Function at 0x1401da550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
movzx r11d, byte [rbp + 0x30]
lea rax, [rbp + 0x28]
mov r15, qword [rax]
movabs r13, 0xbff7effb3cb1ee88
mov qword [rax], 0
movabs r12, 0xbf56af9bfa989128
mov rsi, qword [0x1404e35f0]
xor eax, eax
mov r14, qword [0x1404e35f8]
mov qword [rbp - 0x17], rax
mov byte [rbp - 0xf], al
mov dword [rbp - 0x40], 0x9f6c9d9c
mov dword [rbp - 0x3c], 0x726271bf
mov dword [rbp - 0x38], 0x766e687a
mov dword [rbp - 0x34], 0x7b6b6978
mov dword [rbp - 0x30], 0x6773707d
mov dword [rbp - 0x2c], 0x606f7874
mov dword [rbp - 0x28], 0xa3474b5e
mov dword [rbp - 0x24], 0x5c4eaf4c
mov dword [rbp - 0x20], 0xa757a559
mov dword [rbp - 0x1c], 0x9a545d56
mov byte [rbp - 0x18], 8
nop
mov rax, r14
mov r9, rsi
nop word [rax + rax]
xor edi, edi
cmp rdi, 0x32
jae 0x1401db0d2
movzx ebx, byte [rbp + rdi - 0x40]
mov r10d, ebx
cmp rax, rdi
ja 0x1401db0c9
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x1401da654
lea rdx, [rdi + r13]
movzx ecx, r10b
and cl, dl
mov r11d, Ordinal_41
sub r11b, cl
add r11b, r11b
add r11b, bl
add r11b, dl
jmp 0x1401da6a0
je 0x1401db054
inc rcx
cmp rax, rcx
je 0x1401dafcc
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x1401daf95
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x1401daf5a
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x1401daf34
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x1401daeef
nop word [rax + rax]
cmp r9, rdi
ja 0x1401db0c0
lea r8, [r9 + 8]
cmp rax, r8
jae 0x1401da6cf
lea r8, [rdi + r12]
movzx ecx, r10b
and cl, r8b
movzx r11d, bl
add cl, cl
sub r11b, cl
sub r11b, 0x18
add r11b, r8b
jmp 0x1401da710
lea rdx, [r9 + 1]
cmp rax, rdx
je 0x1401daee0
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x1401daec1
lea rcx, [rdx + 1]
cmp rax, rcx
je 0x1401daea0
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x1401dae87
cmp rax, r8
je 0x1401dae60
nop dword [rax]
lea rcx, [r9 + rax]
cmp rcx, rdi
jbe 0x1401dac30
nop dword [rax]
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x1401dac10
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x1401dabeb
lea rcx, [r9 + 0x42]
cmp rax, rcx
je 0x1401dabdd
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x1401dabbd
lea rcx, [r9 + 0x7a]
cmp rax, rcx
je 0x1401dabaf
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
je 0x1401dab96
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x1401dab76
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x1401dab57
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x1401dab29
lea rcx, [r9 + 0xa]
cmp rax, rcx
je 0x1401da720
lea rax, [r9 + 0x41]
lea r9, [rax + 0x61]
lea rcx, [r9 + 0x400]
cmp rax, rcx
jb 0x1401db0a5
lea rcx, [r9 + 6]
cmp rax, rcx
jb 0x1401db085
lea rcx, [r9 + 2]
cmp rax, rcx
jb 0x1401da90d
lea rcx, [r9 + 0x42]
cmp rax, rcx
jb 0x1401da8ee
lea rcx, [r9 + 0x10]
cmp rax, rcx
jb 0x1401da8ce
lea rcx, [r9 + 0x7a]
cmp rax, rcx
jb 0x1401daae0
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
jb 0x1401daa94
lea rcx, [r9 + 5]
cmp rax, rcx
jb 0x1401daa4f
lea rcx, [r9 + 1]
cmp rax, rcx
jb 0x1401daa27
lea rcx, [r9 + 0x40]
cmp rax, rcx
jb 0x1401da720
lea rax, [r9 + 0x20]
lea r9, [rax + 0xa]
lea rcx, [r9 + 8]
cmp rax, rcx
ja 0x1401daa00
lea rcx, [r9 + 0x400]
cmp rax, rcx
ja 0x1401da9e0
lea rcx, [r9 + 0x64]
cmp rax, rcx
ja 0x1401da9c1
lea rcx, [r9 + 2]
cmp rax, rcx
ja 0x1401da9a1
lea rcx, [r9 + 0x41]
cmp rax, rcx
ja 0x1401da98e
lea rcx, [r9 + 0x10]
cmp rax, rcx
ja 0x1401da96e
lea rcx, [r9 + 6]
cmp rax, rcx
ja 0x1401da960
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
ja 0x1401da93e
lea rcx, [r9 + 0x42]
cmp rax, rcx
ja 0x1401da92c
lea rcx, [r9 + 1]
cmp rax, rcx
ja 0x1401da720
lea rax, [r9 + 0x5a]
lea r9, [rax + 0x7a]
jmp 0x1401da720
lea r8d, [rdi - 0x28]
mov edx, ntohl
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
jmp 0x1401da710
lea r8d, [rdi - 0x38]
movzx ecx, bl
and cl, r8b
movzx r11d, bl
add cl, cl
sub r11b, cl
sub r11b, 0x78
add r11b, r8b
jmp 0x1401da6a0
lea r8d, [rdi - 0x48]
movzx ecx, bl
and cl, r8b
movzx r11d, bl
add cl, cl
sub r11b, cl
sub r11b, 8
add r11b, r8b
jmp 0x1401da624
lea r8d, [rdi + 0x40]
mov edx, reloc.WLDAP32.dll_Ordinal_32
movzx r10d, dil
jmp 0x1401daefc
lea edx, [rdi + 0x30]
movzx ecx, bl
and cl, dl
inc r9
add cl, cl
dec rdi
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x50
inc rdi
jmp 0x1401da612
lea r8d, [rdi + 0x20]
mov edx, reloc.WS2_32.dll_recv
jmp 0x1401daf3d
lea r8d, [rdi + 0x10]
movzx ecx, bl
and cl, r8b
movzx r11d, bl
add cl, cl
movzx r10d, dil
sub r11b, cl
sub r11b, 0x70
jmp 0x1401daf75
movzx ecx, bl
and cl, dil
add cl, cl
sub bl, cl
lea r11d, [rdi + rbx]
jmp 0x1401dafb0
lea r8d, [rdi - 0x10]
mov edx, Ordinal_60
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
jmp 0x1401dafb3
lea r8d, [rdi - 0x20]
movzx ecx, bl
and cl, r8b
movzx r11d, bl
add cl, cl
sub r11b, cl
sub r11b, 0x20
add r11b, r8b
jmp 0x1401dafed
lea r8d, [rdi - 0x30]
mov edx, Ordinal_41
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
jmp 0x1401db015
lea edx, [rdi - 0x40]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
movzx ecx, byte [rbp + rdi - 0x40]
add rcx, r9
add rdi, rcx
lea r11d, [rdx + rbx]
sub r11b, 0x40
inc rdi
jmp 0x1401da612
lea r8d, [rdi + 0x18]
mov edx, Ordinal_45
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
mov byte [rbp + rdi - 0x40], r11b
inc rdi
jmp 0x1401da612
lea r8d, [rdi + 8]
movzx ecx, bl
and cl, r8b
movzx r11d, bl
add cl, cl
sub r11b, cl
sub r11b, 0x38
add r11b, r8b
cmp r9, 0x64
jb 0x1401daa42
mov edx, Ordinal_27
movzx r10d, dil
movzx ecx, bl
lea r8d, [r10 + 0x30]
and cl, r8b
sub dl, cl
add dl, dl
add dl, bl
add dl, r8b
lea r11d, [rdx + rdx]
jmp 0x1401daf0e
lea r8d, [rdi - 8]
movzx ecx, bl
and cl, r8b
mov edx, Ordinal_32
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
cmp rax, 2
jae 0x1401dae1b
lea rcx, [r9 + 0x2a]
cmp rax, rcx
jbe 0x1401dad82
mov edx, 8
lea r8d, [rdi - 0x70]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x1401daa66
lea r8d, [rdi - 0x18]
movzx ecx, bl
and cl, r8b
movzx r11d, bl
add cl, cl
sub r11b, cl
sub r11b, 0x58
add r11b, r8b
lea rcx, [r9 + rax]
cmp rcx, 0x41
je 0x1401dae3c
lea rcx, [r9 + 0x28]
cmp rax, rcx
jbe 0x1401dacda
lea r8d, [rdi + 0x68]
movzx ecx, bl
and cl, r8b
mov edx, reloc.WS2_32.dll_sendto
jmp 0x1401daaa3
lea r8d, [rdi - 0x10]
movzx ecx, bl
and cl, r8b
mov edx, Ordinal_60
sub dl, cl
movzx ecx, byte [rbp + rdi - 0x40]
add rcx, r9
add rdi, rcx
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
inc rdi
jmp 0x1401da612
lea r8d, [rdi - 0x20]
movzx ecx, bl
and cl, r8b
movzx r11d, bl
add cl, cl
sub r11b, cl
sub r11b, 0x20
add r11b, r8b
jmp 0x1401db015
lea r8d, [rdi - 0x30]
mov edx, Ordinal_41
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
jmp 0x1401dafed
lea edx, [rdi - 0x40]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x40
jmp 0x1401dafb3
lea r8d, [rdi - 0x50]
mov edx, Ordinal_27
jmp 0x1401daf9e
movzx r10d, dil
movzx ecx, bl
movzx r11d, bl
lea r8d, [r10 - 0x60]
and cl, r8b
add cl, cl
sub r11b, cl
sub r11b, 0x60
jmp 0x1401daf75
lea r8d, [rdi - 0x70]
mov edx, 8
jmp 0x1401daf3d
lea edx, [rdi + 0x80]
movzx ecx, bl
and cl, dl
inc r9
add cl, cl
dec rdi
sub bl, cl
lea r11d, [rdx + rbx]
add r11b, 0x80
inc rdi
jmp 0x1401da612
movzx r10d, dil
movzx ecx, bl
movzx r11d, bl
lea r8d, [r10 + 0x70]
and cl, r8b
add cl, cl
sub r11b, cl
sub r11b, 0x10
jmp 0x1401daf0b
lea rcx, [r9 + 0x7a]
cmp rax, rcx
jae 0x1401dac56
mov edx, 0x24
lea r8d, [rdi - 0x78]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x1401daaf7
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1401dac86
lea edx, [rdi + 0x50]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
movzx ecx, byte [rbp + rdi - 0x40]
add rcx, r9
add rdi, rcx
lea r11d, [rdx + rbx]
sub r11b, 0x30
inc rdi
jmp 0x1401da612
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1401dacab
lea edx, [rdi + 0x80]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
add r11b, 0x80
jmp 0x1401dafb3
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x1401daafa
lea edx, [rdi - 0x40]
movzx ecx, bl
and cl, dl
inc r9
add cl, cl
dec rdi
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x40
inc rdi
jmp 0x1401da612
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1401dad03
movzx r10d, dil
movzx ecx, bl
movzx r11d, bl
lea r8d, [r10 + 0x78]
and cl, r8b
add cl, cl
sub r11b, cl
sub r11b, 0x48
jmp 0x1401daf0b
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1401dad2b
lea edx, [rdi - 0x68]
movzx ecx, bl
and cl, dl
dec rdi
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x28
inc rdi
jmp 0x1401da612
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x1401dad55
mov edx, 0x34
movzx r10d, dil
movzx ecx, bl
lea r8d, [r10 - 0x58]
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x1401daf75
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x1401daaaf
lea r8d, [rdi - 0x28]
mov edx, ntohl
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
jmp 0x1401dafed
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1401dadb2
lea edx, [rdi - 0x60]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
movzx ecx, byte [rbp + rdi - 0x40]
add rcx, r9
add rdi, rcx
lea r11d, [rdx + rbx]
sub r11b, 0x60
inc rdi
jmp 0x1401da612
inc rcx
cmp rax, rcx
jne 0x1401dadda
lea r8d, [rdi - 0x50]
mov edx, Ordinal_27
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
jmp 0x1401db015
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x1401dadfc
movzx ecx, bl
and cl, dil
add cl, cl
sub bl, cl
lea r11d, [rdi + rbx]
dec rdi
inc rdi
jmp 0x1401da612
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x1401daa69
movzx r10d, dil
mov edx, reloc.WS2_32.dll_recv
lea r8d, [r10 + 0x20]
jmp 0x1401daefc
movzx edx, byte [rbp + rdi - 0x40]
movzx r10d, dil
movzx ecx, bl
lea r8d, [r10 + 0x40]
and cl, r8b
sub dl, cl
add dl, 0x20
lea r11d, [rdx + rdx]
jmp 0x1401daf75
lea r8d, [rdi + 0x50]
movzx ecx, bl
and cl, r8b
movzx r11d, bl
add cl, cl
sub r11b, cl
sub r11b, byte [rbp + rdi - 0x40]
sub r11b, 0x30
add r11b, r8b
jmp 0x1401dafed
lea edx, [rdi - 0x48]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
movzx ecx, byte [rbp + rdi - 0x40]
add rcx, r9
add rdi, rcx
lea r11d, [rdx + rbx]
sub r11b, 8
inc rdi
jmp 0x1401da612
lea edx, [rdi + 0x78]
movzx ecx, bl
and cl, dl
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x48
jmp 0x1401dafb0
mov edx, reloc.WS2_32.dll_sendto
movzx r10d, dil
movzx ecx, bl
lea r8d, [r10 + 0x68]
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
jmp 0x1401daf75
lea edx, [rdi + 0x58]
movzx ecx, bl
and cl, dl
dec rdi
add cl, cl
sub bl, cl
lea r11d, [rdx + rbx]
sub r11b, 0x68
inc rdi
jmp 0x1401da612
movzx r10d, dil
mov edx, reloc.WLDAP32.dll_Ordinal_60
lea r8d, [r10 + 0x38]
jmp 0x1401daefc
movzx r10d, dil
mov edx, Ordinal_45
lea r8d, [r10 + 0x18]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
movzx ecx, bl
sub r10b, 0x48
and cl, r10b
add cl, cl
sub bl, cl
sub bl, 8
add bl, r10b
mov byte [rbp + rdi - 0x40], bl
inc r9
dec rdi
inc rdi
jmp 0x1401da612
lea r8d, [rdi - 8]
mov edx, Ordinal_32
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
dec rdi
inc rdi
jmp 0x1401da612
movzx r10d, dil
movzx ecx, bl
movzx r11d, bl
lea r8d, [r10 - 0x18]
and cl, r8b
add cl, cl
sub r11b, cl
sub r11b, 0x58
add r11b, r8b
movzx ecx, bl
sub r10b, 0x38
and cl, r10b
add cl, cl
sub bl, cl
sub bl, 0x78
add bl, r11b
add bl, r10b
mov byte [rbp + rdi - 0x40], bl
jmp 0x1401dafb0
lea r8d, [rdi - 0x28]
mov edx, ntohl
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, r8b
add rax, r9
movzx ecx, r11b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add rdi, rdx
inc rdi
jmp 0x1401da612
movabs rdx, 0x3fc78fdea8dd85b8
movzx r11d, bl
add rdx, rdi
and r10b, dl
add r10b, r10b
sub r11b, r10b
sub r11b, 8
add r11b, dl
lea r8d, [rdi - 0x28]
movzx ecx, bl
and cl, r8b
inc r9
mov edx, ntohl
sub dl, cl
add dl, dl
add dl, bl
add dl, r8b
movzx ecx, dl
mov byte [rbp + rdi - 0x40], cl
add rcx, r9
sub rdi, rcx
lea r8d, [rdi + 0x60]
inc rax
movzx ecx, r8b
mov edx, Ordinal_50
and cl, bl
sub dl, cl
mov rcx, 0xffffffffffffffff
sub rcx, rax
add dl, dl
add dl, r8b
add dl, bl
mov byte [rbp + rdi - 0x40], dl
add rdi, rcx
movzx ecx, byte [rbp + rdi - 0x40]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x1401da612
movabs rcx, 0x3fe7cff1b615cb98
add rcx, rdi
and r10b, cl
add r10b, r10b
sub bl, r10b
lea r11d, [rcx + rbx]
sub r11b, 0x28
movzx ecx, byte [rbp + rdi - 0x40]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x1401da612
sub dil, 0x58
mov edx, 0x34
movzx ecx, bl
and cl, dil
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, bl
add r11b, dil
jmp 0x1401da610
sub dil, 0x68
movzx eax, bl
and al, dil
add al, al
sub bl, al
lea r11d, [rdi + rbx]
sub r11b, 0x28
jmp 0x1401da600
lea rcx, [rbp + 0x14c4320]
jmp 0x1401db0d6
lea rcx, [rbp + 0x7e31a8]
jmp 0x1401db0d6
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r11, [rsp + 0x80]
mov qword [0x1404e38c8], rax
mov rbx, qword [r11 + 0x38]
lea rcx, [rbp + 0x28]
mov rsi, qword [r11 + 0x40]
cmp rax, 0xffffffffffffffff
mov rdi, qword [r11 + 0x48]
setne al
mov qword [rcx], r15
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret