Function at 0x1400e30e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rbx, rcx
mov rsi, rdx
lea rcx, [0x14048d6c2]
call fcn.140289ea0
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400e3533
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
cmp dword [rax], 0x4550
jne 0x1400e3533
test rax, rax
je 0x1400e3533
mov ecx, dword [rax + 0xd8]
test ecx, ecx
jne 0x1400e31b8
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x69]
call fcn.1400e3540
mov r9, rax
mov r10d, reloc.WS2_32.dll_socket
lea rdx, [rax + 2]
lea r8, [rax + 4]
nop
movsx ecx, byte [r9]
xor word [r8 - 2], cx
lea r8, [r8 + 8]
movsx ecx, byte [r9]
xor word [r8 - 8], cx
movsx eax, byte [r9]
xor word [r8 - 6], ax
movsx eax, byte [r9]
xor word [r8 - 4], ax
sub r10, 1
jne 0x1400e3160
xor r8d, r8d
mov rcx, rbx
mov word [rdx + 0xb8], r8w
call fcn.1400e0430
lea rdx, [0x1400e0620]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
jmp 0x1400e32d6
mov qword [rsp + 0xf0], rdi
mov rdi, qword [rcx + rbx + 0x58]
test rdi, rdi
jne 0x1400e32eb
xor r8d, r8d
mov dword [rbp - 0x69], 0x780023
mov word [rbp - 9], r8w
mov ecx, r8d
mov al, reloc.WLDAP32.dll_Ordinal_35
mov dword [rbp - 0x65], 0x7e0008
mov dword [rbp - 0x61], 0x700003
mov dword [rbp - 0x5d], 0x420057
mov dword [rbp - 0x59], 0x480040
mov dword [rbp - 0x55], 0x4c0060
mov dword [rbp - 0x51], 0x48004c
mov dword [rbp - 0x4d], 0x46004a
mov dword [rbp - 0x49], 0x4d0003
mov dword [rbp - 0x45], 0x57004c
mov dword [rbp - 0x41], 0x470003
mov dword [rbp - 0x3d], 0x450046
mov dword [rbp - 0x39], 0x4d004a
mov dword [rbp - 0x35], 0x470046
mov dword [rbp - 0x31], 0x3000f
mov dword [rbp - 0x2d], 0x4a0045
mov dword [rbp - 0x29], 0x3005b
mov dword [rbp - 0x25], 0x4c0040
mov dword [rbp - 0x21], 0x48004c
mov dword [rbp - 0x1d], 0x46004a
mov dword [rbp - 0x19], 0x500003
mov dword [rbp - 0x15], 0x4a0048
mov dword [rbp - 0x11], 0x530053
mov dword [rbp - 0xd], 0x470046
nop dword [rax]
nop word [rax + rax]
movsx eax, al
xor word [rbp + rcx*2 - 0x67], ax
inc rcx
cmp rcx, 0x2f
jae 0x1400e32a7
movzx eax, byte [rbp - 0x69]
jmp 0x1400e3290
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x67]
mov word [rbp - 9], r8w
call fcn.1400e0430
lea rdx, [0x1400e0620]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
mov rdi, qword [rsp + 0xf0]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
sub rbx, rsi
movabs rsi, 0x2b992ddfa232
add rdi, rbx
cmp qword [rdi], rsi
je 0x1400e33f2
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x69]
call fcn.1400e3700
mov r9, rax
mov edx, 3
lea r8, [rax + 4]
movsx ecx, byte [r9]
xor word [r8 - 2], cx
lea r8, [r8 + 0x22]
movsx ecx, byte [r9]
xor word [r8 - 0x22], cx
movsx eax, byte [r9]
xor word [r8 - 0x20], ax
movsx eax, byte [r9]
xor word [r8 - 0x1e], ax
movsx eax, byte [r9]
xor word [r8 - 0x1c], ax
movsx eax, byte [r9]
xor word [r8 - 0x1a], ax
movsx eax, byte [r9]
xor word [r8 - 0x18], ax
movsx eax, byte [r9]
xor word [r8 - 0x16], ax
movsx eax, byte [r9]
xor word [r8 - 0x14], ax
movsx eax, byte [r9]
xor word [r8 - 0x12], ax
movsx eax, byte [r9]
xor word [r8 - 0x10], ax
movsx eax, byte [r9]
xor word [r8 - 0xe], ax
movsx eax, byte [r9]
xor word [r8 - 0xc], ax
movsx eax, byte [r9]
xor word [r8 - 0xa], ax
movsx eax, byte [r9]
xor word [r8 - 8], ax
movsx eax, byte [r9]
xor word [r8 - 6], ax
movsx eax, byte [r9]
xor word [r8 - 4], ax
sub rdx, 1
jne 0x1400e3320
xor r8d, r8d
lea rdx, [r9 + 2]
mov rcx, rbx
mov word [r9 + 0x68], r8w
call fcn.1400e0430
lea rdx, [0x1400e0620]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x1400e32ce
mov cl, 0x41
mov word [rbp - 0x69], 0x41
movsx r9d, cl
movzx eax, r9w
movzx r8d, r9w
xor ax, 0x1a
xor r8w, 0x28
mov word [rbp - 0x67], ax
movzx ecx, r9w
xor cx, 0x61
mov word [rbp - 0x5d], r8w
movzx eax, r9w
mov word [rbp - 0x59], r8w
xor ax, 0x6a
mov word [rbp - 0x3d], r8w
mov word [rbp - 0x65], ax
movzx edx, r9w
movzx eax, r9w
mov word [rbp - 0x61], cx
xor ax, 0x1c
mov word [rbp - 0x53], cx
mov word [rbp - 0x63], ax
xor dx, 0x2a
movzx eax, r9w
mov word [rbp - 0x49], dx
xor ax, 7
mov word [rbp - 0x47], cx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
xor r8d, r8d
mov word [rbp - 0x5f], ax
movzx eax, r9w
xor ax, 0x39
mov word [rbp - 0x3f], dx
mov word [rbp - 0x5b], ax
lea rdx, [rbp - 0x67]
movzx eax, r9w
mov word [rbp - 0x39], r8w
xor ax, 0x2f
mov word [rbp - 0x57], ax
movzx eax, r9w
xor ax, 0x26
mov word [rbp - 0x55], ax
movzx eax, r9w
xor ax, 0x32
mov word [rbp - 0x51], ax
movzx eax, r9w
xor ax, 0x35
mov word [rbp - 0x4f], ax
movzx eax, r9w
xor ax, 0x20
mov word [rbp - 0x4d], ax
movzx eax, r9w
xor ax, 0x22
mov word [rbp - 0x4b], ax
mov word [rbp - 0x45], ax
movzx eax, r9w
xor ax, 0x2e
xor r9w, 0x24
mov word [rbp - 0x43], ax
mov word [rbp - 0x41], ax
mov word [rbp - 0x3b], r9w
call fcn.1400e0430
lea rdx, [0x1400e0620]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
xor rcx, rsi
cmp rcx, rsi
cmove rcx, rax
mov qword [rdi], rcx
jmp 0x1400e32cc
xor al, al
jmp 0x1400e32d6