Function at 0x140009c50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1400880c0]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov rsi, rcx
mov qword [rsp + 0x70], rcx
xor r15d, r15d
mov dword [rsp + 0x58], r15d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
mov eax, 0x202
mov word [rsp + 0x48], ax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea rax, [rbp + 0x2a8]
movabs rcx, 0xff00ff00ff00ff00
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov rbx, qword [rax]
xor rbx, rcx
mov qword [rsp + 0x30], rbx
mov qword [rax], r15
mov ecx, r15d
mov edi, 3
lea r12, [0x140001690]
lea r14, [0x140000000]
mov rax, qword [0x140088820]
test rax, rax
je 0x140009d2a
mov edx, r15d
cmp rax, r12
je 0x140009d19
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x88820]
test rax, rax
jne 0x140009d01
jmp 0x140009d2a
mov r9, qword [r14 + rdx*8 + 0x88b40]
test r9, r9
jne 0x140009e0f
mov edx, 0x1f4
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9, rax
test rax, rax
jne 0x140009d53
mov r9, r15
jmp 0x140009dee
mov rax, r12
mov rcx, r9
mov rdx, rdi
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140009d60
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x140088818]
mov qword [r14 + rax*8 + 0x88820], r12
mov qword [r14 + rax*8 + 0x88b40], r9
inc rax
mov qword [0x140088818], rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
mov rcx, qword [sym.imp.WS2_32.dll_WSAStartup]
call r9
nop
mov qword [rsp + 0x50], 0x100
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea r13, [rbp + 0x2a8]
movabs rax, 0xff00ff00ff00ff00
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x30], rbx
mov qword [r13], r15
mov ecx, r15d
lea r12, [0x1400016d0]
mov rax, qword [0x140088e70]
test rax, rax
je 0x140009e9b
mov rdx, r15
cmp rax, r12
je 0x140009e8a
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x88e70]
test rax, rax
jne 0x140009e72
jmp 0x140009e9b
mov r9, qword [r14 + rdx*8 + 0x89190]
test r9, r9
jne 0x140009f7f
mov edx, 0x1f4
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9, rax
test rax, rax
jne 0x140009ec4
mov r9, r15
jmp 0x140009f5e
mov rax, r12
mov rcx, r9
mov rdx, rdi
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140009ed0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x140088e60]
mov qword [r14 + rax*8 + 0x88e70], r12
mov qword [r14 + rax*8 + 0x89190], r9
inc rax
mov qword [0x140088e60], rax
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x170]
mov rcx, qword [sym.imp.WS2_32.dll_gethostname]
call r9
nop
movabs rcx, 0xff00ff00ff00ff00
xor rbx, rcx
mov qword [r13], rbx
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x50], Ordinal_50
mov dword [rsp + 0x4c], r15d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea r13, [rbp + 0x2a8]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], r13
mov rbx, qword [r13]
xor rbx, rcx
mov qword [rsp + 0x30], rbx
mov qword [r13], r15
mov ecx, r15d
lea r12, [0x140001650]
mov rax, qword [0x1400894c0]
test rax, rax
je 0x14000a02e
mov rdx, r15
cmp rax, r12
je 0x14000a01d
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x894c0]
test rax, rax
jne 0x14000a005
jmp 0x14000a02e
mov r10, qword [r14 + rdx*8 + 0x897e0]
test r10, r10
jne 0x14000a10f
mov edx, 0x1f4
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r10, rax
test rax, rax
jne 0x14000a057
mov r10, r15
jmp 0x14000a0ee
mov rax, r12
mov rcx, r10
mov rdx, rdi
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x14000a060
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1400894b0]
mov qword [r14 + rax*8 + 0x894c0], r12
mov qword [r14 + rax*8 + 0x897e0], r10
inc rax
mov qword [0x1400894b0], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x60]
lea rcx, [sub.VCRUNTIME140.dll_memset]
call r10
nop
movabs r12, 0xff00ff00ff00ff00
xor rbx, r12
mov qword [r13], rbx
mov dword [rbp - 0x7c], 2
mov dword [rbp - 0x78], 2
mov dword [rbp - 0x74], reloc.WS2_32.dll_recvfrom
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x80]
xor edx, edx
lea rcx, [rbp + 0x170]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov dword [rsp + 0x58], 1
mov rax, qword [rsp + 0x78]
mov rax, qword [rax + 0x20]
mov dword [rsp + 0x4c], reloc.WLDAP32.dll_Ordinal_22
add rax, 4
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 2
movups xmmword [rsp + 0x30], xmm0
lea r13, [rbp + 0x2a8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r13
mov rbx, qword [r13]
xor rbx, r12
mov qword [rsp + 0x30], rbx
mov qword [r13], r15
mov ecx, r15d
lea r12, [0x140001ab0]
mov rax, qword [0x140089b10]
test rax, rax
je 0x14000a20e
mov rdx, r15
cmp rax, r12
je 0x14000a1fd
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x89b10]
test rax, rax
jne 0x14000a1e5
jmp 0x14000a20e
mov r10, qword [r14 + rdx*8 + 0x89e30]
test r10, r10
jne 0x14000a2ef
mov edx, 0x1f4
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r10, rax
test rax, rax
jne 0x14000a237
mov r10, r15
jmp 0x14000a2ce
mov rax, r12
mov rcx, r10
mov rdx, rdi
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x14000a240
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x140089b00]
mov qword [r14 + rax*8 + 0x89b10], r12
mov qword [r14 + rax*8 + 0x89e30], r10
inc rax
mov qword [0x140089b00], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [0x14006d0f8]
call r10
nop
movabs r12, 0xff00ff00ff00ff00
xor rbx, r12
mov qword [r13], rbx
lea rax, [rbp + 0x150]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14000a334
lea rdx, [rbp + 0x150]
mov rcx, rsi
call fcn.14001ce60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rax
mov rbx, qword [rax]
xor rbx, r12
mov qword [rsp + 0x30], rbx
mov qword [rax], r15
mov ecx, r15d
lea r12, [0x140001620]
mov rax, qword [0x14008a160]
test rax, rax
je 0x14000a3b9
mov rdx, r15
nop dword [rax]
cmp rax, r12
je 0x14000a3a8
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x8a160]
test rax, rax
jne 0x14000a390
jmp 0x14000a3b9
mov r8, qword [r14 + rdx*8 + 0x8a480]
test r8, r8
jne 0x14000a49f
mov edx, 0x1f4
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x14000a3e2
mov r8, r15
jmp 0x14000a47e
mov rax, r12
mov rcx, r8
mov rdx, rdi
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x14000a3f0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x14008a150]
mov qword [r14 + rax*8 + 0x8a160], r12
mov qword [r14 + rax*8 + 0x8a480], r8
inc rax
mov qword [0x14008a150], rax
lea rdx, [rsp + 0x78]
mov rcx, qword [sym.imp.WS2_32.dll_freeaddrinfo]
call r8
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea r13, [rbp + 0x2a8]
movabs rax, 0xff00ff00ff00ff00
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x30], rbx
mov qword [r13], r15
mov ecx, r15d
lea r12, [0x1400019d0]
mov rax, qword [0x14008a7b0]
test rax, rax
je 0x14000a51d
mov rdx, r15
cmp rax, r12
je 0x14000a50c
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x8a7b0]
test rax, rax
jne 0x14000a4f4
jmp 0x14000a51d
mov r10, qword [r14 + rdx*8 + 0x8aad0]
test r10, r10
jne 0x14000a5ff
mov edx, 0x1f4
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r10, rax
test rax, rax
jne 0x14000a546
mov r10, r15
jmp 0x14000a5de
mov rax, r12
mov rcx, r10
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdi, 1
jne 0x14000a550
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rcx, qword [0x14008a7a0]
mov qword [r14 + rcx*8 + 0x8a7b0], r12
mov qword [r14 + rcx*8 + 0x8aad0], r10
inc rcx
mov qword [0x14008a7a0], rcx
mov rcx, qword [sym.imp.WS2_32.dll_WSACleanup]
call r10
nop
movabs rax, 0xff00ff00ff00ff00
xor rbx, rax
mov qword [r13], rbx
mov rax, rsi
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.14006d500
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret