Function at 0x140052cd0
Capabilities:
Create process on windows
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [0x14017b4c0]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov r15, r8
mov qword [rbp - 0x58], r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x10], rdx
xor r13d, r13d
xor edx, edx
mov r8d, 0x430
lea rcx, [rbp + 0x90]
call fcn.140107fe0
lea rcx, [rbp + 0x90]
call fcn.140048900
nop
lea rax, [rbp - 0x50]
mov qword [rbp + 0x30], rax
lea rax, [0x14015c850]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rsi
lea rax, [rbp - 0x50]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x50]
mov qword [rbp + 0x20], rax
movabs r12, 0x7fffffffffffffff
mov rax, r12
mov rcx, qword [reloc.WS2_32.dll_htonl]
sub rax, rcx
cmp rax, 1
jb 0x14005379b
lea rax, str.callback
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rax, qword [str.callback]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x140159cb8]
lea r8, str.callback
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140012da0
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x30]
call fcn.140048e40
mov rcx, rax
mov rax, qword [rbp + 0x1c0]
cmp rax, qword [rbp + 0x1c8]
je 0x140052dff
lea r8, [rbp - 0x50]
mov rdx, rcx
mov rcx, rax
call fcn.140060970
add qword [rbp + 0x1c0], 0x48
jmp 0x140052e16
lea r9, [rbp - 0x50]
mov r8, rcx
mov rdx, rax
lea rcx, [rbp + 0x1b8]
call fcn.140059a90
nop
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140052e2a
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140052e47
mov rax, qword [rcx]
lea rdx, [rbp - 0x50]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov qword [rbp - 0x18], r13
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140052e84
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052e7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400537a1
call fcn.1400ce56c
mov qword [rbp + 0x20], rsi
lea rax, [rbp + 0x90]
mov qword [rbp + 0x28], rax
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400ce220
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rax], xmm0
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x14005ed90]
xor edx, edx
xor ecx, ecx
call fcn.1400e6780
mov qword [rbp + 0x60], rax
test rax, rax
je 0x14005378c
lea rdx, [rbp + 0x40]
mov rcx, rsi
call fcn.140050580
nop
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r8, qword [rbp + 0x40]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, str._Authorization__Authorization_URL:_
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], Ordinal_41
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x50], xmm0
lea r9, [rbp + 0x40]
lea r8, [rsp + 0x50]
call fcn.140058390
lea rax, str.If_your_browser_didnt_open_a_authorization_page:_n
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], reloc.WLDAP32.dll_Ordinal_50
mov ecx, 1
call fcn.1400dcbc0
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.14001af20
mov ecx, 1
call fcn.1400dcbc0
mov rdi, rax
lea rax, str.Please_go_to_the_following_URL_and_authorize_the_application:_n_n_n_n
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 0x43
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rax, qword [rbp + 0x40]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x28], rax
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbp - 0x78], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x20], 1
lea rax, [rbp - 0x80]
mov qword [rbp + 0x28], rax
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x20], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x70]
call fcn.14000fd40
nop
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rcx, qword [rbp + 0x70]
mov rbx, qword [rbp + 0x80]
mov r9, rdi
mov r8, rbx
mov edx, 1
call fcn.1400e1e3c
cmp rax, rbx
jne 0x1400537a7
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x14005305f
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005305a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400537b4
call fcn.1400ce56c
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
lea rbx, [rsi + 0x120]
mov qword [rbp + 0x20], rbx
mov byte [rbp + 0x28], 0
mov rcx, rbx
call fcn.1400cd714
test eax, eax
jne 0x14005377b
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x1400537ba
mov byte [rbp + 0x28], 1
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], r15
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x30]
call fcn.140053810
test al, al
jne 0x1400530dc
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rsi + 0xd8]
call fcn.1400cc35c
lea rcx, [rbp + 0x30]
call fcn.140053810
test al, al
je 0x1400530c0
mov rcx, rbx
call fcn.1400cd71c
movzx eax, byte [rbp + 0x128]
test al, al
je 0x14005311a
mov rax, 0xffffffffffffffff
xchg qword [rbp + 0xd8], rax
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x30]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_closesocket]
cmp dword [rbp + 0x68], 0
je 0x1400537ca
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0x68], eax
je 0x14005377b
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400cc9d0
test eax, eax
jne 0x1400537d5
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x60], xmm0
lea rax, str._Authentication__Authentication_finished
mov qword [rbp + 0x20], rax
mov qword [rbp + Ordinal_41], 0x28
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, 1
call fcn.140010730
movzx eax, byte [rsi + 0xd1]
test al, al
je 0x140053720
mov rax, qword [rsi + 0x1c8]
mov qword [r15 + 0x18], rax
cmp qword [rsi + 0x1b0], 0
jle 0x140053642
lea rdi, [rsi + 0x190]
lea rbx, [rsi + 0x170]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rdi + 0x10]
mov rax, r12
sub rax, rcx
cmp rax, rdx
jb 0x1400537e0
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400531de
mov r9, qword [rbx]
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400531eb
mov rax, qword [rdi]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, rbx
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.140012da0
nop
lea r9, [rbp - 0x10]
mov r15, qword [rbp - 0x10]
mov r13, qword [rbp + 8]
cmp r13, 0xf
cmova r9, r15
xor ecx, ecx
xor edx, edx
mov r8, qword [rbp]
test r8, r8
je 0x140053251
nop dword [rax]
movsx rax, byte [r9 + rdx]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r8
jb 0x140053230
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
movabs rcx, 0x5851f42d4c957f2d
test rax, rax
jne 0x14005327e
imul r8, rcx
inc r8
jmp 0x140053281
mov r8, rax
sub r8, qword [rsi + 0x1b0]
cmp byte [rsi + 0x1b8], 0
sete al
lea rcx, [0x14015bac4]
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], 5
mov byte [rsp + 0x70], al
movabs rax, 0x5000000000000000
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x71], r8
movabs rax, 0x4000000000000001
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x20], 2
lea rax, [rsp + 0x60]
mov qword [rbp + 0x28], rax
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x20], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.14000fd40
nop
mov rax, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
sub r12, rax
cmp r12, rcx
jb 0x1400537e6
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140053324
mov r9, qword [rbx]
cmp qword [rdi + 0x18], 0xf
jbe 0x14005332e
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov r8, rbx
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140012da0
nop
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
xor r12d, r12d
mov ecx, r12d
mov edx, r12d
mov r9, qword [rbp - 0x70]
test r9, r9
je 0x140053391
movsx rax, byte [r8 + rdx]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r9
jb 0x140053370
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
movabs r11, 0x5851f42d4c957f2d
test rax, rax
jne 0x1400533be
imul r9, r11
inc r9
jmp 0x1400533c1
mov r9, rax
lea r10, [rsp + 0x60]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
cmp rdi, 0xf
cmova r10, rbx
mov rcx, r12
mov rdx, r12
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x140053411
nop dword [rax + rax]
movsx rax, byte [rdx + r10]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r8
jb 0x1400533f0
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x140053434
imul r8, r11
inc r8
jmp 0x140053437
mov r8, rax
imul r8, r9
mov rcx, qword [rsi + 0x1b0]
inc rcx
xor edx, edx
mov rax, r8
div rcx
lea rcx, [0x1401513cc]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 2
mov qword [rbp + 0x28], rax
movabs rax, 0x4000000000000000
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp + 0x38], rax
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rbp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.14000fd40
lea r9, [rbp + 0x70]
mov r10, qword [rbp + 0x70]
mov r11, qword [rbp + 0x88]
cmp r11, 0xf
cmova r9, r10
mov rcx, r12
mov rdx, r12
mov r8, qword [rbp + 0x80]
test r8, r8
je 0x140053501
nop dword [rax]
nop word [rax + rax]
movsx rax, byte [r9 + rdx]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r8
jb 0x1400534e0
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x14005352e
movabs rax, 0x5851f42d4c957f2d
imul r8, rax
inc r8
jmp 0x140053531
mov r8, rax
mov rax, qword [rbp - 0x58]
mov qword [rax + 0x10], r8
cmp r11, 0xf
jbe 0x140053570
lea rdx, [r11 + 1]
mov rax, r10
cmp rdx, 0x1000
jb 0x140053568
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400537ec
mov rcx, r10
call fcn.1400ce56c
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x70], 0
cmp rdi, 0xf
jbe 0x1400535be
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400535b5
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400537f2
mov rcx, rbx
call fcn.1400ce56c
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400535f9
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400535f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400537f8
call fcn.1400ce56c
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], 0
cmp r13, 0xf
jbe 0x140053645
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140053638
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400537fe
mov rcx, r15
call fcn.1400ce56c
jmp 0x140053645
xor r12d, r12d
mov byte [r14 + 0x50], 0
cmp byte [rsi + 0x1c0], 0
je 0x140053692
mov qword [rbp + 0x20], r14
lea rdx, [rsi + 0x170]
mov rcx, r14
call fcn.140005370
nop
lea rcx, [r14 + 0x20]
lea rdx, [rsi + 0x190]
call fcn.140005370
mov rax, qword [rsi + 0x1b0]
mov qword [r14 + 0x40], rax
movzx eax, byte [rsi + 0x1b8]
mov byte [r14 + 0x48], al
mov byte [r14 + 0x50], 1
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x1400536cd
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400536c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053804
call fcn.1400ce56c
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], 0
cmp dword [rbp + 0x68], 0
jne 0x140053786
lea rcx, [rbp + 0x90]
call fcn.140048bd0
mov rax, r14
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.1400ce1f0
mov rbx, qword [rsp + 0x628]
add rsp, 0x5d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov byte [r14 + 0x50], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140053760
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005375b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053804
call fcn.1400ce56c
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], 0
cmp dword [rbp + 0x68], 0
jne 0x140053786
jmp 0x1400536e7
mov ecx, 5
call fcn.1400cd5a0
nop
call fcn.1400e69c8
nop
mov dword [rbp + 0x68], r13d
mov ecx, 6
call fcn.1400cd5a0
nop
call fcn.140002530
nop
call fcn.1400e1a34
nop
call fcn.1400e1fb4
mov ecx, dword [rax]
call fcn.140002e00
nop
call fcn.1400e1a34
int3
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.1400cd5a0
int3
mov ecx, 1
call fcn.1400cd5a0
int3
mov ecx, 2
call fcn.1400cd5a0
int3
call fcn.140002530
nop
call fcn.140002530
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
int3