Function at 0x140002af0
Capabilities:
Create thread
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140076070]
xor rax, rsp
mov qword [rbp + 0x98], rax
call fcn.140001340
mov al, 0x49
mov byte [rbp - 0x10], 0x3d
mov r11b, reloc.WS2_32.dll_listen
movzx edx, al
movzx ebx, r11b
mov cl, 0x54
xor cl, 0x3d
mov r8b, 0x51
mov r9b, 0x58
mov byte [rbp - 0xe], cl
mov r10b, Ordinal_30
lea rcx, [rbp - 0xf]
xor dl, 0x3d
xor al, 0x3d
xor r8b, 0x3d
mov byte [rbp - 0xd], dl
xor r9b, 0x3d
mov byte [rbp - 0xf], al
xor r10b, 0x3d
mov byte [rbp - 0xc], r8b
xor r11b, 0x3d
mov byte [rbp - 0xb], r9b
mov dil, 0xa
mov byte [rbp - 0xa], r10b
xor bl, 0x3d
mov byte [rbp - 9], r11b
xor esi, esi
mov byte [rbp - 8], bl
xor dil, 0x3d
mov byte [rbp - 6], sil
mov byte [rbp - 7], dil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x78]
call fcn.140001c80
mov cl, 0x3d
mov byte [rbp - 0x10], 0x58
xor cl, 0x58
mov dl, 0x2a
xor dl, 0x58
mov byte [rbp - 0xe], cl
mov al, ntohs
mov byte [rbp - 0xd], dl
mov r8b, Ordinal_45
lea rdx, [rbp - 0xf]
mov r9b, Ordinal_50
lea rcx, [rbp + 0x58]
mov r10b, gethostname
mov r11b, 0x36
xor al, 0x58
xor r8b, 0x58
xor r9b, 0x58
mov byte [rbp - 0xf], al
xor r10b, 0x58
mov byte [rbp - 0xc], r8b
xor r11b, 0x58
mov byte [rbp - 0xb], r9b
mov bl, 0x62
mov byte [rbp - 0xa], r10b
mov dil, 0x78
mov byte [rbp - 9], r11b
mov sil, Ordinal_33
mov r14b, reloc.WLDAP32.dll_Ordinal_27
xor r15d, r15d
xor bl, 0x58
xor dil, 0x58
mov byte [rbp - 8], bl
xor sil, 0x58
mov byte [rbp - 7], dil
xor r14b, 0x58
mov byte [rbp - 6], sil
mov byte [rbp - 5], r14b
mov byte [rbp - 4], r15b
call fcn.140003d50
lea rdx, [rbp + 0x78]
lea rcx, [rbp]
call fcn.140003e70
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x50]
call fcn.140003e70
mov rbx, rax
movdqa xmm0, xmmword [0x14006dd50]
xor eax, eax
movdqa xmm1, xmmword [0x14006dd70]
xor r12d, r12d
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, r12d
movdqa xmm0, xmmword [0x14006ddf0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x14006dcf0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm1, xmmword [0x14006dd40]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x14006de00]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x14006dcd0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x60], 0x1f3e083d
mov dword [rbp - 0x5c], 0x663c1313
mov word [rbp - 0x58], 0x6600
mov byte [rbp - 0x56], al
nop dword [rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x32], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x33], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x34], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x35], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x36], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x37], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x38], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x39], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x3a], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x3b], al
add rcx, 0xb
cmp rcx, 0x79
jb 0x140002cc0
lea rdx, [rsp + 0x31]
mov byte [rbp - 0x56], r12b
lea rcx, [rbp - 0x30]
call fcn.140003d50
mov r8, rbx
lea rcx, [rbp + 0x20]
mov rdx, rax
call fcn.1400020c0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140002d8c
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d87
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400594e4
mov r15, qword [rbp]
lea rsi, [rbp]
mov rdi, qword [rbp + 0x10]
movabs rbx, 0x7fffffffffffffff
mov qword [rsp + 0x1d0], r13
xorps xmm0, xmm0
mov r13, qword [rbp + 0x18]
cmp r13, 0x10
movups xmmword [rbp + 0x20], xmm0
cmovae rsi, r15
cmp rdi, rbx
ja 0x14000342e
mov r14, 0xffffffffffffffff
cmp rdi, 0x10
jae 0x140002deb
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x20], xmm0
jmp 0x140002e7b
mov rax, rdi
or rax, 0xf
mov qword [rbp - 0x10], rax
cmp rax, rbx
ja 0x140002e0e
mov ecx, reloc.WLDAP32.dll_Ordinal_22
mov rbx, rax
cmp rax, rcx
mov qword [rbp - 0x10], rcx
cmovb rbx, rcx
mov rcx, rbx
add rcx, 1
cmovb rcx, r14
cmp rcx, 0x1000
jb 0x140002e51
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003428
mov rcx, rax
call fcn.1400594ec
mov rcx, rax
test rax, rax
je 0x140002fc1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002e60
test rcx, rcx
je 0x140002e5d
call fcn.1400594ec
jmp 0x140002e60
mov rax, r12
lea r8, [rdi + 1]
mov qword [rbp + 0x20], rax
mov rdx, rsi
mov qword [rbp + 0x30], rdi
mov rcx, rax
mov qword [rbp + 0x38], rbx
call sub.VCRUNTIME140.dll_memcpy
movdqa xmm0, xmmword [0x14006ddb0]
xor eax, eax
movdqa xmm1, xmmword [0x14006ddd0]
mov rcx, r12
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x14006dca0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x14006dd80]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm1, xmmword [0x14006dd90]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [str.dZSbbXcVfEvfVG]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x14006de20]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x60], 0x79586e5b
mov dword [rbp - 0x5c], 0x5a7575
mov word [rbp - 0x58], 0x66
mov byte [rbp - 0x56], al
nop word [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x32], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x33], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x34], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x35], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x36], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x37], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x38], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x39], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x3a], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x3b], al
add rcx, 0xb
cmp rcx, 0x79
jb 0x140002f00
lea rdx, [rsp + 0x31]
mov byte [rbp - 0x56], r12b
lea rcx, [rbp - 0x30]
call fcn.140003d50
lea r8, [rbp + 0x20]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400020c0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140002fcd
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fc8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002fc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400594e4
mov ecx, 8
call fcn.1400594ec
lea rcx, [0x140001bb0]
mov r9, rax
lea r8, [0x140004e20]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140003418
lea rcx, str.color_2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dl, 1
mov qword [rbp + 0x30], r12
movzx r8d, dl
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
xor dl, 0x72
mov byte [rbp - 0x10], WSACleanup
mov cl, reloc.WS2_32.dll_send
mov byte [rbp - 0xd], dl
xor cl, 0x72
mov byte [rbp - 5], r12b
mov al, 2
mov byte [rbp - 0xe], cl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0xf]
mov r9b, 5
mov r10b, Ordinal_30
xor r11b, r11b
xorps xmm0, xmm0
xor al, 0x72
xor r8b, 0x72
xor r9b, 0x72
mov byte [rbp - 0xf], al
xor r10b, 0x72
mov byte [rbp - 0xc], r8b
xor r11b, 0x72
mov byte [rbp - 0xb], r9b
movups xmmword [rbp + 0x20], xmm0
mov bl, reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp + 0x20], r12b
mov dil, 0x48
mov byte [rbp - 0xa], r10b
mov sil, 0x52
mov byte [rbp - 9], r11b
xor bl, 0x72
xor dil, 0x72
xor sil, 0x72
mov byte [rbp - 8], bl
mov byte [rbp - 7], dil
mov byte [rbp - 6], sil
call fcn.140004490
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rbp + 0x20]
call fcn.1400046c0
movdqa xmm1, xmmword [str.15__9.030__mno]
movdqu xmmword [rbp], xmm1
mov byte [rbp + 0xf], r12b
movd ecx, xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
xor byte [rbp + 2], cl
xor byte [rbp + 3], cl
xor byte [rbp + 4], cl
xor al, cl
xor byte [rbp + 5], cl
xor byte [rbp + 6], cl
xor byte [rbp + 7], cl
xor byte [rbp + 8], cl
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
mov byte [rbp + 1], al
lea rax, [rbp + 1]
inc r14
cmp byte [rax + r14], r12b
jne 0x140003110
mov rdi, qword [rbp + 0x38]
lea rcx, [rbp + 0x20]
mov rbx, qword [rbp + 0x20]
cmp rdi, 0x10
mov r8, qword [rbp + 0x30]
cmovae rcx, rbx
cmp r8, r14
jne 0x1400032f4
lea rdx, [rbp + 1]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400032f4
mov cl, 0x1c
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSASetLastError
xor cl, 0x70
mov al, reloc.WS2_32.dll_send
mov dl, 3
mov byte [rbp - 0xe], cl
xor r8d, r8d
lea rcx, [rbp - 0xf]
xor al, 0x70
mov byte [rbp - 0xc], r8b
xor dl, 0x70
mov byte [rbp - 0xf], al
mov byte [rbp - 0xd], dl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400025f0
movdqa xmm1, xmmword [0x14006dde0]
mov r8b, 0x40
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmm1
movd edx, xmm1
mov r9b, 0x55
movdqu xmmword [rbp], xmm1
mov byte [rbp + 0x12], r12b
xor byte [rbp + 2], dl
xor r8b, dl
xor byte [rbp + 3], dl
xor r9b, dl
xor byte [rbp + 4], dl
xor byte [rbp + 5], dl
xor byte [rbp + 6], dl
xor byte [rbp + 7], dl
xor byte [rbp + 8], dl
xor byte [rbp + 9], dl
xor byte [rbp + 0xa], dl
xor byte [rbp + 0xb], dl
xor byte [rbp + 0xc], dl
xor byte [rbp + 0xd], dl
xor byte [rbp + 0xe], dl
xor byte [rbp + 0xf], dl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rbp + 0x10], r8b
mov byte [rbp + 0x11], r9b
xor al, dl
lea rdx, [rbp + 1]
mov byte [rbp + 1], al
call fcn.140004490
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
mov cl, reloc.WLDAP32.dll_Ordinal_26
mov byte [rbp - 0x10], 0x76
xor cl, 0x76
mov al, reloc.WS2_32.dll_setsockopt
mov dl, 5
mov byte [rbp - 0xe], cl
xor r8d, r8d
lea rcx, [rbp - 0xf]
xor al, 0x76
mov byte [rbp - 0xc], r8b
xor dl, 0x76
mov byte [rbp - 0xf], al
mov byte [rbp - 0xd], dl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400025f0
mov al, 0x7b
mov byte [rbp], 0x5b
movzx ecx, al
movzx edx, al
xor cl, 0x5b
xor dl, 0x5b
movzx r8d, al
mov byte [rbp + 2], cl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movzx r9d, al
movzx r10d, al
mov byte [rbp + 3], dl
movzx r12d, al
lea rdx, [rbp + 1]
mov r11b, 0x2f
xor al, 0x5b
xor r8b, 0x5b
mov byte [rbp + 1], al
xor r9b, 0x5b
mov byte [rbp + 4], r8b
xor r10b, 0x5b
mov byte [rbp + 5], r9b
xor r11b, 0x5b
mov byte [rbp + 6], r10b
mov bl, reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 7], r11b
mov dil, 0x36
mov sil, 0x3e
mov r14b, reloc.WLDAP32.dll_Ordinal_41
mov r15b, 0x61
xor r13d, r13d
xor bl, 0x5b
xor dil, 0x5b
mov byte [rbp + 8], bl
xor sil, 0x5b
mov byte [rbp + 9], dil
xor r14b, 0x5b
mov byte [rbp + 0xa], sil
xor r15b, 0x5b
mov byte [rbp + 0xb], r14b
xor r12b, 0x5b
mov byte [rbp + 0xc], r15b
mov byte [rbp + 0xd], r12b
mov byte [rbp + 0xe], r13b
call fcn.140004490
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___float____ptr64____ptr64]
movss xmm0, dword [rbp + 0x40]
call fcn.140001910
jmp 0x140003200
cmp rdi, 0x10
jb 0x14000332b
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140003323
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400033d7
mov rcx, rbx
call fcn.1400594e4
cmp dword [rbp + 0x50], r12d
je 0x140003338
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
cmp r13, 0x10
jb 0x14000336b
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140003363
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400033d7
mov rcx, r15
call fcn.1400594e4
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x1400033a2
mov rcx, qword [rbp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000339d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400033d7
call fcn.1400594e4
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x1400033e3
mov rcx, qword [rbp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033de
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400033de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400594e4
mov r13, qword [rsp + 0x1d0]
xor eax, eax
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.140058ee0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 6
mov dword [rbp + 0x50], r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call fcn.1400011b0
int3
call fcn.140001250
int3