Function at 0x14004e9f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor r10d, r10d
lea rsi, [rbp + 0x18]
mov rdi, qword [rsi]
movabs r15, 0xafe303a8d94ab809
mov qword [rsi], r10
mov rbx, r15
mov byte [rbp - 0x20], Ordinal_79
mov r11d, r10d
mov byte [rbp - 0x1f], 0x7e
lea r14d, [r10 + 0xf]
mov byte [rbp - 0x1e], 0x56
mov byte [rbp - 0x1d], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1c], 0x62
mov byte [rbp - 0x1b], 0x78
mov byte [rbp - 0x1a], reloc.WLDAP32.dll_Ordinal_79
mov byte [rbp - 0x19], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x18], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x17], 0x7d
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x15], 0x60
mov byte [rbp - 0x14], 0x5b
mov byte [rbp - 0x13], 0x77
mov byte [rbp - 0x12], WSASetLastError
mov byte [rbp - 0x11], 0x61
mov byte [rbp - 0x10], 0x75
mov byte [rbp - 0xf], 0x53
mov byte [rbp - 0xe], 0x7d
mov byte [rbp - 0xd], 0x67
mov byte [rbp - 0xc], 0x62
mov byte [rbp - 0xb], WSASetLastError
mov byte [rbp - 0xa], reloc.WLDAP32.dll_Ordinal_22
movzx eax, byte [rbp - 0x20]
lea rax, [rbp - 0x20]
sub rbx, rax
nop dword [rax]
nop word [rax + rax]
mov rax, r11
lea r8, [rbp - 0x20]
add r8, r11
and eax, r14d
cmp rax, r14
mov rdx, r15
cmovae rax, r14
movsx r9, byte [r8]
add r8b, bl
shl al, 2
movzx ecx, al
shr rdx, cl
and dl, r14b
xor dl, r8b
xor dl, r9b
mov byte [rbp + r11 - 0x20], dl
inc r11
cmp r11, 0x17
jb 0x14004eaa0
mov byte [rbp + 0x20], 0xb7
movabs rbx, 0x1001273bebfe8bc9
mov byte [rbp + 0x21], 0xaf
mov r11, rbx
mov byte [rbp + 0x22], 0xae
mov byte [rbp + 0x23], 0xf7
mov byte [rbp + 0x24], 0xf1
mov byte [rbp + 0x25], 0xb4
mov byte [rbp + 0x26], 0xc4
movzx eax, byte [rbp + 0x20]
lea rax, [rbp + 0x20]
sub r11, rax
nop dword [rax]
nop word [rax + rax]
mov rax, r10
lea r8, [rbp + 0x20]
add r8, r10
and eax, r14d
cmp rax, r14
mov rdx, rbx
cmovae rax, r14
movzx r9d, byte [r8]
add r8b, r11b
shl al, 2
movzx ecx, al
shr rdx, cl
and dl, r14b
xor dl, r8b
xor dl, r9b
mov byte [rbp + r10 + 0x20], dl
inc r10
cmp r10, 7
jb 0x14004eb20
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14004ebc7
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14004ebc7
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.InjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x14004ec22
movups xmm1, xmmword [rcx]
movdqu xmmword [0x140331c98], xmm1
movsd xmm0, qword [rcx + 0x10]
movsd qword [0x140331ca8], xmm0
mov eax, dword [rcx + 0x18]
movdqa xmm0, xmmword [0x1400e09d0]
mov dword [0x140331cb0], eax
pxor xmm0, xmm1
movzx eax, word [rcx + 0x1c]
lea rcx, [0x140331c98]
mov word [0x140331cb4], ax
mov eax, reloc.WS2_32.dll_recv
movdqu xmmword [0x140331c98], xmm0
xor byte [rax + rcx], 0xfa
inc rax
cmp rax, 0x1e
jb 0x14004ec13
mov al, 1
mov rbx, qword [rsp + 0x68]
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret