Function at 0x140002fd0
Capabilities:
Encode data using xor
Initialize winsock library
Reference cloudflare dns server

Disassembly:
push rbp
push rsi
push rdi
push r12
lea rbp, [rsp - 0x2c8]
sub rsp, 0x3c8
mov rax, qword [0x140063040]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rsi, rcx
call fcn.14000a830
lea rcx, [0x14000aa40]
mov qword [rax], rcx
call fcn.14000a830
mov r12d, 1
mov rdi, 0xffffffffffffffff
mov dword [rax + 0x18], r12d
nop
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140003020
cmp rdi, 0x152
ja 0x140003755
mov qword [rsp + 0x3f0], rbx
lea rcx, [rbp + 0x190]
xor edx, edx
mov qword [rsp + 0x400], r14
mov r8d, 0xfa
call fcn.1400326f0
xor r14d, r14d
mov r9d, r14d
mov ebx, r14d
test edi, edi
je 0x14000314c
mov r10, rsi
lea r11, [0x14005cd50]
nop word [rax + rax]
movsx rcx, byte [r10]
cmp cl, 0x3d
je 0x14000314c
lea eax, [rcx - 0x2b]
cmp al, 0x4f
ja 0x140003147
movsx edx, byte [rcx + r11 - 0x2b]
mov ecx, edx
cmp edx, 0xffffffff
je 0x140003147
mov r8d, r9d
and r8d, 3
je 0x14000312a
sub r8d, r12d
je 0x1400030fc
sub r8d, r12d
je 0x1400030ce
cmp r8d, r12d
jne 0x140003136
mov eax, ebx
add byte [rbp + rax + 0x190], dl
inc ebx
jmp 0x140003136
mov eax, ebx
inc ebx
shr ecx, 2
and cl, 0xf
add byte [rbp + rax + 0x190], cl
lea eax, [rdi - 2]
cmp r9d, eax
jb 0x1400030f0
lea eax, [rdi - 1]
cmp byte [rax + rsi], 0x3d
je 0x140003136
shl dl, 6
mov byte [rbp + rbx + 0x190], dl
jmp 0x140003136
mov eax, ebx
inc ebx
shr ecx, 4
and cl, 3
add byte [rbp + rax + 0x190], cl
lea eax, [rdi - 3]
cmp r9d, eax
jb 0x14000311e
lea eax, [rdi - 2]
cmp byte [rax + rsi], 0x3d
je 0x140003136
shl dl, 4
mov byte [rbp + rbx + 0x190], dl
jmp 0x140003136
mov eax, ebx
shl dl, 2
mov byte [rbp + rax + 0x190], dl
inc r9d
inc r10
cmp r9d, edi
jb 0x140003080
jmp 0x14000314c
mov ebx, 0xffffffff
cmp bl, 0xf
jb 0x140003745
mov r8b, 5
lea r9, [rbp + 0x195]
nop
movzx ecx, r8b
lea r9, [r9 + 1]
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
movsxd rax, ecx
movzx ecx, r8b
inc r8b
xor cl, byte [rbp + rax + 0x190]
xor byte [r9 - 1], cl
cmp r8b, bl
jb 0x140003160
mov ecx, 0xc80
call fcn.140038aa8
mov rdi, rax
test rax, rax
je 0x1400031d9
lea rax, str._____________________
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
lea rax, [rdi + 0xc80]
xor edx, edx
mov qword [rsp + 0x60], rax
call fcn.140005060
test rax, rax
jne 0x1400031dc
mov rcx, rdi
call fcn.140037f04
mov rdi, r14
mov rcx, rdi
call fcn.140004c40
mov rcx, rdi
mov rsi, rax
call fcn.140037f04
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
mov ecx, dword [rsi]
add ecx, ecx
movsxd rcx, ecx
imul rcx, rcx, 0xb0
call fcn.140038aa8
mov rdi, rax
test rax, rax
je 0x140003745
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x120]
movzx r8d, bl
lea rdx, [rbp + 0x195]
sub r8, 5
mov dword [rsp + 0x20], recvfrom
mov rcx, rsi
call fcn.140005920
mov rcx, rdi
mov ebx, eax
call fcn.140037f04
test ebx, ebx
jle 0x140003745
mov rdx, qword [rbp + 0x130]
lea rcx, [0x140067300]
mov r8, qword [rbp + 0x138]
mov ebx, 0x95
sub r8, rdx
mov qword [rsp + 0x3c0], r15
cmp r8, rbx
cmovg r8, rbx
call fcn.140032040
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x180]
mov r8, qword [rbp + 0x148]
xor eax, eax
sub r8, rdx
mov qword [rbp + 0x180], rax
mov word [rbp + 0x188], ax
mov eax, 9
cmp r8, rax
cmovg r8, rax
call fcn.140032040
lea rcx, [rbp + 0x180]
call fcn.1400389f8
mov rdx, qword [rbp + 0x150]
lea rcx, [0x140067230]
mov r8, qword [rbp + 0x158]
sub r8, rdx
mov dword [0x140067484], eax
cmp r8, rbx
cmovg r8, rbx
call fcn.140032040
mov rax, qword [rbp + 0x170]
lea rdx, str._client_version_:__.s._s._.s_
mov rcx, qword [rbp + 0x178]
mov r15d, 0xa
mov r8, qword [rbp + 0x168]
sub rcx, rax
mov r9, qword [rbp + 0x160]
cmp rcx, r15
mov qword [rsp + 0x30], rax
lea rax, [0x14005c67c]
cmovg rcx, r15
sub r8, r9
mov qword [rsp + 0x28], rcx
cmp r8, r15
lea rcx, [0x140067490]
mov qword [rsp + 0x20], rax
cmovg r8, r15
call fcn.140001070
test eax, eax
jle 0x14000373d
mov qword [rsp + 0x3f8], r13
mov rcx, rsi
movaps xmmword [rsp + 0x3b0], xmm6
movaps xmmword [rsp + 0x3a0], xmm7
call fcn.140037f04
mov byte [0x140067480], r14b
lock inc dword [0x1400673c8]
mov ecx, 0x1a0
call fcn.140038aa8
mov rbx, rax
test rax, rax
je 0x140003771
movsd xmm7, qword [0x14005d058]
lea rsi, [0x140006000]
movsd xmm6, qword [0x14005d060]
lea rdi, [0x140002ef0]
movabs r13, 0x8000000000000000
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x1a0
mov rcx, rbx
call fcn.1400326f0
xor eax, eax
lock cmpxchg dword [0x1400673e8], r12d
jne 0x14000341c
mov ecx, 0x202
lea rdx, [rbp - 0x80]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbx + 4], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x34], eax
lea rcx, [rbx + 0x178]
lea rax, [rbx + 0xc8]
mov qword [rbx + 0xe0], r14
mov qword [rax], rax
mov qword [rax + 8], rax
mov dword [rbx + 0xe8], r14d
mov qword [rbx + 0xf0], rsi
mov qword [rbx + 0xf8], r14
mov dword [rbx + 0x100], r14d
mov qword [rbx + 0x108], rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsp + 0x68]
mov qword [rbx + 0x150], 0xffffffffffffffff
call fcn.140038d0c
movsxd rax, dword [rsp + 0x68]
imul rcx, rax, 0x3e8
movzx eax, word [rsp + 0x70]
add rcx, rax
cmp qword [0x1400673e0], r14
mov qword [rbx + 8], rcx
jne 0x1400034ce
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x40]
mov qword [0x1400673e0], rax
test rax, rax
jne 0x1400034ce
mov rax, r14
jmp 0x140003514
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm1, qword [rsp + 0x48]
xor ecx, ecx
cvtsi2sd xmm0, qword [0x1400673e0]
divsd xmm1, xmm0
mulsd xmm1, xmm7
comisd xmm1, xmm6
jb 0x14000350c
subsd xmm1, xmm6
comisd xmm1, xmm6
jae 0x14000350c
mov rcx, r13
cvttsd2si rax, xmm1
add rax, rcx
or dword [rbx], 2
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x10], rax
call fcn.14000a830
mov rcx, rax
lea r9, str.hloop_new
mov eax, dword [rbx + 0x34]
lea r8, str._s:_hloop_new_tid_ld_n
mov edx, r12d
mov dword [rsp + 0x20], eax
call fcn.140009dc0
mov r9d, 0x1000000
mov qword [0x140067478], rbx
mov r8d, 0x1bb
lea rdx, str.1.1.1.1
mov rcx, rbx
call fcn.140007470
mov rbx, rax
test rax, rax
jne 0x140003573
mov rbx, r14
jmp 0x140003596
mov qword [rax + 0x118], rdi
mov rcx, rbx
lea rax, [0x140002bf0]
mov qword [rbx + 0x108], rax
call fcn.140008270
test eax, eax
cmovne rbx, r14
call fcn.14000cd40
test rax, rax
je 0x1400035b5
or dword [rbx + 0x3c], 0x8000
mov dword [rbx + 0x40], 0x1000000
mov qword [rbx + 0x188], rax
mov rdi, qword [0x140067478]
test rdi, rdi
je 0x1400036de
cmp dword [rdi + 4], r12d
je 0x1400036de
mov dword [rdi + 4], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rdi + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov dword [rdi + 0x34], eax
call fcn.14000a830
mov rcx, rax
mov dword [rsp + 0x20], ebx
lea r9, str.hloop_run
mov edx, r12d
lea r8, str._s:_hloop_run_tid_ld_n
call fcn.140009dc0
cmp dword [rdi + 0x40], r14d
jne 0x14000363a
lea rcx, [rdi + 0x178]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rdi + 0x154], 0xffffffff
jne 0x14000362d
mov rcx, rdi
call fcn.140006650
lea rcx, [rdi + 0x178]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rdi + 4]
test eax, eax
je 0x14000367e
cmp eax, 2
jne 0x140003659
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call fcn.140006d70
jmp 0x140003677
inc qword [rdi + 0x28]
test byte [rdi], 4
je 0x14000366a
mov eax, dword [rdi + 0x40]
cmp dword [rdi + 0x44], eax
jbe 0x14000367e
mov rcx, rdi
call fcn.140006290
test byte [rdi], r12b
jne 0x14000367e
mov eax, dword [rdi + 4]
test eax, eax
jne 0x140003641
mov dword [rdi + 4], r14d
call fcn.14000b0a0
mov qword [rdi + 0x18], rax
test byte [rdi], 2
je 0x1400036de
cmp dword [rdi + 4], 3
je 0x1400036de
mov dword [rdi + 4], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.14000a830
mov rcx, rax
mov dword [rsp + 0x20], ebx
lea r9, str.hloop_free
mov edx, r12d
lea r8, str._s:_hloop_free_tid_ld_n
call fcn.140009dc0
mov rcx, rdi
call fcn.140006970
mov rcx, rdi
call fcn.140037f04
lock inc dword [0x1400673cc]
cmp byte [0x140067480], r14b
mov qword [0x140067488], r14
mov qword [0x140067478], r14
jne 0x140003725
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
lock inc dword [0x1400673c8]
mov ecx, 0x1a0
call fcn.140038aa8
lea rdi, [0x140002ef0]
mov rbx, rax
test rax, rax
je 0x140003771
jmp 0x1400033f0
movaps xmm6, xmmword [rsp + 0x3b0]
mov r13, qword [rsp + 0x3f8]
movaps xmm7, xmmword [rsp + 0x3a0]
mov r15, qword [rsp + 0x3c0]
mov rbx, qword [rsp + 0x3f0]
mov r14, qword [rsp + 0x400]
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1400310d0
add rsp, 0x3c8
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 2
call fcn.14003521c
mov rcx, rax
lea rdx, str.malloc_failed__n
call fcn.1400096c0
mov ecx, 0xffffffff
call fcn.140039714
int3