Function at 0x140041070
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14022b2b0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x10], rdx
movdqa xmm0, xmmword [0x14020ac70]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x1009d82
xor r12d, r12d
mov ecx, r12d
nop
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x12
jb 0x1400410c0
mov byte [rbp - 0x1d], r12b
lea rcx, [rbp - 0x30]
mov rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp byte [rcx + rax], r12b
jne 0x1400410e2
mov r8, qword [rdx + 0x10]
mov rcx, rdi
cmp qword [rdx + 0x18], 0x10
jb 0x1400410fc
mov rcx, qword [rdx]
cmp r8, rax
jne 0x14004111e
lea rdx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004111e
lea r8d, [rax + 5]
lea rdx, str.Smoke
jmp 0x14004131b
movdqa xmm0, xmmword [0x14020a400]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x9e
mov byte [rbp - 0x1e], 1
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x11
jb 0x140041140
mov byte [rbp - 0x1e], r12b
mov r14, qword [rdi + 0x10]
mov r15, qword [rdi + 0x18]
lea rcx, [rbp - 0x30]
mov rax, rsi
inc rax
cmp byte [rcx + rax], r12b
jne 0x140041163
mov rcx, rdi
cmp r15, 0x10
jb 0x140041178
mov rcx, qword [rdi]
cmp r14, rax
jne 0x14004119d
mov r8, r14
lea rdx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004119d
lea r8d, [rax + 4]
lea rdx, str.Burn
jmp 0x14004131b
movdqa xmm0, xmmword [0x14020a410]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x9e
mov byte [rbp - 0x1e], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x11
jb 0x1400411c0
mov byte [rbp - 0x1e], r12b
lea rcx, [rbp - 0x30]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], r12b
jne 0x1400411e0
mov rcx, rdi
cmp r15, 0x10
jb 0x1400411f5
mov rcx, qword [rdi]
cmp r14, rax
jne 0x14004121a
mov r8, r14
lea rdx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004121a
lea r8d, [rax + 5]
lea rdx, str.Flash
jmp 0x14004131b
movdqa xmm0, xmmword [0x14020a950]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xa380b7b8
mov word [rbp - 0x1c], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x14
jb 0x140041240
mov byte [rbp - 0x1b], r12b
lea rcx, [rbp - 0x30]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], r12b
jne 0x140041260
mov rcx, rdi
cmp r15, 0x10
jb 0x140041275
mov rcx, qword [rdi]
cmp r14, rax
jne 0x14004128a
mov r8, r14
lea rdx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400412ff
movdqa xmm0, xmmword [0x14020a260]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x444d7875
mov dword [rbp - 0x1c], 0x437e617d
mov dword [rbp - 0x18], 0x44696971
mov word [rbp - 0x14], 0x5f
mov byte [rbp - 0x12], 1
mov rax, r12
nop dword [rax]
xor byte [rbp + rax - 0x30], al
inc rax
cmp rax, 0x1d
jb 0x1400412c0
mov byte [rbp - 0x12], r12b
lea rax, [rbp - 0x30]
inc rsi
cmp byte [rax + rsi], r12b
jne 0x1400412d5
mov rcx, rdi
cmp r15, 0x10
jb 0x1400412ea
mov rcx, qword [rdi]
cmp r14, rsi
jne 0x14004130e
mov r8, r14
lea rdx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004130e
mov r8d, 4
lea rdx, str.Frag
jmp 0x14004131b
mov r8d, 6
lea rdx, str.Unknow
mov qword [rbx], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r12b
mov rcx, rbx
call fcn.14000b840
nop
mov rcx, rdi
call fcn.14000b7e0
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140154010
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret