Function at 0x140001ee0
Capabilities:
Convert ip address from string
Create thread
Create udp socket
Encode data using xor
Initialize winsock library
Set socket configuration
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x3a10]
mov eax, 0x3b10
call fcn.1400033f0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x39e0], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 9
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x202
lea rdx, [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140001f9e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.Error_Code:__d_n
call fcn.140001270
mov eax, 1
jmp 0x1400025b9
mov qword [rsp + 0x3b20], rbx
lea rcx, [rbp + 0x29e0]
mov qword [rsp + 0x3b28], rsi
mov qword [rsp + 0x3b30], rdi
mov qword [rsp + 0x3b00], r13
call fcn.140001c50
test rax, rax
jne 0x140001fdf
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 1
jmp 0x1400020e6
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], 0
jne 0x140001fe6
dec rdx
lea r8, [rsp + 0x30]
mov rcx, rax
call section..text
mov r9, rax
test rax, rax
jne 0x140002023
lea rcx, str.Base64_decoding_failed_n
call fcn.140001270
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 1
jmp 0x1400020e6
mov r10, qword [rsp + 0x30]
xor r8d, r8d
sub r10, 1
je 0x140002066
movabs r11, 0xd79435e50d79435f
lea rbx, str.a183b23daw12aa110df
mov rcx, r8
mov rax, r11
mul r8
shr rdx, 4
imul rax, rdx, 0x13
sub rcx, rax
movzx eax, byte [rcx + rbx]
xor byte [r9 + r8], al
inc r8
cmp r8, r10
jb 0x140002042
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rdx, [0x14000455c]
xor ebx, ebx
mov rcx, rax
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
test rax, rax
je 0x1400020ce
lea rdi, [rbp + 0x9e0]
nop word [rax + rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x38]
mov qword [rdi], rax
lea rdx, [0x14000455c]
lea rdi, [rdi + 8]
inc ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
test rax, rax
jne 0x1400020a0
movsxd rax, ebx
mov rcx, rsi
mov qword [rbp + rax*8 + 0x9e0], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movsxd rdi, ebx
lea r13, [0x1400067a0]
test ebx, ebx
jle 0x1400021a6
xor ebx, ebx
nop word [rax + rax]
mov rcx, qword [rbp + rbx*8 + 0x9e0]
lea rdx, [rbp + 0x29e0]
call fcn.1400013c0
mov r11, rax
test rax, rax
je 0x140002191
movsxd r10, dword [0x140007038]
xor r9d, r9d
test r10d, r10d
jle 0x14000215f
nop dword [rax + rax]
movsxd rcx, r9d
mov r8, r11
imul rcx, rcx, 0x16
add rcx, r13
sub r8, rcx
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140002153
inc rcx
test eax, eax
jne 0x140002140
test edx, edx
je 0x140002198
inc r9d
cmp r9d, r10d
jl 0x140002130
cmp r10d, 0x64
jge 0x140002198
imul rcx, r10, 0x16
mov r9d, socket
mov r8, r11
add rcx, r13
mov edx, r9d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov r10d, dword [0x140007038]
inc r10d
mov dword [0x140007038], r10d
jmp 0x140002198
mov r10d, dword [0x140007038]
inc rbx
cmp rbx, rdi
jl 0x140002100
jmp 0x1400021ad
mov r10d, dword [0x140007038]
cmp r10d, 1
jge 0x1400021df
mov ecx, 4
call fcn.140001390
lea rcx, str.Error_code:_20030_n
call fcn.140001270
mov ecx, 7
call fcn.140001390
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
jne 0x14000220d
mov ecx, 6
call fcn.140001390
lea rcx, str.Error_code:_20031_n
call fcn.140001270
mov ecx, 7
call fcn.140001390
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x3b08], r12
mov r8d, reloc.WS2_32.dll_recvfrom
mov r12d, 2
mov qword [rsp + 0x3af8], r14
mov edx, r12d
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000228e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.Error_code:__d_n
call fcn.140001270
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, 1
jmp 0x140002589
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0x10000
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
mov rcx, r14
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, r14
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r8, [rsp + 0x4c]
mov word [rsp + 0x48], r12w
lea rdx, str.0.0.0.0
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, 0x35
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x48]
mov rcx, r14
mov word [rsp + 0x4a], ax
call qword [sym.imp.WS2_32.dll_bind]
mov ecx, 0xfffffff5
cmp eax, 0xffffffff
je 0x140002243
mov qword [rsp + 0x3af0], r15
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r8d, reloc.WS2_32.dll_recvfrom
mov edx, r12d
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1400023a5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.Error_code:__d_n
call fcn.140001270
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14000257c
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1002
mov rcx, r15
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, r15
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r8, [rsp + 0x5c]
mov word [rsp + 0x58], r12w
lea rdx, str.78.157.42.100
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_inet_pton]
mov ecx, 0x35
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 0xfffffff5
mov word [rsp + 0x5a], ax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edi, edi
lea rsi, [rbp + 0x110]
lea rbx, [rbp + 0x128]
nop dword [rax]
movups xmm0, xmmword [rsp + 0x58]
lea rcx, [rbx + 0x18]
mov qword [rbx - 8], r14
mov rdx, r13
mov qword [rbx], r15
mov r8d, 0x89c
movups xmmword [rbx + 8], xmm0
call sub.VCRUNTIME140.dll_memcpy
movsxd rax, edi
lea r9, [rbp + 0x120]
imul rcx, rax, 0x8c0
xor eax, eax
lea r8, [0x1400016c0]
add r9, rcx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
test rax, rax
je 0x140002524
inc edi
add rbx, 0x8c0
add rsi, 8
cmp edi, 1
jl 0x140002440
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.___DNS_Server_started._n
call fcn.140001270
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r8d, 1
lea rdx, [rbp + 0x110]
mov ecx, r8d
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x140002581
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_code:__d_n
call fcn.140001270
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 1
mov r15, qword [rsp + 0x3af0]
mov r12, qword [rsp + 0x3b08]
mov r14, qword [rsp + 0x3af8]
mov rdi, qword [rsp + 0x3b30]
mov rsi, qword [rsp + 0x3b28]
mov rbx, qword [rsp + 0x3b20]
mov r13, qword [rsp + 0x3b00]
mov rcx, qword [rbp + 0x39e0]
xor rcx, rsp
call fcn.1400025f0
add rsp, 0x3b10
pop rbp
ret