Function at 0x1400046b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x188
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x14009c688]
xor rax, rsp
mov qword [rsp + 0x178], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x68]
call fcn.1400098e0
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xa0]
call fcn.140004250
mov byte [rsp + 0xe8], gethostname
mov byte [rsp + 0xe9], Ordinal_50
mov byte [rsp + 0xea], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xeb], Ordinal_50
mov byte [rsp + 0xec], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0xed], gethostname
mov byte [rsp + 0xee], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xef], 0
xor r8d, r8d
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x14000479e
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x28]
jmp 0x140005048
mov byte [rsp + 0xc8], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0xc9], gethostname
mov byte [rsp + 0xca], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xcb], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0xcc], gethostname
mov byte [rsp + 0xcd], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xce], 0
xor r8d, r8d
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004827
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x2c]
jmp 0x140005048
mov byte [rsp + 0xc0], Ordinal_50
mov byte [rsp + 0xc1], Ordinal_50
mov byte [rsp + 0xc2], Ordinal_50
mov byte [rsp + 0xc3], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xc4], gethostname
mov byte [rsp + 0xc5], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xc6], 0
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x1400048b0
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x30]
jmp 0x140005048
mov byte [rsp + 0x128], Ordinal_50
mov byte [rsp + 0x129], gethostname
mov byte [rsp + 0x12a], Ordinal_50
mov byte [rsp + 0x12b], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x12c], Ordinal_50
mov byte [rsp + reloc.WLDAP32.dll_Ordinal_301], gethostname
mov byte [rsp + 0x12e], gethostname
mov byte [rsp + 0x12f], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x130], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x131], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x132], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x133], 0
xor r8d, r8d
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004961
mov dword [rsp + 0x34], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x34]
jmp 0x140005048
mov byte [rsp + 0x138], Ordinal_50
mov byte [rsp + 0x139], gethostname
mov byte [rsp + 0x13a], Ordinal_50
mov byte [rsp + 0x13b], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x13c], Ordinal_50
mov byte [rsp + 0x13d], gethostname
mov byte [rsp + 0x13e], gethostname
mov byte [rsp + 0x13f], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x140], gethostname
mov byte [rsp + 0x141], Ordinal_50
mov byte [rsp + 0x142], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x143], 0
xor r8d, r8d
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004a12
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x38]
jmp 0x140005048
mov byte [rsp + 0x168], Ordinal_50
mov byte [rsp + 0x169], gethostname
mov byte [rsp + 0x16a], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x16b], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x16c], Ordinal_50
mov byte [rsp + 0x16d], gethostname
mov byte [rsp + 0x16e], gethostname
mov byte [rsp + 0x16f], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x170], Ordinal_50
mov byte [rsp + 0x171], gethostname
mov byte [rsp + 0x172], Ordinal_50
mov byte [rsp + 0x173], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x174], 0
xor r8d, r8d
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004acb
mov dword [rsp + 0x3c], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x3c]
jmp 0x140005048
mov byte [rsp + 0xf8], Ordinal_50
mov byte [rsp + 0xf9], Ordinal_50
mov byte [rsp + 0xfa], gethostname
mov byte [rsp + 0xfb], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xfc], Ordinal_50
mov byte [rsp + 0xfd], gethostname
mov byte [rsp + 0xfe], Ordinal_50
mov byte [rsp + 0xff], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x100], 0
xor r8d, r8d
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004b64
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x40]
jmp 0x140005048
mov byte [rsp + 0xe0], gethostname
mov byte [rsp + 0xe1], Ordinal_50
mov byte [rsp + 0xe2], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xe3], gethostname
mov byte [rsp + 0xe4], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0xe5], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xe6], 0
xor r8d, r8d
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004bed
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x44]
jmp 0x140005048
mov byte [rsp + 0xd0], gethostname
mov byte [rsp + 0xd1], gethostname
mov byte [rsp + 0xd2], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xd3], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0xd4], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0xd5], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xd6], 0
xor r8d, r8d
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004c76
mov dword [rsp + 0x48], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x48]
jmp 0x140005048
mov byte [rsp + 0xd8], gethostname
mov byte [rsp + 0xd9], gethostname
mov byte [rsp + 0xda], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xdb], gethostname
mov byte [rsp + 0xdc], gethostname
mov byte [rsp + 0xdd], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xde], 0
xor r8d, r8d
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004cff
mov dword [rsp + 0x4c], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x4c]
jmp 0x140005048
mov byte [rsp + 0x108], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x109], Ordinal_50
mov byte [rsp + 0x10a], gethostname
mov byte [rsp + 0x10b], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x10c], Ordinal_50
mov byte [rsp + 0x10d], gethostname
mov byte [rsp + 0x10e], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x10f], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x110], 0
xor r8d, r8d
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004d98
mov dword [rsp + 0x50], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x50]
jmp 0x140005048
mov byte [rsp + 0x148], Ordinal_50
mov byte [rsp + 0x149], Ordinal_50
mov byte [rsp + 0x14a], gethostname
mov byte [rsp + 0x14b], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x14c], Ordinal_50
mov byte [rsp + 0x14d], gethostname
mov byte [rsp + 0x14e], gethostname
mov byte [rsp + 0x14f], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x150], gethostname
mov byte [rsp + 0x151], gethostname
mov byte [rsp + 0x152], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x153], 0
xor r8d, r8d
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004e49
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x54]
jmp 0x140005048
mov byte [rsp + 0x158], Ordinal_50
mov byte [rsp + 0x159], gethostname
mov byte [rsp + 0x15a], Ordinal_50
mov byte [rsp + 0x15b], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x15c], Ordinal_50
mov byte [rsp + 0x15d], gethostname
mov byte [rsp + 0x15e], gethostname
mov byte [rsp + 0x15f], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x160], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x161], gethostname
mov byte [rsp + 0x162], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x163], 0
xor r8d, r8d
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004efa
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x58]
jmp 0x140005048
mov byte [rsp + 0x118], Ordinal_50
mov byte [rsp + 0x119], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0x11a], gethostname
mov byte [rsp + 0x11b], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x11c], Ordinal_50
mov byte [rsp + 0x11d], gethostname
mov byte [rsp + 0x11e], gethostname
mov byte [rsp + 0x11f], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x120], 0
xor r8d, r8d
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140004f93
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x5c]
jmp 0x140005048
mov byte [rsp + 0xf0], gethostname
mov byte [rsp + 0xf1], gethostname
mov byte [rsp + 0xf2], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xf3], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0xf4], Ordinal_50
mov byte [rsp + 0xf5], gethostname
mov byte [rsp + 0xf6], reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0xf7], 0
xor r8d, r8d
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xa0]
call fcn.140009380
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140005021
mov dword [rsp + 0x60], 0
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x60]
jmp 0x140005048
mov dword [rsp + 0x64], 1
lea rcx, [rsp + 0xa0]
call fcn.140001780
nop
mov rcx, qword [rsp + 0x190]
call fcn.140001780
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14007c450
add rsp, 0x188
ret