Function at 0x1400b6ad0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x1401ffe18]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r14, rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x48], 0x253d266e
mov dword [rsp + 0x4c], 0x2b273f29
mov word [rsp + 0x50], WSAStartup
mov byte [rsp + 0x52], 1
mov dword [rsp + 0x40], 0x262b276e
mov dword [rsp + 0x44], 0x1007029
mov dword [rsp + 0x68], 0x382f3a6e
mov dword [rsp + 0x6c], 0x2121243f
mov dword [rsp + 0x70], 0x6f3539
mov byte [rsp + 0x74], 1
mov dword [rsp + 0x58], 0x2e3a303c
mov dword [rsp + 0x5c], 0x2a262e71
mov dword [rsp + 0x60], 0x1003a33
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x38]
call fcn.1400b5760
nop
lea rdx, [r14 + 0x238]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400b6b9d
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140059f10
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x58]
call fcn.1400b4ea0
nop
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1400b6be3
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
mov rcx, rax
call fcn.140059f10
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 8]
call fcn.1400b5660
nop
lea rdx, [r14 + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400b6c32
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140059f10
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x1400b6c9c
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b6c97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b6c97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400b6ceb
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b6ce5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b6ce5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x1400b6d29
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b6d24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b6d24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400b6d78
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b6d72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b6d72
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400b6db6
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b6db1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b6db1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
lea rax, [rbp - 0x58]
mov qword [rbp + 0x28], rax
lea rdx, [r14 + 0x80]
lea rcx, [rbp - 0x58]
call fcn.140009090
mov r15, rax
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
lea rdi, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0x10
cmovae rdi, qword [rbp + 0x98]
mov rsi, qword [rbp + 0xa8]
cmp rsi, 0x10
jae 0x1400b6e1f
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x78], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x1400b6e9a
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x1400b6e78
add rcx, 0x27
call fcn.14010809c
mov rcx, rax
test rax, rax
je 0x1400b6e71
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400b6e87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400b6e84
call fcn.14010809c
jmp 0x1400b6e87
mov rax, r13
mov qword [rbp - 0x78], rax
lea r8, [rsi + 1]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rbx
mov r8, r15
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x78]
call fcn.1400bb220
nop
mov qword [rbp], r13
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x30]
call fcn.140006860
nop
mov dword [rsp + 0x30], 0x38392c25
mov dword [rsp + 0x34], 0x2b2a2d
mov byte [rsp + 0x38], 1
mov rcx, r13
nop dword [rax]
lea eax, [rcx + 0x48]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 7
jb 0x1400b6ef0
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
mov r8d, 7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.14005a030
nop
mov rbx, qword [rsp + 0x30]
movzx ecx, byte [rbp + 0x30]
test cl, cl
jne 0x1400b6f52
mov byte [rbp + 0x30], 1
call fcn.1400b5de0
mov qword [rbp + 0x38], rax
movzx ecx, byte [rbp + 0x30]
jmp 0x1400b6f56
mov rax, qword [rbp + 0x38]
cmp cl, 1
jne 0x1400b6f6b
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.14000c4d0
mov rbx, rax
mov qword [rbp + 0x58], r13
movdqa xmm0, xmmword [0x140114c50]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov dword [rsp + 0x40], 0x5f
cmp byte [rbx], 3
jne 0x1400b6f9c
mov rdx, qword [rbx + 8]
lea rax, [rbp + 0x58]
cmp rax, rdx
je 0x1400b6fb7
jmp 0x1400b6f9f
mov rdx, r13
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400b6fad
mov rdx, qword [rdx]
lea rcx, [rbp + 0x58]
call fcn.14005a030
nop
mov r8, qword [rbp - 0x80]
cmp r8, 0x10
jb 0x1400b6fd3
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.14005abb0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memset
mov edx, 1
lea rcx, [rbp + 0xc0]
call fcn.1400b5e60
nop
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
mov qword [rbp + 0x50], r13
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14010809c
mov qword [rbp + 0x40], rax
lea r9, [rax + 0x20]
mov qword [rbp + 0x50], r9
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rbp + 0x48], r9
mov rax, qword [rbp + 0x40]
sub r9, rax
lea r8, [rbp + 0x78]
cmp qword [rbp + 0x90], 0x10
cmovae r8, qword [rbp + 0x78]
lea rcx, [r14 + 0x258]
cmp qword [r14 + 0x270], 0x10
jb 0x1400b706b
mov rcx, qword [r14 + 0x258]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x88]
mov rdx, qword [r14 + 0x268]
call fcn.1400d13a0
mov r15, qword [rbp + 0x48]
mov rsi, qword [rbp + 0x40]
cmp rsi, r15
je 0x1400b70f1
movzx edi, byte [rsi]
lea rdx, [0x1400b8800]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], Ordinal_50
mov edx, 2
lea rcx, [rsp + 0x68]
call sub.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
mov edx, edi
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
inc rsi
cmp rsi, r15
jne 0x1400b7095
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0xc0]
call fcn.1400bb7e0
lea rdx, [0x1401ffdb8]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1401ffdb8]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1400b7126
mov rax, qword [rax]
cmp r8, qword [0x1401ffdc8]
jne 0x1400b713f
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400b713f
xor bl, bl
jmp 0x1400b7141
mov bl, 1
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400b717f
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b717a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b717a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401080d8
test bl, bl
je 0x1400b7246
lea r8, [r14 + 0x258]
lea rdx, str.Signature_checksum_failed._Request_was_tampered_with_or_session_ended_most_likely.__echo:__echo_Enckey:
lea rcx, [rbp - 0x58]
call fcn.1400b4d60
nop
mov r8d, Ordinal_30
lea rdx, str._echo:__echo_Message_:
mov rcx, rax
call fcn.140059f10
mov qword [rbp - 0x38], r13
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 0x10
cmovae rdx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x88]
lea rcx, [rbp - 0x38]
call fcn.140059f10
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp - 0x78]
call fcn.1400b82c0
nop
lea rcx, [rbp - 0x38]
call fcn.14000b160
nop
lea rcx, [rbp - 0x58]
call fcn.14000b160
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140008bc0
mov rdx, rax
mov rcx, r14
call fcn.1400ba2a0
nop
lea rcx, [rbp + 0x40]
call fcn.14000b550
nop
lea rcx, [rbp + 0xc0]
call fcn.1400b67f0
nop
lea rcx, [rbp + 0x58]
call fcn.14000b160
nop
movzx edx, byte [rbp + 0x30]
lea rcx, [rbp + 0x38]
call fcn.14005ae20
nop
lea rcx, [rbp + 0x78]
call fcn.14000b160
nop
lea rcx, [rbp + 0x98]
call fcn.14000b160
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140108a30
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret