Function at 0x14006e470
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rbp - 0x20], Ordinal_41
xor ebx, ebx
mov byte [rbp - 0x1f], reloc.WLDAP32.dll_Ordinal_60
movabs r14, 0xf20e162419bb1053
mov byte [rbp - 0x1e], reloc.WLDAP32.dll_Ordinal_33
mov r10, r14
mov byte [rbp - 0x1d], gethostname
mov r9d, ebx
mov byte [rbp - 0x1c], 0x33
mov edi, reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x1b], 0x3f
mov byte [rbp - 0x1a], reloc.WLDAP32.dll_Ordinal_35
mov byte [rbp - 0x19], 0x3f
mov byte [rbp - 0x18], WSAStartup
mov byte [rbp - 0x17], Ordinal_60
mov byte [rbp - 0x16], reloc.WLDAP32.dll_Ordinal_35
mov byte [rbp - 0x15], Ordinal_60
mov byte [rbp - 0x14], 0x51
movzx eax, byte [rbp - 0x20]
lea rax, [rbp - 0x20]
sub r10, rax
nop dword [rax]
nop word [rax + rax]
mov rcx, r9
lea r8, [rbp - 0x20]
add r8, r9
and ecx, edi
cmp rcx, rdi
mov rdx, r14
cmovae rcx, rdi
shl cl, 2
lea eax, [r10 + r8]
shr rdx, cl
and dl, dil
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x20], dl
inc r9
cmp r9, 0xd
jb 0x14006e4f0
lea rcx, [rbp - 0x20]
call fcn.140066920
test al, al
je 0x14006e542
mov qword [0], 1
mov byte [rbp - 0x20], 6
movabs rsi, 0xcf3bf876453ba077
mov byte [rbp - 0x1f], reloc.WS2_32.dll_select
mov r10, rsi
mov byte [rbp - 0x1e], reloc.WS2_32.dll_ntohl
mov r9, rbx
mov byte [rbp - 0x1d], reloc.WS2_32.dll_recvfrom
mov byte [rbp - 0x1c], 2
mov byte [rbp - 0x1b], reloc.WLDAP32.dll_Ordinal_26
mov byte [rbp - 0x1a], ntohs
mov byte [rbp - 0x19], 8
mov byte [rbp - Ordinal_26], 0x18
mov byte [rbp - 0x17], 0xfe
mov byte [rbp - 0x16], 0xa7
mov byte [rbp - 0x15], 0xe8
mov byte [rbp - 0x14], 0xf0
mov byte [rbp - 0x13], 0xe2
mov byte [rbp - 0x12], 0x8a
movzx eax, byte [rbp - 0x20]
lea rax, [rbp - 0x20]
sub r10, rax
nop dword [rax]
mov rcx, r9
lea r8, [rbp - 0x20]
add r8, r9
and ecx, edi
cmp rcx, rdi
mov rdx, rsi
cmovae rcx, rdi
shl cl, 2
lea eax, [r10 + r8]
shr rdx, cl
and dl, dil
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x20], dl
inc r9
cmp r9, rdi
jb 0x14006e5a0
lea rcx, [rbp - 0x20]
call fcn.140066920
test al, al
je 0x14006e5f1
mov qword [0], 1
mov byte [rbp - 0x20], 6
mov r10, rsi
mov byte [rbp - 0x1f], reloc.WS2_32.dll_select
mov r9, rbx
mov byte [rbp - 0x1e], reloc.WS2_32.dll_ntohl
mov byte [rbp - 0x1d], reloc.WS2_32.dll_recvfrom
mov byte [rbp - 0x1c], 2
mov byte [rbp - 0x1b], reloc.WLDAP32.dll_Ordinal_26
mov byte [rbp - 0x1a], reloc.WS2_32.dll_listen
mov byte [rbp - 0x19], 9
mov byte [rbp - 0x18], Ordinal_30
mov byte [rbp - 0x17], 0xf5
mov byte [rbp - 0x16], 0xa7
mov byte [rbp - 0x15], 0xe8
mov byte [rbp - 0x14], 0xf0
mov byte [rbp - 0x13], 0xe2
mov byte [rbp - 0x12], 0x8a
movzx eax, byte [rbp - 0x20]
lea rax, [rbp - 0x20]
sub r10, rax
nop
mov rcx, r9
lea r8, [rbp - 0x20]
add r8, r9
and ecx, edi
cmp rcx, rdi
mov rdx, rsi
cmovae rcx, rdi
shl cl, 2
lea eax, [r10 + r8]
shr rdx, cl
and dl, dil
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x20], dl
inc r9
cmp r9, rdi
jb 0x14006e640
lea rcx, [rbp - 0x20]
call fcn.140066920
test al, al
je 0x14006e691
mov qword [0], 1
mov byte [rbp - 0x20], 0x76
movabs r11, 0x5a077bd8c417a323
mov byte [rbp - 0x1f], 0x61
mov r10, r11
mov byte [rbp - 0x1e], 0x67
mov r9, rbx
mov byte [rbp - 0x1d], 0x59
mov byte [rbp - 0x1c], 0x54
mov byte [rbp - 0x1b], 0x41
mov byte [rbp - 0x1a], 0x7e
mov byte [rbp - 0x19], 0x43
mov byte [rbp - 0x18], 0x51
mov byte [rbp - 0x17], 0x57
mov byte [rbp - 0x16], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x15], 0x4a
mov byte [rbp - 0x14], Ordinal_79
mov byte [rbp - 0x13], reloc.WLDAP32.dll_Ordinal_30
mov byte [rbp - 0x12], 0x5e
mov byte [rbp - 0x11], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x10], 0x55
mov byte [rbp - 0xf], gethostname
movzx eax, byte [rbp - 0x20]
lea rax, [rbp - 0x20]
sub r10, rax
nop dword [rax]
nop dword [rax + rax]
mov rcx, r9
lea r8, [rbp - 0x20]
add r8, r9
and ecx, edi
cmp rcx, rdi
mov rdx, r11
cmovae rcx, rdi
shl cl, 2
lea eax, [r10 + r8]
shr rdx, cl
and dl, dil
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x20], dl
inc r9
cmp r9, 0x12
jb 0x14006e700
lea rcx, [rbp - 0x20]
call fcn.140066920
test al, al
je 0x14006e752
mov qword [0], 1
mov byte [rbp - 0x20], Ordinal_41
mov byte [rbp - 0x1f], reloc.WLDAP32.dll_Ordinal_60
mov byte [rbp - 0x1e], 0x34
mov byte [rbp - 0x1d], 0x34
mov byte [rbp - 0x1c], Ordinal_41
mov byte [rbp - 0x1b], Ordinal_60
mov byte [rbp - 0x1a], reloc.WLDAP32.dll_Ordinal_60
mov byte [rbp - 0x19], Ordinal_45
mov byte [rbp - 0x18], WSAStartup
mov byte [rbp - 0x17], Ordinal_60
mov byte [rbp - 0x16], reloc.WLDAP32.dll_Ordinal_35
mov byte [rbp - 0x15], Ordinal_60
mov byte [rbp - 0x14], 0x51
movzx eax, byte [rbp - 0x20]
nop word [rax + rax]
movzx eax, byte [rbp + rbx - 0x20]
mov rcx, rbx
and ecx, edi
mov rdx, r14
cmp rcx, rdi
cmovae rcx, rdi
shl cl, 2
shr rdx, cl
and dl, dil
xor dl, al
lea eax, [rbx + 0x53]
xor dl, al
mov byte [rbp + rbx - 0x20], dl
inc rbx
cmp rbx, 0xd
jb 0x14006e790
lea rcx, [rbp - 0x20]
call fcn.140066920
test al, al
je 0x14006e7da
mov qword [0], 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret