Function at 0x140019430
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
push rsi
mov eax, 0x12a8
call fcn.14008ad60
sub rsp, rax
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x1270], rax
mov r9, qword [rsp + 0x12e8]
xor eax, eax
movsxd rsi, edx
cmp esi, 0x40
mov rbx, rcx
mov byte [rsp + 0x1f0], 0
mov qword [rsp + 0x1f1], rax
mov qword [rsp + 0x1f9], rax
mov qword [rsp + 0x201], rax
mov qword [rsp + 0x209], rax
mov qword [rsp + 0x211], rax
mov qword [rsp + 0x219], rax
mov qword [rsp + 0x221], rax
mov qword [rsp + 0x229], rax
jge 0x1400194b9
mov eax, 0x113
jmp 0x1400195ba
mov rax, qword [rbx]
lea rcx, [rsp + 0x1f0]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x10], rax
mov rax, qword [rbx + 0x18]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x20]
mov qword [rcx + 0x20], rax
mov rax, qword [rbx + 0x28]
mov qword [rcx + 0x28], rax
mov rax, qword [rbx + 0x30]
mov qword [rcx + 0x30], rax
mov rax, qword [rbx + 0x38]
mov qword [rcx + 0x38], rax
lea rax, [rsp + 0x1f0]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140019523
inc rax
test ecx, ecx
jne 0x140019510
test edx, edx
jne 0x1400194af
mov qword [rsp + 0x12a0], rdi
cmp rsi, 0x44
jb 0x14001953b
cmp rsi, 0x48
jae 0x140019542
mov eax, 0x113
jmp 0x1400195b2
movzx eax, byte [rbx + 0x45]
movzx edx, byte [rbx + 0x44]
mov qword [rsp + 0x12d0], rbp
shl edx, 8
add edx, eax
movzx eax, byte [rbx + 0x46]
shl edx, 8
add edx, eax
movzx eax, byte [rbx + 0x47]
shl edx, 8
add edx, eax
js 0x14001999d
lea ebp, [rdx + 0x48]
cmp ebp, esi
jg 0x14001999d
movsxd r8, edx
lea rdx, [rbx + 0x48]
mov rcx, r9
mov qword [rsp + 0x1288], r14
call fcn.140004840
movsxd r14, ebp
lea rax, [r14 + 0x20]
cmp rax, rsi
jbe 0x1400195d4
mov eax, 0x113
mov r14, qword [rsp + 0x1288]
mov rbp, qword [rsp + 0x12d0]
mov rdi, qword [rsp + 0x12a0]
mov rcx, qword [rsp + 0x1270]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x12a8
pop rsi
pop rbx
ret
mov rax, qword [r14 + rbx]
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x260]
mov qword [rcx], rax
mov rax, qword [r14 + rbx + 8]
add ebp, 0x10
mov qword [rcx + 8], rax
movsxd rcx, ebp
add ebp, 0x10
mov rax, qword [rcx + rbx]
mov qword [rsp + 0x1298], r12
mov qword [rsp + 0x1280], r15
mov qword [rdx], rax
mov rax, qword [rcx + rbx + 8]
mov edi, 0x1a0
mov qword [rdx + 8], rax
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x1d1], rax
mov qword [rsp + 0x1d9], rax
mov qword [rsp + 0x1e1], rax
mov dword [rsp + 0x1e9], eax
mov word [rsp + 0x1ed], ax
mov byte [rsp + 0x1ef], al
movsxd r15, ebp
mov r8, rdi
xor edx, edx
mov byte [rsp + 0x1d1], 0xa8
mov byte [rsp + 0x1d2], 0xfb
mov byte [rsp + 0x1d3], Ordinal_211
mov byte [rsp + 0x1d4], 0x5a
mov byte [rsp + 0x1d5], 0xf8
mov byte [rsp + 0x1d6], reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0x1d7], 0xcb
mov byte [rsp + 0x1d8], 0xec
mov byte [rsp + 0x1d9], Ordinal_79
mov byte [rsp + 0x1da], Ordinal_200
mov byte [rsp + 0x1db], Ordinal_27
mov byte [rsp + 0x1dc], __WSAFDIsSet
mov byte [rsp + 0x1dd], 0x99
mov byte [rsp + 0x1de], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x1df], 0x85
mov byte [rsp + 0x1e0], 0x9d
mov byte [rsp + 0x1e1], __WSAFDIsSet
mov byte [rsp + 0x1e2], WSAGetLastError
mov byte [rsp + 0x1e3], 0x60
mov byte [rsp + 0x1e4], Ordinal_211
mov byte [rsp + 0x1e5], reloc.WS2_32.dll_select
mov byte [rsp + 0x1e6], Ordinal_45
mov byte [rsp + 0x1e7], Ordinal_143
mov byte [rsp + 0x1e8], __WSAFDIsSet
mov byte [rsp + 0x1e9], Ordinal_33
mov byte [rsp + 0x1ea], 0x79
mov byte [rsp + 0x1eb], 0x46
mov byte [rsp + 0x1ec], reloc.WLDAP32.dll_Ordinal_35
mov byte [rsp + 0x1ed], 0x99
mov byte [rsp + 0x1ee], gethostname
mov byte [rsp + 0x1ef], 0x60
add r15, rbx
sub esi, ebp
mov byte [rsp + 0x1d0], 0xb0
call fcn.1400717b0
lea r11, [rsp + 0x1d1]
mov eax, reloc.WS2_32.dll_recv
nop word [rax + rax]
xor byte [r11 - 1], 0x87
xor byte [r11], 0x87
add r11, 2
sub rax, 1
jne 0x140019780
movzx ecx, byte [rsp + 0x1d1]
movzx eax, byte [rsp + 0x1d7]
mov r12d, 0x103
mov byte [rsp + 0x1d7], cl
movzx ecx, byte [rsp + 0x1d6]
mov byte [rsp + 0x1d1], al
movzx eax, byte [rsp + 0x1df]
mov byte [rsp + 0x1df], cl
movzx ecx, byte [rsp + 0x1ef]
mov byte [rsp + 0x1d6], al
movzx eax, byte [rsp + 0x1d2]
mov byte [rsp + 0x1d2], cl
movzx ecx, byte [rsp + 0x1d3]
mov byte [rsp + 0x1ef], al
movzx eax, byte [rsp + 0x1dd]
mov byte [rsp + 0x1dd], cl
movzx ecx, byte [rsp + 0x1e1]
mov byte [rsp + 0x1d3], al
movzx eax, byte [rsp + 0x1d9]
mov byte [rsp + 0x1d9], cl
lea r9d, [r12 - 3]
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x1d0]
mov edx, 2
mov byte [rsp + 0x1e1], al
call fcn.14001fbc0
test eax, eax
jne 0x140019945
mov qword [rsp + 0x1290], r13
lea r9d, [rax + 0x10]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x30]
movsxd r13, esi
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
mov rsi, r13
call fcn.14001fe70
test eax, eax
jne 0x14001993d
test r13, r13
je 0x1400198e7
mov r14d, 0x1000
nop word [rax + rax]
mov rbx, rsi
cmp rsi, r14
mov rbp, r13
cmova rbx, r14
sub rbp, rsi
lea r9, [rsp + 0x270]
add rbp, r15
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, rbp
call fcn.140020090
test eax, eax
jne 0x14001993d
lea rdx, [rsp + 0x270]
mov r8, rbx
mov rcx, rbp
call fcn.14006ecb0
sub rsi, rbx
jne 0x1400198a0
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
call fcn.140020550
test eax, eax
jne 0x14001993d
lea rax, [rsp + 0x250]
lea rcx, [rsp + 0x240]
xor r12d, r12d
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x14001992d
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x14001992d
mov ecx, r12d
jmp 0x140019932
sbb ecx, ecx
sbb ecx, 0xffffffff
mov eax, 0x113
test ecx, ecx
cmovne r12d, eax
mov r13, qword [rsp + 0x1290]
mov rcx, qword [rsp + 0x80]
mov r15, qword [rsp + 0x1280]
test rcx, rcx
je 0x140019966
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x28]
call qword [rdx + 0x48]
mov eax, 0x58
lea rcx, [rsp + 0x30]
mov byte [rcx], 0
inc rcx
sub rax, 1
jne 0x140019970
lea rcx, [rsp + 0x30]
mov byte [rcx], 0
inc rcx
sub rdi, 1
jne 0x140019981
mov eax, r12d
mov r12, qword [rsp + 0x1298]
jmp 0x1400195a2
mov eax, 0x113
jmp 0x1400195aa