Function at 0x14000fe40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x14008c118]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov r13, r9
mov r15, r8
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x60], r9
mov rsi, qword [rsp + 0x140]
mov qword [rsp + 0x58], rsi
call fcn.14001d1c0
mov r14, rax
test rax, rax
jne 0x14000fe9d
mov rcx, rsi
call fcn.140001ce0
jmp 0x1400107df
xor edi, edi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x98], dil
mov qword [rsp + 0xb8], rdi
movdqa xmm0, xmmword [0x14006eca0]
movdqu xmmword [rsp + 0xc8], xmm0
mov byte [rsp + 0xb8], dil
mov r8, r15
mov rdx, r12
mov rcx, rbx
call fcn.14000e770
nop
mov r8, qword [0x14008c7d0]
mov edx, 0x2712
mov rcx, r14
call fcn.14001f9c0
lea edx, [rdi + 0x51]
lea r8d, [rdi + 1]
mov rcx, r14
call fcn.14001f9c0
mov dword [rsp + 0x80], 0x20273f27
mov dword [rsp + 0x84], 0x3d3a3d
mov byte [rsp + 0x88], 1
mov ecx, edi
nop word [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x80], al
inc rcx
cmp rcx, 7
jb 0x14000ff40
mov byte [rsp + 0x88], 0
lea r8, [rsp + 0x80]
mov edx, 0x2722
mov rcx, r14
call fcn.14001f9c0
mov r8, r12
mov edx, 0x27c1
mov rcx, r14
call fcn.14001f9c0
mov edx, 0x40
lea r8d, [rdx - 0x3f]
mov rcx, r14
call fcn.14001f9c0
mov r8, rsi
lea r15, [rsi + 0x18]
mov qword [rsp + 0x80], r15
cmp qword [r15], 0x10
jb 0x14000ffa9
mov r8, qword [rsi]
mov edx, 0x271f
mov rcx, r14
call fcn.14001f9c0
lea r8, [0x140011300]
mov edx, 0x4e2b
mov rcx, r14
call fcn.14001f9c0
lea r8, [rsp + 0x98]
mov edx, 0x2711
mov rcx, r14
call fcn.14001f9c0
lea r8, [0x14000eb00]
mov edx, 0x4e6f
mov rcx, r14
call fcn.14001f9c0
lea r8, [rsp + 0xb8]
mov edx, 0x272d
mov rcx, r14
call fcn.14001f9c0
nop
mov rcx, r14
call fcn.14001d280
mov ebx, eax
mov rcx, r14
call fcn.14001d1a0
mov rcx, qword [0x14008c7d0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
jne 0x1400101f6
lea rbx, [rsp + 0x98]
cmp qword [rsp + 0xb0], 0x10
cmovae rbx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa8]
cmp rax, 5
jb 0x1400100f0
lea r14, [rax + rbx]
lea r8, [r14 - 4]
sub r8, rbx
mov edx, 0x65
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x1400100f0
lea r12, str.error
nop dword [rax]
nop word [rax + rax]
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [r12 + rcx - 1]
jne 0x1400100b9
cmp rcx, 5
jne 0x1400100a0
mov eax, edi
jmp 0x1400100be
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400100e3
inc r9
lea r8, [r14 - 4]
sub r8, r9
mov edx, 0x65
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140010090
jmp 0x1400100f0
sub r9, rbx
cmp r9, 0xffffffffffffffff
jne 0x1400101f6
mov ecx, 0x1024
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x14008ca60], rax
invalid
add byte [rbx], dh
rol byte [rcx - 0x48], cl
and al, 0x10
add byte [rax], al
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x98]
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0xb0]
cmp r9, 0x10
cmovae rcx, r8
sub r13, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rcx + r13], al
lea rcx, [rcx + 1]
test al, al
jne 0x140010140
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0x10
jb 0x1400101a2
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001018d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010706
call fcn.14006ab5c
mov r9, qword [rsp + 0xb0]
mov r8, qword [rsp + 0x98]
movdqa xmm0, xmmword [0x14006eca0]
movdqu xmmword [rsp + 0xc8], xmm0
mov byte [rsp + 0xb8], 0
cmp r9, 0x10
jb 0x140010443
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400101ee
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010765
mov rcx, r8
jmp 0x14001043e
mov eax, dword [rsp + 0x148]
cmp eax, 1
je 0x1400102ca
cmp eax, 2
je 0x1400104ad
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140002d90
mov rdx, rax
xor eax, eax
mov word [rsp + 0x30], ax
mov dword [rsp + 0x60], 0x3e3e2b3a
mov dword [rsp + 0x64], 0x312d2022
mov dword [rsp + 0x68], 0x3b307c3f
mov word [rsp + 0x6c], gethostname
mov byte [rsp + 0x6e], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xd
jb 0x140010250
mov byte [rsp + 0x6e], 0
mov dword [rsp + 0x90], 0x223a28
mov byte [rsp + 0x94], 1
mov rcx, rdi
nop dword [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x90], al
inc rcx
cmp rcx, 3
jb 0x140010280
mov byte [rsp + 0x94], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdx
mov r9, r13
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call fcn.14000fe40
test al, al
jne 0x1400103a4
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140002d90
mov rdx, rax
xor eax, eax
mov word [rsp + 0x30], ax
mov dword [rsp + 0x80], 0x3e3e2b3a
mov dword [rsp + 0x84], 0x312d2022
mov dword [rsp + 0x88], 0x3b307c3f
mov word [rsp + 0x8c], gethostname
mov byte [rsp + 0x8e], 1
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x80], al
inc rcx
cmp rcx, 0xd
jb 0x140010320
mov byte [rsp + 0x8e], 0
mov dword [rsp + 0x60], 0x29392527
mov dword [rsp + 0x64], 0x36223d
mov byte [rsp + 0x68], 1
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x49]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 7
jb 0x140010360
mov byte [rsp + 0x68], 0
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rdx
mov r9, r13
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
call fcn.14000fe40
test al, al
je 0x1400104ad
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0x10
jb 0x1400103e7
inc rdx
mov rcx, qword [rsp + 0xb8]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400103e2
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010706
call fcn.14006ab5c
movdqa xmm0, xmmword [0x14006eca0]
mov byte [rsp + 0xb8], 0
movdqu xmmword [rsp + 0xc8], xmm0
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0x10
jb 0x140010443
inc rdx
mov rcx, qword [rsp + 0x98]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14001043e
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010765
call fcn.14006ab5c
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x98], 0
mov rdx, qword [r15]
cmp rdx, 0x10
jb 0x140010498
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140010493
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010804
mov rcx, r8
call fcn.14006ab5c
mov qword [rsi + 0x10], rdi
mov qword [r15], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov al, 1
jmp 0x1400107e1
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0x10
jb 0x1400104f0
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400104eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010706
call fcn.14006ab5c
movdqa xmm0, xmmword [0x14006eca0]
movdqu xmmword [rsp + 0xc8], xmm0
mov byte [rsp + 0xb8], 0
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0x10
jb 0x14001054c
inc rdx
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010547
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010765
call fcn.14006ab5c
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x98], 0
mov rdx, qword [r15]
cmp rdx, 0x10
jb 0x1400105a1
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14001059c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010804
mov rcx, r8
call fcn.14006ab5c
mov qword [rsi + 0x10], rdi
mov qword [r15], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
jmp 0x1400107df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor al, al
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.14006abf0
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3