Function at 0x14004ddf0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor r9d, r9d
lea rdi, [rbp + 0x18]
mov rbx, qword [rdi]
movabs r14, 0xc75b4fe343fdb943
mov qword [rdi], r9
mov r11, r14
mov byte [rbp - 0x20], reloc.WS2_32.dll_ntohl
mov r10d, r9d
mov byte [rbp - 0x1f], 0x34
lea esi, [r9 + 0xf]
mov byte [rbp - 0x1e], Ordinal_26
mov byte [rbp - 0x1d], 0x3e
mov byte [rbp - 0x1c], Ordinal_50
mov byte [rbp - 0x1b], 0x35
mov byte [rbp - 0x1a], 3
mov byte [rbp - 0x19], reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp - 0x18], Ordinal_35
mov byte [rbp - 0x17], Ordinal_41
mov byte [rbp - 0x16], reloc.WLDAP32.dll_Ordinal_33
mov byte [rbp - 0x15], 0x3e
mov byte [rbp - 0x14], 9
mov byte [rbp - 0x13], Ordinal_60
mov byte [rbp - 0x12], reloc.WLDAP32.dll_Ordinal_35
mov byte [rbp - 0x11], reloc.WLDAP32.dll_Ordinal_45
mov byte [rbp - 0x10], 0x35
mov byte [rbp - 0xf], Ordinal_26
mov byte [rbp - 0xe], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0xd], reloc.WLDAP32.dll_Ordinal_45
mov byte [rbp - 0xc], Ordinal_50
mov byte [rbp - 0xb], reloc.WLDAP32.dll_Ordinal_35
mov byte [rbp - 0xa], 0x5a
movzx eax, byte [rbp - 0x20]
lea rax, [rbp - 0x20]
sub r11, rax
nop dword [rax]
mov rcx, r10
lea rdx, [rbp - 0x20]
add rdx, r10
and ecx, esi
cmp rcx, rsi
mov rax, r14
cmovae rcx, rsi
movsx r8, byte [rdx]
add dl, r11b
shl cl, 2
shr rax, cl
and al, sil
xor al, dl
xor al, r8b
mov byte [rbp + r10 - 0x20], al
inc r10
cmp r10, 0x17
jb 0x14004de90
mov byte [rbp + 0x20], gethostname
movabs r11, 0xdc77ebef981a8c43
mov byte [rbp + 0x21], reloc.WLDAP32.dll_Ordinal_41
mov r10, r11
mov byte [rbp + 0x22], Ordinal_41
mov byte [rbp + 0x23], 0x7d
mov byte [rbp + 0x24], 0x7f
mov byte [rbp + 0x25], reloc.WLDAP32.dll_Ordinal_60
mov byte [rbp + 0x26], 0x41
movzx eax, byte [rbp + 0x20]
lea rax, [rbp + 0x20]
sub r10, rax
nop dword [rax]
mov rcx, r9
lea rdx, [rbp + 0x20]
add rdx, r9
and ecx, esi
cmp rcx, rsi
mov rax, r11
cmovae rcx, rsi
movzx r8d, byte [rdx]
add dl, r10b
shl cl, 2
shr rax, cl
and al, sil
xor al, dl
xor al, r8b
mov byte [rbp + r9 + 0x20], al
inc r9
cmp r9, 7
jb 0x14004df00
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14004dfa2
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14004dfa2
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.InjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x14004dfff
movups xmm1, xmmword [rcx]
movdqu xmmword [0x14032fc20], xmm1
movsd xmm0, qword [rcx + 0x10]
movsd qword [0x14032fc30], xmm0
mov eax, dword [rcx + 0x18]
movdqa xmm0, xmmword [0x1400df7c0]
mov dword [0x14032fc38], eax
xorps xmm0, xmm1
movzx eax, word [rcx + 0x1c]
lea rcx, [0x14032fc20]
mov word [0x14032fc3c], ax
mov eax, reloc.WS2_32.dll_recv
movdqu xmmword [0x14032fc20], xmm0
nop dword [rax]
xor byte [rax + rcx], 0xfa
inc rax
cmp rax, 0x1e
jb 0x14004dff0
mov al, 1
mov rsi, qword [rsp + 0x70]
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret