Function at 0x140076c70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
xor eax, eax
mov dword [rsp + 0x40], 0xd7e1312
xor edi, edi
mov dword [rsp + 0x44], 0x20102019
mov edx, edi
mov dword [rsp + 0x48], 0x2b3d273b
mov byte [rsp + 0x4c], al
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x140076cb0
movdqa xmm0, xmmword [0x140268200]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov edx, edi
xor eax, eax
mov word [rsp + 0x50], 0x2d3b
mov byte [rsp + 0x52], al
movdqu xmmword [rsp + 0x40], xmm0
nop
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x12
jb 0x140076cf0
movdqa xmm0, xmmword [0x1402681f0]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov edx, edi
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x532d3b
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x13
jb 0x140076d30
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xd7e1312
mov qword [rsp + 0x70], rax
mov edx, edi
xor eax, eax
mov dword [rsp + 0x44], 0x32133a1c
mov byte [rsp + 0x4a], al
mov word [rsp + 0x48], 0x2513
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x140076d70
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xd7e1312
mov qword [rsp + 0x78], rax
mov edx, edi
mov dword [rsp + 0x44], 0x34203a06
mov dword [rsp + 0x48], 0x3d311f38
mov word [rsp + 0x4c], 0x3f
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x140076dc0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xd7e1312
mov qword [rbp - 0x80], rax
mov edx, edi
mov dword [rsp + 0x44], 0x2520271a
mov dword [rsp + 0x48], 0x2c3a3212
mov word [rsp + 0x4c], 0x3d
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x140076e10
movdqa xmm0, xmmword [0x140268050]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov edx, edi
movdqu xmmword [rsp + 0x40], xmm0
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x140076e40
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xd7e1312
mov qword [rbp - 0x70], rax
mov edx, edi
xor eax, eax
mov dword [rsp + 0x44], 0x612141a
mov byte [rsp + 0x48], al
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x140076e80
lea rax, [rsp + 0x40]
mov dword [rbp + 0xd0], 0xd7e1312
mov qword [rbp - 0x68], rax
mov edx, edi
mov dword [rbp + 0xd4], 0x32233c
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0xd0]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 7
jb 0x140076ec0
movdqa xmm0, xmmword [0x140268130]
lea rax, [rbp + 0xd0]
mov qword [rbp - 0x60], rax
mov edx, edi
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], reloc.WS2_32.dll_recv
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x11
jb 0x140076f00
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xd7e1312
mov qword [rbp - 0x58], rax
mov edx, edi
mov dword [rsp + 0x44], 0x2d3b1104
mov dword [rsp + 0x48], 0x2a3d2211
mov word [rsp + 0x4c], reloc.WLDAP32.dll_Ordinal_46
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x140076f50
movdqa xmm0, xmmword [0x140268100]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x50], rax
mov edx, edi
xor eax, eax
mov byte [rsp + 0x50], al
movdqu xmmword [rsp + 0x40], xmm0
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x10
jb 0x140076f90
movdqa xmm0, xmmword [0x140268040]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x48], rax
mov edx, edi
movdqu xmmword [rsp + 0x40], xmm0
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x140076fc0
movdqa xmm0, xmmword [0x140268130]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x40], rax
mov edx, edi
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], reloc.WS2_32.dll_recv
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x11
jb 0x140077000
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xd7e1312
mov qword [rbp - 0x38], rax
mov edx, edi
mov dword [rsp + 0x44], 0x2d3b1104
mov dword [rsp + 0x48], 0x2a3d2211
mov word [rsp + 0x4c], reloc.WLDAP32.dll_Ordinal_46
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x140077050
movdqa xmm0, xmmword [0x1402681d0]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x30], rax
mov edx, edi
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x25040d37
mov word [rsp + 0x54], Ordinal_46
nop
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x15
jb 0x140077090
movdqa xmm0, xmmword [0x140268040]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x28], rax
mov edx, edi
movdqu xmmword [rsp + 0x40], xmm0
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x1400770c0
movdqa xmm0, xmmword [0x140268260]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x20], rax
mov edx, edi
xor eax, eax
mov dword [rsp + 0x50], 0x22301627
mov byte [rsp + 0x54], al
movdqu xmmword [rsp + 0x40], xmm0
nop
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x14
jb 0x140077100
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xd7e1312
mov qword [rbp - 0x18], rax
mov edx, edi
xor eax, eax
mov dword [rsp + 0x44], 0x3c373e24
mov byte [rsp + 0x48], al
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x140077140
movdqa xmm0, xmmword [0x140268120]
lea rax, [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov edx, edi
xor eax, eax
mov byte [rsp + 0x50], al
movdqu xmmword [rsp + 0x40], xmm0
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x10
jb 0x140077180
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x38220b12
mov qword [rbp - 8], rax
mov edx, edi
mov dword [rsp + 0x44], 0x9263624
mov dword [rsp + 0x48], 0x2c3a3a20
mov word [rsp + 0x4c], reloc.WLDAP32.dll_Ordinal_41
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x1400771d0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x38220b12
mov qword [rbp], rax
mov edx, edi
mov dword [rsp + 0x44], 0x9263624
mov dword [rsp + 0x48], 0x303f3a20
mov word [rsp + 0x4c], 0x3e
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x140077220
movdqa xmm0, xmmword [0x140268190]
lea rax, [rsp + 0x40]
mov qword [rbp + 8], rax
mov edx, edi
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x43215
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x13
jb 0x140077260
movdqa xmm0, xmmword [0x140268220]
lea rax, [rsp + 0x40]
mov qword [rbp + 0x10], rax
mov edx, edi
xor eax, eax
mov word [rsp + 0x50], 0x303b
mov byte [rsp + 0x52], al
movdqu xmmword [rsp + 0x40], xmm0
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x12
jb 0x1400772a0
movdqa xmm0, xmmword [0x140268240]
lea rax, [rsp + 0x40]
mov qword [rbp + 0x18], rax
mov edx, edi
xor eax, eax
mov byte [rsp + 0x50], al
movdqu xmmword [rsp + 0x40], xmm0
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x10
jb 0x1400772e0
movdqa xmm0, xmmword [0x1402680e0]
lea rax, [rsp + 0x40]
mov qword [rbp + 0x20], rax
mov edx, edi
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x7d
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x11
jb 0x140077320
movdqa xmm0, xmmword [0x1402680f0]
lea rax, [rsp + 0x40]
mov qword [rbp + 0x28], rax
mov edx, edi
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x341011
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x13
jb 0x140077360
movdqa xmm0, xmmword [0x1402681e0]
lea rax, [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov edx, edi
xor eax, eax
mov dword [rsp + 0x50], 0x15012d3b
mov byte [rsp + 0x5e], al
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x54], 0x260a0c0b
mov dword [rsp + 0x58], 0x1d061209
mov word [rsp + 0x5c], 0x190f
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x1e
jb 0x1400773c0
movdqa xmm0, xmmword [0x140268230]
lea rax, [rsp + 0x40]
mov qword [rbp + 0x38], rax
mov edx, edi
xor eax, eax
mov byte [rsp + 0x50], al
movdqu xmmword [rsp + 0x40], xmm0
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0x10
jb 0x140077400
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x25222618
mov qword [rbp + 0x40], rax
mov edx, edi
mov dword [rsp + 0x44], 0x2793c3b
mov dword [rsp + 0x48], 0x4393f
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xb
jb 0x140077440
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x293f0d18
mov qword [rbp + 0x48], rax
mov edx, edi
xor eax, eax
mov dword [rsp + 0x44], 0x38303705
mov byte [rsp + 0x48], al
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x140077480
lea rax, [rsp + 0x40]
mov dword [rbp + 0xd0], 0x293f0d18
mov qword [rbp + 0x50], rax
mov edx, edi
xor eax, eax
mov word [rbp + 0xd4], 0x1501
mov byte [rbp + 0xd6], al
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp + 0xd0]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 6
jb 0x1400774c0
lea rax, [rbp + 0xd0]
mov dword [rsp + 0x40], 0x293f0d18
mov qword [rbp + 0x58], rax
mov edx, edi
mov dword [rsp + 0x44], 0x26213c1f
mov word [rsp + 0x48], gethostname
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x140077500
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x293f0d18
mov qword [rbp + 0x60], rax
mov edx, edi
mov dword [rsp + 0x44], 0x26312615
mov word [rsp + 0x48], Ordinal_35
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x140077540
lea rax, [rsp + 0x40]
mov dword [rbp + 0xd0], 0x38332238
mov qword [rbp + 0x68], rax
mov edx, edi
xor eax, eax
mov byte [rbp + 0xd4], al
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0xd0]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 4
jb 0x140077580
lea rax, [rbp + 0xd0]
mov dword [rbp + 0xd0], 0x36382238
mov qword [rbp + 0x70], rax
mov edx, edi
xor eax, eax
mov word [rbp + 0xd4], 0x2034
mov byte [rbp + 0xd6], al
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0xd0]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 6
jb 0x1400775d0
lea rax, [rbp + 0xd0]
mov dword [rbp + 0xd0], 0x3e3d2238
mov qword [rbp + 0x78], rax
mov edx, edi
mov dword [rbp + 0xd4], 0x312027
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0xd0]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 7
jb 0x140077610
lea rax, [rbp + 0xd0]
mov dword [rsp + 0x40], 0x343d2238
mov qword [rbp + 0x80], rax
mov edx, edi
xor eax, eax
mov dword [rsp + 0x44], 0x3920303f
mov byte [rsp + 0x48], al
nop
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x140077650
lea rax, [rsp + 0x40]
mov dword [rbp + 0xd0], 0x22252238
mov qword [rbp + 0x88], rax
mov edx, edi
mov word [rbp + 0xd4], Ordinal_50
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0xd0]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 5
jb 0x140077690
lea rax, [rbp + 0xd0]
mov dword [rsp + 0x40], 0x22252238
mov qword [rbp + 0x90], rax
mov edx, edi
xor eax, eax
mov dword [rsp + 0x44], 0x203b3e30
mov byte [rsp + 0x4a], al
mov word [rsp + 0x48], 0x3225
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x1400776e0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0xe282238
mov qword [rbp + 0x98], rax
mov edx, edi
xor eax, eax
mov dword [rsp + 0x44], 0x34332521
mov byte [rsp + 0x48], al
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x140077720
lea rax, [rsp + 0x40]
mov dword [rbp + 0xd0], 0x3f282238
mov qword [rbp + 0xa0], rax
mov edx, edi
xor eax, eax
mov word [rbp + 0xd4], 0x2737
mov byte [rbp + 0xd6], al
movsxd rax, edx
lea rcx, [rbp + 0xd0]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 6
jb 0x140077760
lea rax, [rbp + 0xd0]
mov dword [rbp + 0xd0], 0x69282238
mov qword [rbp + 0xa8], rax
mov edx, edi
mov word [rbp + 0xd4], 0x64
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp + 0xd0]
add rcx, rax
lea eax, [rdx + 0x4e]
inc edx
xor byte [rcx], al
cmp edx, 5
jb 0x1400777a0
lea rax, [rbp + 0xd0]
mov rbx, rdi
mov qword [rbp + 0xb0], rax
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x60]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x140077820
inc rbx
cmp rbx, 0x2b
jl 0x1400777d0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140069c20
lea rcx, [0x140a37c30]
call fcn.1400719e0
call fcn.140069c20
mov ecx, 1
call fcn.1402339b8
int3