Function at 0x14002d3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
xor r12b, r12b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor r13d, r13d
mov qword [rsp + 0x40], r13
lea edx, [r13 + 1]
lea rcx, [rsp + 0x30]
call fcn.140031740
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14002d3f7
mov dword [rdi], r13d
add rdi, 4
mov qword [rsp + 0x38], rdi
mov dword [rbp + 0x60], 0x200
lea rax, [rbp + 0x60]
mov r14, qword [rsp + 0x30]
cmp rax, rdi
jae 0x14002d4cd
lea rax, [rbp + 0x60]
cmp r14, rax
ja 0x14002d4cd
lea rbx, [rbp + 0x60]
sub rbx, r14
sar rbx, 2
movabs r15, 0x3fffffffffffffff
mov rsi, qword [rsp + 0x40]
cmp rdi, rsi
jne 0x14002d4b9
mov rax, rsi
sub rax, rdi
sar rax, 2
cmp rax, 1
jae 0x14002d4b9
sub rdi, r14
sar rdi, 2
mov rax, r15
sub rax, rdi
cmp rax, 1
jae 0x14002d475
lea rcx, str.vector_T__too_long
call fcn.14007e074
int3
lea rdx, [rdi + 1]
sub rsi, r14
sar rsi, 2
mov rax, rsi
shr rax, 1
mov rcx, r15
sub rcx, rax
add rax, rsi
mov r8, r13
cmp rcx, rsi
cmovae r8, rax
cmp r8, rdx
cmovae rdx, r8
lea rcx, [rsp + 0x30]
call fcn.140031740
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
test rdi, rdi
je 0x14002d560
mov eax, dword [r14 + rbx*4]
mov dword [rdi], eax
jmp 0x14002d560
movabs r15, 0x3fffffffffffffff
mov rsi, qword [rsp + 0x40]
cmp rdi, rsi
jne 0x14002d555
mov rax, rsi
sub rax, rdi
sar rax, 2
cmp rax, 1
jae 0x14002d555
sub rdi, r14
sar rdi, 2
mov rax, r15
sub rax, rdi
cmp rax, 1
jae 0x14002d511
lea rcx, str.vector_T__too_long
call fcn.14007e074
int3
lea rdx, [rdi + 1]
sub rsi, r14
sar rsi, 2
mov rax, rsi
shr rax, 1
mov rcx, r15
sub rcx, rax
add rax, rsi
mov r8, r13
cmp rcx, rsi
cmovae r8, rax
cmp r8, rdx
cmovae rdx, r8
lea rcx, [rsp + 0x30]
call fcn.140031740
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
test rdi, rdi
je 0x14002d560
mov dword [rdi], 0x200
add rdi, 4
mov dword [rsp + 0x76], 0x45004e
mov dword [rbp - 0x68], 0x700075
mov dword [rbp - 0x60], 0x500044
mov dword [rsp + 0x6a], 0x73006f
mov dword [rbp - 0x6e], 0x650053
mov dword [rbp - 0x7c], 0x65006d
mov dword [rsp + 0x5e], 0x5c0065
mov dword [rbp - 0x80], 0x610072
mov dword [rsp + 0x50], 0x6f0053
mov dword [rsp + 0x6e], 0x66006f
mov dword [rsp + 0x72], 0x5c0074
mov dword [rbp - 0x78], 0x6f0077
mov dword [rbp - 0x64], 0x4e005c
mov dword [rsp + 0x7c], 0x460020
mov dword [rsp + 0x54], 0x740066
mov dword [rsp + 0x64], 0x630069
mov dword [rbp - 0x5c], 0x76005c
mov dword [rbp - 0x72], 0x20006b
mov r11d, Ordinal_79
mov word [rsp + 0x62], r11w
mov ecx, 0x54
mov word [rsp + 0x7a], cx
mov dword [rbp - 0x58], gethostname
mov dword [rsp + 0x58], 0x610077
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rbp - 0x6a], ax
mov r13d, WSACleanup
mov word [rbp - 0x74], r13w
mov word [rsp + 0x5c], r13w
mov word [rsp + 0x68], r13w
mov dword [rbp - 0x34], 0x6f0073
mov dword [rbp - 0x26], 0x200054
mov dword [rbp - 0x40], 0x4d005c
mov dword [rbp - 0x4c], 0x740066
mov dword [rbp - 0x22], 0x720046
mov dword [rbp + 6], 0x340076
mov dword [rbp + 0xc], Ordinal_50
mov dword [rbp - 0x1e], 0x6d0061
mov dword [rbp - 0x50], 0x6f0053
mov dword [rbp - 8], 0x700075
mov dword [rbp - 0x2a], 0x45004e
mov dword [rbp - 0x38], 0x6f0072
mov dword [rbp - 0x48], 0x610077
mov dword [rbp - 2], 0x44004e
lea r13d, [r11 + 0x18]
mov dword [rbp - 0xc], 0x740065
lea edx, [rcx + 8]
mov dword [rbp - 0x2e], 0x5c0074
mov dword [rbp - 0x3c], 0x630069
mov dword [rbp - 0x12], 0x20006b
mov eax, reloc.WLDAP32.dll_Ordinal_46
mov word [rbp + 0xa], ax
lea r10d, [r11 + 0x25]
mov dword [rbp + 2], 0x5c0050
mov dword [rbp - 0x18], 0x6f0077
mov eax, 0x66
mov word [rbp - 0x30], ax
mov word [rbp - 4], dx
mov eax, 0x53
mov word [rbp - 0xe], ax
mov dword [rbp - 0x44], 0x650072
mov word [rbp - 0x14], r10w
mov word [rbp - 0x1a], r13w
mov rbx, r14
cmp r14, rdi
je 0x14002d76a
nop
mov r9d, dword [rbx]
or r9d, 1
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14002d75c
mov r9d, dword [rbx]
or r9d, 1
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14002d75c
add rbx, 4
cmp rbx, rdi
jne 0x14002d700
jmp 0x14002d76a
mov r12b, 1
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test r14, r14
je 0x14002d7d2
sub rsi, r14
sar rsi, 2
cmp rsi, r15
jbe 0x14002d781
call fcn.1400e462c
int3
lea rax, [rsi*4]
cmp rax, 0x1000
jb 0x14002d7ca
test r14b, 0x1f
je 0x14002d79d
call fcn.1400e462c
int3
mov rax, qword [r14 - 8]
cmp rax, r14
jb 0x14002d7ac
call fcn.1400e462c
int3
sub r14, rax
cmp r14, 8
jae 0x14002d7bb
call fcn.1400e462c
int3
cmp r14, 0x27
jbe 0x14002d7c7
call fcn.1400e462c
int3
mov r14, rax
mov rcx, r14
call fcn.14007b800
movzx eax, r12b
mov rbx, qword [rsp + 0x170]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret