Function at 0x1400f1be0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xf8
mov rax, qword [0x14041d0c0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, rcx
mov r14, r8
lea rcx, [0x1404b98c7]
mov rbx, rdx
call fcn.1402b13b0
test rbx, rbx
je 0x1400f21a9
test r14, r14
je 0x1400f21a9
mov qword [rsp + 0xe8], r12
lea rax, [rbp - 5]
xor r12d, r12d
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0x38], r12
lea r8, [rbp - 1]
mov qword [rsp + 0x30], rax
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x28], r12d
mov edx, 0x80862007
mov rcx, rdi
mov qword [rsp + 0x20], r12
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r12
mov qword [rbp - 1], Ordinal_41
mov qword [rbp + 0x17], rbx
mov dword [rbp - 5], r12d
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x1400f1e2c
mov qword [rsp + 0xe0], r15
mov al, 0x18
mov r15, qword [rsp + 0xe0]
mov ecx, r12d
mov dword [rbp - 0x79], 0x430018
mov dword [rbp - 0x75], 0x450035
mov dword [rbp - 0x71], 0x5e0038
mov dword [rbp - 0x6d], 0x710079
mov dword [rbp - 0x69], 0x7d0074
mov dword [rbp - 0x65], 0x38007c
mov dword [rbp - 0x61], 0x77006c
mov dword [rbp - 0x5d], 0x6c0038
mov dword [rbp - 0x59], 0x79006a
mov dword [rbp - 0x55], 0x6b0076
mov dword [rbp - 0x51], 0x790074
mov dword [rbp - 0x4d], 0x7d006c
mov dword [rbp - 0x49], 0x6e0038
mov dword [rbp - 0x45], 0x6a0071
mov dword [rbp - 0x41], 0x6d006c
mov dword [rbp - 0x3d], 0x740079
mov dword [rbp - 0x39], 0x790038
mov dword [rbp - 0x35], 0x7c007c
mov dword [rbp - 0x31], 0x7d006a
mov dword [rbp - 0x2d], 0x6b006b
mov dword [rbp - 0x29], 0x280038
mov dword [rbp - 0x25], 0x60
nop dword [rax]
movsx eax, al
xor word [rbp + rcx*2 - 0x77], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x75], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x73], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x71], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x6f], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x6d], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x6b], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x69], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x67], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x65], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x63], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x61], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x5f], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x5d], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x5b], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x59], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x57], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x55], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x53], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x51], ax
movsx eax, byte [rbp - 0x79]
xor word [rbp + rcx*2 - 0x4f], ax
add rcx, 0x15
cmp rcx, 0x2a
jae 0x1400f1e0f
movzx eax, byte [rbp - 0x79]
jmp 0x1400f1d40
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x77]
mov word [rbp - 0x23], r12w
call fcn.1400f9480
mov rdx, rbx
jmp 0x1400f1ff1
mov rsi, qword [rbp + 0xf]
test rsi, rsi
je 0x1400f1e95
mov qword [rsp + 0x38], r12
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x79]
xorps xmm0, xmm0
mov dword [rsp + 0x28], r12d
mov r9d, Ordinal_50
mov qword [rsp + 0x20], r12
mov edx, 0x80862007
mov qword [rbp - 0x61], r12
mov rcx, rdi
mov qword [rbp - 0x51], recvfrom
movdqu xmmword [rbp - 0x71], xmm0
mov qword [rbp - 0x79], Ordinal_27
mov qword [rbp - 0x59], rsi
mov dword [rbp - 9], r12d
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov rbx, qword [rbp - 0x61]
test eax, eax
cmove rbx, r12
jmp 0x1400f1e98
mov rbx, r12
test rbx, rbx
jne 0x1400f2035
mov cl, reloc.WLDAP32.dll_Ordinal_32
mov word [rbp - 0x79], reloc.WLDAP32.dll_Ordinal_32
movsx r10d, cl
movzx eax, r10w
mov word [rbp - 0x71], r10w
xor ax, 0x7b
mov word [rbp - 0x63], r10w
mov word [rbp - 0x77], ax
movzx edx, r10w
movzx eax, r10w
mov word [rbp - 0x5d], r10w
xor ax, 0xd
mov word [rbp - 0x55], r10w
mov word [rbp - 0x75], ax
movzx ecx, r10w
movzx eax, r10w
mov word [rbp - 0x4f], r10w
xor ax, 0x7d
mov word [rbp - 0x43], r10w
mov word [rbp - 0x73], ax
xor dx, 0x4f
movzx eax, r10w
mov word [rbp - 0x3d], r10w
xor ax, 0x66
mov word [rbp - 0x5f], dx
mov word [rbp - 0x6f], ax
xor cx, 0x50
movzx eax, r10w
mov word [rbp - 0x57], cx
xor ax, 0x49
mov word [rbp - 0x4b], cx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
movzx r9d, r10w
mov word [rbp - 0x6b], ax
xor r9w, 0x41
movzx eax, r10w
mov word [rbp - 0x41], dx
xor ax, 0x4c
mov word [rbp - 0x6d], r9w
mov word [rbp - 0x69], ax
lea rdx, [rbp - 0x77]
movzx eax, r10w
mov word [rbp - 0x59], r9w
xor ax, 0x44
mov word [rbp - 0x49], r9w
mov word [rbp - 0x65], ax
movzx r8d, r10w
movzx eax, r10w
mov word [rbp - 0x37], r12w
xor ax, 0x54
xor r8w, 0x45
mov word [rbp - 0x61], ax
movzx eax, r10w
xor ax, 0x4d
mov word [rbp - 0x67], r8w
mov word [rbp - 0x5b], ax
movzx eax, r10w
xor ax, 0x69
mov word [rbp - 0x45], r8w
mov word [rbp - 0x53], ax
movzx eax, r10w
xor ax, 0x6f
mov word [rbp - 0x51], ax
movzx eax, r10w
xor ax, 0x53
mov word [rbp - 0x4d], ax
movzx eax, r10w
xor ax, 0x43
mov word [rbp - 0x47], ax
movzx eax, r10w
xor ax, 0x46
mov word [rbp - 0x3f], ax
movzx eax, r10w
xor ax, 0x10
xor r10w, 0x58
mov word [rbp - 0x3b], ax
mov word [rbp - 0x39], r10w
call fcn.1400f9480
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400f9670]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
mov rsi, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1402aff00
add rsp, 0xf8
pop r14
pop rdi
pop rbx
pop rbp
ret
mov r9d, recvfrom
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.1400f1ac0
mov qword [rsp + 0x38], r12
lea r8, [rbp - 0x79]
movzx r14d, al
mov qword [rbp - 0x59], r12
lea rax, [rbp - 9]
mov qword [rbp - 0x51], recvfrom
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
mov dword [rsp + 0x28], r12d
mov r9d, Ordinal_50
mov edx, 0x80862007
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov qword [rbp - 0x79], reloc.WLDAP32.dll_Ordinal_26
movdqu xmmword [rbp - 0x71], xmm0
mov qword [rbp - 0x61], rbx
mov dword [rbp - 9], r12d
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x1400f21a0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x79]
call fcn.1400f21b0
mov r9, rax
mov r10d, 3
lea rdx, [rax + 2]
lea r8, [rax + 4]
nop word [rax + rax]
movsx ecx, byte [r9]
xor word [r8 - 2], cx
lea r8, [r8 + 0x22]
movsx ecx, byte [r9]
xor word [r8 - 0x22], cx
movsx eax, byte [r9]
xor word [r8 - 0x20], ax
movsx eax, byte [r9]
xor word [r8 - 0x1e], ax
movsx eax, byte [r9]
xor word [r8 - 0x1c], ax
movsx eax, byte [r9]
xor word [r8 - 0x1a], ax
movsx eax, byte [r9]
xor word [r8 - 0x18], ax
movsx eax, byte [r9]
xor word [r8 - 0x16], ax
movsx eax, byte [r9]
xor word [r8 - 0x14], ax
movsx eax, byte [r9]
xor word [r8 - 0x12], ax
movsx eax, byte [r9]
xor word [r8 - 0x10], ax
movsx eax, byte [r9]
xor word [r8 - 0xe], ax
movsx eax, byte [r9]
xor word [r8 - 0xc], ax
movsx eax, byte [r9]
xor word [r8 - 0xa], ax
movsx eax, byte [r9]
xor word [r8 - 8], ax
movsx eax, byte [r9]
xor word [r8 - 6], ax
movsx eax, byte [r9]
xor word [r8 - 4], ax
sub r10, 1
jne 0x1400f20d0
mov rcx, rbx
mov word [rdx + 0x66], r12w
call fcn.1400f9480
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400f9670]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
movzx eax, r14b
jmp 0x1400f200c
xor al, al
jmp 0x1400f201c