Function at 0x140061ba0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r13
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14012d080]
xor rax, rsp
mov qword [rbp + 0x37], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
lea r15, [rbp + 0x5f]
movabs r13, 0xff00ff00ff00ff00
mov qword [rbp + 0x27], r13
mov qword [rbp + 0x2f], r15
mov rax, qword [r15]
xor rax, r13
mov qword [rbp + 0x1f], rax
mov qword [r15], 0
cmp qword [0x140369b08], 0
jne 0x140061edb
mov byte [rbp - 0x19], Ordinal_41
mov byte [rbp - 0x18], 0x3f
mov byte [rbp - 0x17], gethostname
mov byte [rbp - 0x16], 0x6b
mov byte [rbp - 0x15], 0x64
mov byte [rbp - 0x14], Ordinal_50
mov byte [rbp - 0x13], 0x7f
mov byte [rbp - 0x12], 0x34
mov byte [rbp - 0x11], 0x33
mov byte [rbp - 0x10], Ordinal_60
mov byte [rbp - 0xf], 0x5d
movzx eax, byte [rbp - 0x19]
xor r9d, r9d
movabs rdi, 0x58e991d599d0dd52
mov r10, rdi
lea rax, [rbp - 0x19]
sub r10, rax
mov esi, reloc.WS2_32.dll_ntohs
nop dword [rax + rax]
lea r8, [rbp - 0x19]
add r8, r9
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rdx, rdi
shr rdx, cl
and dl, sil
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x19], dl
inc r9
cmp r9, 0xb
jb 0x140061c60
lea rcx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
jne 0x140061dd3
lea r12, [rbp + 0x5f]
mov rbx, qword [r12]
mov qword [r12], rax
mov byte [rbp - 0x29], 0x25
mov byte [rbp - 0x28], 0x25
mov byte [rbp - 0x27], reloc.WLDAP32.dll_Ordinal_60
mov byte [rbp - 0x26], Ordinal_45
mov byte [rbp - 0x25], 0x65
mov byte [rbp - 0x24], 0x68
mov byte [rbp - 0x23], 0x7f
mov byte [rbp - 0x22], 0x34
mov byte [rbp - 0x21], 0x33
mov byte [rbp - 0x20], Ordinal_60
mov byte [rbp - 0x1f], 0x5d
movzx eax, byte [rbp - 0x29]
xor r9d, r9d
mov r10, rdi
lea rax, [rbp - 0x29]
sub r10, rax
nop dword [rax + rax]
lea r8, [rbp - 0x29]
add r8, r9
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rdx, rdi
shr rdx, cl
and dl, sil
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x29], dl
inc r9
cmp r9, 0xb
jb 0x140061d00
lea rcx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [rbp - 0x29], Ordinal_41
mov byte [rbp - 0x28], 0x3f
mov byte [rbp - 0x27], gethostname
mov byte [rbp - 0x26], 0x6b
mov byte [rbp - 0x25], 0x64
mov byte [rbp - 0x24], Ordinal_50
mov byte [rbp - 0x23], 0x7f
mov byte [rbp - 0x22], 0x34
mov byte [rbp - 0x21], 0x33
mov byte [rbp - 0x20], Ordinal_60
mov byte [rbp - 0x1f], 0x5d
movzx eax, byte [rbp - 0x29]
xor r9d, r9d
mov r10, rdi
lea rax, [rbp - 0x29]
sub r10, rax
lea r8, [rbp - 0x29]
add r8, r9
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rdx, rdi
shr rdx, cl
and dl, sil
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x29], dl
inc r9
cmp r9, 0xb
jb 0x140061d80
lea rcx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10, rax
mov qword [r12], rbx
test rax, rax
je 0x140061ef8
mov byte [rbp - 9], reloc.WS2_32.dll_ntohl
mov byte [rbp - 8], gethostname
mov byte [rbp - 7], 0
mov byte [rbp - 6], reloc.WLDAP32.dll_Ordinal_45
mov byte [rbp - 5], Ordinal_41
mov byte [rbp - 4], Ordinal_27
mov byte [rbp - 3], 4
mov byte [rbp - 2], 3
mov byte [rbp - 1], reloc.WLDAP32.dll_Ordinal_27
mov byte [rbp], 6
mov byte [rbp + 1], reloc.WS2_32.dll_recv
mov byte [rbp + 2], reloc.WS2_32.dll_recvfrom
mov byte [rbp + 3], reloc.WS2_32.dll_select
mov byte [rbp + 4], 1
mov byte [rbp + 5], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 6], reloc.WS2_32.dll_setsockopt
mov byte [rbp + 7], 0x35
mov byte [rbp + 8], Ordinal_41
mov byte [rbp + 9], reloc.WS2_32.dll_sendto
mov byte [rbp + 0xa], gethostname
mov byte [rbp + 0xb], 0x3d
mov byte [rbp + 0xc], 0x3e
mov byte [rbp + 0xd], Ordinal_45
mov byte [rbp + 0xe], 6
mov byte [rbp + 0xf], reloc.WLDAP32.dll_Ordinal_45
mov byte [rbp + 0x10], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp + 0x11], 1
mov byte [rbp + 0x12], reloc.WS2_32.dll_recv
mov byte [rbp + 0x13], reloc.WS2_32.dll_ntohl
mov byte [rbp + 0x14], 1
mov byte [rbp + 0x15], Ordinal_27
mov byte [rbp + 0x16], sil
mov byte [rbp + 0x17], 0x60
movzx eax, byte [rbp - 9]
xor r9d, r9d
movabs rbx, 0x7eda2fc1f4ab0f46
mov r11, rbx
lea rax, [rbp - 9]
sub r11, rax
nop dword [rax]
nop word [rax + rax]
lea r8, [rbp - 9]
add r8, r9
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rdx, rbx
shr rdx, cl
and dl, sil
lea eax, [r11 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 9], dl
inc r9
cmp r9, 0x21
jb 0x140061e80
lea rdx, [rbp - 9]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140369b08], rax
test rax, rax
jne 0x140061edb
mov qword [0x140369b08], rax
jmp 0x140061efe
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
call fcn.140061f40
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rbx, rax
je 0x140061efc
xor al, al
jmp 0x140061efe
mov al, 1
mov rcx, qword [rbp + 0x1f]
xor rcx, r13
mov qword [r15], rcx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400f3550
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop rbp
ret