Function at 0x140006960
Capabilities:
Create thread
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140088088]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r13d, r13d
call fcn.140002f00
call fcn.140006340
lea rcx, [0x140088750]
call fcn.1400142a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x78], r13b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, rax
mov dword [rbp - 0x80], r13d
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rbp - 0x80]
or edx, 4
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
mov rsi, qword [rbp - 0x68]
lea r15, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae r15, qword [rbp - 0x78]
movabs rdi, 0x7fffffffffffffff
cmp rsi, rdi
ja 0x140007092
lea eax, [r13 + 0x16]
lea rcx, [rax - 0x17]
cmp rsi, 0x10
jae 0x140006a4e
mov qword [rbp - 0x28], rsi
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], rbx
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x38], xmm0
movq r14, xmm0
jmp 0x140006a99
mov rbx, rsi
or rbx, 0xf
cmp rbx, rdi
jbe 0x140006a5f
mov rbx, rdi
jmp 0x140006a66
cmp rbx, rax
cmovb rbx, rax
mov rdx, rbx
add rdx, 1
cmovb rdx, rcx
lea rcx, [rbp - 0x38]
call fcn.140005df0
mov r14, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rbx
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov r9d, 2
mov r8b, 0xc3
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movzx r8d, word [section..data]
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [0x140088708]
call fcn.140006730
lea rdx, [0x1400048f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movzx r8d, word [reloc.WS2_32.dll_getsockname]
mov edx, reloc.WLDAP32.dll_Ordinal_30
lea rcx, [0x1400886e8]
call fcn.140006730
lea rdx, [0x1400048f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movzx r8d, word [section..data]
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [0x140088728]
call fcn.140006730
lea rdx, [0x1400048f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movzx r8d, word [reloc.WS2_32.dll_bind]
mov edx, reloc.WLDAP32.dll_Ordinal_30
lea rcx, [0x140088628]
call fcn.140006730
lea rdx, [0x1400048f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm0, xmmword [0x14006e7a0]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0xd38d9488
mov word [rsp + 0x74], 0xca
mov byte [rsp + 0x76], 1
mov rcx, r13
nop dword [rax]
lea eax, [rcx - 0x2a]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x15
jb 0x140006b90
mov byte [rsp + 0x76], 0
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003f50
lea rdx, [rbp - 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003aa0
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov rsi, qword [rbp - 0x68]
lea r15, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae r15, qword [rbp - 0x78]
cmp rsi, rdi
ja 0x14000707d
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rsi, 0x10
jae 0x140006c0c
mov qword [rbp - 0x48], rsi
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x58], xmm0
jmp 0x140006c5e
mov rax, rsi
or rax, 0xf
cmp rax, rdi
ja 0x140006c28
mov rdi, rax
cmp rax, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rdi, rax
mov rdx, rdi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140005df0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], rdi
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp - 0x58]
lea rcx, [0x140088750]
call fcn.140015c90
mov ecx, 8
call fcn.14006a144
test rax, rax
je 0x140006c89
lea rcx, [0x140005ab0]
mov qword [rax], rcx
jmp 0x140006c8c
mov rax, r13
mov qword [rsp + 0x78], rax
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x1400018f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x140007083
movzx r8d, word [reloc.WS2_32.dll_getsockname]
lea rcx, [0x140088668]
cmp byte [0x140088960], 0
jne 0x140006da1
mov edx, reloc.WS2_32.dll_sendto
call fcn.140006730
lea rdx, [0x1400048f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x78], 0xf985e98d
mov word [rsp + 0x7c], 0x100
lea rcx, [rsp + 0x78]
call fcn.140005ff0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003f50
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.140003cf0
lea rdx, [0x1400048f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400048f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx r8d, word [reloc.WS2_32.dll_connect]
mov edx, Ordinal_26
lea rcx, [0x140088688]
call fcn.140006730
lea rdx, [0x1400048f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, reloc.WLDAP32.dll_Ordinal_30
call fcn.140006730
lea rdx, [0x1400048f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x78], 0xf985e98d
mov word [rsp + 0x7c], 0x100
mov rcx, r13
nop
lea eax, [rcx - 0x2a]
xor byte [rsp + rcx + 0x78], al
inc rcx
cmp rcx, 4
jb 0x140006de0
mov byte [rsp + 0x7d], 0
lea rdx, [rsp + 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003f50
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x68]
mov rcx, rax
call fcn.1400043a0
lea rdx, [0x1400048f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx r8d, word [reloc.WS2_32.dll_bind]
mov edx, Ordinal_41
lea rcx, [0x140088608]
call fcn.140006730
lea rdx, [0x1400048f0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x78], 0xabbbb5
mov byte [rsp + 0x7c], 1
mov rcx, r13
nop dword [rax + rax]
lea eax, [rcx - 0x2a]
xor byte [rsp + rcx + 0x78], al
inc rcx
cmp rcx, 3
jb 0x140006e80
mov byte [rsp + 0x7c], 0
lea rcx, [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea r8d, [rax + 6]
lea rdx, str.611863
lea rcx, [rsp + 0x38]
call fcn.1400041b0
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x58]
lea rcx, [0x140088750]
call fcn.140011a20
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [rsp + 0x78], r13d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
xorps xmm1, xmm1
movups xmmword [rbp], xmm1
movups xmmword [rbp + 0x10], xmm1
movups xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x30], xmm1
movups xmmword [rbp + 0x40], xmm1
movups xmmword [rbp + 0x50], xmm1
mov qword [rbp + 0x60], rax
mov word [rsp + 0x30], r13w
mov qword [rsp + 0x20], 2
lea r9, [rsp + 0x30]
mov r8, qword [rbp - 0x58]
lea rdx, [rbp]
lea rcx, [rsp + 0x60]
call fcn.140006020
test eax, eax
jne 0x140006f8a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140006fc8
mov rdx, qword [rbp - 0x48]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006fc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006fc2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006a180
nop
cmp dword [rbp - 0x10], 0
je 0x140006fd5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp rbx, 0x10
jb 0x140007010
lea rdx, [rbx + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140007007
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007007
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14006a180
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000704e
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007049
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007049
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006a180
xor eax, eax
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14006a2a0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140005dd0
nop
mov dword [rbp - 0x10], r13d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.140005dd0
int3