Function at 0x1400af87c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov r14, qword [rsp + 0x210]
mov rbp, rcx
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0xa0]
xor r15d, r15d
mov rcx, rax
mov byte [rsp + 0xa0], 0x43
mov byte [rsp + 0xa1], WSAStartup
mov rbx, rax
mov byte [rsp + 0xa2], reloc.WS2_32.dll_WSAAsyncSelect
mov byte [rsp + 0xa3], WSAAsyncSelect
mov byte [rsp + 0xa4], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xa5], reloc.WS2_32.dll_WSAAsyncSelect
mov byte [rsp + 0xa6], 0x50
mov byte [rsp + 0xa7], WSAStartup
mov byte [rsp + 0xa8], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0xa9], WSAAsyncSelect
mov byte [rsp + 0xaa], reloc.WS2_32.dll_WSAAsyncSelect
mov byte [rsp + 0xab], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xac], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xad], 0x41
mov byte [rsp + 0xae], r15b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
cmp rax, r15
je 0x1400afb26
lea rdx, [rsp + 0xa0]
mov rcx, rbx
mov byte [rsp + 0xa0], 0x43
mov byte [rsp + 0xa1], WSAStartup
mov byte [rsp + 0xa2], reloc.WS2_32.dll_WSAAsyncSelect
mov byte [rsp + 0xa3], WSAAsyncSelect
mov byte [rsp + 0xa4], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xa5], reloc.WS2_32.dll_WSAAsyncSelect
mov byte [rsp + 0xa6], 0x50
mov byte [rsp + 0xa7], WSACancelAsyncRequest
mov byte [rsp + 0xa8], WSAStartup
mov byte [rsp + 0xa9], reloc.WS2_32.dll_WSAAsyncSelect
mov byte [rsp + 0xaa], r15b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
cmp rax, r15
je 0x1400afb26
lea rcx, [rbp + 0xf0]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x60], 0x18
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
call rbx
cmp al, r15b
je 0x1400afb1c
lea rdx, [rbp + 0xf8]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x58]
xor r9d, r9d
call rbx
mov r12b, al
cmp al, r15b
je 0x1400afb1c
lea rsi, [rbp + 0x118]
lea ebx, [r15 + 0x68]
xor edx, edx
mov r8, rbx
mov rcx, rsi
call fcn.1400e1fc0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x168], rcx
mov qword [rbp + 0x170], rax
mov dword [rsi], ebx
mov word [rbp + 0x158], r15w
mov dword [rbp + 0x154], 0x101
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x30], r15d
lea r9, [rbp + 0x178]
mov r8, rbx
mov rcx, rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
lea r11, [rbp + 0x100]
xor r9d, r9d
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call r13
cmp al, r15b
je 0x1400afb14
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 0x180], eax
jmp 0x1400afb17
mov r12b, r15b
cmp r12b, r15b
jne 0x1400afb26
xor edx, edx
mov rcx, rbp
call fcn.1400af578
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x19]
call fcn.1400e1fc0
mov eax, dword [rbp + 0x110]
lea rdx, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x84], eax
mov dword [rsp + 0x78], 0x33120101
call fcn.1400ae91c
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400e2890
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret