Function at 0x14006e140
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x1401abb80]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov byte [rsp + 0x20], reloc.WS2_32.dll_send
mov byte [rsp + 0x21], reloc.WS2_32.dll_recv
mov byte [rsp + 0x22], 0xa
mov byte [rsp + 0x23], 0x75
movzx eax, byte [rsp + 0x20]
xor r9d, r9d
movabs rsi, 0x9aa4aeb1aed8857a
mov r10, rsi
lea rax, [rsp + 0x20]
sub r10, rax
mov edi, reloc.WS2_32.dll_ntohs
nop word [rax + rax]
lea r8, [rsp + 0x20]
add r8, r9
mov rcx, r9
and ecx, edi
cmp rcx, rdi
cmovae rcx, rdi
shl cl, 2
mov rdx, rsi
shr rdx, cl
and dl, dil
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x20], dl
inc r9
cmp r9, 4
jb 0x14006e1b0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
mov qword [rbp + 0x37], 0
mov qword [rbp + 0x3f], rdi
mov byte [rbp + 0x27], 0
mov byte [rbp - 0x79], Ordinal_45
mov byte [rbp - 0x78], 3
mov byte [rbp - 0x77], 0x77
mov byte [rbp - 0x76], 0x44
mov byte [rbp - 0x75], 0x7d
mov byte [rbp - 0x74], reloc.WS2_32.dll_ntohl
mov byte [rbp - 0x73], 0x67
mov byte [rbp - 0x72], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x71], 1
mov byte [rbp - 0x70], WSAStartup
mov byte [rbp - 0x6f], Ordinal_79
mov byte [rbp - 0x6e], 0x51
mov byte [rbp - 0x6d], 8
mov byte [rbp - 0x6c], 0x7f
mov byte [rbp - 0x6b], 0x4a
mov byte [rbp - 0x6a], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x69], 0x44
mov byte [rbp - 0x68], reloc.WS2_32.dll_send
mov byte [rbp - 0x67], 0x68
mov byte [rbp - 0x66], 0x52
mov byte [rbp - 0x65], reloc.WS2_32.dll_recv
mov byte [rbp - 0x64], 0x7b
mov byte [rbp - 0x63], 0x5d
mov byte [rbp - 0x62], 0x51
mov byte [rbp - 0x61], 0x53
mov byte [rbp - 0x60], 0x54
mov byte [rbp - 0x5f], 0x54
mov byte [rbp - 0x5e], reloc.WS2_32.dll_sendto
mov byte [rbp - 0x5d], WSAGetLastError
mov byte [rbp - 0x5c], 0x6b
mov byte [rbp - 0x5b], 0x42
mov byte [rbp - 0x5a], 0x5f
mov byte [rbp - 0x59], reloc.WLDAP32.dll_Ordinal_35
mov byte [rbp - 0x58], 0x7c
mov byte [rbp - 0x57], 0x46
mov byte [rbp - 0x56], 0x47
mov byte [rbp - 0x55], 0x60
mov byte [rbp - 0x54], reloc.WS2_32.dll_setsockopt
mov byte [rbp - 0x53], WSAStartup
mov byte [rbp - 0x52], Ordinal_32
mov byte [rbp - 0x51], 0x61
mov byte [rbp - 0x50], reloc.WS2_32.dll_recvfrom
mov byte [rbp - 0x4f], 0x24
mov byte [rbp - 0x4e], gethostname
mov byte [rbp - 0x4d], 0x68
mov byte [rbp - 0x4c], 0x60
mov byte [rbp - 0x4b], Ordinal_41
mov byte [rbp - 0x4a], reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp - 0x49], reloc.WLDAP32.dll_Ordinal_41
mov byte [rbp - 0x48], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x47], 0x3f
mov byte [rbp - 0x46], reloc.WLDAP32.dll_Ordinal_60
mov byte [rbp - 0x45], 0x25
mov byte [rbp - 0x44], reloc.WLDAP32.dll_Ordinal_45
mov byte [rbp - 0x43], gethostname
mov byte [rbp - 0x42], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x41], reloc.WS2_32.dll_sendto
mov byte [rbp - 0x40], listen
mov byte [rbp - 0x3f], 1
mov byte [rbp - 0x3e], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x3d], 0x34
mov byte [rbp - 0x3c], reloc.WS2_32.dll_gethostname
mov byte [rbp - 0x3b], reloc.WLDAP32.dll_Ordinal_60
mov byte [rbp - 0x3a], Ordinal_35
mov byte [rbp - 0x39], 0x40
mov byte [rbp - 0x38], listen
mov byte [rbp - 0x37], 2
mov byte [rbp - 0x36], Ordinal_79
mov byte [rbp - 0x35], listen
mov byte [rbp - 0x34], 1
mov byte [rbp - 0x33], reloc.WS2_32.dll_sendto
mov byte [rbp - 0x32], 0x40
mov byte [rbp - 0x31], 9
mov byte [rbp - 0x30], reloc.WS2_32.dll_select
mov byte [rbp - 0x2f], 0x41
mov byte [rbp - 0x2e], 9
mov byte [rbp - 0x2d], 7
mov byte [rbp - 0x2c], 6
mov byte [rbp - 0x2b], 2
mov byte [rbp - 0x2a], reloc.WS2_32.dll_setsockopt
mov byte [rbp - 0x29], Ordinal_32
mov byte [rbp - 0x28], 1
mov byte [rbp - 0x27], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x26], 0x54
mov byte [rbp - 0x25], 0x50
mov byte [rbp - 0x24], 0x25
mov byte [rbp - 0x23], 1
mov byte [rbp - 0x22], reloc.WS2_32.dll_setsockopt
mov byte [rbp - 0x21], reloc.WS2_32.dll_select
mov byte [rbp - 0x20], reloc.WS2_32.dll_socket
mov byte [rbp - 0x1f], Ordinal_30
mov byte [rbp - 0x1e], Ordinal_26
mov byte [rbp - Ordinal_32], 0x1d
mov byte [rbp - 0x1c], reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp - 0x1b], Ordinal_32
mov byte [rbp - 0x1a], reloc.WS2_32.dll_sendto
mov byte [rbp - 0x19], 0xe4
mov byte [rbp - 0x18], 0xde
mov byte [rbp - 0x17], 0x86
mov byte [rbp - 0x16], 0xad
mov byte [rbp - 0x15], 0xdb
mov byte [rbp - 0x14], 0xbc
mov byte [rbp - 0x13], 0xde
mov byte [rbp - 0x12], 0xa0
mov byte [rbp - 0x11], 0xcf
mov byte [rbp - 0x10], 0xe7
mov byte [rbp - 0xf], 0xa1
mov byte [rbp - 0xe], 0xac
mov byte [rbp - 0xd], 0xeb
mov byte [rbp - 0xc], 0xe0
mov byte [rbp - 0xb], 0xee
mov byte [rbp - 0xa], 0xe0
mov byte [rbp - 9], 0xe4
mov byte [rbp - 8], 0xb3
mov byte [rbp - 7], 0xeb
mov byte [rbp - 6], 0xf4
mov byte [rbp - 5], 0xfc
mov byte [rbp - 4], 0xf2
mov byte [rbp - 3], 0xb3
mov byte [rbp - 2], 0xe5
mov byte [rbp - 1], 0xe2
mov byte [rbp], 0xfd
mov byte [rbp + 1], 0xb1
mov byte [rbp + 2], 0xf9
mov byte [rbp + 3], 0xf7
mov byte [rbp + 4], 0xea
mov byte [rbp + 5], 0xfe
mov byte [rbp + 6], 0xb1
mov byte [rbp + 7], 0xe7
mov byte [rbp + 8], 0xf3
mov byte [rbp + 9], 0xf9
mov byte [rbp + 0xa], 0x82
mov byte [rbp + 0xb], 0xe3
mov byte [rbp + 0xc], 0xfe
mov byte [rbp + 0xd], 0xf6
mov byte [rbp + 0xe], 0x80
mov byte [rbp + 0xf], reloc.WLDAP32.dll_Ordinal_211
mov byte [rbp + 0x10], 0xcd
mov byte [rbp + 0x11], Ordinal_211
mov byte [rbp + 0x12], 0xcb
mov byte [rbp + 0x13], 0xdd
mov byte [rbp + 0x14], 0xda
mov byte [rbp + 0x15], reloc.WLDAP32.dll_Ordinal_200
mov byte [rbp + 0x16], 0xc4
mov byte [rbp + 0x17], 0xc3
mov byte [rbp + 0x18], 0x9a
mov byte [rbp + 0x19], 0xb6
mov byte [rbp + 0x1a], 0x9d
mov byte [rbp + 0x1b], 0x90
mov byte [rbp + 0x1c], 0xb4
mov byte [rbp + 0x1d], 0xb9
mov byte [rbp + 0x1e], 0x90
mov byte [rbp + 0x1f], reloc.WLDAP32.dll_Ordinal_143
mov byte [rbp + 0x20], 0x98
mov byte [rbp + 0x21], 0xb1
movzx eax, byte [rbp - 0x79]
xor r9d, r9d
movabs r11, 0xe554fb1975b4ee20
mov r10, r11
lea rax, [rbp - 0x79]
sub r10, rax
lea r8, [rbp - 0x79]
add r8, r9
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, rdi
shl cl, 2
mov rdx, r11
shr rdx, cl
and dl, 0xf
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x79], dl
inc r9
cmp r9, 0x9b
jb 0x14006e493
lea rcx, [rbp - 0x79]
call fcn.14001ffa0
lea rdx, [rbp + 0x27]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14004f8a0
movsx rax, byte [0x1400d3fc0]
xor al, 0x90
mov byte [rsp + 0x20], al
movsx rax, byte [0x1400d3fc1]
xor al, 0x96
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x20]
xor r9d, r9d
movabs r14, 0x1f0f1c91bf74839e
mov r10, r14
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
nop word [rax + rax]
lea r8, [rsp + 0x20]
add r8, r9
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, rdi
shl cl, 2
mov rdx, r14
shr rdx, cl
and dl, 0xf
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x20], dl
inc r9
cmp r9, 2
jb 0x14006e530
lea rcx, [rsp + 0x20]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14006e580
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0xf
cmova rcx, qword [rbp + 0x27]
mov r8, qword [rbp + 0x37]
cmp r8, rax
jne 0x14006e5b2
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14006e83f
mov byte [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_41
mov byte [rsp + 0x21], Ordinal_26
mov byte [rsp + 0x22], 0xa
mov byte [rsp + 0x23], 0x75
movzx eax, byte [rsp + 0x20]
xor r9d, r9d
mov r10, rsi
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
lea r8, [rsp + 0x20]
add r8, r9
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, rdi
shl cl, 2
mov rdx, rsi
shr rdx, cl
and dl, 0xf
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x20], dl
inc r9
cmp r9, 4
jb 0x14006e5e0
lea rcx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x14006e624
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0xf
cmova rcx, qword [rbp + 0x27]
mov r8, qword [rbp + 0x37]
cmp r8, rax
jne 0x14006e656
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14006e83f
mov byte [rsp + 0x20], 9
mov byte [rsp + 0x21], Ordinal_26
mov byte [rsp + 0x22], 0xa
mov byte [rsp + 0x23], 0x75
movzx eax, byte [rsp + 0x20]
xor r9d, r9d
mov r10, rsi
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
lea r8, [rsp + 0x20]
add r8, r9
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, rdi
shl cl, 2
mov rdx, rsi
shr rdx, cl
and dl, 0xf
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x20], dl
inc r9
cmp r9, 4
jb 0x14006e680
lea rcx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x14006e6c4
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0xf
cmova rcx, qword [rbp + 0x27]
mov r8, qword [rbp + 0x37]
cmp r8, rax
jne 0x14006e6f6
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14006e83f
movsx rax, byte [0x1400d4040]
xor al, 0x90
mov byte [rsp + 0x20], al
movsx rax, byte [0x1400d4041]
xor al, 0x96
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x20]
xor r9d, r9d
mov r10, r14
lea rax, [rsp + 0x20]
sub r10, rax
nop word [rax + rax]
lea r8, [rsp + 0x20]
add r8, r9
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, rdi
shl cl, 2
mov rdx, r14
shr rdx, cl
and dl, 0xf
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x20], dl
inc r9
cmp r9, 2
jb 0x14006e730
lea rcx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x14006e774
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0xf
cmova rcx, qword [rbp + 0x27]
mov r8, qword [rbp + 0x37]
cmp r8, rax
jne 0x14006e7a6
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14006e83f
mov byte [rsp + 0x20], 0xe9
mov byte [rsp + 0x21], __WSAFDIsSet
movzx eax, byte [rsp + 0x20]
xor r9d, r9d
mov r10, r14
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
nop word [rax + rax]
lea r8, [rsp + 0x20]
add r8, r9
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, rdi
shl cl, 2
mov rdx, r14
shr rdx, cl
and dl, 0xf
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rsp + r9 + 0x20], dl
inc r9
cmp r9, 2
jb 0x14006e7d0
lea rax, [rsp + 0x20]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14006e811
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0xf
cmova rcx, qword [rbp + 0x27]
mov r8, qword [rbp + 0x37]
cmp r8, rbx
jne 0x14006e84f
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14006e84f
mov rax, qword [0x1401ac288]
mov dword [rax + 4], 1
jmp 0x14006e85d
mov rax, qword [0x1401ac288]
mov dword [rax + 4], 0
lea rcx, [rbp + 0x27]
call fcn.1400032a0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400cee20
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret