Function at 0x140106bd0
Capabilities:
Create thread
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x978
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x8e0], xmm14
movdqa xmmword [rbp + 0x8d0], xmm13
movdqa xmmword [rbp + 0x8c0], xmm12
movdqa xmmword [rbp + 0x8b0], xmm11
movdqa xmmword [rbp + 0x8a0], xmm10
movdqa xmmword [rbp + 0x890], xmm9
movdqa xmmword [rbp + 0x880], xmm8
movdqa xmmword [rbp + 0x870], xmm7
movdqa xmmword [rbp + 0x860], xmm6
mov qword [rbp + 0x858], 0xfffffffffffffffe
mov r14, rcx
lea rax, [0x140107261]
movq xmm0, rax
lea rax, [0x140107233]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x380], xmm1
lea rax, [0x1401073ab]
movq xmm0, rax
lea rax, [0x1401072ce]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x390], xmm1
lea rax, [0x14010748f]
movq xmm0, rax
lea rax, [0x140107439]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x3a0], xmm1
lea rax, [0x140107569]
movq xmm0, rax
lea rax, [0x1401074fa]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x3b0], xmm1
lea rax, [0x1401075d6]
movq xmm0, rax
lea rax, [0x1401075c1]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x3c0], xmm1
lea rax, [0x1401077b1]
movq xmm0, rax
lea rax, [0x140107640]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x3d0], xmm1
mov qword [rbp + 0x3e0], 1
mov qword [rbp + 0x3e8], 1
mov qword [rbp + 0x3f0], 1
mov qword [rbp + 0x3f8], 1
mov qword [rbp + 0x400], 1
mov qword [rbp + 0x408], 1
mov qword [rbp + 0x410], 1
lea rax, [0x1401076f1]
movq xmm0, rax
lea rax, [0x14010769d]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [rbp + 0x418], xmm1
lea rax, [0x140107759]
movq xmm0, rax
lea rax, [0x140107705]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [rbp + 0x428], xmm1
lea rax, [0x140107773]
movq xmm0, rax
lea rax, [0x14010776b]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [rbp + 0x438], xmm1
mov qword [rbp + 0x448], 1
mov qword [rbp + 0x450], 1
lea rax, [0x140108d80]
movq xmm0, rax
lea rax, [0x140108bd7]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [rbp + 0x458], xmm1
lea rax, [0x140108d90]
mov qword [rbp + 0x468], rax
mov qword [rbp + 0x470], 1
lea rax, [0x1401089ce]
movq xmm0, rax
lea rax, [0x140107815]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [rbp + 0x478], xmm1
lea rax, [0x140108b90]
movq xmm0, rax
lea rax, [0x140108b80]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [rbp + 0x488], xmm1
mov qword [rbp + 0x498], 1
lea rax, [0x140108583]
movq xmm0, rax
lea rax, [0x1401083a9]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x4a0], xmm1
lea rax, [0x140108593]
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 0x4b8], 1
lea rax, [0x14010811e]
movq xmm0, rax
lea rax, [0x140107f35]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x4c0], xmm1
lea rax, [0x14010812e]
mov qword [rbp + 0x4d0], rax
mov qword [rbp + 0x4d8], 1
lea rax, [0x140107a60]
movq xmm0, rax
lea rax, [0x1401078af]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x4e0], xmm1
lea rax, [0x140107a73]
mov qword [rbp + 0x4f0], rax
mov qword [rbp + 0x4f8], 1
lea rax, [0x14010879e]
movq xmm0, rax
lea rax, [0x1401085a8]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x500], xmm1
lea rax, [0x1401087b1]
mov qword [rbp + 0x510], rax
mov qword [rbp + 0x518], 1
lea rax, [0x14010837e]
movq xmm0, rax
lea rax, [0x140108143]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x520], xmm1
lea rax, [0x140108391]
mov qword [rbp + 0x530], rax
mov qword [rbp + 0x538], 1
lea rax, [0x140108fde]
movq xmm0, rax
lea rax, [0x140108daa]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x540], xmm1
lea rax, [0x140108ff1]
mov qword [rbp + 0x550], rax
mov qword [rbp + 0x558], 1
lea rax, [0x140107c83]
movq xmm0, rax
lea rax, [0x140107aa1]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x560], xmm1
lea rax, [0x140107c96]
mov qword [rbp + 0x570], rax
mov qword [rbp + 0x578], 1
lea rax, [0x1401089a3]
movq xmm0, rax
lea rax, [0x1401087c9]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x580], xmm1
lea rax, [0x1401089b6]
mov qword [rbp + 0x590], rax
mov qword [rbp + 0x598], 1
lea rax, [0x140107cbf]
movq xmm0, rax
lea rax, [0x140107cae]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x5a0], xmm1
lea rax, [0x140107eb9]
movq xmm0, rax
lea rax, [0x140107e9e]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x5b0], xmm1
lea rax, [0x140107eeb]
movq xmm0, rax
lea rax, [0x140107edc]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x5c0], xmm1
lea rax, [0x140107f1d]
movq xmm0, rax
lea rax, [0x140107f0a]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x5d0], xmm1
lea rax, [0x1401090d8]
mov qword [rbp + 0x5e0], rax
mov qword [rbp + 0x5e8], 1
mov qword [rbp + 0x5f0], 1
lea rax, [0x1401091aa]
mov qword [rbp + 0x5f8], rax
mov qword [rbp + 0x600], 1
lea rax, [0x140109294]
movq xmm0, rax
lea rax, [0x140107822]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [rbp + 0x608], xmm1
mov qword [rbp + 0x618], 1
lea rax, [0x140109004]
movq xmm0, rax
lea rax, [0x140109368]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqa xmmword [rbp + 0x620], xmm1
mov dword [rbp + 0x7a0], 0x1706
mov eax, dword [rbp + 0x7a0]
mov dword [rbp + 0x7b8], 1
mov ecx, dword [rbp + 0x7b8]
lea esi, [rax + rcx]
add esi, 0xffffeaed
mov ecx, 4
call fcn.14004801c
mov dword [rax], esi
mov qword [rbp + 0x818], rax
mov rax, qword [r14 + 0x128]
mov rax, qword [rax + 0x88]
mov r15d, eax
add r15, qword [r14 + 0x178]
lea rcx, [0x140086980]
mov qword [rbp + 0x650], rcx
mov dword [rbp + 0x828], 0x2c3240f1
mov dword [rbp + 0x7f8], 0xd3cdbf0e
mov rbx, qword [rbp + 0x650]
mov ecx, dword [rbp + 0x7f8]
mov edx, dword [rbp + 0x828]
movq xmm0, rdx
pxor xmm1, xmm1
movq xmm2, rcx
pxor xmm3, xmm3
movdqu xmm4, xmm0
movdqu xmm5, xmm2
pand xmm4, xmm5
movq rcx, xmm4
or rcx, 0x2f14d7
sub rbx, rcx
add rbx, 0x294297
shr rax, 0x20
mov r8, qword [r14 + 0x178]
mov edx, 0xaaaaaaab
imul rdx, rax
shr rdx, 0x23
mov rcx, r15
call rbx
lea rax, [0x1400eacbb]
mov qword [rbp + 0x650], rax
mov dword [rbp + 0x828], 0x7bb0cb45
mov dword [rbp + 0x7f8], 0x844f34ba
mov rax, qword [rbp + 0x650]
mov ecx, dword [rbp + 0x7f8]
mov edx, dword [rbp + 0x828]
movq xmm0, rdx
pxor xmm1, xmm1
movq xmm2, rcx
pxor xmm3, xmm3
movdqu xmm4, xmm0
movdqu xmm5, xmm2
pand xmm4, xmm5
movq rcx, xmm4
or rcx, 0xd25f1
neg rcx
lea r8, [rax + rcx]
add r8, 0x10066
mov byte [rbp + 0x828], 0x32
lea rdx, [rbp + 0x829]
mov dword [rbp + 0x82b], 0xae57b557
mov byte [rbp + 0x82f], 0
mov word [rbp + 0x829], 0xa272
mov ecx, 2
movabs rdi, 0x8000000000000000
mov rsi, rdi
nop dword [rax + rax]
mov rbx, rsi
sar rbx, 0x3f
xor bl, byte [rbp + rcx + 0x828]
xor bl, 0x32
mov byte [rbp + rcx + 0x828], bl
add rcx, 1
add rsi, rdi
cmp rcx, 7
jne 0x140107310
mov byte [rbp + 0x650], 0x32
lea rcx, [rbp + 0x651]
mov dword [rbp + 0x653], 0xb842a053
mov word [rbp + 0x657], 0x41
mov word [rbp + 0x651], 0xbf6b
mov ebx, 2
movabs rax, 0x8000000000000000
mov rdi, rax
nop word cs:[rax + rax]
nop dword [rax + rax]
mov rsi, rdi
sar rsi, 0x3f
xor sil, byte [rbp + rbx + 0x650]
xor sil, 0x32
mov byte [rbp + rbx + 0x650], sil
add rbx, 1
add rdi, rax
cmp rbx, 8
jne 0x140107380
call r8
mov dword [rbp + 0x7a4], 0x116a
mov eax, dword [rbp + 0x7a4]
mov dword [rbp + 0x7c0], 1
mov ecx, dword [rbp + 0x7c0]
add eax, ecx
add eax, 0xffffee95
mov dword [rbp + 0x824], eax
mov ecx, 0x18
call fcn.14004801c
lea rcx, [rbp + 0x824]
mov qword [rax], rcx
mov qword [rax + 8], r14
lea rcx, [rbp + 0x818]
mov qword [rax + 0x10], rcx
lea rcx, [rbp + 0x7f0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x14000cac0]
xor ecx, ecx
xor edx, edx
mov qword [rbp + 0x638], rax
mov r9, rax
call fcn.140097d10
mov qword [rbp + 0x7e8], rax
test rax, rax
je 0x140108ba5
mov esi, dword [rbp + 0x7f0]
test esi, esi
je 0x140108bb9
call sub.KERNEL32.dll_GetCurrentThreadId
cmp esi, eax
je 0x140108bc3
movdqu xmm0, xmmword [rbp + 0x7e8]
movdqa xmmword [rbp + 0x650], xmm0
lea rcx, [rbp + 0x650]
xor edx, edx
call fcn.140049c10
test eax, eax
jne 0x140108bcd
mov qword [rbp + 0x7e8], 0
mov dword [rbp + 0x7f0], 0
lea rax, [0x1400958c6]
mov qword [rbp + 0x650], rax
mov dword [rbp + 0x828], 0x157a1013
mov dword [rbp + 0x7f8], 0xea85efec
mov rax, qword [rbp + 0x650]
mov ecx, dword [rbp + 0x7f8]
mov edx, dword [rbp + 0x828]
movq xmm0, rdx
pxor xmm1, xmm1
movq xmm2, rcx
pxor xmm3, xmm3
movdqu xmm4, xmm0
movdqu xmm5, xmm2
pand xmm4, xmm5
movq rcx, xmm4
or rcx, 0xfd88b
neg rcx
add rax, rcx
add rax, 0x906f5
mov byte [rbp + 0x650], reloc.WS2_32.dll_gethostname
lea rcx, [rbp + 0x651]
mov dword [rbp + 0x653], 0xb349ab58
mov word [rbp + 0x657], 0x4a
mov word [rbp + 0x651], 0xb46b
mov edx, 2
movabs rsi, 0x8000000000000000
mov rdi, rsi
nop word cs:[rax + rax]
mov rbx, rdi
sar rbx, 0x3f
xor bl, byte [rbp + rdx + 0x650]
xor bl, 0x39
mov byte [rbp + rdx + 0x650], bl
add rdx, 1
add rdi, rsi
cmp rdx, 8
jne 0x140107540
xor edx, edx
call rax
lea rax, [0x14004338b]
mov qword [rbp + 0x650], rax
mov dword [rbp + 0x828], 0x53ae8c17
mov dword [rbp + 0x7f8], 0xac5173e8
mov rax, qword [rbp + 0x650]
mov ecx, dword [rbp + 0x7f8]
mov edx, dword [rbp + 0x828]
movq xmm0, rdx
pxor xmm1, xmm1
movq xmm2, rcx
pxor xmm3, xmm3
movdqu xmm4, xmm0
movdqu xmm5, xmm2
pand xmm4, xmm5
movq rcx, xmm4
or rcx, 0x2eddf1
sub rax, rcx
add rax, 0x2d4466
mov rcx, r15
call rax
mov rbx, qword [r14 + 0x160]
mov r14, qword [r14 + 0x168]
mov dword [rbp + 0x7a8], 0x15b4
mov eax, dword [rbp + 0x7a8]
mov dword [rbp + 0x7c8], 1
mov ecx, dword [rbp + 0x7c8]
lea eax, [rax + rcx - 0x15ab]
mov dword [rbp + 0x7b4], eax
mov eax, dword [rbp + 0x7b4]
mov r15d, 0x189a
lea r12, [0x14016d0d0]
lea r13, [0x1400856e0]
jmp qword [rbp + rax*8 + 0x380]
mov dword [rbp + 0x7f0], 0
mov ecx, 6
call fcn.140048e10
mov ecx, 1
call fcn.140048e10
mov ecx, 5
call fcn.140048e10
mov ecx, 2
call fcn.140048e10
mov byte [rbp + 0x650], 0x32
lea rdx, [rbp + 0x651]
movdqu xmm0, xmmword [0x1400bb210]
movdqu xmmword [rbp + 0x651], xmm0
mov word [rbp + 0x661], 7
mov byte [rbp + 0x651], 0x43
movdqa xmm11, xmmword [reloc.WS2_32.dll_ntohs]
movdqa xmm12, xmmword [reloc.WS2_32.dll_listen]
movdqa xmm13, xmmword [0x1400ba0a0]
movdqa xmm14, xmmword [reloc.WS2_32.dll_htons]
movdqa xmm4, xmmword [reloc.WS2_32.dll_getsockopt]
movdqa xmm5, xmmword [reloc.WS2_32.dll_getpeername]
movdqa xmm3, xmmword [reloc.WS2_32.dll_closesocket]
movdqa xmm7, xmmword [reloc.WS2_32.dll_accept]
xor eax, eax
movdqa xmm8, xmmword [0x1400bb700]
movdqa xmm9, xmmword [reloc.WS2_32.dll_recv]
nop dword [rax]
mov rcx, rax
or rcx, 1
movdqu xmm10, xmmword [rbp + rcx + 0x651]
movdqa xmm0, xmm12
psllq xmm0, 0x3f
psrad xmm0, 0x1f
pshufd xmm1, xmm0, 0xf5
movdqa xmm0, xmm11
psllq xmm0, 0x3f
psrad xmm0, 0x1f
pshufd xmm0, xmm0, 0xf5
packssdw xmm1, xmm0
movdqa xmm0, xmm14
psllq xmm0, 0x3f
psrad xmm0, 0x1f
pshufd xmm0, xmm0, 0xf5
movdqa xmm2, xmm13
psllq xmm2, 0x3f
psrad xmm2, 0x1f
pshufd xmm2, xmm2, 0xf5
packssdw xmm0, xmm2
packssdw xmm0, xmm1
movdqa xmm1, xmm5
psllq xmm1, 0x3f
psrad xmm1, 0x1f
pshufd xmm1, xmm1, 0xf5
movdqa xmm2, xmm4
psllq xmm2, 0x3f
psrad xmm2, 0x1f
pshufd xmm2, xmm2, 0xf5
packssdw xmm1, xmm2
movdqa xmm2, xmm7
psllq xmm2, 0x3f
psrad xmm2, 0x1f
pshufd xmm2, xmm2, 0xf5
movdqa xmm6, xmm3
psllq xmm6, 0x3f
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
packssdw xmm2, xmm6
packssdw xmm2, xmm1
packsswb xmm2, xmm0
pxor xmm2, xmm10
pxor xmm2, xmm8
movdqu xmmword [rbp + rcx + 0x651], xmm2
lea rcx, [rax + 0x10]
paddq xmm7, xmm9
paddq xmm3, xmm9
paddq xmm5, xmm9
paddq xmm4, xmm9
paddq xmm14, xmm9
paddq xmm13, xmm9
paddq xmm12, xmm9
paddq xmm11, xmm9
test rax, rax
mov rax, rcx
jne 0x140108c60
lea rcx, [rbp + 0x220]
call fcn.14000c130
lea rcx, [rbp - 0x48]
lea rdx, [rbp + 0x220]
call fcn.14000c1a0
lea rdx, [0x1400e5380]
lea rcx, [rbp - 0x48]
call fcn.14008baac
jmp 0x140109004
int3