Function at 0x180065290
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x18029d790]
xor rax, rsp
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x60], rax
movdqa xmm0, xmmword [0x180272a10]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0x346a6b6d
mov word [rbp + 0x14], 0x3534
xor eax, eax
mov byte [rbp + 0x16], al
xor r12d, r12d
mov ecx, r12d
movzx eax, byte [rbp]
xor byte [rbp + rcx + 1], al
inc rcx
cmp rcx, 0x15
jb 0x1800652f0
mov byte [rbp + 0x16], r12b
lea rdx, [rbp + 1]
lea rcx, [rbp + 0x18]
call fcn.18000faf0
mov rbx, rax
movdqa xmm0, xmmword [0x180272390]
movdqu xmmword [rsp + 0x40], xmm0
xor eax, eax
mov byte [rsp + 0x50], al
mov rcx, r12
nop dword [rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
inc rcx
cmp rcx, 0xf
jb 0x180065330
mov byte [rsp + 0x50], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x40]
call fcn.18000faf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.180065f70
mov qword [0x180341580], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [str._bDH_plv_WSLF_z]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x1415
xor eax, eax
mov byte [rsp + 0x52], al
mov rcx, r12
nop
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
inc rcx
cmp rcx, 0x11
jb 0x180065390
mov byte [rsp + 0x52], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x40]
call fcn.18000faf0
mov r15, rax
mov byte [rsp + 0x30], reloc.WS2_32.dll_ntohs
mov cl, 0x6a
mov dl, 0x61
mov r8b, 0x68
mov r9b, 0x66
movzx r10d, dl
movzx r11d, cl
mov bl, 0x3d
mov dil, 0x21
mov al, 0x6b
mov sil, 0x63
movzx r14d, sil
xor r13d, r13d
xor cl, 0xf
mov byte [rsp + 0x31], cl
xor dl, 0xf
mov byte [rsp + 0x32], dl
xor r8b, 0xf
mov byte [rsp + 0x33], r8b
xor r9b, 0xf
mov byte [rsp + 0x34], r9b
xor r10b, 0xf
mov byte [rsp + 0x35], r10b
xor r11b, 0xf
mov byte [rsp + 0x36], r11b
xor bl, 0xf
mov byte [rsp + 0x37], bl
xor dil, 0xf
mov byte [rsp + 0x38], dil
xor al, 0xf
mov byte [rsp + 0x39], al
xor sil, 0xf
mov byte [rsp + 0x3a], sil
xor r14b, 0xf
mov byte [rsp + 0x3b], r14b
mov byte [rsp + 0x3c], r13b
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x18]
call fcn.18000faf0
nop
mov rdx, r15
mov rcx, rax
call fcn.180065f70
mov qword [0x180337010], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x1802718b0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x15131906
mov dword [rsp + 0x54], 0x15191c33
mov dword [rsp + 0x58], 0x4026041e
mov word [rsp + 0x5c], 0x4140
xor eax, eax
mov byte [rsp + 0x5e], al
mov rcx, r12
nop
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
inc rcx
cmp rcx, 0x1d
jb 0x1800654a0
mov byte [rsp + 0x5e], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x40]
call fcn.18000faf0
mov r15, rax
mov byte [rsp + 0x30], 0x21
mov cl, 0x44
mov dl, 0x4f
mov r8b, 0x46
mov r9b, 0x48
movzx r10d, dl
movzx r11d, cl
mov bl, reloc.WS2_32.dll_send
mov dil, reloc.WS2_32.dll_ntohs
mov al, 0x45
mov sil, 0x4d
movzx r14d, sil
xor r13d, r13d
xor cl, 0x21
mov byte [rsp + 0x31], cl
xor dl, 0x21
mov byte [rsp + 0x32], dl
xor r8b, 0x21
mov byte [rsp + 0x33], r8b
xor r9b, 0x21
mov byte [rsp + 0x34], r9b
xor r10b, 0x21
mov byte [rsp + 0x35], r10b
xor r11b, 0x21
mov byte [rsp + 0x36], r11b
xor bl, 0x21
mov byte [rsp + 0x37], bl
xor dil, 0x21
mov byte [rsp + 0x38], dil
xor al, 0x21
mov byte [rsp + 0x39], al
xor sil, 0x21
mov byte [rsp + 0x3a], sil
xor r14b, 0x21
mov byte [rsp + 0x3b], r14b
mov byte [rsp + 0x3c], r13b
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x18]
call fcn.18000faf0
nop
mov rdx, r15
mov rcx, rax
call fcn.180065f70
mov qword [0x180341620], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x180272860]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x6f636649
mov dword [rsp + 0x54], 0x3a3a7e64
mov word [rsp + 0x58], 0x3b
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
inc rcx
cmp rcx, 0x18
jb 0x1800655b0
mov byte [rsp + 0x59], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x40]
call fcn.18000faf0
mov r15, rax
mov byte [rsp + 0x30], 0x7b
mov cl, 0x1e
mov dl, reloc.WS2_32.dll_setsockopt
mov r8b, 0x1c
mov r9b, reloc.WS2_32.dll_select
movzx r10d, dl
movzx r11d, cl
mov bl, 0x49
mov dil, 0x55
mov al, 0x1f
mov sil, reloc.WS2_32.dll_socket
movzx r14d, sil
xor r13d, r13d
xor cl, 0x7b
mov byte [rsp + 0x31], cl
xor dl, 0x7b
mov byte [rsp + 0x32], dl
xor r8b, 0x7b
mov byte [rsp + 0x33], r8b
xor r9b, 0x7b
mov byte [rsp + 0x34], r9b
xor r10b, 0x7b
mov byte [rsp + 0x35], r10b
xor r11b, 0x7b
mov byte [rsp + 0x36], r11b
xor bl, 0x7b
mov byte [rsp + 0x37], bl
xor dil, 0x7b
mov byte [rsp + 0x38], dil
xor al, 0x7b
mov byte [rsp + 0x39], al
xor sil, 0x7b
mov byte [rsp + 0x3a], sil
xor r14b, 0x7b
mov byte [rsp + 0x3b], r14b
mov byte [rsp + 0x3c], r13b
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x18]
call fcn.18000faf0
nop
mov rdx, r15
mov rcx, rax
call fcn.180065f70
mov qword [0x180337020], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x180271f20]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], gethostname
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
inc rcx
cmp rcx, 0x10
jb 0x1800656b0
mov byte [rsp + 0x51], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x40]
call fcn.18000faf0
mov r14, rax
mov byte [rsp + 0x30], 0x4d
mov cl, 0x2e
mov dl, 0x21
mov r8b, 0x24
mov r9b, 0x28
mov r10b, 0x23
mov r11b, reloc.WS2_32.dll_gethostname
mov bl, 0x63
mov dil, 0x29
movzx eax, dl
movzx esi, dl
xor r15d, r15d
xor cl, 0x4d
mov byte [rsp + 0x31], cl
xor dl, 0x4d
mov byte [rsp + 0x32], dl
xor r8b, 0x4d
mov byte [rsp + 0x33], r8b
xor r9b, 0x4d
mov byte [rsp + 0x34], r9b
xor r10b, 0x4d
mov byte [rsp + 0x35], r10b
xor r11b, 0x4d
mov byte [rsp + 0x36], r11b
xor bl, 0x4d
mov byte [rsp + 0x37], bl
xor dil, 0x4d
mov byte [rsp + 0x38], dil
xor al, 0x4d
mov byte [rsp + 0x39], al
xor sil, 0x4d
mov byte [rsp + 0x3a], sil
mov byte [rsp + 0x3b], r15b
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x18]
call fcn.18000faf0
nop
mov rdx, r14
mov rcx, rax
call fcn.180065f70
mov qword [0x180337008], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [str..MFKCOW_ZKCq]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x1f
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
inc rcx
cmp rcx, 0x10
jb 0x1800657a0
mov byte [rsp + 0x51], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x40]
call fcn.18000faf0
mov rbx, rax
movdqa xmm0, xmmword [0x1802719b0]
movdqu xmmword [rbp], xmm0
mov word [rbp + 0x10], reloc.WS2_32.dll_listen
mov rcx, r12
nop
movzx eax, byte [rbp]
xor byte [rbp + rcx + 1], al
inc rcx
cmp rcx, 0x10
jb 0x1800657e0
mov byte [rbp + 0x11], 0
lea rdx, [rbp + 1]
lea rcx, [rbp + 0x18]
call fcn.18000faf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.180065f70
mov qword [0x180341628], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x180271830]
movdqu xmmword [rbp], xmm0
mov rcx, r12
nop
movzx eax, byte [rbp]
xor byte [rbp + rcx + 1], al
inc rcx
cmp rcx, 0xe
jb 0x180065830
mov byte [rbp + 0xf], 0
lea rdx, [rbp + 1]
lea rcx, [rbp - 0x40]
call fcn.18000faf0
mov rsi, rax
mov byte [rsp + 0x30], 0x66
mov cl, reloc.WS2_32.dll_select
mov dl, reloc.WS2_32.dll_ntohs
mov r8b, 3
mov r9b, reloc.WS2_32.dll_sendto
mov r10b, 0x56
mov r11b, 0x48
mov bl, 2
mov dil, 0xa
movzx eax, dil
xor r14d, r14d
xor cl, 0x66
mov byte [rsp + 0x31], cl
xor dl, 0x66
mov byte [rsp + 0x32], dl
xor r8b, 0x66
mov byte [rsp + 0x33], r8b
xor r9b, 0x66
mov byte [rsp + 0x34], r9b
xor r10b, 0x66
mov byte [rsp + 0x35], r10b
xor r11b, 0x66
mov byte [rsp + 0x36], r11b
xor bl, 0x66
mov byte [rsp + 0x37], bl
xor dil, 0x66
mov byte [rsp + 0x38], dil
xor al, 0x66
mov byte [rsp + 0x39], al
mov byte [rsp + 0x3a], r14b
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x18]
call fcn.18000faf0
nop
mov rdx, rsi
mov rcx, rax
call fcn.180065f70
mov qword [0x180336df0], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x78], rax
mov cl, 0x26
mov dword [rsp + 0x30], 0x45496a26
mov dword [rsp + 0x34], 0x5c4f4a47
mov dword [rsp + 0x38], 0x16167943
mov word [rsp + 0x3c], reloc.WS2_32.dll_socket
mov rax, r12
xor byte [rsp + rax + 0x31], cl
inc rax
cmp rax, 0xc
jae 0x180065925
movzx ecx, byte [rsp + 0x30]
jmp 0x180065911
mov byte [rsp + 0x3d], 0
lea rdx, [rsp + 0x31]
lea rcx, [rbp - 0x40]
call fcn.18000faf0
mov rbx, rax
mov cl, reloc.WS2_32.dll_socket
mov dword [rsp + 0x68], 0x74787b17
mov dword [rsp + 0x6c], 0x6d7e7b76
mov dword [rsp + 0x70], 0x7b733972
mov word [rsp + 0x74], 0x7b
mov rax, r12
nop
xor byte [rsp + rax + 0x69], cl
inc rax
cmp rax, 0xc
jae 0x180065974
movzx ecx, byte [rsp + 0x68]
jmp 0x180065960
mov byte [rsp + 0x75], 0
lea rdx, [rsp + 0x69]
lea rcx, [rbp + 0x18]
call fcn.18000faf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.180065f70
mov qword [0x180336e18], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [0x180272640]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0xe0e610c
mov word [rbp + 0x14], reloc.WS2_32.dll_ntohs
mov rcx, r12
movzx eax, byte [rbp]
xor byte [rbp + rcx + 1], al
inc rcx
cmp rcx, 0x14
jb 0x1800659c0
mov byte [rbp + 0x15], 0
lea rdx, [rbp + 1]
lea rcx, [rbp - 0x40]
call fcn.18000faf0
mov rbx, rax
movdqa xmm0, xmmword [0x180272960]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x2e2e266c
xor eax, eax
mov byte [rsp + 0x54], al
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
inc rcx
cmp rcx, 0x13
jb 0x180065a10
mov byte [rsp + 0x54], 0
lea rdx, [rsp + 0x41]
lea rcx, [rbp + 0x18]
call fcn.18000faf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.180065f70
mov qword [0x180341588], rax
movdqa xmm0, xmmword [0x180272a70]
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x180272930]
movdqu xmmword [rbp - 0x70], xmm1
xor eax, eax
mov byte [rbp - 0x60], al
mov rcx, r12
nop word [rax + rax]
movzx eax, byte [rbp - 0x80]
xor byte [rbp + rcx - 0x7f], al
inc rcx
cmp rcx, 0x1f
jb 0x180065a70
mov byte [rbp - 0x60], 0
mov dword [rsp + 0x20], r12d
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rbp - 0x7f]
lea rcx, [0x180336790]
call fcn.180068750
movdqa xmm0, xmmword [0x180271c00]
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x180271970]
movdqu xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x180271980]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0xb140b14
mov dword [rbp - 0x4c], 0xb140b14
mov word [rbp - 0x48], 0x131f
xor eax, eax
mov byte [rbp - 0x46], al
mov rcx, r12
nop dword [rax + rax]
movzx eax, byte [rbp - 0x80]
xor byte [rbp + rcx - 0x7f], al
inc rcx
cmp rcx, 0x39
jb 0x180065af0
mov byte [rbp - 0x46], 0
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rbp - 0x7f]
lea rcx, [0x180336790]
call fcn.180068750
movsxd rcx, dword [rax]
add rcx, 4
add rax, rcx
mov qword [0x180336eb8], rax
movdqa xmm0, xmmword [0x1802726d0]
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x180272530]
movdqu xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x180272590]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x50], 0x49
mov rcx, r12
nop dword [rax]
movzx eax, byte [rbp - 0x80]
xor byte [rbp + rcx - 0x7f], al
movzx eax, byte [rbp - 0x80]
xor byte [rbp + rcx - 0x7e], al
add rcx, 2
cmp rcx, 0x30
jb 0x180065b70
mov byte [rbp - 0x4f], 0
mov dword [rsp + 0x20], 3
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rbp - 0x7f]
lea rcx, [0x180336790]
call fcn.180068750
movsxd rcx, dword [rax]
add rcx, 4
add rax, rcx
mov qword [0x180336ec0], rax
movdqa xmm0, xmmword [0x180271900]
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x180271b70]
movdqu xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x60], 0x1c051a05
mov word [rbp - 0x5c], reloc.WS2_32.dll_setsockopt
mov rcx, r12
nop
movzx eax, byte [rbp - 0x80]
xor byte [rbp + rcx - 0x7f], al
movzx eax, byte [rbp - 0x80]
xor byte [rbp + rcx - 0x7e], al
add rcx, 2
cmp rcx, 0x24
jb 0x180065bf0
mov byte [rbp - 0x5b], 0
mov dword [rsp + 0x20], 3
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rbp - 0x7f]
lea rcx, [0x180336790]
call fcn.180068750
movsxd rcx, dword [rax]
add rcx, 4
add rax, rcx
mov qword [0x180337018], rax
lea rcx, [rbp + 0x38]
call fcn.18006a960
nop
jmp 0x180065d05
movdqa xmm0, xmmword [0x1802723a0]
movdqu xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x180272620]
movdqu xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x60], 0x5a425d42
mov dword [rbp - 0x5c], 0x24264220
xor eax, eax
mov byte [rbp - 0x58], al
mov rdx, r12
nop word [rax + rax]
movzx eax, byte [rbp - 0x80]
xor byte [rbp + rdx - 0x7f], al
inc rdx
cmp rdx, 0x27
jb 0x180065d40
mov byte [rbp - 0x58], 0
mov dword [rsp + 0x20], r12d
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rbp - 0x7f]
lea rcx, [0x180336790]
call fcn.180068750
movsxd rcx, dword [rax + 3]
mov rax, qword [rcx + rax + 7]
mov qword [0x180336ce8], rax
mov rax, qword [0x180341620]
mov rcx, qword [rax + 0x58]
mov qword [0x180336ce0], rcx
jmp 0x180065f38
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.1801a9b50
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret