mov word [rcx + 0x2c], ax
mov byte [rcx + 0x2e], 0xc3
jmp 0x140005fe1
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rsp + 0x70]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rsp + 0x78]
mov dword [rcx + 0x28], eax
movzx eax, word [rsp + 0x7c]
mov word [rcx + 0x2c], ax
mov byte [rcx + 0x2e], 0xc3
lea rcx, [0x140009f00]
call fcn.140007e04
nop
lea r11, [rbx + rdi]
mov rcx, r11
call fcn.140006620
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [r11 + rdi], 0
jne 0x140006001
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x14000604a
lea rax, [rdi + rcx]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x60]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x60]
add rbx, rcx
mov r8, rdi
mov rdx, r11
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x14000605e
mov qword [rsp + 0x20], rdi
mov r9, r11
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.140006920
mov rsi, qword [rbp - 0x50]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 2
jb 0x140006488
lea r15, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r15, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea r14, [rsi + 2]
mov edi, send
lea rbx, [rbp - 0x80]
cmp r14, rdi
jbe 0x140006124
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400060e7
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140007ea0
test rax, rax
je 0x140006192
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140006120
mov eax, socket
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140006100
xor ebx, ebx
jmp 0x140006120
cmp rcx, 0x1000
jb 0x140006118
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000648e
jmp 0x1400060c8
call fcn.140007ea0
mov rbx, rax
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], rdi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], 0x2a5c
mov byte [rbx + r14], 0
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000619e
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006199
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006199
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007ee4
movdqa xmm0, xmmword [0x14000b6e0]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
cmp r14, 0xffffffffffffffff
jne 0x14000627a
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movdqa xmm0, xmmword [0x14000b720]
mov dword [rsp + 0x40], 0x18c62b66
mov dword [rsp + 0x44], 0x1627a2e1
mov ecx, 0x770
mov eax, dword [rcx + rdi]
mov ebx, 0x750
test al, 1
jne 0x14000624e
or eax, 1
mov dword [rcx + rdi], eax
lea rax, [rbx + rdi]
mov byte [rax + 0x19], 1
lea rcx, [rax + 0x18]
lea rdx, [rsp + 0x48]
cmp rax, rdx
ja 0x14000622f
lea rdx, [rsp + 0x30]
cmp rcx, rdx
jb 0x14000622f
movups xmmword [rax], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], recv
jmp 0x140006241
movups xmmword [rax], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], recv
lea rcx, [0x140009ed0]
call fcn.140007e04
nop
lea r11, [rbx + rdi]
mov rcx, r11
call fcn.1400064a0
mov rdx, r11
mov rcx, rsi
call fcn.140005610
lea rdx, [0x1400057f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000640b
mov r13d, 0x710
mov ebx, r13d
mov ecx, 0x70c
movabs r15, 0xfd4ff1bda37d1fd3
movdqa xmm6, xmmword [0x14000bdc0]
nop word [rax + rax]
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov eax, dword [rcx + rdi]
test al, 1
jne 0x1400062e0
or eax, 1
mov dword [rdi + rcx], eax
mov dword [rdi + rbx + 0xc], 0x14fd187
mov dword [rdi + rbx], 0xd11c6b80
mov dword [rdi + rbx + 4], 0xdd3f84c9
mov dword [rdi + rbx + 8], 0xce186bba
lea rcx, [0x140009ea0]
call fcn.140007e04
nop
lea rdx, [rdi + rbx]
cmp byte [rdx + 0xf], 0
je 0x1400063c3
xor eax, eax
cmp r12d, 5
jl 0x1400063a0
movdqa xmm0, xmm11
psllq xmm0, 3
vpsrlvq xmm1, xmm6, xmm0
pshufb xmm1, xmm7
movzx eax, word [rdx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdx], ax
movdqa xmm0, xmm10
psllq xmm0, 3
vpsrlvq xmm1, xmm6, xmm0
pshufb xmm1, xmm7
movzx eax, word [rdx + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdx + 2], ax
movdqa xmm0, xmm9
psllq xmm0, 3
vpsrlvq xmm1, xmm6, xmm0
pshufb xmm1, xmm7
movzx eax, word [rdx + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdx + 4], ax
movdqa xmm0, xmm8
psllq xmm0, 3
vpsrlvq xmm1, xmm6, xmm0
pshufb xmm1, xmm7
movzx eax, word [rdx + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rdx + 6], ax
mov eax, 8
nop dword [rax]
movzx ecx, al
and cl, 7
shl cl, 3
mov r8, r15
shr r8, cl
xor byte [rdx + rax], r8b
inc rax
cmp rax, 0xf
jb 0x1400063a0
mov byte [rdx + 0xf], 0
mov rbx, r13
mov rcx, rsi
call fcn.140005610
mov rcx, rax
lea rdx, [rbp + 0x1c]
call fcn.140005610
lea rdx, [0x1400057f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp - 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
mov ecx, 0x70c
jne 0x1400062a0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140006449
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006444
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006444
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007ee4
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140004e70
nop
call fcn.140004dd0
int3