Function at 0x1400df7d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rbx, rcx
mov rsi, rdx
lea rcx, reloc.WS2_32.dll_accept
call fcn.14027ddb0
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400dfc3f
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
cmp dword [rax], 0x4550
jne 0x1400dfc3f
test rax, rax
je 0x1400dfc3f
mov ecx, dword [rax + 0xd8]
test ecx, ecx
jne 0x1400df8a8
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x69]
call fcn.1400dfc50
mov r9, rax
mov r10d, reloc.WS2_32.dll_socket
lea rdx, [rax + 2]
lea r8, [rax + 4]
nop
movsx ecx, byte [r9]
xor word [r8 - 2], cx
lea r8, [r8 + 8]
movsx ecx, byte [r9]
xor word [r8 - 8], cx
movsx eax, byte [r9]
xor word [r8 - 6], ax
movsx eax, byte [r9]
xor word [r8 - 4], ax
sub r10, 1
jne 0x1400df850
xor r8d, r8d
mov rcx, rbx
mov word [rdx + 0xb8], r8w
call fcn.1400dcb30
lea rdx, [0x1400dcd20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
jmp 0x1400df9d6
mov qword [rsp + 0xf0], rdi
mov rdi, qword [rcx + rbx + 0x58]
test rdi, rdi
jne 0x1400df9eb
xor r8d, r8d
mov qword [rsp + 0xf8], r14
mov r14, qword [rsp + 0xf8]
mov ecx, r8d
mov word [rbp - 9], r8w
mov al, Ordinal_60
mov dword [rbp - 0x69], 0x60003b
mov dword [rbp - 0x65], 0x660010
mov dword [rbp - 0x61], 0x68001b
mov dword [rbp - 0x5d], 0x5a004f
mov dword [rbp - 0x59], 0x500058
mov dword [rbp - 0x55], 0x540078
mov dword [rbp - 0x51], 0x500054
mov dword [rbp - 0x4d], 0x5e0052
mov dword [rbp - 0x49], 0x55001b
mov dword [rbp - 0x45], 0x4f0054
mov dword [rbp - 0x41], 0x5f001b
mov dword [rbp - 0x3d], 0x5d005e
mov dword [rbp - 0x39], 0x550052
mov dword [rbp - 0x35], 0x5f005e
mov dword [rbp - 0x31], 0x1b0017
mov dword [rbp - 0x2d], 0x52005d
mov dword [rbp - 0x29], 0x1b0043
mov dword [rbp - 0x25], 0x540058
mov dword [rbp - 0x21], 0x500054
mov dword [rbp - 0x1d], 0x5e0052
mov dword [rbp - 0x19], 0x48001b
mov dword [rbp - 0x15], 0x520050
mov dword [rbp - 0x11], 0x4b004b
mov dword [rbp - 0xd], 0x5f005e
nop dword [rax]
nop word [rax + rax]
movsx eax, al
xor word [rbp + rcx*2 - 0x67], ax
inc rcx
cmp rcx, 0x2f
jae 0x1400df9a7
movzx eax, byte [rbp - 0x69]
jmp 0x1400df990
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x67]
mov word [rbp - 9], r8w
call fcn.1400dcb30
lea rdx, [0x1400dcd20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
mov rdi, qword [rsp + 0xf0]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
sub rbx, rsi
movabs rsi, 0x2b992ddfa232
add rdi, rbx
cmp qword [rdi], rsi
je 0x1400dfafe
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x69]
call fcn.1400dfe10
mov r9, rax
mov r10d, 3
lea rdx, [rax + 2]
lea r8, [rax + 4]
nop word [rax + rax]
movsx ecx, byte [r9]
xor word [r8 - 2], cx
lea r8, [r8 + 0x22]
movsx ecx, byte [r9]
xor word [r8 - 0x22], cx
movsx eax, byte [r9]
xor word [r8 - 0x20], ax
movsx eax, byte [r9]
xor word [r8 - 0x1e], ax
movsx eax, byte [r9]
xor word [r8 - 0x1c], ax
movsx eax, byte [r9]
xor word [r8 - 0x1a], ax
movsx eax, byte [r9]
xor word [r8 - 0x18], ax
movsx eax, byte [r9]
xor word [r8 - 0x16], ax
movsx eax, byte [r9]
xor word [r8 - 0x14], ax
movsx eax, byte [r9]
xor word [r8 - 0x12], ax
movsx eax, byte [r9]
xor word [r8 - 0x10], ax
movsx eax, byte [r9]
xor word [r8 - 0xe], ax
movsx eax, byte [r9]
xor word [r8 - 0xc], ax
movsx eax, byte [r9]
xor word [r8 - 0xa], ax
movsx eax, byte [r9]
xor word [r8 - 8], ax
movsx eax, byte [r9]
xor word [r8 - 6], ax
movsx eax, byte [r9]
xor word [r8 - 4], ax
sub r10, 1
jne 0x1400dfa30
xor r8d, r8d
mov rcx, rbx
mov word [rdx + 0x66], r8w
call fcn.1400dcb30
lea rdx, [0x1400dcd20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x1400df9ce
mov cl, Ordinal_41
mov word [rbp - 0x69], Ordinal_45
movsx r9d, cl
movzx eax, r9w
movzx r8d, r9w
xor ax, 0x73
xor r8w, 0x41
mov word [rbp - 0x67], ax
movzx ecx, r9w
xor cx, 8
mov word [rbp - 0x5d], r8w
movzx eax, r9w
mov word [rbp - 0x59], r8w
xor ax, 3
mov word [rbp - 0x3d], r8w
mov word [rbp - 0x65], ax
movzx edx, r9w
movzx eax, r9w
mov word [rbp - 0x61], cx
xor ax, 0x75
mov word [rbp - 0x53], cx
mov word [rbp - 0x63], ax
xor dx, 0x43
movzx eax, r9w
mov word [rbp - 0x49], dx
xor ax, 0x6e
mov word [rbp - 0x47], cx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
xor r8d, r8d
mov word [rbp - 0x5f], ax
movzx eax, r9w
xor ax, 0x50
mov word [rbp - 0x3f], dx
mov word [rbp - 0x5b], ax
lea rdx, [rbp - 0x67]
movzx eax, r9w
mov word [rbp - 0x39], r8w
xor ax, 0x46
mov word [rbp - 0x57], ax
movzx eax, r9w
xor ax, 0x4f
mov word [rbp - 0x55], ax
movzx eax, r9w
xor ax, 0x5b
mov word [rbp - 0x51], ax
movzx eax, r9w
xor ax, 0x5c
mov word [rbp - 0x4f], ax
movzx eax, r9w
xor ax, 0x49
mov word [rbp - 0x4d], ax
movzx eax, r9w
xor ax, 0x4b
mov word [rbp - 0x4b], ax
mov word [rbp - 0x45], ax
movzx eax, r9w
xor ax, 0x47
xor r9w, 0x4d
mov word [rbp - 0x43], ax
mov word [rbp - 0x41], ax
mov word [rbp - 0x3b], r9w
call fcn.1400dcb30
lea rdx, [0x1400dcd20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
xor rcx, rsi
cmp rcx, rsi
cmove rcx, rax
mov qword [rdi], rcx
jmp 0x1400df9cc
xor al, al
jmp 0x1400df9d6