Function at 0x140002d10
Capabilities:
Encode data using xor
Initialize winsock library
Reference cloudflare dns server

Disassembly:
push rbp
push rsi
push rdi
push r12
lea rbp, [rsp - 0x298]
sub rsp, 0x398
mov rax, qword [0x140066010]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov rsi, rcx
call fcn.14000a750
lea rcx, [0x14000a960]
mov qword [rax], rcx
call fcn.14000a750
mov r12d, 1
mov rdi, 0xffffffffffffffff
mov dword [rax + 0x18], r12d
nop
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140002d60
cmp rdi, 0x152
ja 0x1400033f4
mov qword [rsp + 0x3c0], rbx
lea rcx, [rbp + 0x180]
xor edx, edx
mov qword [rsp + 0x3d0], r14
mov r8d, 0xfa
call fcn.1400366d0
xor r14d, r14d
mov r9d, r14d
mov ebx, r14d
test edi, edi
je 0x140002e8c
mov r10, rsi
lea r11, [0x14005cb30]
nop word [rax + rax]
movsx rcx, byte [r10]
cmp cl, 0x3d
je 0x140002e8c
lea eax, [rcx - 0x2b]
cmp al, 0x4f
ja 0x140002e87
movsx edx, byte [rcx + r11 - 0x2b]
mov ecx, edx
cmp edx, 0xffffffff
je 0x140002e87
mov r8d, r9d
and r8d, 3
je 0x140002e6a
sub r8d, r12d
je 0x140002e3c
sub r8d, r12d
je 0x140002e0e
cmp r8d, r12d
jne 0x140002e76
mov eax, ebx
add byte [rbp + rax + 0x180], dl
inc ebx
jmp 0x140002e76
mov eax, ebx
inc ebx
shr ecx, 2
and cl, 0xf
add byte [rbp + rax + 0x180], cl
lea eax, [rdi - 2]
cmp r9d, eax
jb 0x140002e30
lea eax, [rdi - 1]
cmp byte [rax + rsi], 0x3d
je 0x140002e76
shl dl, 6
mov byte [rbp + rbx + 0x180], dl
jmp 0x140002e76
mov eax, ebx
inc ebx
shr ecx, 4
and cl, 3
add byte [rbp + rax + 0x180], cl
lea eax, [rdi - 3]
cmp r9d, eax
jb 0x140002e5e
lea eax, [rdi - 2]
cmp byte [rax + rsi], 0x3d
je 0x140002e76
shl dl, 4
mov byte [rbp + rbx + 0x180], dl
jmp 0x140002e76
mov eax, ebx
shl dl, 2
mov byte [rbp + rax + 0x180], dl
inc r9d
inc r10
cmp r9d, edi
jb 0x140002dc0
jmp 0x140002e8c
mov ebx, 0xffffffff
cmp bl, 0xf
jb 0x1400033e4
mov r8b, 5
lea r9, [rbp + 0x185]
nop
movzx ecx, r8b
lea r9, [r9 + 1]
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
movsxd rax, ecx
movzx ecx, byte [rbp + rax + 0x180]
xor cl, byte [r9 - 1]
xor cl, r8b
inc r8b
mov byte [r9 - 1], cl
cmp r8b, bl
jb 0x140002ea0
mov ecx, 0xc80
call fcn.14003cd4c
mov rdi, rax
test rax, rax
je 0x140002f1d
lea rax, str._____________________
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
lea rax, [rdi + 0xc80]
xor edx, edx
mov qword [rsp + 0x50], rax
call fcn.140004ca0
test rax, rax
jne 0x140002f20
mov rcx, rdi
call fcn.14003c184
mov rdi, r14
mov rcx, rdi
call fcn.1400048f0
mov rcx, rdi
mov rsi, rax
call fcn.14003c184
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
mov ecx, dword [rsi]
add ecx, ecx
movsxd rcx, ecx
imul rcx, rcx, 0xb0
call fcn.14003cd4c
mov rdi, rax
test rax, rax
je 0x1400033e4
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x110]
movzx r8d, bl
lea rdx, [rbp + 0x185]
sub r8, 5
mov dword [rsp + 0x20], recvfrom
mov rcx, rsi
call fcn.140005560
mov rcx, rdi
mov ebx, eax
call fcn.14003c184
test ebx, ebx
jle 0x1400033e4
mov rdx, qword [rbp + 0x120]
lea rcx, [0x140068090]
mov r8, qword [rbp + 0x128]
mov ebx, 0x95
sub r8, rdx
mov qword [rsp + 0x390], r15
cmp r8, rbx
cmovg r8, rbx
call fcn.140037380
mov rdx, qword [rbp + 0x130]
lea rcx, [rbp + 0x170]
mov r8, qword [rbp + 0x138]
xor eax, eax
sub r8, rdx
mov qword [rbp + 0x170], rax
mov word [rbp + 0x178], ax
mov eax, 9
cmp r8, rax
cmovg r8, rax
call fcn.140037380
lea rcx, [rbp + 0x170]
call fcn.14003cc9c
mov rdx, qword [rbp + 0x140]
lea rcx, [0x140067fc0]
mov r8, qword [rbp + 0x148]
sub r8, rdx
mov dword [0x140068224], eax
cmp r8, rbx
cmovg r8, rbx
call fcn.140037380
mov rax, qword [rbp + 0x160]
lea rdx, str._client_version_:__.s._s._.s_
mov rcx, qword [rbp + 0x168]
mov r15d, 0xa
mov r8, qword [rbp + 0x158]
sub rcx, rax
mov r9, qword [rbp + 0x150]
cmp rcx, r15
mov qword [rsp + 0x30], rax
lea rax, [0x14005c3bc]
cmovg rcx, r15
sub r8, r9
mov qword [rsp + 0x28], rcx
cmp r8, r15
lea rcx, [0x140068230]
mov qword [rsp + 0x20], rax
cmovg r8, r15
call fcn.140001070
test eax, eax
jle 0x1400033dc
mov rcx, rsi
mov qword [rsp + 0x3c8], r13
call fcn.14003c184
mov byte [0x140068220], r14b
lock inc dword [0x140068160]
mov ecx, 0x1a0
call fcn.14003cd4c
mov rbx, rax
test rax, rax
je 0x140003410
lea rdi, [0x140005c40]
lea rsi, [0x140002c30]
lea r13, [0x1400029d0]
nop dword [rax]
xor edx, edx
mov r8d, 0x1a0
mov rcx, rbx
call fcn.1400366d0
xor eax, eax
lock cmpxchg dword [0x140068178], r12d
jne 0x14000313d
mov ecx, 0x202
lea rdx, [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbx + 4], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x34], eax
lea rcx, [rbx + 0x178]
lea rax, [rbx + 0xc8]
mov qword [rbx + 0xe0], r14
mov qword [rax], rax
mov qword [rax + 8], rax
mov dword [rbx + 0xe8], r14d
mov qword [rbx + 0xf0], rdi
mov qword [rbx + 0xf8], r14
mov dword [rbx + 0x100], r14d
mov qword [rbx + 0x108], rdi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x58]
mov qword [rbx + 0x150], 0xffffffffffffffff
call fcn.14003cfb0
movsxd rax, dword [rsp + 0x58]
imul rcx, rax, 0x3e8
movzx eax, word [rsp + 0x60]
add rcx, rax
mov qword [rbx + 8], rcx
call fcn.140007210
or dword [rbx], 2
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x10], rax
call fcn.14000a750
mov rcx, rax
lea r9, str.hloop_new
mov eax, dword [rbx + 0x34]
lea r8, str._s:_hloop_new_tid_ld
mov edx, r12d
mov dword [rsp + 0x20], eax
call fcn.140009d10
mov r9d, 0x1000000
mov qword [0x140068218], rbx
mov r8d, 0x1bb
lea rdx, str.1.1.1.1
mov rcx, rbx
call fcn.1400070b0
mov rbx, rax
test rax, rax
jne 0x140003229
mov rbx, r14
jmp 0x140003245
mov rcx, rbx
mov qword [rax + 0x118], rsi
mov qword [rax + 0x108], r13
call fcn.1400081b0
test eax, eax
cmovne rbx, r14
call fcn.14000cbc0
test rax, rax
je 0x140003264
or dword [rbx + 0x3c], 0x8000
mov dword [rbx + 0x40], 0x1000000
mov qword [rbx + 0x188], rax
mov rbx, qword [0x140068218]
test rbx, rbx
je 0x140003394
cmp dword [rbx + 4], r12d
je 0x140003394
mov dword [rbx + 4], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov dword [rbx + 0x34], eax
call fcn.14000a750
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.hloop_run
mov edx, r12d
lea r8, str._s:_hloop_run_tid_ld
call fcn.140009d10
cmp dword [rbx + 0x40], r14d
jne 0x1400032e9
lea rcx, [rbx + 0x178]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx + 0x154], 0xffffffff
jne 0x1400032dc
mov rcx, rbx
call fcn.140006290
lea rcx, [rbx + 0x178]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rbx + 4]
test eax, eax
je 0x14000332d
cmp eax, 2
jne 0x140003308
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call fcn.1400069b0
jmp 0x140003326
inc qword [rbx + 0x28]
test byte [rbx], 4
je 0x140003319
mov eax, dword [rbx + 0x40]
cmp dword [rbx + 0x44], eax
jbe 0x14000332d
mov rcx, rbx
call fcn.140005ed0
test byte [rbx], r12b
jne 0x14000332d
mov eax, dword [rbx + 4]
test eax, eax
jne 0x1400032f0
mov dword [rbx + 4], r14d
call fcn.140007210
mov qword [rbx + 0x18], rax
test byte [rbx], 2
je 0x14000338d
cmp dword [rbx + 4], 3
je 0x14000338d
mov dword [rbx + 4], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call fcn.14000a750
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.hloop_free
mov edx, r12d
lea r8, str._s:_hloop_free_tid_ld
call fcn.140009d10
mov rcx, rbx
call fcn.1400065b0
mov rcx, rbx
call fcn.14003c184
lock inc dword [0x140068164]
lea rdi, [0x140005c40]
cmp byte [0x140068220], r14b
mov qword [0x140068228], r14
mov qword [0x140068218], r14
jne 0x1400033d4
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
lock inc dword [0x140068160]
mov ecx, 0x1a0
call fcn.14003cd4c
mov rbx, rax
test rax, rax
je 0x140003410
jmp 0x140003110
mov r13, qword [rsp + 0x3c8]
mov r15, qword [rsp + 0x390]
mov rbx, qword [rsp + 0x3c0]
mov r14, qword [rsp + 0x3d0]
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140035400
add rsp, 0x398
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 2
call fcn.1400393ec
mov rcx, rax
lea rdx, str.malloc_failed__n
call fcn.1400095a0
mov ecx, 0xffffffff
call fcn.14003e96c
int3