Function at 0x140031640
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0xd8]
sub rsp, 0x1c0
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rbx, rcx
xor r12d, r12d
movdqa xmm0, xmmword [0x1401f5c10]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1401f5c00]
movdqu xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x1401f5d70]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0x447f697a
mov dword [rbp + 0x14], 0x79766e75
mov dword [rbp + 0x18], 0x11697e
mov ecx, r12d
lea edi, [r12 + 1]
lea edx, [rdi + 0x39]
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
add rcx, rdi
cmp rcx, rdx
jb 0x1400316bc
mov byte [rbp + 0x1b], r12b
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], r12b
lea rdx, [rbp - 0x1f]
lea rcx, [rbp - 0x80]
call fcn.140005250
nop
movdqa xmm0, xmmword [0x1401f5c70]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1401f5b30]
movdqu xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x1401f5b50]
movdqu xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1401f5970]
movdqu xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [0x1401f5cb0]
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1401f5990]
movdqu xmmword [rbp + 0x30], xmm1
mov byte [rbp + 0x40], r12b
mov rcx, r12
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
add rcx, rdi
cmp rcx, 0x5f
jb 0x140031746
mov byte [rbp + 0x40], r12b
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, pe_nt_image_headers64
or r8d, 0xffffffff
lea rdx, [rbp - 0x1f]
mov rcx, rbx
call fcn.1400b4140
mov edi, 0x1000
test eax, eax
jne 0x140031c8f
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1400823b8
cmp eax, 0x64
jne 0x140031ab6
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.1400dcd84
nop
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0x68]
call fcn.1400dcd84
nop
mov r8d, 2
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.1400dcd84
nop
mov r8d, 3
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.1400dcd84
nop
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
lea rcx, [rbp - 0x80]
call fcn.1400052c0
mov word [rsp + 0x40], 0x96c
mov byte [rsp + 0x42], r12b
lea rax, [rsp + 0x41]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x140031823
lea rdx, [rsp + 0x41]
lea rcx, [rbp - 0x80]
call fcn.1400052c0
lea rdx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0x10
cmovae rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x78]
lea rcx, [rbp - 0x80]
call fcn.1400052c0
mov word [rsp + 0x43], 0x92d
mov byte [rsp + 0x45], r12b
lea rax, [rsp + 0x44]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x14003186d
lea rdx, [rsp + 0x44]
lea rcx, [rbp - 0x80]
call fcn.1400052c0
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rdx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.1400052c0
mov word [rsp + 0x46], 0x929
mov byte [rsp + 0x48], r12b
lea rax, [rsp + 0x47]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x1400318b4
lea rdx, [rsp + 0x47]
lea rcx, [rbp - 0x80]
call fcn.1400052c0
lea rax, [rsp + 0x58]
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea rdx, [rsi + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140005338
nop
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x48]
call fcn.140005338
nop
lea r8, [rsp + 0x58]
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005a638
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140031933
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400052c0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14003197b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031976
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031ce9
call fcn.140173310
mov word [rsp + 0x50], 0xa45
mov byte [rsp + 0x52], r12b
lea rax, [rsp + 0x51]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x140031990
lea rdx, [rsp + 0x51]
lea rcx, [rbp - 0x80]
call fcn.1400052c0
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x1400319ea
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400319e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031cef
call fcn.140173310
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140031a26
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031a20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031cf5
call fcn.140173310
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x140031a65
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031a5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031cfb
call fcn.140173310
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140031aa0
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031a9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d01
call fcn.140173310
mov rcx, rbx
call fcn.1400823b8
cmp eax, 0x64
je 0x1400317a7
mov edi, 0x1000
mov al, 0x5e
mov dword [rsp + 0x58], 0x3d005e
mov dword [rsp + 0x5c], 0x3b002c
mov dword [rsp + 0x60], 0x37003a
mov dword [rsp + 0x64], 0x1002a
mov r10d, 1
mov dword [rsp + 0x68], 0x3f003d
mov dword [rsp + 0x6c], 0x3a002c
mov dword [rsp + 0x70], 0x70002d
mov dword [rsp + 0x74], 0x26002a
mov dword [rsp + 0x78], Ordinal_45
mov rcx, r12
movsx eax, al
xor word [rsp + rcx*2 + 0x5a], ax
add rcx, r10
cmp rcx, 0x10
jae 0x140031b20
mov al, byte [rsp + 0x58]
jmp 0x140031b09
mov word [rsp + 0x7a], r12w
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
lea rdx, [rsp + 0x5a]
lea rcx, [rbp - 0x40]
call fcn.140002cdc
nop
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.14000352c
nop
mov r8, rax
mov rdx, r15
lea rcx, [rbp + 0x48]
call fcn.140003644
nop
lea rcx, [rsp + 0x58]
call fcn.14000299c
nop
mov rdx, r14
lea rcx, [rbp - 0x60]
call fcn.14000352c
nop
mov r8, rax
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x88]
call fcn.140003644
nop
lea rcx, [rbp - 0x60]
call fcn.14000299c
nop
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x58]
call fcn.14000352c
nop
mov r8, rax
lea rdx, [rbp + 0x88]
lea rcx, [rbp - 0x20]
call fcn.140003644
nop
lea rcx, [rsp + 0x58]
call fcn.14000299c
nop
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x60]
call fcn.140003f34
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.140059680
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140031c31
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, rdi
jb 0x140031c2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d07
call fcn.140173310
nop
lea rcx, [rbp - 0x20]
call fcn.14000299c
nop
lea rcx, [rbp + 0x88]
call fcn.14000299c
nop
lea rcx, [rbp + 0x48]
call fcn.14000299c
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140031c8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, rdi
jb 0x140031c89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031d0d
call fcn.140173310
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140031cc2
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, rdi
jb 0x140031cbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031ce3
call fcn.140173310
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
int3