Function at 0x14013a7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x560
mov qword [rsp + 0x518], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov eax, dword [0x1404bda88]
and eax, 1
test eax, eax
jne 0x14013a7ef
mov eax, dword [0x1404bda88]
or eax, 1
mov dword [0x1404bda88], eax
lea rcx, [0x1404bda80]
call fcn.14001e2b0
lea rcx, [rsp + 0x28]
call fcn.140002de0
nop
mov eax, 0x43
mov word [rsp + 0x498], ax
mov eax, 0x43
mov word [rsp + 0x49a], ax
mov eax, 0x42
mov word [rsp + 0x49c], ax
mov eax, reloc.WSOCK32.dll_WSAGetLastError
mov word [rsp + 0x49e], ax
mov eax, reloc.WSOCK32.dll_WSAGetLastError
mov word [rsp + 0x4a0], ax
mov eax, reloc.WSOCK32.dll_WSACleanup
mov word [rsp + 0x4a2], ax
xor eax, eax
mov word [rsp + 0x4a4], ax
mov eax, 0x2e
mov word [rsp + 0x440], ax
mov eax, 0x65
mov word [rsp + 0x442], ax
mov eax, 0x78
mov word [rsp + 0x444], ax
mov eax, 0x65
mov word [rsp + 0x446], ax
xor eax, eax
mov word [rsp + 0x448], ax
lea rdx, [rsp + 0x498]
lea rcx, [rsp + 0x28]
call fcn.1400020d0
cmp dword [0x1404bd9f4], 0
jne 0x14013a9fd
lea rcx, [rsp + 0x4b0]
call fcn.1400767b0
nop
lea rdx, [0x1403b58d0]
add rdx, 0x228
lea r8, [0x140235d5c]
lea rcx, [rsp + 0x4e8]
call fcn.1400010b0
mov qword [rsp + 0x520], rax
mov rax, qword [rsp + 0x520]
mov qword [rsp + 0x528], rax
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x528]
lea rcx, [rsp + 0x4f0]
call fcn.140006bd0
mov qword [rsp + 0x530], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x538], rax
lea r8, [rsp + 0x440]
mov rdx, qword [rsp + 0x538]
lea rcx, [rsp + 0x4f8]
call fcn.1400010b0
mov qword [rsp + 0x540], rax
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0x548], rax
mov rcx, qword [rsp + 0x548]
call fcn.14000f8f0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x4b0]
call fcn.1400768b4
mov dword [rsp + 0x4e0], eax
lea rcx, [rsp + 0x4f8]
call fcn.140001490
nop
lea rcx, [rsp + 0x4f0]
call fcn.140001490
nop
lea rcx, [rsp + 0x4e8]
call fcn.140001490
cmp dword [rsp + 0x4e0], 0
je 0x14013a9d9
lea rcx, [rsp + 0x4b0]
call fcn.1400764bc
lea rdx, [0x1404bda80]
lea rcx, [rsp + 0x4b0]
call fcn.1400766e4
lea rcx, [rsp + 0x4b0]
call fcn.1400763e8
mov dword [0x1404bd9f4], 1
lea rcx, [rsp + 0x4b0]
call fcn.14007680c
lea rcx, [rsp + 0x500]
call fcn.14000e290
mov r8, qword [0x1404bda80]
lea rdx, [rsp + 0x490]
mov rcx, rax
call fcn.14000e250
lea rcx, [rsp + 0x490]
call fcn.14000e230
mov qword [rsp + 0x4a8], rax
mov ecx, dword [rsp + 0x4a8]
call fcn.14001e290
mov ebx, eax
mov ecx, 5
call fcn.1401398f0
add eax, 5
cmp ebx, eax
jge 0x14013aa76
mov dword [rsp + 0x508], 1
lea rcx, [rsp + 0x28]
call fcn.140001490
mov eax, dword [rsp + 0x508]
jmp 0x14013acc5
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x450], 0
mov r8d, 0x200
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, 0x2e
lea rcx, [rsp + 0x40]
call fcn.140001460
mov r11, rax
xor eax, eax
mov word [r11], ax
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x40]
call fcn.1400a99b0
mov r11d, 0x69
mov word [rsp + 0x458], r11w
mov eax, WSASetLastError
mov word [rsp + 0x45a], ax
mov eax, 0x61
mov word [rsp + 0x45c], ax
mov eax, 0x67
mov word [rsp + 0x45e], ax
mov eax, 0x65
mov word [rsp + 0x460], ax
mov eax, 0x68
mov word [rsp + 0x462], ax
mov eax, WSASetLastError
mov word [rsp + 0x464], ax
mov eax, reloc.WSOCK32.dll_WSASetLastError
mov word [rsp + 0x466], ax
mov eax, 0x2e
mov word [rsp + 0x468], ax
mov eax, 0x64
mov word [rsp + 0x46a], ax
mov eax, WSASetLastError
mov word [rsp + 0x46c], ax
mov eax, WSASetLastError
mov word [rsp + 0x46e], ax
xor eax, eax
mov word [rsp + 0x470], ax
cmp qword [0x1404bd9f8], 0
jne 0x14013ab8c
lea rcx, [rsp + 0x458]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1404bd9f8], rax
mov byte [rsp + 0x478], 0x4d
mov byte [rsp + 0x479], 0x61
mov byte [rsp + 0x47a], 0x70
mov byte [rsp + 0x47b], 0x46
mov byte [rsp + 0x47c], 0x69
mov byte [rsp + 0x47d], 0x6c
mov byte [rsp + 0x47e], 0x65
mov byte [rsp + 0x47f], 0x41
mov byte [rsp + 0x480], 0x6e
mov byte [rsp + 0x481], 0x64
mov byte [rsp + 0x482], 0x43
mov byte [rsp + 0x483], 0x68
mov byte [rsp + 0x484], 0x65
mov byte [rsp + 0x485], 0x63
mov byte [rsp + 0x486], 0x6b
mov byte [rsp + 0x487], 0x53
mov byte [rsp + 0x488], 0x75
mov byte [rsp + 0x489], 0x6d
mov byte [rsp + 0x48a], 0x57
mov byte [rsp + 0x48b], 0
lea rdx, [rsp + 0x478]
mov rcx, qword [0x1404bd9f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x450]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call qword [rsp + 0x30]
test eax, eax
je 0x14013ac7e
mov dword [rsp + 0x50c], 0
lea rcx, [rsp + 0x28]
call fcn.140001490
mov eax, dword [rsp + 0x50c]
jmp 0x14013acc5
mov eax, dword [rsp + 0x450]
cmp dword [rsp + 0x20], eax
je 0x14013aca9
mov dword [rsp + 0x510], 0
lea rcx, [rsp + 0x28]
call fcn.140001490
mov eax, dword [rsp + 0x510]
jmp 0x14013acc5
mov dword [rsp + 0x514], 1
lea rcx, [rsp + 0x28]
call fcn.140001490
mov eax, dword [rsp + 0x514]
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0x560
pop rbx
ret