Function at 0x1400025e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x68
mov eax, dword [r8]
mov r12, rdx
mov ecx, 0x40
mov rsi, r8
lea r13d, [rax*4 + 0x94]
mov edx, r13d
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x140002632
add rsp, 0x68
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
call fcn.14000b5b4
mov byte [rbp - 0x28], 0x76
xor ecx, ecx
mov byte [rbp - 0x27], 0x7f
mov byte [rbp - 0x26], WSACleanup
mov byte [rbp - 0x25], 0x7f
mov byte [rbp - 0x24], 0x7f
mov byte [rbp - 0x23], 0x75
mov byte [rbp - 0x22], 0x7b
mov byte [rbp - 0x21], 0x7a
mov byte [rbp - 0x20], 0x75
mov byte [rbp - 0x1f], WSAStartup
mov byte [rbp - 0x1e], 0x49
mov byte [rbp - 0x1d], 0x31
mov byte [rbp - 0x1c], 0x3c
mov byte [rbp - 0x1b], 0x41
mov byte [rbp - 0x1a], 0x84
mov byte [rbp - 0x19], 0x31
mov byte [rbp - 0x18], 0x3c
mov byte [rbp - 0x17], 0x44
mov byte [rbp - 0x16], 0x84
mov byte [rbp - 0x15], 0x31
mov byte [rbp - 0x14], 0x3c
mov byte [rbp - 0x13], 0x44
mov byte [rbp - 0x12], 0x84
mov byte [rbp - 0x11], 0x31
mov byte [rbp - 0x10], 0x3c
mov byte [rbp - 0xf], 0x44
mov byte [rbp - 0xe], 0x84
mov byte [rbp - 0xd], 0
movzx eax, byte [rbp - 0x28]
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x28]
sub al, 0xc
mov byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0x1b
jb 0x1400026c0
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0x60], r15
call fcn.14000b588
mov r9d, eax
lea r8, [rbp - 0x28]
mov eax, 0x80008001
mov rcx, r14
imul r9d
add edx, r9d
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xffff
mov rdx, rbx
sub r9d, eax
mov eax, dword [0x140025c6c]
mov dword [rsp + 0x30], eax
mov eax, dword [0x140025c70]
mov dword [rsp + 0x28], eax
mov eax, dword [0x140025c74]
mov dword [rsp + 0x20], eax
call fcn.140002500
test r12, r12
je 0x140002883
mov eax, dword [rsi]
test eax, eax
je 0x140002883
lea r15d, [r13 - 0x28]
mov r8d, eax
lea rdi, [r14 + 0x28]
test rax, rax
je 0x140002795
test rdi, rdi
jne 0x140002769
call fcn.140008ccc
mov dword [rax], 0x16
jmp 0x140002790
mov rcx, rdi
cmp r15, r8
jb 0x14000277b
mov rdx, r12
call fcn.1400085c0
jmp 0x140002795
mov r8, r15
xor edx, edx
call fcn.140005d00
call fcn.140008ccc
mov dword [rax], 0x22
call fcn.140008bac
cmp dword [rbp + 0x50], 0
je 0x1400027b2
mov edx, dword [rsi]
lea r8, [0x140025a44]
mov r9d, 0x20
mov rcx, rdi
call fcn.140001030
mov ebx, dword [rsi]
call fcn.14000b588
mov r9d, eax
lea rcx, [rbx + 0x28]
mov eax, 0x80008001
lea r8, str._04x
imul r9d
sub r13d, ebx
add rcx, r14
add edx, r9d
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xffff
lea edx, [r13 - 0x28]
sub r9d, eax
call fcn.140002500
mov eax, dword [rsi]
lea rdx, [rbp + 0x38]
add eax, 4
mov rcx, rdi
mov dword [rbp + 0x38], eax
call fcn.140001190
mov r12, rax
test rax, rax
je 0x140002876
mov ebx, dword [rbp + 0x38]
mov r8d, ebx
test ebx, ebx
je 0x140002866
test rdi, rdi
jne 0x14000282c
call fcn.140008ccc
mov dword [rax], 0x16
jmp 0x140002861
mov rcx, rdi
cmp r15, r8
jb 0x14000284c
mov rdx, r12
call fcn.1400085c0
lea eax, [rbx + 0x28]
mov rcx, r12
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140002889
mov r8, r15
xor edx, edx
call fcn.140005d00
call fcn.140008ccc
mov dword [rax], 0x22
call fcn.140008bac
lea eax, [rbx + 0x28]
mov rcx, r12
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140002889
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x14000288c
mov dword [rsi], 0x28
mov rax, r14
mov rdi, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x60]
add rsp, 0x68
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret