Function at 0x140062740
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x140170e40]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor esi, esi
movabs r14, 0xcccccccccccccccd
movabs r15, 0x7fffffffffffffff
lea r12, [0x140170d68]
movzx ebx, byte [rbp - 0x69]
call fcn.140083fe0
movsxd rdi, eax
test eax, eax
je 0x140062794
cmp edi, 1
je 0x140062794
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1401169e0]
movdqu xmmword [rbp + 0x27], xmm0
mov word [rbp + 0x37], 0x100
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 0x38]
xor byte [rbp + rcx + 0x27], al
inc rcx
cmp rcx, 0x10
jb 0x1400627d0
mov byte [rbp + 0x38], 0
lea r9, [rbp - 0x69]
lea r8, [rbp + 0x37]
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x21]
call fcn.140056e10
mov rdx, qword [0x1401a75c0]
cmp rdx, 0xf
jbe 0x14006283a
inc rdx
mov rcx, qword [0x1401a75a8]
cmp rdx, 0x1000
jb 0x140062835
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140062cac
mov rcx, r8
call fcn.1400e486c
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [0x1401a75a8], xmm0
movups xmm1, xmmword [rbp - 0x11]
movups xmmword [0x1401a75b8], xmm1
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401a72d8], rax
mov rcx, rdi
lea r10, [rbp + 0x3c]
test edi, edi
jns 0x1400628c0
neg rcx
nop word [rax + rax]
dec r10
mov rax, r14
mul rcx
shr rdx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov rcx, rdx
test rdx, rdx
jne 0x140062880
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x1400628eb
dec r10
mov rax, r14
mul rcx
shr rdx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov rcx, rdx
test rdx, rdx
jne 0x1400628c0
lea r9, [rbp - 0x69]
lea r8, [rbp + 0x3c]
mov rdx, r10
lea rcx, [rbp + 7]
call fcn.140056e10
nop
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp - 0x41], 0x54575c75
mov dword [rbp - 0x3d], 0x791e444e
mov dword [rbp - 0x39], 0x272c342f
mov word [rbp - 0x35], 0x100
mov rcx, rsi
nop dword [rax]
lea eax, [rcx + 0x38]
xor byte [rbp + rcx - 0x41], al
inc rcx
cmp rcx, 0xc
jb 0x140062930
mov byte [rbp - 0x34], 0
lea r9, [rbp - 0x69]
lea r8, [rbp - 0x35]
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x21]
call fcn.140056e10
mov rdx, qword [0x1401a75c0]
cmp rdx, 0xf
jbe 0x14006299a
inc rdx
mov rcx, qword [0x1401a75a8]
cmp rdx, 0x1000
jb 0x140062995
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140062cb3
mov rcx, r8
call fcn.1400e486c
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [0x1401a75a8], xmm0
movups xmm1, xmmword [rbp - 0x11]
movups xmmword [0x1401a75b8], xmm1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp - 0x31], 0x5f5b5c6a
mov dword [rbp - 0x2d], 0x1f595355
mov dword [rbp - 0x29], 0x2c2f240d
mov dword [rbp - 0x25], 0x1003c36
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 0x38]
xor byte [rbp + rcx - 0x31], al
inc rcx
cmp rcx, 0xe
jb 0x1400629e0
mov byte [rbp - 0x22], 0
lea r9, [rbp - 0x69]
lea r8, [rbp - 0x23]
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x21]
call fcn.140056e10
mov rdx, qword [0x1401a75c0]
cmp rdx, 0xf
jbe 0x140062a4a
inc rdx
mov rcx, qword [0x1401a75a8]
cmp rdx, 0x1000
jb 0x140062a45
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140062cba
mov rcx, r8
call fcn.1400e486c
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [0x1401a75a8], xmm0
movups xmm1, xmmword [rbp - 0x11]
movups xmmword [0x1401a75b8], xmm1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1401165a0]
movdqu xmmword [rbp - 0x61], xmm0
mov dword [rbp - 0x51], 0x243e6924
mov word [rbp - 0x4d], WSAGetLastError
mov byte [rbp - 0x4b], 1
mov rcx, rsi
nop dword [rax]
lea eax, [rcx + 0x38]
xor byte [rbp + rcx - 0x61], al
inc rcx
cmp rcx, 0x15
jb 0x140062a90
mov byte [rbp - 0x4b], 0
lea rax, [rbp - 0x61]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x140062ab0
mov rdx, qword [0x140170d78]
mov rax, r15
sub rax, rdx
cmp rax, rcx
jb 0x140062ccf
mov rax, r12
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rax, qword [0x140170d68]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x61]
mov r8, r12
movzx edx, bl
lea rcx, [rbp - 0x21]
call fcn.14005fd30
mov rdx, qword [0x1401a75c0]
cmp rdx, 0xf
jbe 0x140062b45
inc rdx
mov rcx, qword [0x1401a75a8]
cmp rdx, 0x1000
jb 0x140062b40
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140062cc1
mov rcx, r8
call fcn.1400e486c
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [0x1401a75a8], xmm0
movups xmm1, xmmword [rbp - 0x11]
movups xmmword [0x1401a75b8], xmm1
movdqa xmm0, xmmword [0x1401167f0]
movdqu xmmword [rbp - 0x61], xmm0
mov dword [rbp - 0x51], 0x2e2e692b
mov dword [rbp - 0x4d], 0x2a3a2820
mov dword [rbp - 0x49], 0x3a3d0770
mov word [rbp - 0x45], Ordinal_50
mov byte [rbp - 0x43], 1
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 0x38]
xor byte [rbp + rcx - 0x61], al
inc rcx
cmp rcx, 0x1d
jb 0x140062b90
mov byte [rbp - 0x43], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rsi
mov qword [rbp - 9], rsi
lea rax, [rbp - 0x61]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140062bc0
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x21]
call fcn.140057450
lea rcx, [rbp - 0x21]
call fcn.140081c10
movdqa xmm0, xmmword [0x1401160d0]
movdqu xmmword [rbp - 0x61], xmm0
mov dword [rbp - 0x51], 0x652e2027
mov dword [rbp - 0x4d], 0x3d343f
mov byte [rbp - 0x49], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x38]
xor byte [rbp + rcx - 0x61], al
inc rcx
cmp rcx, 0x17
jb 0x140062c10
mov byte [rbp - 0x49], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], rsi
mov qword [rbp - 9], rsi
lea rax, [rbp - 0x61]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140062c40
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x21]
call fcn.140057450
lea rcx, [rbp - 0x21]
call fcn.140081c10
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140062794
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062ca2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062cc8
call fcn.1400e486c
jmp 0x140062794
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140073770
int3