Function at 0x1800478c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push r15
mov eax, 0x1298
call fcn.1801003d0
sub rsp, rax
mov rax, qword [0x18015f460]
xor rax, rsp
mov qword [rsp + 0x1270], rax
mov r15, qword [rsp + 0x12e0]
mov r9, qword [rsp + 0x12e8]
xor eax, eax
movsxd rbp, edx
mov rsi, rcx
mov byte [rsp + 0x1f0], 0
cmp ebp, 0x40
mov qword [rsp + 0x1f1], rax
mov qword [rsp + 0x1f9], rax
mov qword [rsp + 0x201], rax
mov qword [rsp + 0x209], rax
mov qword [rsp + 0x211], rax
mov qword [rsp + 0x219], rax
mov qword [rsp + 0x221], rax
mov qword [rsp + 0x229], rax
jge 0x180047954
mov eax, 0x113
jmp 0x180047a4f
mov rax, qword [rsi]
lea rcx, [rsp + 0x1f0]
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov qword [rcx + 8], rax
mov rax, qword [rsi + 0x10]
mov qword [rcx + 0x10], rax
mov rax, qword [rsi + 0x18]
mov qword [rcx + 0x18], rax
mov rax, qword [rsi + 0x20]
mov qword [rcx + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rcx + 0x28], rax
mov rax, qword [rsi + 0x30]
mov qword [rcx + 0x30], rax
mov rax, qword [rsi + 0x38]
mov qword [rcx + 0x38], rax
lea rax, [rsp + 0x1f0]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800479c3
inc rax
test ecx, ecx
jne 0x1800479b0
test edx, edx
jne 0x18004794a
mov rbx, rbp
cmp rbp, 0x44
jb 0x18004794a
cmp rbx, 0x48
jb 0x18004794a
movzx eax, byte [rsi + 0x45]
movzx edx, byte [rsi + 0x44]
mov qword [rsp + 0x12d0], rdi
shl edx, 8
add edx, eax
movzx eax, byte [rsi + 0x46]
shl edx, 8
add edx, eax
movzx eax, byte [rsi + 0x47]
shl edx, 8
add edx, eax
js 0x180047e44
lea edi, [rdx + 0x48]
cmp edi, ebp
jg 0x180047e44
movsxd r8, edx
lea rdx, [rsi + 0x48]
mov rcx, r9
mov qword [rsp + 0x1290], r12
call fcn.180002db0
movsxd r12, edi
lea rax, [r12 + 0x20]
cmp rax, rbx
jbe 0x180047a6c
mov eax, 0x113
mov r12, qword [rsp + 0x1290]
mov rdi, qword [rsp + 0x12d0]
mov rcx, qword [rsp + 0x1270]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x1298
pop r15
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [r12 + rsi]
add edi, 0x10
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x1280], r14
mov byte [rsp + 0x1d0], 0xb0
mov qword [rcx], rax
mov rax, qword [r12 + rsi + 8]
mov qword [rcx + 8], rax
movsxd rcx, edi
add edi, 0x10
mov rax, qword [rcx + rsi]
movsxd r14, edi
sub ebp, edi
mov qword [rdx], rax
mov rax, qword [rcx + rsi + 8]
mov edi, 0x1a0
mov qword [rdx + 8], rax
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x1d1], rax
mov qword [rsp + 0x1d9], rax
mov qword [rsp + 0x1e1], rax
mov dword [rsp + 0x1e9], eax
mov word [rsp + 0x1ed], ax
mov byte [rsp + 0x1ef], al
mov r8, rdi
xor edx, edx
mov byte [rsp + 0x1d1], 0xa8
mov byte [rsp + 0x1d2], 0xfb
mov byte [rsp + 0x1d3], Ordinal_211
mov byte [rsp + 0x1d4], 0x5a
mov byte [rsp + 0x1d5], 0xf8
mov byte [rsp + 0x1d6], reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0x1d7], 0xcb
mov byte [rsp + 0x1d8], 0xec
mov byte [rsp + 0x1d9], Ordinal_79
mov byte [rsp + 0x1da], Ordinal_200
mov byte [rsp + 0x1db], Ordinal_27
mov byte [rsp + 0x1dc], __WSAFDIsSet
mov byte [rsp + 0x1dd], 0x99
mov byte [rsp + 0x1de], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x1df], 0x85
mov byte [rsp + 0x1e0], 0x9d
mov byte [rsp + 0x1e1], __WSAFDIsSet
mov byte [rsp + 0x1e2], WSAGetLastError
mov byte [rsp + 0x1e3], 0x60
mov byte [rsp + 0x1e4], Ordinal_211
mov byte [rsp + 0x1e5], reloc.WS2_32.dll_select
mov byte [rsp + 0x1e6], Ordinal_45
mov byte [rsp + 0x1e7], Ordinal_143
mov byte [rsp + 0x1e8], __WSAFDIsSet
mov byte [rsp + 0x1e9], Ordinal_35
mov byte [rsp + 0x1ea], 0x79
mov byte [rsp + 0x1eb], 0x46
mov byte [rsp + 0x1ec], reloc.WLDAP32.dll_Ordinal_35
mov byte [rsp + 0x1ed], 0x99
mov byte [rsp + 0x1ee], gethostname
mov byte [rsp + 0x1ef], 0x60
add r14, rsi
call fcn.1800cc600
lea r11, [rsp + 0x1d1]
mov eax, reloc.WS2_32.dll_recv
nop word [rax + rax]
xor byte [r11 - 1], 0x87
xor byte [r11], 0x87
add r11, 2
sub rax, 1
jne 0x180047c10
movzx ecx, byte [rsp + 0x1d1]
movzx eax, byte [rsp + 0x1d7]
mov ebx, 0x103
mov byte [rsp + 0x1d7], cl
movzx ecx, byte [rsp + 0x1d6]
mov byte [rsp + 0x1d1], al
movzx eax, byte [rsp + 0x1df]
mov byte [rsp + 0x1df], cl
movzx ecx, byte [rsp + 0x1ef]
mov byte [rsp + 0x1d6], al
movzx eax, byte [rsp + 0x1d2]
mov byte [rsp + 0x1d2], cl
movzx ecx, byte [rsp + 0x1d3]
mov byte [rsp + 0x1ef], al
movzx eax, byte [rsp + 0x1dd]
mov byte [rsp + 0x1dd], cl
movzx ecx, byte [rsp + 0x1e1]
mov byte [rsp + 0x1d3], al
movzx eax, byte [rsp + 0x1d9]
mov byte [rsp + 0x1d9], cl
lea r9d, [rbx - 3]
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x1d0]
mov edx, 2
mov byte [rsp + 0x1e1], al
call fcn.180057850
test eax, eax
jne 0x180047def
mov qword [rsp + 0x1288], r13
lea r9d, [rax + 0x10]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x30]
movsxd r13, ebp
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
mov rbp, r13
call fcn.180057b00
test eax, eax
jne 0x180047de7
test r13, r13
je 0x180047d80
mov eax, 0x1000
nop word [rax + rax]
cmp rbp, rax
mov rsi, rbp
mov r12, r13
cmova rsi, rax
sub r12, rbp
lea r9, [rsp + 0x270]
add r12, r14
lea rcx, [rsp + 0x30]
mov rdx, rsi
mov r8, r12
call fcn.180057d80
test eax, eax
jne 0x180047de7
lea rdx, [rsp + 0x270]
mov r8, rsi
mov rcx, r12
call fcn.1800cbb10
sub rbp, rsi
mov eax, 0x1000
jne 0x180047d30
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
call fcn.180057f10
test eax, eax
jne 0x180047de7
lea rax, [rsp + 0x250]
lea rcx, [rsp + 0x240]
xor ebx, ebx
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x180047dc4
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x180047dc4
mov eax, ebx
jmp 0x180047dc9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x180047dd4
mov ebx, 0x113
jmp 0x180047de7
test r15, r15
je 0x180047de7
mov r8, r13
mov rdx, r14
mov rcx, r15
call fcn.180002db0
mov r13, qword [rsp + 0x1288]
mov rcx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x1280]
test rcx, rcx
je 0x180047e10
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x28]
call qword [rdx + 0x48]
mov eax, 0x58
lea rcx, [rsp + 0x30]
nop word [rax + rax]
mov byte [rcx], 0
inc rcx
sub rax, 1
jne 0x180047e20
lea rax, [rsp + 0x30]
mov byte [rax], 0
inc rax
sub rdi, 1
jne 0x180047e31
mov eax, ebx
jmp 0x180047a3f
mov eax, 0x113
jmp 0x180047a47