Function at 0x140030d40
Capabilities:
Contain obfuscated stackstrings
Create new key via cryptacquirecontext
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov r14, rcx
mov rax, qword [0x1400503c8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x28], 0
lea r8, [rsp + 0x29]
mov byte [rsp + 0x29], WSACleanup
mov byte [rsp + 0x2a], 0x4d
mov byte [rsp + 0x2b], 0x5e
mov byte [rsp + 0x2c], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x2d], 0x3c
mov byte [rsp + 0x2e], 0x5b
mov byte [rsp + 0x2f], 0x3c
mov byte [rsp + 0x30], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x31], 0x43
mov byte [rsp + 0x32], gethostbyname
mov byte [rsp + 0x33], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0x34], 0x54
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x36], 0xf
mov byte [rsp + 0x37], 0x54
mov byte [rsp + 0x38], 0x5e
mov byte [rsp + 0x39], 0x2e
mov byte [rsp + 0x3a], 0x46
mov byte [rsp + 0x3b], gethostbyname
mov byte [rsp + 0x3c], 0x79
mov byte [rsp + 0x3d], 0x61
mov byte [rsp + 0x3e], reloc.WS2_32.dll_setsockopt
mov byte [rsp + 0x3f], gethostbyname
mov byte [rsp + 0x40], 0xf
mov byte [rsp + 0x41], 0x54
mov byte [rsp + 0x42], 0x46
mov byte [rsp + 0x43], gethostbyname
mov byte [rsp + 0x44], reloc.WS2_32.dll_setsockopt
mov byte [rsp + 0x45], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0x46], 0x61
mov byte [rsp + 0x47], gethostbyname
mov byte [rsp + 0x48], 0x64
mov byte [rsp + 0x49], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x4a], 0x4a
mov byte [rsp + 0x4b], 0x24
mov byte [rsp + 0x4c], 0x43
mov byte [rsp + 0x4d], 0x3c
mov byte [rsp + 0x4e], 0x7d
mov byte [rsp + 0x4f], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x50], 0xf
mov byte [rsp + 0x51], 0x24
mov byte [rsp + 0x52], 0x65
mov byte [rsp + 0x53], 0x4d
mov byte [rsp + 0x54], 0x5e
mov byte [rsp + 0x55], gethostbyname
mov byte [rsp + 0x56], 0x2a
mov byte [rsp + 0x57], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x58], 0x3c
mov byte [rsp + 0x59], shutdown
mov byte [rsp + 0x5a], 0x4d
mov byte [rsp + 0x5b], 0x46
mov byte [rsp + 0x5c], 0x2e
mov byte [rsp + 0x5d], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x5e], reloc.WS2_32.dll_gethostname
mov al, byte [rsp + 0x28]
test al, 1
jne 0x140030ef8
mov esi, 1
movzx ecx, byte [rsp + rsi + 0x28]
movzx ecx, cl
lea edx, [rcx + rcx*8]
lea edi, [rcx + rdx*4]
lea ecx, [rcx + rdx*4]
add ecx, 0xfffff7c3
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edi
add ecx, 0xfffff7c3
movzx ecx, cx
mov edx, ecx
shr edx, 0xf
shr ecx, 6
add ecx, edx
mov edx, ecx
shl edx, 7
sub ecx, edx
add ecx, edi
add ecx, 0xfffff7c3
add cl, 0x7f
movzx ecx, cl
lea edx, [rcx + rcx*2]
shr edx, 8
mov eax, ecx
sub al, dl
shr al, 1
add al, dl
shr al, 6
movzx eax, al
mov edx, eax
shl edx, 7
sub edx, eax
sub cl, dl
mov byte [rsp + rsi + 0x28], cl
add rsi, 1
cmp rsi, 0x37
jne 0x140030e80
mov dword [rsp + 0x20], 0xf0000000
mov rcx, r14
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov edi, 1
test eax, eax
jne 0x1400314ca
mov byte [rsp + 0x28], 0
lea r8, [rsp + 0x29]
mov byte [rsp + 0x29], 0x75
mov byte [rsp + 0x2a], 0x45
mov byte [rsp + 0x2b], 0x2b
mov byte [rsp + 0x2c], WSAGetLastError
mov byte [rsp + 0x2d], 0x5f
mov byte [rsp + 0x2e], 0x46
mov byte [rsp + 0x2f], 0x5f
mov byte [rsp + 0x30], gethostname
mov byte [rsp + 0x31], 0x20
mov byte [rsp + 0x32], gethostbyname
mov byte [rsp + 0x33], 0x28
mov byte [rsp + 0x34], 6
mov byte [rsp + 0x35], WSAGetLastError
mov byte [rsp + 0x36], 0x77
mov byte [rsp + 0x37], 6
mov byte [rsp + 0x38], 0x2b
mov byte [rsp + 0x39], 0x5e
mov byte [rsp + 0x3a], 5
mov byte [rsp + 0x3b], gethostbyname
mov byte [rsp + 0x3c], gethostname
mov byte [rsp + 0x3d], 0x10
mov byte [rsp + 0x3e], 0x41
mov byte [rsp + 0x3f], gethostbyname
mov byte [rsp + 0x40], 0x77
mov byte [rsp + 0x41], 6
mov byte [rsp + 0x42], 5
mov byte [rsp + 0x43], gethostbyname
mov byte [rsp + 0x44], 0x41
mov byte [rsp + 0x45], 0x28
mov byte [rsp + 0x46], 0x10
mov byte [rsp + 0x47], gethostbyname
mov byte [rsp + 0x48], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x49], WSAGetLastError
mov byte [rsp + 0x4a], 0x60
mov byte [rsp + 0x4b], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x4c], 0x20
mov byte [rsp + 0x4d], 0x5f
mov byte [rsp + 0x4e], shutdown
mov byte [rsp + 0x4f], WSAGetLastError
mov byte [rsp + 0x50], 0x77
mov byte [rsp + 0x51], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x52], WSAGetLastError
mov byte [rsp + 0x53], 0x45
mov byte [rsp + 0x54], 0x2b
mov byte [rsp + 0x55], gethostbyname
mov byte [rsp + 0x56], 3
mov byte [rsp + 0x57], WSAGetLastError
mov byte [rsp + 0x58], 0x5f
mov byte [rsp + 0x59], 0x53
mov byte [rsp + 0x5a], 0x45
mov byte [rsp + 0x5b], 5
mov byte [rsp + 0x5c], 0x5e
mov byte [rsp + 0x5d], WSAGetLastError
mov byte [rsp + 0x5e], 0x7a
mov al, byte [rsp + 0x28]
test al, 1
jne 0x1400310c7
mov eax, 1
nop word [rax + rax]
movzx ecx, byte [rsp + rax + 0x28]
movzx ecx, cl
lea ecx, [rcx + rcx*4]
lea edx, [rcx + rcx]
add edx, 0xfffffb3c
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
lea edx, [rdx + rcx*2]
add edx, 0xfffffb3c
movzx edx, dx
mov esi, edx
shr esi, 0xf
shr edx, 6
add edx, esi
mov esi, edx
shl esi, 7
sub edx, esi
lea ecx, [rdx + rcx*2]
add ecx, 0xfffffb3c
add cl, 0x7f
movzx ecx, cl
lea edx, [rcx + rcx*2]
shr edx, 8
mov ebx, ecx
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebx, bl
mov edx, ebx
shl edx, 7
sub edx, ebx
sub cl, dl
mov byte [rsp + rax + 0x28], cl
add rax, 1
cmp rax, 0x37
jne 0x140031050
mov dword [rsp + 0x20], 0xf0000008
mov rcx, r14
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400314ca
mov byte [rsp + 0x28], 0
lea r8, [rsp + 0x29]
mov byte [rsp + 0x29], 0x1d
mov byte [rsp + 0x2a], 0x22
mov byte [rsp + 0x2b], 0x2a
mov byte [rsp + 0x2c], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x2d], 0x1a
mov byte [rsp + 0x2e], 0x3f
mov byte [rsp + 0x2f], 0x1a
mov byte [rsp + 0x30], 0x26
mov byte [rsp + 0x31], 0x68
mov byte [rsp + 0x32], 0x59
mov byte [rsp + 0x33], 0x52
mov byte [rsp + 0x34], WSACleanup
mov byte [rsp + 0x35], pe_nt_image_headers64
mov byte [rsp + 0x36], 0x57
mov byte [rsp + 0x37], WSACleanup
mov byte [rsp + 0x38], 0x2a
mov byte [rsp + 0x39], 0x7c
mov byte [rsp + 0x3a], 0x53
mov byte [rsp + 0x3b], 0x59
mov byte [rsp + 0x3c], WSAGetLastError
mov byte [rsp + 0x3d], reloc.WS2_32.dll_setsockopt
mov byte [rsp + 0x3e], 0x2d
mov byte [rsp + 0x3f], 0x59
mov byte [rsp + 0x40], 0x57
mov byte [rsp + 0x41], WSACleanup
mov byte [rsp + 0x42], 0x53
mov byte [rsp + 0x43], 0x59
mov byte [rsp + 0x44], 0x2d
mov byte [rsp + 0x45], 0x52
mov byte [rsp + 0x46], reloc.WS2_32.dll_setsockopt
mov byte [rsp + 0x47], 0x59
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x49], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x4a], gethostname
mov byte [rsp + 0x4b], 0x43
mov byte [rsp + 0x4c], 0x68
mov byte [rsp + 0x4d], 0x1a
mov byte [rsp + 0x4e], 0x4f
mov byte [rsp + 0x4f], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x50], 0x57
mov byte [rsp + 0x51], 0x43
mov byte [rsp + 0x52], pe_nt_image_headers64
mov byte [rsp + 0x53], 0x22
mov byte [rsp + 0x54], 0x2a
mov byte [rsp + 0x55], 0x59
mov byte [rsp + 0x56], 0x19
mov byte [rsp + 0x57], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x58], 0x1a
mov byte [rsp + 0x59], 0x3b
mov byte [rsp + 0x5a], 0x22
mov byte [rsp + 0x5b], 0x53
mov byte [rsp + 0x5c], 0x7c
mov byte [rsp + 0x5d], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x5e], 0x59
mov byte [rsp + 0x5f], 0x24
mov byte [rsp + 0x60], 0x19
mov byte [rsp + 0x61], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x62], 0x1a
mov byte [rsp + 0x63], 0x68
mov byte [rsp + 0x64], 0x1a
mov byte [rsp + 0x65], 0x68
mov byte [rsp + 0x66], gethostname
mov byte [rsp + 0x67], 0x43
mov byte [rsp + 0x68], 0x7c
mov byte [rsp + 0x69], 0x4d
mov byte [rsp + 0x6a], 0x2f
mov al, byte [rsp + 0x28]
test al, 1
jne 0x1400312c8
mov eax, 1
nop dword [rax]
movzx ecx, byte [rsp + rax + 0x28]
movzx ecx, cl
mov edx, ecx
shl edx, 5
sub edx, ecx
mov ecx, edx
add ecx, 0xfffffa4f
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
add ecx, 0xfffffa4f
movzx ecx, cx
mov ebx, ecx
shr ebx, 0xf
shr ecx, 6
add ecx, ebx
mov ebx, ecx
shl ebx, 7
sub ecx, ebx
add ecx, edx
add ecx, 0xfffffa4f
add cl, 0x7f
movzx ecx, cl
lea edx, [rcx + rcx*2]
shr edx, 8
mov ebx, ecx
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebx, bl
mov edx, ebx
shl edx, 7
sub edx, ebx
sub cl, dl
mov byte [rsp + rax + 0x28], cl
add rax, 1
cmp rax, 0x43
jne 0x140031250
mov dword [rsp + 0x20], 0xf0000000
mov rcx, r14
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400314ca
mov byte [rsp + 0x28], 0
lea r8, [rsp + 0x29]
mov byte [rsp + 0x29], 0x41
mov byte [rsp + 0x2a], gethostname
mov byte [rsp + 0x2b], inet_ntoa
mov byte [rsp + 0x2c], gethostname
mov byte [rsp + 0x2d], 0x61
mov byte [rsp + 0x2e], 0x29
mov byte [rsp + 0x2f], 0x61
mov byte [rsp + 0x30], 0x60
mov byte [rsp + 0x31], 0x1b
mov byte [rsp + 0x32], 0x3c
mov byte [rsp + 0x33], gethostbyname
mov byte [rsp + 0x34], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x35], 0x44
mov byte [rsp + 0x36], 0x27
mov byte [rsp + 0x37], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x38], inet_ntoa
mov byte [rsp + 0x39], WSAGetLastError
mov byte [rsp + 0x3a], 0x7c
mov byte [rsp + 0x3b], 0x3c
mov byte [rsp + 0x3c], 0x7a
mov byte [rsp + 0x3d], WSAGetLastError
mov byte [rsp + 0x3e], 0x6a
mov byte [rsp + 0x3f], 0x3c
mov byte [rsp + 0x40], 0x27
mov byte [rsp + 0x41], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x42], 0x7c
mov byte [rsp + 0x43], 0x3c
mov byte [rsp + 0x44], 0x6a
mov byte [rsp + 0x45], gethostbyname
mov byte [rsp + 0x46], WSAGetLastError
mov byte [rsp + 0x47], 0x3c
mov byte [rsp + 0x48], 0x4e
mov byte [rsp + 0x49], gethostname
mov byte [rsp + 0x4a], 0x54
mov byte [rsp + 0x4b], 0x53
mov byte [rsp + 0x4c], 0x1b
mov byte [rsp + 0x4d], 0x61
mov byte [rsp + 0x4e], 0x52
mov byte [rsp + 0x4f], gethostname
mov byte [rsp + 0x50], 0x27
mov byte [rsp + 0x51], 0x53
mov byte [rsp + 0x52], 0x44
mov byte [rsp + 0x53], gethostname
mov byte [rsp + 0x54], inet_ntoa
mov byte [rsp + 0x55], 0x3c
mov byte [rsp + 0x56], reloc.WS2_32.dll_socket
mov byte [rsp + 0x57], gethostname
mov byte [rsp + 0x58], 0x61
mov byte [rsp + 0x59], 0x7e
mov byte [rsp + 0x5a], gethostname
mov byte [rsp + 0x5b], 0x7c
mov byte [rsp + 0x5c], WSAGetLastError
mov byte [rsp + 0x5d], gethostname
mov byte [rsp + 0x5e], 0x3c
mov byte [rsp + 0x5f], 0x4b
mov byte [rsp + 0x60], reloc.WS2_32.dll_socket
mov byte [rsp + 0x61], gethostname
mov byte [rsp + 0x62], 0x61
mov byte [rsp + 0x63], 0x1b
mov byte [rsp + 0x64], 0x61
mov byte [rsp + 0x65], 0x1b
mov byte [rsp + 0x66], 0x54
mov byte [rsp + 0x67], 0x53
mov byte [rsp + 0x68], WSAGetLastError
mov byte [rsp + 0x69], 0x3d
mov byte [rsp + 0x6a], 0
mov al, byte [rsp + 0x28]
test al, 1
jne 0x1400314af
mov eax, 1
nop word [rax + rax]
movzx ecx, byte [rsp + rax + 0x28]
movzx ecx, cl
lea ebx, [rcx + rcx*8]
movzx edx, bx
imul edx, edx, 0x205
shr edx, 0x10
mov ecx, ebx
sub ecx, edx
movzx ecx, cx
shr ecx, 1
add ecx, edx
shr ecx, 6
mov edx, ecx
shl edx, 7
sub ecx, edx
add ecx, ebx
add cl, 0x7f
movzx ecx, cl
lea edx, [rcx + rcx*2]
shr edx, 8
mov ebx, ecx
sub bl, dl
shr bl, 1
add bl, dl
shr bl, 6
movzx ebx, bl
mov edx, ebx
shl edx, 7
sub edx, ebx
sub cl, dl
mov byte [rsp + rax + 0x28], cl
add rax, 1
cmp rax, 0x43
jne 0x140031450
mov dword [rsp + 0x20], 0xf0000008
mov rcx, r14
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov edi, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140031ee0
mov eax, edi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret