Function at 0x14000b4e0
Capabilities:
Contain obfuscated stackstrings
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14018d0c0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r13d, r13d
mov dword [rbp + 0x80], r13d
mov dword [rsp + 0x36], 0x8000869
mov cl, 8
mov dword [rsp + 0x32], 0x7c696c78
mov word [rsp + 0x30], 0x7869
lea rax, [rsp + 0x30]
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x38]
cmp rax, rcx
je 0x14000b556
movzx ecx, byte [rsp + 0x39]
jmp 0x14000b540
mov byte [rsp + 0x38], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], r13b
jne 0x14000b573
call fcn.1400e0384
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rbx
lea r8, [rbp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x20]
call fcn.1400093b0
nop
lea rdx, [rbp + 0x20]
lea r15, [0x14018d278]
mov rcx, r15
call fcn.140009600
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14000b5f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b5eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b5eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
mov dword [rsp + 0x49], 0xb000b53
mov cl, 0xb
mov dword [rsp + 0x45], 0x26796e63
mov dword [rsp + 0x41], 0x68657e6a
mov byte [rsp + 0x40], 0x47
lea rax, [rsp + 0x40]
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x4b]
cmp rax, rcx
je 0x14000b636
movzx ecx, byte [rsp + 0x4c]
jmp 0x14000b620
mov byte [rsp + 0x4b], 1
lea rax, [rsp + 0x40]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000b643
call fcn.1400e0384
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rbx
lea r8, [rbp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x20]
call fcn.1400093b0
nop
lea rdx, [rbp + 0x20]
mov rcx, r15
call fcn.140009600
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14000b6be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b6b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
call fcn.14000a200
test al, al
jne 0x14000b6ee
mov rcx, r15
cmp qword [reloc.WS2_32.dll_getsockopt], 7
cmova rcx, qword [0x14018d278]
call fcn.1400e05e4
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14000bce1
mov dword [rsp + 0x7a], 0x14001460
mov cl, reloc.WS2_32.dll_sendto
mov dword [rsp + 0x76], 0x6c603a7a
mov dword [rsp + 0x72], 0x7b7d6766
mov dword [rsp + 0x6e], 0x71426671
mov dword [rsp + 0x6a], 0x7c777a61
mov word [rsp + 0x68], 0x7558
lea rax, [rsp + 0x68]
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x7c]
cmp rax, rcx
je 0x14000b746
movzx ecx, byte [rsp + 0x7d]
jmp 0x14000b730
mov byte [rsp + 0x7c], 1
lea rax, [rsp + 0x68]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000b753
call fcn.1400e0384
lea rcx, [rsp + 0x68]
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rbx
lea r8, [rbp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x20]
call fcn.1400093b0
nop
lea rdx, [rbp + 0x20]
mov rcx, r15
call fcn.140009600
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14000b7ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b7c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b7c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
lea rax, [rbp]
mov qword [rbp + 0x40], rax
mov r14, r15
cmp qword [reloc.WS2_32.dll_getsockopt], 7
cmova r14, qword [0x14018d278]
mov rsi, qword [0x14018d288]
call fcn.1400e0384
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], 0
mov dword [rbp + 0x80], 0x23f
test rsi, rsi
je 0x14000b88d
cmp rsi, 0x7fffffff
ja 0x14000bceb
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.1400e03f4
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000bcf1
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp]
call fcn.14000fa30
lea r9, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r9, qword [rbp]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r12d
call fcn.1400e03f4
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14000bcd7
mov dword [rbp - 0x13], 0x4f004f3b
mov cl, reloc.WLDAP32.dll_Ordinal_79
mov dword [rbp - 0x17], 0x373b6121
mov dword [rbp - 0x1b], 0x20263c3d
mov dword [rbp - 0x1f], 0x2a193d2a
mov dword [rbp - 0x23], 0x272c213a
mov dword [rbp - 0x27], 0x2e036021
mov dword [rbp - 0x2b], 0x262e2260
mov dword [rbp - 0x2f], 0x17622a21
mov dword [rbp - 0x33], 0x2628210a
mov dword [rbp - 0x37], 0x603c3b2e
mov dword [rbp - 0x3b], 0x2a270c2a
mov dword [rbp - 0x3f], 0x35201d60
mov dword [rbp - 0x43], 0x22202c61
mov dword [rbp - 0x47], 0x3b212a3b
mov dword [rbp - 0x4b], 0x21202c3d
mov dword [rbp - 0x4f], 0x2a3c3a2d
mov dword [rbp - 0x53], 0x3a273b26
mov dword [rbp - 0x57], 0x2861382e
mov dword [rbp - 0x5b], 0x3d606075
mov dword [rbp - 0x5f], 0x3c3f3b3b
mov byte [rbp - 0x60], Ordinal_41
lea rax, [rbp - 0x60]
nop dword [rax]
nop word [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x11]
cmp rax, rcx
je 0x14000b944
movzx ecx, byte [rbp - 0x10]
jmp 0x14000b930
mov byte [rbp - 0x11], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
lea rax, [rbp - 0x60]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000b960
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.140006fc0
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x20]
call fcn.14000b360
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memset
cmp qword [reloc.WS2_32.dll_getsockopt], 7
cmova r15, qword [0x14018d278]
mov rdx, r15
lea rcx, [rbp + 0x90]
call fcn.140019500
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x90], rax
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x8c], edx
lea rdx, [rbp + 0xa0]
lea rcx, [0x14018d190]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], 0
mov dword [rbp + 0x80], 0x9ff
mov ecx, dword [0x14018d208]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000ba58
mov rax, qword [0x14018d1d8]
mov rbx, qword [rax]
test rbx, rbx
je 0x14000ba58
mov rax, qword [0x14018d1b8]
mov r9, qword [rax]
cmp rbx, qword [0x14018d200]
cmovb rbx, qword [0x14018d200]
jmp 0x14000ba83
test cl, 4
jne 0x14000bab7
mov rax, qword [0x14018d1d0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000bab7
mov rax, qword [0x14018d1b0]
mov r9, qword [rax]
mov rax, qword [0x14018d1e8]
movsxd rbx, dword [rax]
add rbx, rcx
mov rax, r9
sub rbx, r9
test rax, rax
je 0x14000bab7
lea rcx, [rbp]
cmp rbx, 0xf
ja 0x14000baae
mov qword [rbp + 0x10], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx], 0
jmp 0x14000bab7
mov rdx, rbx
call fcn.140018660
nop
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
inc rdi
cmp byte [rdx + rdi], 0
jne 0x14000bad4
mov r8, rdi
lea rcx, [rbp + 0x60]
call fcn.140006fc0
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rbx, qword [rbp + 0x60]
mov dword [rax], r13d
mov r8d, 0xa
lea rdx, [rbp + 0x80]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov esi, eax
cmp rbx, qword [rbp + 0x80]
jne 0x14000bb33
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rdi], 0x22
jne 0x14000bb46
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14000bb84
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bb7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
movdqa xmm0, xmmword [0x140177db0]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14000bbd3
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bbce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bbce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e0d84
cmp esi, 1
jne 0x14000bbe1
movzx ebx, sil
jmp 0x14000bc98
mov dword [rsp + 0x5e], 0x10001078
mov cl, reloc.WS2_32.dll_recv
mov dword [rsp + 0x5a], 0x64655130
mov dword [rsp + 0x56], 0x6c304830
mov dword [rsp + 0x52], 0x757e7977
mov word [rsp + 0x50], 0x7e55
lea rax, [rsp + 0x50]
nop
xor byte [rax], cl
inc rax
lea rcx, [rsp + 0x60]
cmp rax, rcx
je 0x14000bc26
movzx ecx, byte [rsp + 0x61]
jmp 0x14000bc10
mov byte [rsp + 0x60], 1
mov dword [rbp - 0x70], 0x12001276
mov cl, reloc.WS2_32.dll_select
mov dword [rbp - 0x74], 0x77667376
mov dword [rbp - 0x78], 0x66675d32
mov dword [rbp - 0x7c], 0x60777a71
mov dword [rbp - 0x80], 0x7c67735e
lea rax, [rbp - 0x80]
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], cl
inc rax
lea rcx, [rbp - 0x6e]
cmp rax, rcx
je 0x14000bc74
movzx ecx, byte [rbp - 0x6d]
jmp 0x14000bc60
mov byte [rbp - 0x6e], 1
mov r9d, Ordinal_50
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov byte [reloc.WS2_32.dll_accept], 0
xor bl, bl
lea rcx, [rbp + 0x90]
call fcn.14000bd00
movzx eax, bl
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400e0ae0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rcx, 0x20
call fcn.140007930
nop
shr rdx, 0x20
call fcn.14000a140
nop
call fcn.140007660
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140007930
int3