Function at 0x1401dfd70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push r12
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
lea rax, [rbp + 0x370]
mov byte [rbp + 0x370], 0
mov r8, rcx
lea rdx, [rbp + 0x370]
sub r8, rax
mov r15, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1401dfdb0
xor r12d, r12d
lea rdx, [rbp + 0x388]
xor r8d, r8d
mov dword [rbp + 0x388], r12d
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetIpAddrTable]
cmp eax, 0x7a
jne 0x1401e0245
mov ecx, dword [rbp + 0x388]
mov qword [rsp + 0x430], r14
call fcn.1403ddfc0
xor r8d, r8d
lea rdx, [rbp + 0x388]
mov rcx, rax
mov r14, rax
call qword [sym.imp.IPHLPAPI.DLL_GetIpAddrTable]
test eax, eax
jne 0x1401e0252
mov qword [rsp + 0x438], rdi
mov edi, r12d
cmp dword [r14], r12d
jbe 0x1401e0235
mov qword [rsp + 0x448], rbx
mov qword [rsp + 0x440], rsi
lea rsi, [r14 + 8]
nop dword [rax]
mov eax, dword [rsi]
lea rcx, [rbp - 0x30]
mov dword [rbp + 0x1d0], eax
call qword [sym.imp.IPHLPAPI.DLL_GetIfEntry]
mov eax, dword [rbp + 0x1d4]
cmp eax, 6
je 0x1401dfe66
cmp eax, 0x47
jne 0x1401e0216
lea rdx, [rbp + 0x22c]
mov qword [rsp + 0x68], r12
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], 0xf
call fcn.14013eec4
mov rbx, r12
nop dword [rax]
mov rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x68]
mov r8, qword [rsp + 0x68]
cmp rdx, 0x10
mov rax, 0xffffffffffffffff
setae r9b
cmovae rcx, r8
inc rax
cmp byte [rcx + rax], r12b
jne 0x1401dfeb1
cmp rbx, rax
jae 0x1401dfeec
test r9b, r9b
lea rax, [rsp + 0x68]
cmovne rax, r8
movsx ecx, byte [rax + rbx]
call fcn.1403e0bb0
cmp qword [rbp - 0x80], 0x10
lea rcx, [rsp + 0x68]
cmovae rcx, qword [rsp + 0x68]
mov byte [rcx + rbx], al
inc rbx
jmp 0x1401dfe90
mov dword [rsp + 0x40], 0x77706876
mov ecx, r12d
mov dword [rsp + 0x44], 0x6a6471
nop
movsxd rax, ecx
xor byte [rsp + rax + 0x40], cl
inc ecx
cmp ecx, 7
jb 0x1401dff00
cmp rdx, 0x10
mov byte [rsp + 0x47], r12b
lea rcx, [rsp + 0x68]
cmovae rcx, r8
lea rdx, [rsp + 0x40]
call fcn.1403cbcb0
test rax, rax
jne 0x1401e01de
mov dword [rbp + 0x370], 0x726074
mov ecx, r12d
movsxd rax, ecx
xor byte [rbp + rax + 0x370], cl
inc ecx
cmp ecx, 3
jb 0x1401dff40
cmp qword [rbp - 0x80], 0x10
lea rcx, [rsp + 0x68]
lea rdx, [rbp + 0x370]
mov byte [rbp + 0x373], r12b
cmovae rcx, qword [rsp + 0x68]
call fcn.1403cbcb0
test rax, rax
jne 0x1401e01de
mov dword [rbp + 0x378], 0x607275
mov ecx, r12d
nop word [rax + rax]
movsxd rax, ecx
xor byte [rbp + rax + 0x378], cl
inc ecx
cmp ecx, 3
jb 0x1401dff90
cmp qword [rbp - 0x80], 0x10
lea rcx, [rsp + 0x68]
lea rdx, [rbp + 0x378]
mov byte [rbp + 0x37b], r12b
cmovae rcx, qword [rsp + 0x68]
call fcn.1403cbcb0
test rax, rax
jne 0x1401e01de
mov dword [rbp + 0x380], 0x6c7176
mov ecx, r12d
nop word [rax + rax]
movsxd rax, ecx
xor byte [rbp + rax + 0x380], cl
inc ecx
cmp ecx, 3
jb 0x1401dffe0
cmp qword [rbp - 0x80], 0x10
lea rcx, [rsp + 0x68]
lea rdx, [rbp + 0x380]
mov byte [rbp + 0x383], r12b
cmovae rcx, qword [rsp + 0x68]
call fcn.1403cbcb0
test rax, rax
jne 0x1401e01de
mov dword [rsp + 0x51], 0x66776d62
mov ecx, r12d
mov dword [rsp + 0x55], 0x73696a70
mov word [rsp + 0x59], 0x60
nop word [rax + rax]
movsxd rax, ecx
xor byte [rsp + rax + 0x51], cl
inc ecx
cmp ecx, 9
jb 0x1401e0040
cmp qword [rbp - 0x80], 0x10
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x51]
mov byte [rsp + 0x5a], r12b
cmovae rcx, qword [rsp + 0x68]
call fcn.1403cbcb0
test rax, rax
jne 0x1401e01de
mov dword [rsp + 0x5b], 0x7371606b
mov ecx, r12d
mov dword [rsp + 0x5f], 0x6c757761
mov word [rsp + 0x63], 0x71
movsxd rax, ecx
xor byte [rsp + rax + 0x5b], cl
inc ecx
cmp ecx, 9
jb 0x1401e0090
cmp qword [rbp - 0x80], 0x10
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x5b]
mov byte [rsp + 0x64], r12b
cmovae rcx, qword [rsp + 0x68]
call fcn.1403cbcb0
test rax, rax
jne 0x1401e01de
mov dword [rsp + 0x48], 0x76616473
mov ecx, r12d
mov dword [rsp + 0x4c], 0x7e726c76
mov byte [rsp + 0x50], al
nop dword [rax]
movsxd rax, ecx
xor byte [rsp + rax + 0x48], cl
inc ecx
cmp ecx, 8
jb 0x1401e00e0
cmp qword [rbp - 0x80], 0x10
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x50], r12b
cmovae rcx, qword [rsp + 0x68]
call fcn.1403cbcb0
test rax, rax
jne 0x1401e01de
xorps xmm0, xmm0
mov qword [rbp - 0x48], rax
movups xmmword [rbp - 0x58], xmm0
mov ecx, r12d
mov dword [rbp - 0x40], eax
movdqa xmm0, xmmword [0x1404cf160]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rbp - 0x3c], ax
mov dword [rbp - 0x68], 0x3e4a2320
mov dword [rbp - 0x64], 0x4f242531
mov dword [rbp - 0x60], 0x292a3c35
mov word [rbp - 0x5c], 0x44
nop dword [rax]
nop word [rax + rax]
movsxd rax, ecx
xor byte [rbp + rax - 0x78], cl
inc ecx
cmp ecx, 0x1d
jb 0x1401e0160
mov byte [rbp - 0x5b], r12b
mov rcx, r12
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x78]
mov byte [rbp + rcx - 0x58], al
lea rcx, [rcx + 1]
test al, al
jne 0x1401e0180
movzx ecx, byte [rbp + 0x1e8]
movzx edx, byte [rbp + 0x1e7]
movzx eax, byte [rbp + 0x1e9]
movzx r10d, byte [rbp + 0x1e6]
movzx r9d, byte [rbp + 0x1e5]
movzx r8d, byte [rbp + 0x1e4]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov rcx, r15
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x58]
mov byte [r15], r12b
mov dword [rsp + 0x20], r10d
call fcn.1401a0fe0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1401e0216
mov rcx, qword [rsp + 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401e0211
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401e025c
call fcn.1403cad84
inc edi
add rsi, 0x18
cmp edi, dword [r14]
jb 0x1401dfe40
mov rsi, qword [rsp + 0x440]
mov rbx, qword [rsp + 0x448]
mov rdi, qword [rsp + 0x438]
mov r14, qword [rsp + 0x430]
add rsp, 0x450
pop r15
pop r12
pop rbp
ret
mov rcx, r14
call fcn.1403d8820
jmp 0x1401e023d
call fcn.1403d7020
int3