Function at 0x140048280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb0
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rax, qword [rbp + 0x7f]
mov r13d, 0xffffffff
mov rbx, qword [rcx + 0x18]
mov edi, r8d
mov byte [rbp - 0x51], r9b
mov r12, rdx
mov dword [rbp - 0x4d], r8d
mov rsi, rcx
mov qword [rax], 0
lea r15d, [r13 + 3]
mov byte [rbx + 0x3dd], 0
mov r9, qword [rcx + 0xe0]
mov qword [rbp - 0x39], rax
test r9, r9
je 0x140048308
test byte [r9 + 4], 8
je 0x140048308
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x140048308
mov r9, qword [r9 + 0x20]
lea edx, [r13 + 4]
mov r8d, r15d
call rax
mov r8d, edi
mov rdx, r12
mov rcx, rsi
call fcn.140047d40
mov qword [rbp + 7], rax
mov r14, rax
test rax, rax
je 0x140048328
inc dword [rax + 0x10]
xor r13d, r13d
mov r8, qword [rsi + 0xe0]
test r8, r8
je 0x140048352
test byte [r8 + 4], 8
je 0x140048352
mov rax, qword [r8 + 0x18]
test rax, rax
je 0x140048352
mov r8, qword [r8 + 0x20]
mov edx, 3
mov rcx, rsi
call rax
test r14, r14
jne 0x1400485e5
cmp qword [rsi + 0xa20], r14
je 0x1400483cb
mov rax, qword [rsi + 0xd8]
test rax, rax
jne 0x14004837c
mov rax, qword [rsi + 0xd0]
test rax, rax
je 0x140048383
mov byte [rax + 0x182], 1
mov r8, qword [rsi + 0xa28]
xor edx, edx
mov rcx, qword [rsi + 0xdd0]
call qword [rsi + 0xa20]
mov rcx, qword [rsi + 0xd8]
mov edx, eax
test rcx, rcx
je 0x1400483b0
mov byte [rcx + 0x182], 0
jmp 0x1400483c3
mov rax, qword [rsi + 0xd0]
test rax, rax
je 0x1400483c3
mov byte [rax + 0x182], 0
test edx, edx
jne 0x1400487f2
lea r8, [rbp - 1]
mov rdx, r12
call fcn.140050760
test eax, eax
jle 0x1400483f9
mov r9d, edi
lea rdx, [rbp - 1]
mov r8, r12
call fcn.140055820
mov rdi, rax
test rax, rax
jne 0x14004856e
mov edi, dword [rbp - 0x4d]
cmp byte [rbx + 0x18c], r15b
je 0x1400487f2
cmp byte [r12], 0
lea r8, str.localhost
mov rdx, r12
je 0x140048445
lea r9, [0x1400b9950]
nop
movzx eax, byte [r8]
test al, al
je 0x140048445
movzx ecx, byte [rdx]
movzx eax, byte [rax + r9]
cmp byte [rcx + r9], al
jne 0x14004861b
inc rdx
inc r8
cmp byte [rdx], 0
jne 0x140048420
xor ecx, ecx
cmp byte [r8], cl
setne cl
xor eax, eax
cmp byte [rdx], al
sete al
cmp eax, ecx
je 0x14004861b
lea rcx, [rbp + 7]
mov qword [rbp - 0x41], 0
mov word [rbp - 0x49], r15w
movzx ebx, di
mov word [rbp + 9], 0x5f32
mov word [rbp + 0xc], 0x2e32
mov word [rbp + 7], 0x7357
mov word [rbp + 0xf], 0x6c6c
mov byte [rbp + 0xb], 0x33
mov byte [rbp + 0x11], 0
mov byte [rbp + 0xe], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1400484ae
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400484dc
lea rdx, [rbp - 1]
mov word [rbp], 0x6f74
mov rcx, rax
mov word [rbp + 3], 0x73
mov byte [rbp - 1], 0x68
mov byte [rbp + 2], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400484dc
movzx ecx, di
call rax
movzx ebx, ax
lea r8, [rbp - 1]
mov word [rbp - 0x47], bx
lea rdx, str.127.0.0.1
call fcn.140050760
cmp eax, 1
jl 0x1400485e5
mov eax, dword [rbp - 1]
mov edx, 1
mov dword [rbp - 0x45], eax
lea ecx, [rdx + 0x49]
call qword [fcn.14006da94]
mov rdi, rax
test rax, rax
je 0x1400485e5
movups xmm0, xmmword [rbp - 0x49]
mov dword [rax], 0
mov dword [rax + 4], r15d
mov dword [rax + 8], 1
mov dword [rax + 0xc], 6
mov dword [rax + 0x10], 0x10
add rax, 0x30
mov qword [rdi + 0x20], rax
lea rcx, [rax + 0x10]
movups xmmword [rax], xmm0
mov qword [rdi + 0x18], rcx
movsd xmm0, qword [str.localhost]
movsd qword [rcx], xmm0
movzx eax, word [0x1400bc798]
mov word [rcx + 8], ax
mov qword [rdi + 0x28], 0
cmp qword [rsi + 0xe0], 0
je 0x140048585
mov edx, 3
mov rcx, rsi
call fcn.14003aa60
mov r9d, dword [rbp - 0x4d]
mov r8, r12
mov rdx, rdi
mov rcx, rsi
call fcn.140047fd0
mov r8, qword [rsi + 0xe0]
mov r14, rax
test r8, r8
je 0x1400485c4
test byte [r8 + 4], 8
je 0x1400485c4
mov rax, qword [r8 + 0x18]
test rax, rax
je 0x1400485c4
mov r8, qword [r8 + 0x20]
mov edx, 3
mov rcx, rsi
call rax
test r14, r14
jne 0x140048616
test rdi, rdi
je 0x1400485e5
nop
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [fcn.14006baa8]
mov rdi, rbx
test rbx, rbx
jne 0x1400485d0
mov rax, qword [rbp - 0x39]
mov qword [rax], r14
mov eax, r13d
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140060fb0
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r13d, r13d
jmp 0x1400485e5
cmp byte [rbp - 0x51], 0
je 0x140048764
cmp byte [rsi + 0xa8f], 0
je 0x140048764
mov rbx, qword [rsi + 0x18]
mov edx, 1
mov ecx, 0x488
call qword [fcn.14006da94]
mov qword [rsi + 0x1b8], rax
mov r14, rax
test rax, rax
je 0x1400487b8
mov byte [rbx + 0x3dd], 1
lea rcx, str.Content_Type:_application_dns_message
mov qword [rax + 0x480], r12
mov dword [rax + 0x47c], edi
call qword [case.0x14002e419.0]
mov rbx, rax
test rax, rax
jne 0x14004868a
xor r12d, r12d
mov qword [r14], r12
jmp 0x1400486f2
mov ecx, 0x10
call qword [fcn.14006bcf0]
test rax, rax
jne 0x1400486ab
mov rcx, rbx
call qword [fcn.14006baa8]
xor r12d, r12d
mov qword [r14], r12
jmp 0x1400486f2
mov qword [rsp + 0x30], rax
lea rdx, [r14 + 8]
mov qword [rax + 8], 0
mov r9, r12
mov qword [rax], rbx
mov r8d, 1
mov qword [r14], rax
mov rcx, rsi
mov rax, qword [rsi + 0xd0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi + 0x958]
mov qword [rsp + 0x20], rax
call fcn.14005bb30
test eax, eax
je 0x14004875b
xor r12d, r12d
mov rdi, qword [r14]
test rdi, rdi
je 0x140048721
nop word [rax + rax]
mov rcx, qword [rdi]
mov rbx, qword [rdi + 8]
call qword [fcn.14006baa8]
mov rcx, rdi
mov qword [rdi], r12
call qword [fcn.14006baa8]
mov rdi, rbx
test rbx, rbx
jne 0x140048700
mov rax, qword [rsi + 0x1b8]
lea rbx, [r14 + 8]
mov qword [rax], r12
nop
mov rcx, rbx
call fcn.140030d00
add rbx, 0x238
sub r15, 1
jne 0x140048730
mov rcx, qword [rsi + 0x1b8]
call qword [fcn.14006baa8]
mov qword [rsi + 0x1b8], r12
jmp 0x1400487bb
inc dword [r14 + 0x478]
jmp 0x1400487b8
mov rax, qword [rsi + 0x18]
xor ecx, ecx
mov rbx, qword [rsi + 0xdd0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
mov dword [rbp - 0x2d], r15d
cmp dword [rax + 0x88], 3
movups xmmword [rbp - 0x21], xmm0
setne cl
inc ecx
mov dword [rbp - 0x29], ecx
lea rcx, [rbp - 0x49]
movups xmmword [rbp - 0x11], xmm0
call fcn.14004fc40
lea r9, [rbp - 0x31]
mov r8d, edi
mov rdx, r12
mov rcx, rsi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
call fcn.140038830
test al, al
je 0x1400487de
xor r12d, r12d
lea rdx, [rbp + 7]
mov rcx, rsi
call fcn.140049190
test eax, eax
jne 0x1400487f2
mov r14, qword [rbp + 7]
mov r13d, r12d
test r14, r14
sete r13b
jmp 0x1400485e5
lea rdx, str.getaddrinfo___thread_failed_to_start
mov rcx, rsi
call fcn.14002b570
jmp 0x1400485e5
mov eax, 0xffffffff
jmp 0x1400485ef