Function at 0x1400158b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x1400868c0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r13, rdx
mov rbx, rcx
mov qword [rbp - 0x21], rcx
mov qword [rbp - 0x19], rdx
xor edi, edi
mov dword [rbp - 0x61], edi
mov dword [rbp - 0x79], 0x71677275
mov dword [rbp - 0x75], 0x626b646a
mov word [rbp - 0x71], 0x100
mov eax, edi
xor byte [rbp + rax - 0x79], al
inc rax
cmp rax, 8
jb 0x140015903
mov byte [rbp - 0x70], 0
lea r9, [rbp - 0x59]
lea r8, [rbp - 0x71]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x11]
call fcn.1400060c0
nop
cmp byte [r13], 0
jne 0x14001593f
mov byte [r13], 1
call fcn.140008940
mov qword [r13 + 8], rax
cmp byte [r13], 1
jne 0x140015955
lea rdx, [rbp - 0x11]
mov rcx, qword [r13 + 8]
call fcn.14000dc20
jmp 0x140015959
mov rax, qword [rbp - 0x19]
cmp byte [rax], 3
jne 0x140015964
mov r8, qword [rax + 8]
jmp 0x140015967
mov r8, rdi
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x140015974
mov rdx, qword [r8]
lea rcx, [rbx + 0x140]
mov r8, qword [r8 + 0x10]
call fcn.14000efd0
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x1400159c3
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400159be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400159be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
mov dword [rbp - 0x69], 0x1007169
mov rax, rdi
nop dword [rax]
xor byte [rbp + rax - 0x69], al
inc rax
cmp rax, 2
jb 0x1400159d0
mov byte [rbp - 0x66], 0
mov qword [rbp - 0x11], rdi
mov qword [rbp - 1], 2
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
movzx eax, word [rbp - 0x69]
mov word [rbp - 0x11], ax
mov byte [rbp - 0xf], 0
cmp byte [r13], 0
jne 0x140015a16
mov byte [r13], 1
call fcn.140008940
mov qword [r13 + 8], rax
cmp byte [r13], 1
jne 0x140015a2c
lea rdx, [rbp - 0x11]
mov rcx, qword [r13 + 8]
call fcn.14000dc20
jmp 0x140015a30
mov rax, qword [rbp - 0x19]
cmp byte [rax], 3
jne 0x140015a3b
mov r8, qword [rax + 8]
jmp 0x140015a3e
mov r8, rdi
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x140015a4b
mov rdx, qword [r8]
lea rcx, [rbx + 0x160]
mov r8, qword [r8 + 0x10]
call fcn.14000efd0
nop
mov r8, qword [rbp + 7]
cmp r8, 0x10
jb 0x140015a76
inc r8
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x11]
call fcn.140010060
mov dword [rbp - 0x61], 0x676b7668
mov word [rbp - 0x5d], 0x100
mov rax, rdi
nop word [rax + rax]
xor byte [rbp + rax - 0x61], al
inc rax
cmp rax, 4
jb 0x140015a90
mov byte [rbp - 0x5c], 0
lea r9, [rbp - 0x59]
lea r8, [rbp - 0x5d]
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x11]
call fcn.1400060c0
nop
cmp byte [r13], 0
jne 0x140015acc
mov byte [r13], 1
call fcn.140008940
mov qword [r13 + 8], rax
cmp byte [r13], 1
jne 0x140015ae2
lea rdx, [rbp - 0x11]
mov rcx, qword [r13 + 8]
call fcn.14000dc20
jmp 0x140015ae6
mov rax, qword [rbp - 0x19]
cmp byte [rax], 3
jne 0x140015af1
mov r8, qword [rax + 8]
jmp 0x140015af4
mov r8, rdi
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x140015b01
mov rdx, qword [r8]
lea rcx, [rbx + 0x180]
mov r8, qword [r8 + 0x10]
call fcn.14000efd0
nop
mov r8, qword [rbp + 7]
cmp r8, 0x10
jb 0x140015b2c
inc r8
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x11]
call fcn.140010060
mov dword [rbp - 0x79], 0x62677363
mov dword [rbp - 0x75], 0x66626070
mov dword [rbp - 0x71], 0x1006c7c
mov rax, rdi
nop dword [rax]
nop dword [rax + rax]
xor byte [rbp + rax - 0x79], al
inc rax
cmp rax, 0xa
jb 0x140015b50
mov byte [rbp - 0x6e], 0
lea r9, [rbp - 0x59]
lea r8, [rbp - 0x6f]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x11]
call fcn.1400060c0
nop
cmp byte [r13], 0
jne 0x140015b8c
mov byte [r13], 1
call fcn.140008940
mov qword [r13 + 8], rax
cmp byte [r13], 1
jne 0x140015ba2
lea rdx, [rbp - 0x11]
mov rcx, qword [r13 + 8]
call fcn.14000dc20
jmp 0x140015ba6
mov rax, qword [rbp - 0x19]
cmp byte [rax], 3
jne 0x140015bb1
mov r8, qword [rax + 8]
jmp 0x140015bb4
mov r8, rdi
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x140015bc1
mov rdx, qword [r8]
lea rcx, [rbx + 0x1a0]
mov r8, qword [r8 + 0x10]
call fcn.14000efd0
nop
mov r8, qword [rbp + 7]
cmp r8, 0x10
jb 0x140015bec
inc r8
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x11]
call fcn.140010060
mov dword [rbp - 0x79], 0x7771606c
mov dword [rbp - 0x75], 0x6e616a68
mov word [rbp - 0x71], 0x66
mov byte [rbp - 0x6f], 1
mov rax, rdi
nop word [rax + rax]
xor byte [rbp + rax - 0x79], al
inc rax
cmp rax, 9
jb 0x140015c10
mov byte [rbp - 0x6f], 0
mov qword [rbp - 1], 9
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rbp - 0x79]
movsd qword [rbp - 0x11], xmm0
movzx eax, byte [rbp - 0x71]
mov byte [rbp - 9], al
mov byte [rbp - 8], 0
mov dword [rbp - 0x69], 0xffc0
cmp byte [r13], 0
jne 0x140015c62
mov byte [r13], 1
call fcn.140008940
mov qword [r13 + 8], rax
cmp byte [r13], 1
jne 0x140015c78
lea rdx, [rbp - 0x11]
mov rcx, qword [r13 + 8]
call fcn.14000dc20
jmp 0x140015c7c
mov rax, qword [rbp - 0x19]
cmp byte [rax], 3
jne 0x140015c87
mov r8, qword [rax + 8]
jmp 0x140015c8a
mov r8, rdi
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x140015c97
mov rdx, qword [r8]
lea rcx, [rbx + 0x1c0]
mov r8, qword [r8 + 0x10]
call fcn.14000efd0
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140015ce6
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015ce1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140015ce1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
lea rdx, str.subscriptions
mov rcx, r13
call fcn.140006240
mov r9, rax
mov qword [rbp - 0x79], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
movabs r12, 0x8000000000000000
mov rsi, r12
movzx edx, byte [rax]
mov r8d, edx
mov r10d, 1
sub r8d, r10d
je 0x140015d5c
cmp r8d, r10d
je 0x140015d4f
test edx, edx
je 0x140015d46
sub edx, r10d
je 0x140015d5c
cmp edx, r10d
je 0x140015d4f
mov rsi, rdi
mov rbx, qword [rbp - 9]
jmp 0x140015d66
mov rsi, r10
mov rbx, qword [rbp - 9]
jmp 0x140015d66
mov rdi, qword [rax + 8]
mov rdi, qword [rdi]
mov rbx, qword [rbp - 9]
jmp 0x140015d6a
mov rax, qword [rax + 8]
mov rbx, qword [rax]
mov rbx, qword [rbx]
mov rdi, qword [rbp - 1]
movdqu xmmword [rbp - 9], xmm0
movdqu xmmword [rbp - 1], xmm1
movzx ecx, byte [r9]
mov edx, ecx
sub edx, r10d
je 0x140015da5
cmp edx, r10d
je 0x140015d97
sub ecx, r10d
je 0x140015da5
cmp ecx, r10d
je 0x140015d97
mov r12, r10
mov r15, qword [rbp - 9]
jmp 0x140015dac
mov r14, qword [r9 + 8]
mov r14, qword [r14 + 8]
mov r15, qword [rbp - 9]
jmp 0x140015db0
mov r15, qword [r9 + 8]
mov r15, qword [r15]
mov r14, qword [rbp - 1]
movzx ecx, byte [r9]
mov edx, ecx
sub edx, 1
je 0x140015dca
cmp edx, 1
je 0x140015dc5
cmp rsi, r12
jmp 0x140015dcd
cmp rdi, r14
jmp 0x140015dcd
cmp rbx, r15
sete al
test al, al
jne 0x140015f8b
test ecx, ecx
je 0x140015df1
sub ecx, 1
je 0x140015deb
cmp ecx, 1
jne 0x140015df1
mov rax, rdi
jmp 0x140015dfc
lea rax, [rbx + 0x40]
jmp 0x140015dfc
mov rax, qword [rbp - 0x51]
test rsi, rsi
cmove rax, r9
mov qword [rbp - 0x51], rax
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.14000c860
nop
lea rdx, str.subscription
lea rcx, [rbp + 0xf]
call fcn.140006240
nop
xor edx, edx
mov qword [rbp - 0x41], rdx
mov qword [rbp - 0x31], rdx
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x41], dl
mov ecx, dword [rbp - 0x69]
or ecx, 2
mov dword [rbp - 0x69], ecx
mov dword [rbp - 0x61], ecx
cmp byte [rax], 3
jne 0x140015e51
mov rdx, qword [rax + 8]
lea rax, [rbp - 0x41]
cmp rax, rdx
je 0x140015e6b
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140015e5f
mov rdx, qword [rdx]
lea rcx, [rbp - 0x41]
call fcn.14000efd0
mov ecx, dword [rbp - 0x69]
and ecx, 0xfffffffd
or ecx, 1
mov dword [rbp - 0x69], ecx
mov rax, qword [rbp - 0x21]
mov rdx, qword [rax + 0x1e8]
cmp rdx, qword [rax + 0x1f0]
je 0x140015eaa
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x31]
movups xmmword [rdx + 0x10], xmm1
mov edx, reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x41], 0
add qword [rax + 0x1e8], 0x20
jmp 0x140015ebe
lea r8, [rbp - 0x41]
lea rcx, [rax + 0x1e0]
call fcn.140007e70
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x140015ef6
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015ef0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015f84
call fcn.1400691fc
nop
movzx edx, byte [rbp + 0xf]
lea rcx, [rbp + 0x17]
call fcn.1400101e0
mov r9, qword [rbp - 0x79]
movzx ecx, byte [r9]
sub ecx, 1
je 0x140015f26
cmp ecx, 1
je 0x140015f1d
inc rsi
jmp 0x140015db0
add rdi, 0x10
jmp 0x140015db0
mov rax, rbx
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
je 0x140015f5d
mov rbx, qword [rax + 8]
cmp byte [rbx + 0x19], 0
jne 0x140015db0
cmp rax, qword [rbx + 0x10]
jne 0x140015db0
mov rax, rbx
mov rbx, qword [rbx + 8]
cmp byte [rbx + 0x19], 0
je 0x140015f41
jmp 0x140015db0
mov rcx, qword [rbx]
cmp byte [rcx + 0x19], 0
jne 0x140015db0
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140015f70
jmp 0x140015db0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dword [rbp - 0x51], 0x70607473
mov dword [rbp - 0x4d], 0x776f7767
mov dword [rbp - 0x49], 0x6565607c
mov word [rbp - 0x45], 0x7f
mov byte [rbp - 0x43], 1
xor r14d, r14d
mov eax, r14d
xor byte [rbp + rax - 0x51], al
inc rax
cmp rax, 0xd
jb 0x140015fb0
mov byte [rbp - 0x43], r14b
mov qword [rbp - 1], reloc.WS2_32.dll_listen
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rbp - 0x51]
movsd qword [rbp - 0x11], xmm0
mov eax, dword [rbp - 0x49]
mov dword [rbp - 9], eax
movzx eax, byte [rbp - 0x45]
mov byte [rbp - 5], al
mov byte [rbp - 4], r14b
mov rsi, qword [rbp - 0x19]
cmp byte [r13], 0
jne 0x140016005
mov byte [r13], 1
call fcn.140008940
mov qword [r13 + 8], rax
cmp byte [r13], 1
jne 0x14001601c
lea rdx, [rbp - 0x11]
mov rcx, qword [r13 + 8]
call fcn.14000dc20
mov rsi, rax
mov rbx, qword [rbp - 0x19]
cmp byte [rsi], 0
jne 0x140016041
mov byte [rsi], 2
mov ecx, Ordinal_27
call fcn.1400693e0
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov qword [rsi + 8], rax
cmp byte [rsi], 2
jne 0x1400160ae
mov rbx, qword [rsi + 8]
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
sar rax, 4
test rax, rax
jne 0x1400160a7
mov byte [rbp + 0xf], al
xor edx, edx
lea rcx, [rbp + 0x17]
call fcn.14000cfb0
nop
mov rax, qword [rsi + 8]
mov r8, qword [rax + 8]
mov rdx, r8
sub rdx, qword [rax]
sar rdx, 4
mov r9d, 1
sub r9, rdx
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x79]
mov rcx, rbx
call fcn.1400140f0
nop
movzx edx, byte [rbp + 0xf]
lea rcx, [rbp + 0x17]
call fcn.1400101e0
mov rax, qword [rsi + 8]
mov rbx, qword [rax]
mov dword [rbp - 0x61], 0x6a727965
mov dword [rbp - 0x5d], 0x1007c76
mov rax, r14
nop
xor byte [rbp + rax - 0x61], al
inc rax
cmp rax, 6
jb 0x1400160c0
mov byte [rbp - 0x5a], 0
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x31], 6
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
mov eax, dword [rbp - 0x61]
mov dword [rbp - 0x41], eax
movzx eax, word [rbp - 0x5d]
mov word [rbp - 0x3d], ax
mov byte [rbp - 0x3b], 0
cmp byte [rbx], 0
jne 0x140016108
mov byte [rbx], 1
call fcn.140008940
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x14001611c
lea rdx, [rbp - 0x41]
mov rcx, qword [rbx + 8]
call fcn.14000dc20
jmp 0x140016120
mov rax, qword [rbp - 0x19]
cmp byte [rax], 3
jne 0x14001612b
mov r8, qword [rax + 8]
jmp 0x14001612e
mov r8, r14
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x14001613b
mov rdx, qword [r8]
mov rcx, qword [rbp - 0x21]
add rcx, 0x1f8
mov r8, qword [r8 + 0x10]
call fcn.14000efd0
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x14001618e
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016189
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140016189
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x29], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x41], 0
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x1400161dd
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400161d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400161d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400691fc
nop
lea rcx, [r13 + 8]
movzx edx, byte [r13]
call fcn.1400101e0
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400692f0
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret