Function at 0x140009a10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
xor ebx, ebx
call fcn.14000c190
mov dword [rbp + 0x50], 0x2b3b35
mov byte [rbp + 0x54], 1
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rbp + rcx + 0x50], al
inc rcx
cmp rcx, 3
jb 0x140009a50
mov byte [rbp + 0x54], bl
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140095b28], bl
jne 0x140009a84
mov edx, 0x15e
mov ecx, 0x1f4
call fcn.140007e60
mov edx, 3
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x140072690]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [str.FGHIJK__f]
movdqu xmmword [rsp + 0x30], xmm1
mov word [rsp + 0x40], 0x100
mov rdx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + 0x56]
xor byte [rsp + rdx + 0x20], al
inc rdx
cmp rdx, 0x20
jb 0x140009ad0
mov byte [rsp + 0x41], bl
lea r9, [rbp + 0x50]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.1400027d0
mov dword [rsp + 0x68], reloc.WS2_32.dll_sendto
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140006360
nop
lea rcx, [rsp + 0x48]
call fcn.1400058c0
mov dword [rsp + 0x20], 0x15785d5c
mov dword [rsp + 0x24], 0x2f392f3b
mov dword [rsp + 0x28], 0x100333f
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xa
jb 0x140009b40
mov byte [rsp + 0x2b], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x1400726b0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400726c0]
movdqu xmmword [rsp + 0x30], xmm1
mov word [rsp + 0x40], 0x100
mov rcx, rbx
nop
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x20
jb 0x140009ba0
mov byte [rsp + 0x41], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov dword [rsp + 0x20], 0x303c775c
mov dword [rsp + 0x24], 0x2f333829
mov dword [rsp + 0x28], 0x607713a
mov word [rsp + 0x2c], Ordinal_79
mov byte [rsp + 0x2e], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xd
jb 0x140009bf0
mov byte [rsp + 0x2e], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov dword [rsp + 0x20], 0x2d0b5d5c
mov dword [rsp + 0x24], 0x67392f3b
mov word [rsp + 0x28], 0x100
mov rcx, rbx
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 8
jb 0x140009c30
mov byte [rsp + 0x29], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov r15, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [str.we6459_:]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xc1e1503
mov dword [rsp + 0x34], 0x4c5118
mov byte [rsp + 0x38], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x17
jb 0x140009c90
mov byte [rsp + 0x38], 0
lea r9, [rbp + 0x50]
lea r8, [rsp + 0x37]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x78]
call fcn.1400027d0
mov dword [rbp - 0x68], reloc.WS2_32.dll_sendto
lea rdi, [rsp + 0x78]
mov rsi, qword [rsp + 0x78]
mov r13, qword [rbp - 0x70]
cmp r13, 0xf
cmova rdi, rsi
lea r14, [rsp + 0x78]
cmova r14, rsi
add r14, qword [rbp - 0x78]
cmp rdi, r14
je 0x140009d20
mov qword [rbp + 0x50], reloc.WS2_32.dll_sendto
movzx edx, byte [rdi]
mov rcx, r15
call fcn.1400029a0
lea rdx, [0x140004280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x50]
call fcn.1400045c0
inc rdi
cmp rdi, r14
jne 0x140009cf4
cmp r13, 0xf
jbe 0x140009d5a
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140009d52
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009d52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14006d208
mov edx, 2
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0x20], 0x37371476
mov dword [rsp + 0x24], 0x293f3e34
mov dword [rsp + 0x28], 0x1003b3b
mov rcx, rbx
nop
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xa
jb 0x140009d90
mov byte [rsp + 0x2b], 0
lea r9, [rbp + 0x50]
lea r8, [rsp + 0x2a]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.1400027d0
mov dword [rbp - 0x40], reloc.WLDAP32.dll_Ordinal_50
lea rdi, [rbp - 0x60]
mov rsi, qword [rbp - 0x60]
mov r13, qword [rbp - 0x48]
cmp r13, 0xf
cmova rdi, rsi
lea r15, [rbp - 0x60]
cmova r15, rsi
add r15, qword [rbp - 0x50]
cmp rdi, r15
je 0x140009e1c
mov qword [rbp + 0x50], reloc.WLDAP32.dll_Ordinal_50
movzx edx, byte [rdi]
mov rcx, r14
call fcn.1400029a0
lea rdx, [0x140004280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x50]
call fcn.1400045c0
inc rdi
cmp rdi, r15
jne 0x140009df0
cmp r13, 0xf
jbe 0x140009e56
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140009e4e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009e4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14006d208
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r15, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x140072410]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xd0d0307
mov dword [rsp + 0x34], 0x1004b50
mov rcx, rbx
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x16
jb 0x140009e90
mov byte [rsp + 0x37], 0
lea r9, [rbp + 0x50]
lea r8, [rsp + 0x36]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x38]
call fcn.1400027d0
mov dword [rbp - 0x18], reloc.WS2_32.dll_sendto
lea rdi, [rbp - 0x38]
mov rsi, qword [rbp - 0x38]
mov r13, qword [rbp - 0x20]
cmp r13, 0xf
cmova rdi, rsi
lea r14, [rbp - 0x38]
cmova r14, rsi
add r14, qword [rbp - 0x28]
cmp rdi, r14
je 0x140009f1c
mov qword [rbp + 0x50], reloc.WS2_32.dll_sendto
movzx edx, byte [rdi]
mov rcx, r15
call fcn.1400029a0
lea rdx, [0x140004280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x50]
call fcn.1400045c0
inc rdi
cmp rdi, r14
jne 0x140009ef0
cmp r13, 0xf
jbe 0x140009f56
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140009f4e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009f4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14006d208
mov edx, 2
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r15, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dword [rsp + 0x20], 0x2a361e76
mov dword [rsp + 0x24], 0x31303a2e
mov dword [rsp + 0x28], 0x1003b3b
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xa
jb 0x140009f90
mov byte [rsp + 0x2b], 0
lea r9, [rbp + 0x50]
lea r8, [rsp + 0x2a]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x10]
call fcn.1400027d0
mov dword [rbp + 0x10], reloc.WLDAP32.dll_Ordinal_50
lea rdi, [rbp - 0x10]
mov rsi, qword [rbp - 0x10]
mov r13, qword [rbp + 8]
cmp r13, 0xf
cmova rdi, rsi
lea r14, [rbp - 0x10]
cmova r14, rsi
add r14, qword [rbp]
cmp rdi, r14
je 0x14000a01c
mov qword [rbp + 0x50], reloc.WLDAP32.dll_Ordinal_50
movzx edx, byte [rdi]
mov rcx, r15
call fcn.1400029a0
lea rdx, [0x140004280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x50]
call fcn.1400045c0
inc rdi
cmp rdi, r14
jne 0x140009ff0
cmp r13, 0xf
jbe 0x14000a056
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000a04e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a04e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14006d208
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x20], 0x29175d5c
mov dword [rsp + 0x24], 0x3333322e
mov dword [rsp + 0x28], 0x6a652d
mov byte [rsp + 0x2c], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xb
jb 0x14000a0a0
mov byte [rsp + 0x2c], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x1400723b0]
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1400724c0]
movdqu xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x68], 0x240c1e11
mov dword [rsp + 0x6c], 0x2057205a
mov dword [rsp + 0x70], 0x1005f44
mov rcx, rbx
nop
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 0x2a
jb 0x14000a110
mov byte [rsp + 0x73], 0
lea rdx, [rsp + 0x48]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov edx, 2
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x20], 0x3c3c3903
mov dword [rsp + 0x24], 0x293f3e2e
mov dword [rsp + 0x28], 0x1003b3b
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xa
jb 0x14000a170
mov byte [rsp + 0x2b], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x140072220]
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [str._bXH2_]
movdqu xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x68], 0x59251119
mov dword [rsp + 0x6c], 0x47215021
mov word [rsp + 0x70], 0x5e
mov byte [rsp + 0x72], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 0x29
jb 0x14000a1f0
mov byte [rsp + 0x72], 0
lea rdx, [rsp + 0x48]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov edx, 2
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x20], 0x3c3c3903
mov dword [rsp + 0x24], 0x293f3e2e
mov dword [rsp + 0x28], 0x1003b3b
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xa
jb 0x14000a250
mov byte [rsp + 0x2b], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x140072330]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400722c0]
movdqu xmmword [rsp + 0x30], xmm1
mov byte [rsp + 0x40], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x1f
jb 0x14000a2b0
mov byte [rsp + 0x40], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov edx, 2
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x20], 0x3c3c3903
mov dword [rsp + 0x24], 0x293f3e2e
mov dword [rsp + 0x28], 0x1003b3b
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xa
jb 0x14000a310
mov byte [rsp + 0x2b], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x1400724a0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x46
mov byte [rsp + 0x32], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x56]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14000a370
mov byte [rsp + 0x32], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002be0
nop word [rax + rax]
mov ecx, reloc.WS2_32.dll_WSASetLastError
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000a3bb
call fcn.14000c190
call fcn.14000b6f0
jmp 0x14000a3a0
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000a3d6
call fcn.14000c190
call fcn.14000b6f0
jmp 0x14000a3a0
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000a3f1
call fcn.14000c190
call fcn.14000b3c0
jmp 0x14000a3a0
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000a3a0
call fcn.1400080f0
jmp 0x14000a3a0