Function at 0x140002ce0
Capabilities:
Contain obfuscated stackstrings
Create thread
Execute command
Inject thread

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x14007b180]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rbx, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140002d9e
mov dword [rsp + 0x57], 0x19001913
lea rax, [rsp + 0x40]
mov cl, 0x19
mov dword [rsp + 0x53], 0x376a6a7c
mov dword [rsp + 0x4f], 0x7a766b69
mov dword [rsp + 0x4b], 0x39777c69
mov dword [rsp + 0x47], 0x7639766d
mov dword [rsp + 0x43], 0x397d7c75
mov word [rsp + 0x41], 0x7078
mov byte [rsp + 0x40], 0x5f
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x59]
cmp rax, rcx
je 0x140002d76
movzx ecx, byte [rsp + 0x5a]
jmp 0x140002d60
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x59], 1
call fcn.140009a40
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14000312c
mov r8, qword [rbx + 0x10]
mov r9d, 0x3000
mov qword [rsp + 0x1a0], rsi
xor edx, edx
mov qword [rsp + 0x168], r14
mov rcx, rdi
lea r14, [rbx + 0x10]
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x140002e8a
mov dword [rbp - 0x3d], 0x3500353f
lea rax, [rbp - 0x70]
mov cl, 0x35
mov dword [rbp - 0x41], 0x1b464650
mov dword [rbp - 0x45], 0x565a4745
mov dword [rbp - 0x49], 0x15415052
mov dword [rbp - 0x4d], 0x47544115
mov dword [rbp - 0x51], 0x5b5c1547
mov dword [rbp - 0x55], 0x50535340
mov dword [rbp - 0x59], 0x57155d41
mov dword [rbp - 0x5d], 0x54451579
mov dword [rbp - 0x61], 0x79711550
mov dword [rbp - 0x65], 0x41545047
mov dword [rbp - 0x69], 0x56155a41
mov dword [rbp - 0x6d], 0x15515059
mov word [rbp - 0x6f], 0x5c54
mov byte [rbp - 0x70], reloc.WS2_32.dll_WSAStartup
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x3b]
cmp rax, rcx
je 0x140002e64
movzx ecx, byte [rbp - 0x3a]
jmp 0x140002e50
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x70]
mov byte [rbp - 0x3b], 1
call fcn.140009a40
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x14000311c
cmp qword [rbx + 0x18], 0xf
mov qword [rsp + 0x160], r15
jbe 0x140002e9c
mov rbx, qword [rbx]
mov r9, qword [r14]
xor r15d, r15d
mov r8, rbx
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov rcx, rdi
test eax, eax
jne 0x140002f7d
mov r9d, 0x8000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, 0x3b
mov dword [rbp + 0x41], 0x3b003b31
lea rax, [rbp + 8]
mov dword [rbp + 0x3d], 0x1548485e
mov dword [rbp + 0x39], 0x5854494b
mov dword [rbp + 0x35], 0x1b4f5e5c
mov dword [rbp + 0x31], 0x495a4f1b
mov dword [rbp + 0x2d], 0x55521b49
mov dword [rbp + 0x29], 0x5e5d5d4e
mov dword [rbp + 0x25], 0x591b5e53
mov dword [rbp + 0x21], 0x4f1b544f
mov dword [rbp + 0x1d], 0x1b534f5a
mov dword [rbp + 0x19], 0x4b1b7777
mov dword [rbp + 0x15], 0x7f1b5e4f
mov dword [rbp + 0x11], 0x52494c1b
mov dword [rbp + 0xd], 0x544f1b5f
mov dword [rbp + 9], 0x5e57525a
mov byte [rbp + 8], 0x7d
nop
xor byte [rax], cl
inc rax
lea rcx, [rbp + 0x43]
cmp rax, rcx
je 0x140002f64
movzx ecx, byte [rbp + 0x44]
jmp 0x140002f50
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 8]
mov byte [rbp + 0x43], 1
call fcn.140009a40
jmp 0x140003114
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x48]
mov dword [rbp + 0x48], r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp + 0x48], r15d
je 0x14000305e
mov dword [rbp - 3], 0x3700373d
lea rax, [rbp - 0x38]
mov cl, 0x37
mov dword [rbp - 7], 0x19444452
mov dword [rbp - 0xb], 0x54584547
mov dword [rbp - 0xf], 0x17435250
mov dword [rbp - 0x13], 0x45564317
mov dword [rbp - 0x17], 0x525f4317
mov dword [rbp - 0x1b], 0x5843595e
mov dword [rbp - 0x1f], 0x17525b42
mov dword [rbp - 0x23], 0x53585a17
mov dword [rbp - 0x27], 0x53524354
mov dword [rbp - 0x2b], 0x525d595e
mov dword [rbp - 0x2f], 0x174e5b5b
mov dword [rbp - 0x33], 0x42514444
mov dword [rbp - 0x37], 0x52545442
mov byte [rbp - 0x38], 0x64
nop dword [rax]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 1]
cmp rax, rcx
je 0x140003054
movzx ecx, byte [rbp]
jmp 0x140003040
mov byte [rbp - 1], 1
lea rdx, [rbp - 0x38]
jmp 0x1400030dd
mov dword [rbp - 0x77], 0x2b002b21
lea rax, [rsp + 0x60]
mov cl, 0x2b
mov dword [rbp - 0x7b], 0x558584e
mov dword [rbp - 0x7f], 0x4844595b
mov dword [rsp + 0x7d], 0xb5f4e4c
mov dword [rsp + 0x79], 0x594a5f0b
mov dword [rsp + 0x75], 0x4e435f0b
mov dword [rsp + 0x71], 0x445f4542
mov dword [rsp + 0x6d], 0xb5f484e
mov dword [rsp + 0x69], 0x4145420b
mov dword [rsp + 0x65], 0x445f0b4f
mov dword [rsp + 0x61], 0x4e47424a
mov byte [rsp + 0x60], WSAGetLastError
nop
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x75]
cmp rax, rcx
je 0x1400030d4
movzx ecx, byte [rbp - 0x74]
jmp 0x1400030c0
mov byte [rbp - 0x75], 1
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009a40
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x1a0]
mov r14, qword [rsp + 0x168]
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400590d0
add rsp, 0x170
pop rdi
pop rbx
pop rbp
ret