Function at 0x140047608
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov r14, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
xor r12d, r12d
mov eax, dword [rcx + rdx]
cmp dword [0x14021dc94], eax
jg 0x1400479b0
mov al, 0x37
mov dword [rsp + 0x50], 0x650037
mov dword [rsp + 0x54], 0x560058
mov dword [rsp + 0x58], 0x5e005a
mov dword [rbp - 0x7d], 0x500059
mov dword [rbp - 0x79], 0x53006b
mov dword [rbp - 0x75], 0x44005e
mov dword [rbp - 0x71], 0x580054
mov dword [rbp - 0x6d], 0x530045
mov word [rbp - 0x69], r12w
mov rcx, r12
movsx eax, al
xor word [rsp + rcx*2 + 0x52], ax
inc rcx
cmp rcx, 0xf
jae 0x1400476a6
mov al, byte [rsp + 0x50]
jmp 0x14004768f
mov word [rbp - 0x69], r12w
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x51], r12
mov ebx, 7
mov qword [rbp - 0x49], rbx
mov word [rbp - 0x61], r12w
lea rdx, [rsp + 0x52]
lea rcx, [rbp - 0x61]
call fcn.140002cdc
nop
lea rdx, [rbp - 0x61]
lea rcx, [rbp + 7]
call fcn.140002e0c
nop
mov r13d, 0x1000
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x140047720
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, r13
jb 0x14004771b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140047a34
call fcn.140173310
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], rbx
mov word [rbp - 0x61], r12w
lea rax, [0x14021cf60]
mov qword [rbp + 0x7f], rax
mov rcx, rax
call fcn.140171ac0
test eax, eax
jne 0x140047a3a
mov rdi, qword [r14]
mov r15, qword [r14 + 8]
cmp rdi, r15
je 0x140047965
lea rdx, [0x140216db8]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x140216db8]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14004777c
mov rcx, qword [rdi]
mov rax, qword [rdi + 0x10]
cmp rax, qword [0x140216dc8]
jae 0x14004778e
mov al, r12b
jmp 0x14004779f
mov r8, qword [0x140216dc8]
call fcn.140176500
test eax, eax
sete al
test al, al
je 0x14004795c
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x21]
call fcn.14005af40
nop
mov r9, qword [rdi + 0x10]
mov r8, qword [0x140216dc8]
sub r9, r8
lea rdx, [rbp - 0x41]
mov rcx, rdi
call fcn.140048798
mov rdx, rax
mov rcx, rdi
call fcn.14000fa24
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x140047811
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, r13
jb 0x14004780c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140047a42
call fcn.140173310
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp + 0x77]
call fcn.140048894
nop
mov edx, dword [rdi + 0x10]
mov dword [rbp + 0x6f], edx
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140047832
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
mov rbx, qword [rbp + 0x77]
mov r9, rbx
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x14004791b
lea rax, [rbp - 0x41]
mov qword [rbp - 1], rax
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x41]
call fcn.140005338
nop
mov esi, dword [rbp + 0x6f]
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], reloc.WS2_32.dll_ntohs
lea rcx, [rbp - 0x61]
cmp rsi, 0xf
ja 0x1400478b5
mov qword [rbp - 0x51], rsi
mov r8d, esi
mov rdx, rbx
call fcn.140175840
mov byte [rbp + rsi - 0x61], r12b
jmp 0x1400478c5
mov r9, rbx
mov r8b, byte [rbp + 0x6f]
mov rdx, rsi
call fcn.140005450
nop
lea r8, [rbp - 0x41]
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x50]
call fcn.14005a638
mov rdx, rax
mov rcx, rdi
call fcn.14000fa24
mov rdx, qword [rbp - 0x71]
cmp rdx, 0x10
jb 0x14004791b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r13
jb 0x140047915
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140047a48
call fcn.140173310
nop
test rbx, rbx
je 0x140047929
mov rcx, rbx
call fcn.140173310
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x14004795c
inc rdx
mov rcx, qword [rbp - 0x21]
cmp rdx, r13
mov rax, rcx
jb 0x140047957
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400479aa
call fcn.140173310
add rdi, 0x20
jmp 0x14004774f
mov r9, qword [r14 + 8]
mov r8, qword [r14]
mov rdx, qword [0x14021d758]
call fcn.14004898c
nop
lea rcx, [0x14021cf60]
call fcn.140171ac8
nop
lea rcx, [rbp + 7]
call fcn.14000f320
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14018273c
nop
lea rcx, [0x14021dc94]
call fcn.140173838
cmp dword [0x14021dc94], 0xffffffff
jne 0x14004764a
mov cl, reloc.WLDAP32.dll_Ordinal_22
mov dword [rsp + 0x40], 0x61477216
mov dword [rsp + 0x44], 0x412f6122
mov dword [rsp + 0x48], 0x47754e71
mov word [rsp + 0x4c], Ordinal_50
mov rax, r12
xor byte [rsp + rax + 0x41], cl
inc rax
cmp rax, 0xc
jae 0x140047a00
mov cl, byte [rsp + 0x40]
jmp 0x1400479ed
mov byte [rsp + 0x4d], r12b
lea rdx, [rsp + 0x41]
lea rcx, [0x140216db8]
call fcn.140005250
lea rcx, [0x1401bcd3c]
call fcn.14017358c
nop
lea rcx, [0x14021dc94]
call fcn.1401737d8
jmp 0x14004764a
call fcn.14018273c
int3
mov ecx, eax
call fcn.140171bd4
nop
call fcn.14018273c
nop
call fcn.14018273c
int3