Function at 0x140061c30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r13
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140131080]
xor rax, rsp
mov qword [rbp + 0x37], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
lea r15, [rbp + 0x5f]
movabs r13, 0xff00ff00ff00ff00
mov qword [rbp + 0x27], r13
mov qword [rbp + 0x2f], r15
mov rax, qword [r15]
xor rax, r13
mov qword [rbp + 0x1f], rax
mov qword [r15], 0
cmp qword [0x14036db08], 0
jne 0x140061f6b
mov byte [rbp - 0x19], 0x57
mov byte [rbp - 0x18], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x17], Ordinal_79
mov byte [rbp - 0x16], Ordinal_33
mov byte [rbp - 0x15], Ordinal_33
mov byte [rbp - 0x14], 0x51
mov byte [rbp - 0x13], 7
mov byte [rbp - 0x12], 0x4a
mov byte [rbp - 0x11], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x10], 0x43
mov byte [rbp - 0xf], Ordinal_35
movzx eax, byte [rbp - 0x19]
xor r9d, r9d
movabs rdi, 0xc83ccf3840caa723
mov r10, rdi
lea rax, [rbp - 0x19]
sub r10, rax
mov esi, reloc.WS2_32.dll_ntohs
nop dword [rax + rax]
lea r8, [rbp - 0x19]
add r8, r9
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rdx, rdi
shr rdx, cl
and dl, sil
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x19], dl
inc r9
cmp r9, 0xb
jb 0x140061cf0
lea rcx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
jne 0x140061e63
lea r12, [rbp + 0x5f]
mov rbx, qword [r12]
mov qword [r12], rax
mov byte [rbp - 0x29], 0x55
mov byte [rbp - 0x28], 0x55
mov byte [rbp - 0x27], 0x47
mov byte [rbp - 0x26], 0x5e
mov byte [rbp - 0x25], reloc.WLDAP32.dll_Ordinal_30
mov byte [rbp - 0x24], reloc.WLDAP32.dll_Ordinal_22
mov byte [rbp - 0x23], 7
mov byte [rbp - 0x22], 0x4a
mov byte [rbp - 0x21], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x20], 0x43
mov byte [rbp - 0x1f], Ordinal_35
movzx eax, byte [rbp - 0x29]
xor r9d, r9d
mov r10, rdi
lea rax, [rbp - 0x29]
sub r10, rax
nop dword [rax + rax]
lea r8, [rbp - 0x29]
add r8, r9
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rdx, rdi
shr rdx, cl
and dl, sil
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x29], dl
inc r9
cmp r9, 0xb
jb 0x140061d90
lea rcx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [rbp - 0x29], 0x57
mov byte [rbp - 0x28], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x27], Ordinal_79
mov byte [rbp - 0x26], Ordinal_33
mov byte [rbp - 0x25], Ordinal_33
mov byte [rbp - 0x24], 0x51
mov byte [rbp - 0x23], 7
mov byte [rbp - 0x22], 0x4a
mov byte [rbp - 0x21], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x20], 0x43
mov byte [rbp - 0x1f], Ordinal_35
movzx eax, byte [rbp - 0x29]
xor r9d, r9d
mov r10, rdi
lea rax, [rbp - 0x29]
sub r10, rax
lea r8, [rbp - 0x29]
add r8, r9
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rdx, rdi
shr rdx, cl
and dl, sil
lea eax, [r10 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 0x29], dl
inc r9
cmp r9, 0xb
jb 0x140061e10
lea rcx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10, rax
mov qword [r12], rbx
test rax, rax
je 0x140061f88
mov byte [rbp - 9], 0x7e
mov byte [rbp - 8], 0x43
mov byte [rbp - 7], WSAStartup
mov byte [rbp - 6], 0x55
mov byte [rbp - 5], 0x5c
mov byte [rbp - 4], WSASetLastError
mov byte [rbp - 3], 0x79
mov byte [rbp - 2], WSAStartup
mov byte [rbp - 1], 0x69
mov byte [rbp], 0x7a
mov byte [rbp + 1], 0x7f
mov byte [rbp + 2], reloc.WS2_32.dll_WSACleanup
mov byte [rbp + 3], 0x76
mov byte [rbp + 4], reloc.WS2_32.dll_socket
mov byte [rbp + 5], Ordinal_45
mov byte [rbp + 6], 0xa
mov byte [rbp + 7], 0x25
mov byte [rbp + 8], 0x33
mov byte [rbp + 9], 6
mov byte [rbp + 0xa], reloc.WLDAP32.dll_Ordinal_46
mov byte [rbp + 0xb], reloc.WLDAP32.dll_Ordinal_41
mov byte [rbp + 0xc], reloc.WLDAP32.dll_Ordinal_41
mov byte [rbp + 0xd], gethostname
mov byte [rbp + 0xe], reloc.WS2_32.dll_sendto
mov byte [rbp + 0xf], 0x3f
mov byte [rbp + 0x10], reloc.WLDAP32.dll_Ordinal_46
mov byte [rbp + 0x11], reloc.WLDAP32.dll_Ordinal_46
mov byte [rbp + 0x12], 0x35
mov byte [rbp + 0x13], Ordinal_45
mov byte [rbp + 0x14], gethostname
mov byte [rbp + 0x15], reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp + 0x16], Ordinal_50
mov byte [rbp + 0x17], 0x50
movzx eax, byte [rbp - 9]
xor r9d, r9d
movabs rbx, 0xf3838d36ace27033
mov r11, rbx
lea rax, [rbp - 9]
sub r11, rax
nop dword [rax]
nop word [rax + rax]
lea r8, [rbp - 9]
add r8, r9
mov rcx, r9
and ecx, esi
cmp rcx, rsi
cmovae rcx, rsi
shl cl, 2
mov rdx, rbx
shr rdx, cl
and dl, sil
lea eax, [r11 + r8]
xor dl, al
movzx eax, byte [r8]
xor dl, al
mov byte [rbp + r9 - 9], dl
inc r9
cmp r9, 0x21
jb 0x140061f10
lea rdx, [rbp - 9]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14036db08], rax
test rax, rax
jne 0x140061f6b
mov qword [0x14036db08], rax
jmp 0x140061f8e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
call fcn.140061fd0
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp rbx, rax
je 0x140061f8c
xor al, al
jmp 0x140061f8e
mov al, 1
mov rcx, qword [rbp + 0x1f]
xor rcx, r13
mov qword [r15], rcx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400f6140
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop rbp
ret