Function at 0x1400038c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Terminate process

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xe8]
sub rsp, 0x1e0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rax - 0x88], xmm13
movaps xmmword [rax - 0x98], xmm14
movaps xmmword [rax - 0xa8], xmm15
mov rax, qword [0x14009b080]
xor rax, rsp
mov qword [rbp + 0x38], rax
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x28], 0x736c63
mov byte [rsp + 0x2c], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm15, xmmword [0x14008ed30]
movdqa xmm8, xmmword [0x14008ede0]
movdqa xmm9, xmmword [0x14008eec0]
movdqa xmm7, xmmword [0x14008eea0]
movdqa xmm6, xmmword [0x14008edb0]
movdqa xmm10, xmmword [0x14008ecb0]
movdqa xmm11, xmmword [0x14008edf0]
movdqa xmm12, xmmword [0x14008ed90]
movdqa xmm13, xmmword [0x14008ee10]
movdqa xmm14, xmmword [0x14008ee20]
nop dword [rax]
mov edx, 0xa
mov word [rbp - 0x20], 0xa
lea rcx, [rbp - 0x20]
mov byte [rbp - 0x1e], 0
call fcn.14000eed0
xor eax, eax
movdqa xmmword [rsp + 0x30], xmm6
movdqa xmmword [rsp + 0x40], xmm14
movdqa xmmword [rsp + 0x50], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rbp - 0x80], xmm10
mov dword [rbp - 0x70], 0x1000c2b
nop dword [rax]
lea ecx, [rax - 0x5b]
xor byte [rsp + rax + 0x30], cl
lea ecx, [rax - 0x5a]
xor byte [rsp + rax + 0x31], cl
lea ecx, [rax - 0x59]
xor byte [rsp + rax + 0x32], cl
lea ecx, [rax - 0x58]
xor byte [rsp + rax + 0x33], cl
lea ecx, [rax - 0x57]
xor byte [rsp + rax + 0x34], cl
lea ecx, [rax - 0x56]
xor byte [rsp + rax + 0x35], cl
lea ecx, [rax - 0x55]
xor byte [rsp + rax + 0x36], cl
lea ecx, [rax - 0x54]
xor byte [rsp + rax + 0x37], cl
lea ecx, [rax - 0x53]
xor byte [rsp + rax + 0x38], cl
lea ecx, [rax - 0x52]
xor byte [rsp + rax + 0x39], cl
lea ecx, [rax - 0x51]
xor byte [rsp + rax + 0x3a], cl
lea ecx, [rax - 0x50]
xor byte [rsp + rax + 0x3b], cl
lea ecx, [rax - 0x4f]
xor byte [rsp + rax + 0x3c], cl
lea ecx, [rax - 0x4e]
xor byte [rsp + rax + 0x3d], cl
add rax, 0xe
cmp rax, 0x62
jb 0x1400039e0
mov edx, reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x6d], 0
lea rcx, [rsp + 0x30]
call fcn.14000eed0
mov edx, 0xa
mov word [rbp + 0x14], 0xa
lea rcx, [rbp + 0x14]
mov byte [rbp + 0x16], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp + 0x18], 0xa
lea rcx, [rbp + 0x18]
mov byte [rbp + 0x1a], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x60], 0xa
lea rcx, [rbp - 0x60]
mov byte [rbp - 0x5e], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x5c], 0xa
lea rcx, [rbp - 0x5c]
mov byte [rbp - 0x5a], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x58], 0xa
lea rcx, [rbp - 0x58]
mov byte [rbp - 0x56], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x54], 0xa
lea rcx, [rbp - 0x54]
mov byte [rbp - 0x52], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x50], 0xa
lea rcx, [rbp - 0x50]
mov byte [rbp - 0x4e], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x4c], 0xa
lea rcx, [rbp - 0x4c]
mov byte [rbp - 0x4a], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x48], 0xa
lea rcx, [rbp - 0x48]
mov byte [rbp - 0x46], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x44], 0xa
lea rcx, [rbp - 0x44]
mov byte [rbp - 0x42], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x40], 0xa
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x3e], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x3c], 0xa
lea rcx, [rbp - 0x3c]
mov byte [rbp - 0x3a], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x38], 0xa
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x36], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x34], 0xa
lea rcx, [rbp - 0x34]
mov byte [rbp - 0x32], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x30], 0xa
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x2e], 0
call fcn.14000eed0
mov word [rbp - 0x2c], 0xa
mov byte [rbp - 0x2a], 0
mov edx, 0xa
lea rcx, [rbp - 0x2c]
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x28], 0xa
lea rcx, [rbp - 0x28]
mov byte [rbp - 0x26], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x24], 0xa
lea rcx, [rbp - 0x24]
mov byte [rbp - 0x22], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp + 0x1c], 0xa
lea rcx, [rbp + 0x1c]
mov byte [rbp + 0x1e], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x1c], 0xa
lea rcx, [rbp - 0x1c]
mov byte [rbp - 0x1a], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x18], 0xa
lea rcx, [rbp - 0x18]
mov byte [rbp - 0x16], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x14], 0xa
lea rcx, [rbp - 0x14]
mov byte [rbp - 0x12], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0x10], 0xa
lea rcx, [rbp - 0x10]
mov byte [rbp - 0xe], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 0xc], 0xa
lea rcx, [rbp - 0xc]
mov byte [rbp - 0xa], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 8], 0xa
lea rcx, [rbp - 8]
mov byte [rbp - 6], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp - 4], 0xa
lea rcx, [rbp - 4]
mov byte [rbp - 2], 0
call fcn.14000eed0
movdqa xmm0, xmmword [0x14008eeb0]
xor ecx, ecx
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x14008ee60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x14008eda0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x30], xmm6
movdqa xmmword [rsp + 0x40], xmm7
mov dword [rbp - 0x80], 0x8a9e9e86
mov dword [rbp - 0x7c], 0x929a9c8d
mov dword [rbp - 0x78], 0x100f4dc
nop dword [rax]
lea eax, [rcx - 0x5b]
xor byte [rsp + rcx + 0x30], al
lea eax, [rcx - 0x5a]
xor byte [rsp + rcx + 0x31], al
lea eax, [rcx - 0x59]
xor byte [rsp + rcx + 0x32], al
lea eax, [rcx - 0x58]
xor byte [rsp + rcx + 0x33], al
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0x34], al
lea eax, [rcx - 0x56]
xor byte [rsp + rcx + 0x35], al
lea eax, [rcx - 0x55]
xor byte [rsp + rcx + 0x36], al
lea eax, [rcx - 0x54]
xor byte [rsp + rcx + 0x37], al
lea eax, [rcx - 0x53]
xor byte [rsp + rcx + 0x38], al
lea eax, [rcx - 0x52]
xor byte [rsp + rcx + 0x39], al
lea eax, [rcx - 0x51]
xor byte [rsp + rcx + 0x3a], al
lea eax, [rcx - 0x50]
xor byte [rsp + rcx + 0x3b], al
lea eax, [rcx - 0x4f]
xor byte [rsp + rcx + 0x3c], al
lea eax, [rcx - 0x4e]
xor byte [rsp + rcx + 0x3d], al
lea eax, [rcx - 0x4d]
xor byte [rsp + rcx + 0x3e], al
lea eax, [rcx - 0x4c]
xor byte [rsp + rcx + 0x3f], al
lea eax, [rcx - 0x4b]
xor byte [rsp + rcx + 0x40], al
lea eax, [rcx - 0x4a]
xor byte [rsp + rcx + 0x41], al
add rcx, 0x12
cmp rcx, 0x5a
jb 0x140003d20
mov edx, reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x75], 0
lea rcx, [rsp + 0x30]
call fcn.14000eed0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x28]
mov dword [rbp + 0x28], 0x736c63
mov byte [rbp + 0x2c], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
movdqa xmmword [rsp + 0x30], xmm6
movdqa xmmword [rsp + 0x40], xmm7
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm8
mov dword [rsp + 0x70], 0xed8380
mov byte [rsp + 0x74], 1
nop dword [rax + rax]
lea eax, [rcx - 0x5b]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x43
jb 0x140003e10
mov edx, 0xa
mov byte [rsp + 0x74], 0
lea rcx, [rsp + 0x30]
call fcn.14000eed0
mov edx, 0xa
mov word [rbp], 0xa
lea rcx, [rbp]
mov byte [rbp + 2], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp + 4], 0xa
lea rcx, [rbp + 4]
mov byte [rbp + 6], 0
call fcn.14000eed0
movdqa xmm0, xmmword [0x14008ed50]
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov edx, 9
mov dword [rsp + 0x50], 0xa5d20
movdqa xmm0, xmmword [0x14008ed60]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x54], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp + 8], 0xa
lea rcx, [rbp + 8]
mov byte [rbp + 0xa], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp + 0xc], 0xa
lea rcx, [rbp + 0xc]
mov byte [rbp + 0xe], 0
call fcn.14000eed0
mov edx, 9
mov dword [rsp + 0x3c], 0xa7461
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x205d325b
mov dword [rsp + 0x34], 0x64616f4c
mov dword [rsp + 0x38], 0x65684320
mov byte [rsp + 0x40], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rbp + 0x10], 0xa
lea rcx, [rbp + 0x10]
mov byte [rbp + 0x12], 0
call fcn.14000eed0
mov edx, 0xa
mov word [rsp + 0x28], 0xa
lea rcx, [rsp + 0x28]
mov byte [rsp + 0x2a], 0
call fcn.14000eed0
mov edx, 9
mov word [rsp + 0x40], 0xa
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x42], 0
movdqu xmmword [rsp + 0x30], xmm15
call fcn.14000eed0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov ecx, dword [rbp + 0x30]
sub ecx, 1
je 0x140003fc6
sub ecx, 1
je 0x140003fa7
cmp ecx, 1
jne 0x140003990
mov byte [rsp + 0x24], cl
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0xd4cac6
call fcn.1400029e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x736c63
mov byte [rbp + 0x24], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140002de0
jmp 0x140003990
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x736c63
mov byte [rsp + 0x24], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400024e0
jmp 0x140003990