Function at 0x14006a360
Capabilities:
Connect socket
Contain obfuscated stackstrings
Encode data using xor
Enumerate processes
Execute command
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Set console window title
Terminate process
Terminate process by name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov edx, 0x32
lea rcx, [rsp + 0x50]
call fcn.14005ff90
cmp qword [rax + 0x18], 0x10
jb 0x14006a3b1
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14006a3fa
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006a3f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006a3f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cbc0
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], socket
mov byte [rsp + 0x50], bl
lea edx, [rbx + 0xd]
mov rcx, qword [0x140094220]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.140069fb0
lea edx, [rbx + 0xe]
mov rcx, qword [0x140094220]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x140088300]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xeaf1f0f3
mov word [rsp + 0x34], 0x100
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x14
jb 0x14006a460
mov byte [rsp + 0x35], bl
lea rcx, [rsp + 0x20]
call fcn.140012350
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x202
lea rdx, [rbp - 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov qword [rsp + 0x28], rbx
mov r15d, 2
mov word [rsp + 0x20], r15w
mov ecx, 0x7f000001
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x24], eax
mov ecx, 0x61a8
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x22], ax
xor r8d, r8d
lea edx, [r15 - 1]
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006a505
lea r8d, [r15 + 0xe]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14006a64f
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [0x140094270], 0xffffffffffffffff
movdqa xmm0, xmmword [0x1400883a0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x2d]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x14006a530
mov byte [rsp + 0x31], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14006a9f3
call fcn.140069f90
movdqa xmm0, xmmword [0x140088180]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140088220]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x140088090]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400880c0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x140088030]
movdqa xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x49494703
mov dword [rbp - 0x5c], 0x4d474154
mov word [rbp - 0x58], 5
mov byte [rbp - 0x56], 1
lea rcx, [rsp + 0x50]
call fcn.14006aba0
mov rcx, rax
call fcn.140012350
movdqa xmm0, xmmword [0x140088120]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140088250]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400880b0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140088080]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x140088000]
movdqa xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x4f514553
mov dword [rbp - 0x5c], 0x4550414b
mov dword [rbp - 0x58], 0x1000259
lea rcx, [rsp + 0x50]
call fcn.14006abd0
mov rcx, rax
call fcn.140012350
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [0x140094270], rdi
mov edx, 0xb
mov rcx, qword [0x140094220]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x140088110]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x8ac59d87
mov dword [rsp + 0x34], 0x8f8d8988
mov dword [rsp + 0x38], 0xe7c28f
mov byte [rsp + 0x3c], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x2d]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x1b
jb 0x14006a6a0
mov byte [rsp + 0x3c], bl
lea rcx, [rsp + 0x20]
call fcn.140012350
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 0xf8e7a7b0
mov dword [rsp + 0x24], 0xbca0b2
mov byte [rsp + 0x28], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x2d]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 7
jb 0x14006a6f0
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], socket
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14006a723
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1400549b0
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x50]
cmp rax, 0xffffffffffffffff
jne 0x14006a761
mov eax, ebx
jmp 0x14006a808
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp - 0x4c]
call fcn.14006ddba
mov dword [rbp - 0x50], 0x130
xor r12b, r12b
lea rdx, [rbp - 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14006a7f6
cmp r13, 0x10
setae r15b
mov rsi, qword [rsp + 0x60]
nop word [rax + rax]
lea rcx, [rbp - 0x24]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], r12b
jne 0x14006a7b0
lea rcx, [rsp + 0x50]
test r15b, r15b
cmovne rcx, rdi
cmp rsi, rax
jne 0x14006a7da
mov r8, rsi
lea rdx, [rbp - 0x24]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14006a7ed
lea rdx, [rbp - 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14006a7f0
jmp 0x14006a7a0
mov r12b, 1
mov r15d, 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
test r12b, r12b
cmovne eax, dword [rbp - 0x48]
mov dword [0x140094254], eax
cmp r13, 0x10
jb 0x14006a84e
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14006a840
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006a840
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14006cbc0
mov eax, dword [0x140094254]
test eax, eax
jne 0x14006a89a
call fcn.140069f70
movdqa xmm0, xmmword [0x140088390]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0xcd
mov byte [rsp + 0x32], 1
lea rcx, [rsp + 0x20]
call fcn.140063f80
mov rcx, rax
call fcn.140012350
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rsi, qword [0x140094270]
mov qword [rsp + 0x5c], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x64], xmm0
mov qword [rsp + 0x74], rbx
mov dword [rsp + 0x7c], ebx
mov dword [rsp + 0x50], 0x7f244536
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x58], eax
mov rdi, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
lea r8d, [r9 + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x14006a92d
xor r9d, r9d
lea r8d, [r9 + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 8
jb 0x14006a92d
cmp dword [rsp + 0x20], 0x7f244536
jne 0x14006a92d
cmp dword [rsp + 0x24], 3
jne 0x14006a92d
mov rdi, qword [rsp + 0x28]
mov al, 1
jmp 0x14006a92f
xor al, al
test al, al
cmove rdi, rbx
mov qword [0x140094258], rdi
mov edx, 0xa
mov rcx, qword [0x140094220]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x1400882e0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xeaf1b2a8
mov word [rsp + 0x34], 0x100
mov rcx, rbx
nop
lea eax, [rcx - 0x33]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x14
jb 0x14006a970
mov byte [rsp + 0x35], 0
lea rcx, [rsp + 0x20]
call fcn.140012350
mov edx, recv
mov rcx, qword [0x140094220]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x1400882c0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140088100]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400878f0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp - 0x80], 1
nop
lea eax, [rbx - 0x2d]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 0x2f
jb 0x14006a9d0
mov byte [rbp - 0x80], 0
lea rcx, [rsp + 0x50]
call fcn.140012350
jmp 0x14006ab5a
mov edx, recv
mov rcx, qword [0x140094220]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x1400882b0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xaec1cebb
mov dword [rsp + 0x34], 0x8f81858c
mov dword [rsp + 0x38], 0xc4c78f89
mov word [rsp + 0x3c], 0xc5
mov byte [rsp + 0x3e], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x31]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x1d
jb 0x14006aa40
mov byte [rsp + 0x3e], bl
lea rcx, [rsp + 0x20]
call fcn.140012350
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400647c0
movdqa xmm0, xmmword [0x1400883f0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x2d]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x14006aa90
mov byte [rsp + 0x31], bl
lea rcx, [rsp + 0x20]
call fcn.140012350
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 0xa6b8b0
mov byte [rsp + 0x24], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx - 0x2d]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 3
jb 0x14006aad0
mov byte [rsp + 0x24], bl
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, recv
mov rcx, qword [0x140094220]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.140069fb0
mov edx, recv
mov rcx, qword [0x140094220]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x1400883b0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x100e8cf
nop
lea eax, [rbx - 0x2f]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x12
jb 0x14006ab30
mov byte [rsp + 0x33], 0
lea rcx, [rsp + 0x20]
call fcn.140012350
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400697b0
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.14006cad0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret