Function at 0x14007d660
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
lea rcx, [0x14018f030]
call fcn.140089700
cmp byte [0x14018f260], 0
jne 0x14007d8e3
mov dword [rbp - 0x5b], 0x10001078
lea rax, [rbp - 0x69]
mov cl, reloc.WS2_32.dll_recv
mov dword [rbp - 0x5f], 0x64655130
mov dword [rbp - 0x63], 0x6c304830
mov dword [rbp - 0x67], 0x757e7977
mov word [rbp - 0x69], 0x7e55
nop
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x59]
cmp rax, rcx
je 0x14007d6c4
movzx ecx, byte [rbp - 0x58]
jmp 0x14007d6b0
mov byte [rbp - 0x59], 1
lea rax, [rbp - 0x39]
mov dword [rbp - 0x1f], 0x1c001c6e
mov cl, 0x1c
mov dword [rbp - 0x23], 0x796a6e79
mov dword [rbp - 0x27], 0x4f3c7368
mov dword [rbp - 0x2b], 0x3c687f79
mov dword [rbp - 0x2f], 0x7272735f
mov dword [rbp - 0x33], 0x3c73683c
mov dword [rbp - 0x37], 0x78797075
mov word [rbp - 0x39], 0x7d5a
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x1d]
cmp rax, rcx
je 0x14007d724
movzx ecx, byte [rbp - 0x1c]
jmp 0x14007d710
mov r9d, gethostname
mov byte [rbp - 0x1d], 1
lea r8, [rbp - 0x69]
xor ecx, ecx
lea rdx, [rbp - 0x39]
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x14007d8d7
lea rcx, [0x14018f030]
call fcn.140089700
cmp byte [0x14018f260], 0
jne 0x14007d8e3
mov dword [rbp - 0x43], 0x10001078
lea rax, [rbp - 0x51]
mov cl, reloc.WS2_32.dll_recv
mov dword [rbp - 0x47], 0x64655130
mov dword [rbp - 0x4b], 0x6c304830
mov dword [rbp - 0x4f], 0x757e7977
mov word [rbp - 0x51], 0x7e55
nop dword [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x41]
cmp rax, rcx
je 0x14007d7a4
movzx ecx, byte [rbp - 0x40]
jmp 0x14007d790
mov byte [rbp - 0x41], 1
lea rax, [rbp + 0xf]
mov dword [rbp + 0x49], 0x3c003c03
mov cl, reloc.WLDAP32.dll_Ordinal_60
mov dword [rbp + 0x45], 0x1c525553
mov dword [rbp + 0x41], 0x761c124c
mov dword [rbp + 0x3d], 0x5059541c
mov dword [rbp + 0x39], 0x594e5351
mov dword [rbp + 0x35], 0x1c4e535a
mov dword [rbp + 0x31], 0x1c584e53
mov dword [rbp + 0x2d], 0x5f4f5578
mov dword [rbp + 0x29], 0x1c595448
mov dword [rbp + 0x25], 0x1c525553
mov dword [rbp + 0x21], 0x561c594f
mov dword [rbp + 0x1d], 0x5d59506c
mov dword [rbp + 0x19], 0x1c125859
mov dword [rbp + 0x15], 0x50555d7a
mov dword [rbp + 0x11], 0x1c454e48
mov word [rbp + 0xf], 0x596e
nop dword [rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp + 0x4b]
cmp rax, rcx
je 0x14007d834
movzx ecx, byte [rbp + 0x4c]
jmp 0x14007d820
mov r9d, 0x33
mov byte [rbp + 0x4b], 1
lea r8, [rbp - 0x51]
xor ecx, ecx
lea rdx, [rbp + 0xf]
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x14007d8d2
mov dword [rbp + 9], 0x24002446
lea rax, [rbp - 0x19]
mov cl, 0x24
mov dword [rbp + 5], 0x60476361
mov dword [rbp + 1], 0x4273755c
mov dword [rbp - 3], 0x450b4343
mov dword [rbp - 7], 0xa40564b
mov dword [rbp - 0xb], 0x47574d40
mov dword [rbp - 0xf], 0xb0b1e57
mov dword [rbp - 0x13], 0x5450504c
mov dword [rbp - 0x17], 0x4505645
mov word [rbp - 0x19], 0x5057
nop
xor byte [rax], cl
inc rax
lea rcx, [rbp + 0xb]
cmp rax, rcx
je 0x14007d8b4
movzx ecx, byte [rbp + 0xc]
jmp 0x14007d8a0
lea rcx, [rbp - 0x19]
mov byte [rbp + 0xb], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [reloc.WS2_32.dll_accept], 0
add rsp, 0xe0
pop rbp
ret
cmp eax, 7
je 0x14007d8dc
cmp eax, 2
jne 0x14007d8e3
mov byte [reloc.WS2_32.dll_accept], 0
add rsp, 0xe0
pop rbp
ret