Function at 0x1400d8b90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xf8
mov rax, qword [0x1403f20c0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, rcx
mov r15, r8
lea rcx, [0x14048d6c2]
mov rbx, rdx
call fcn.140289ea0
test rbx, rbx
je 0x1400d9159
test r15, r15
je 0x1400d9159
mov qword [rsp + 0xe8], r12
lea rax, [rbp - 5]
xor r12d, r12d
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0x38], r12
lea r8, [rbp - 1]
mov qword [rsp + 0x30], rax
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x28], r12d
mov edx, 0x80862007
mov rcx, rdi
mov qword [rsp + 0x20], r12
mov qword [rsp + 0xe0], r14
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r12
mov qword [rbp - 1], Ordinal_41
mov qword [rbp + 0x17], rbx
mov dword [rbp - 5], r12d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400d8dcd
mov al, 0x5c
mov dword [rbp - 0x79], 0x7005c
mov dword [rbp - 0x75], 0x10071
mov ecx, r12d
mov dword [rbp - 0x71], 0x1a007c
mov dword [rbp - 0x6d], 0x35003d
mov dword [rbp - 0x69], 0x390030
mov dword [rbp - 0x65], 0x7c0038
mov dword [rbp - 0x61], 0x330028
mov dword [rbp - 0x5d], 0x28007c
mov dword [rbp - 0x59], 0x3d002e
mov dword [rbp - 0x55], 0x2f0032
mov dword [rbp - 0x51], 0x3d0030
mov dword [rbp - 0x4d], 0x390028
mov dword [rbp - 0x49], 0x2a007c
mov dword [rbp - 0x45], 0x2e0035
mov dword [rbp - 0x41], 0x290028
mov dword [rbp - 0x3d], 0x30003d
mov dword [rbp - 0x39], 0x3d007c
mov dword [rbp - 0x35], 0x380038
mov dword [rbp - 0x31], 0x39002e
mov dword [rbp - 0x2d], 0x2f002f
mov dword [rbp - 0x29], 0x6c007c
mov dword [rbp - 0x25], Ordinal_41
movsx eax, al
xor word [rbp + rcx*2 - 0x77], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x75], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x73], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x71], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x6f], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x6d], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x6b], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x69], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x67], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x65], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x63], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x61], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x5f], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x5d], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x5b], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x59], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x57], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x55], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x53], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x51], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x4f], ax
add rcx, 0x15
cmp rcx, 0x2a
jae 0x1400d8db0
movzx eax, byte [rbp - 0x79]
jmp 0x1400d8ce1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x77]
mov word [rbp - 0x23], r12w
call fcn.1400e0430
mov rdx, rbx
jmp 0x1400d8f9e
mov rsi, qword [rbp + 0xf]
mov r14d, Ordinal_50
test rsi, rsi
je 0x1400d8e39
mov qword [rsp + 0x38], r12
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x79]
xorps xmm0, xmm0
mov dword [rsp + 0x28], r12d
mov r9d, r14d
mov qword [rsp + 0x20], r12
mov edx, 0x80862007
mov qword [rbp - 0x61], r12
mov rcx, rdi
mov qword [rbp - 0x51], listen
movdqu xmmword [rbp - 0x71], xmm0
mov qword [rbp - 0x79], Ordinal_32
mov qword [rbp - 0x59], rsi
mov dword [rbp - 9], r12d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rbx, qword [rbp - 0x61]
test eax, eax
cmove rbx, r12
jmp 0x1400d8e3c
mov rbx, r12
test rbx, rbx
jne 0x1400d8fea
mov cl, reloc.WLDAP32.dll_Ordinal_35
mov word [rbp - 0x79], reloc.WLDAP32.dll_Ordinal_35
movsx r11d, cl
movzx eax, r11w
mov word [rbp - 0x37], r12w
xor ax, 0x78
movzx edx, r11w
mov word [rbp - 0x77], ax
movzx ecx, r11w
movzx eax, r11w
xor dx, 0x4c
xor ax, 0xe
mov word [rbp - 0x5f], dx
mov word [rbp - 0x75], ax
xor cx, 0x53
movzx eax, r11w
mov word [rbp - 0x57], cx
xor ax, 0x7e
mov word [rbp - 0x4b], cx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
movzx r10d, r11w
mov word [rbp - 0x73], ax
xor r10w, 3
movzx eax, r11w
mov word [rbp - 0x41], dx
xor ax, 0x65
mov word [rbp - 0x71], r10w
mov word [rbp - 0x6f], ax
lea rdx, [rbp - 0x77]
movzx eax, r11w
mov word [rbp - 0x63], r10w
xor ax, 0x4a
mov word [rbp - 0x5d], r10w
mov word [rbp - 0x6b], ax
movzx r9d, r11w
movzx eax, r11w
mov word [rbp - 0x55], r10w
xor ax, 0x4f
mov word [rbp - 0x4f], r10w
mov word [rbp - 0x69], ax
xor r9w, 0x42
movzx eax, r11w
mov word [rbp - 0x6d], r9w
xor ax, 0x47
mov word [rbp - 0x59], r9w
mov word [rbp - 0x65], ax
movzx r8d, r11w
movzx eax, r11w
mov word [rbp - 0x49], r9w
xor ax, 0x57
mov word [rbp - 0x43], r10w
mov word [rbp - 0x61], ax
xor r8w, 0x46
movzx eax, r11w
mov word [rbp - 0x67], r8w
xor ax, 0x4e
mov word [rbp - 0x45], r8w
mov word [rbp - 0x5b], ax
movzx eax, r11w
xor ax, 0x6a
mov word [rbp - 0x3d], r10w
mov word [rbp - 0x53], ax
movzx eax, r11w
xor ax, 0x6c
mov word [rbp - 0x51], ax
movzx eax, r11w
xor ax, 0x50
mov word [rbp - 0x4d], ax
movzx eax, r11w
xor ax, 0x40
mov word [rbp - 0x47], ax
movzx eax, r11w
xor ax, 0x45
mov word [rbp - 0x3f], ax
movzx eax, r11w
xor ax, 0x13
xor r11w, 0x5b
mov word [rbp - 0x3b], ax
mov word [rbp - 0x39], r11w
call fcn.1400e0430
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400e0620]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
mov rsi, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1402889f0
add rsp, 0xf8
pop r15
pop rdi
pop rbx
pop rbp
ret
mov r9d, listen
mov r8, r15
mov rdx, rbx
mov rcx, rdi
call fcn.1400d8a70
mov qword [rsp + 0x38], r12
lea r8, [rbp - 0x79]
movzx r15d, al
mov qword [rbp - 0x59], r12
lea rax, [rbp - 9]
mov qword [rbp - 0x51], listen
mov qword [rsp + 0x30], rax
mov ecx, reloc.WLDAP32.dll_Ordinal_26
xorps xmm0, xmm0
mov qword [rbp - 0x79], rcx
mov dword [rsp + 0x28], r12d
mov r9d, r14d
mov edx, 0x80862007
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov qword [rbp - 0x61], rbx
movdqu xmmword [rbp - 0x71], xmm0
mov dword [rbp - 9], r12d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400d9150
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x79]
call fcn.1400d9160
mov r9, rax
mov r10d, 3
lea rdx, [rax + 2]
lea r8, [rax + 4]
nop dword [rax]
movsx ecx, byte [r9]
xor word [r8 - 2], cx
lea r8, [r8 + 0x22]
movsx ecx, byte [r9]
xor word [r8 - 0x22], cx
movsx eax, byte [r9]
xor word [r8 - 0x20], ax
movsx eax, byte [r9]
xor word [r8 - 0x1e], ax
movsx eax, byte [r9]
xor word [r8 - 0x1c], ax
movsx eax, byte [r9]
xor word [r8 - 0x1a], ax
movsx eax, byte [r9]
xor word [r8 - 0x18], ax
movsx eax, byte [r9]
xor word [r8 - 0x16], ax
movsx eax, byte [r9]
xor word [r8 - 0x14], ax
movsx eax, byte [r9]
xor word [r8 - 0x12], ax
movsx eax, byte [r9]
xor word [r8 - 0x10], ax
movsx eax, byte [r9]
xor word [r8 - 0xe], ax
movsx eax, byte [r9]
xor word [r8 - 0xc], ax
movsx eax, byte [r9]
xor word [r8 - 0xa], ax
movsx eax, byte [r9]
xor word [r8 - 8], ax
movsx eax, byte [r9]
xor word [r8 - 6], ax
movsx eax, byte [r9]
xor word [r8 - 4], ax
sub r10, 1
jne 0x1400d9080
mov rcx, rbx
mov word [rdx + 0x66], r12w
call fcn.1400e0430
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400e0620]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
movzx eax, r15b
jmp 0x1400d8fb9
xor al, al
jmp 0x1400d8fd1