Function at 0x18003a250
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rdi, rcx
mov qword [rbp + 0x98], rcx
xor r15d, r15d
mov dword [rbp - 0x78], r15d
mov dword [rsp + 0x58], 0x65666061
mov dword [rsp + 0x5c], 0x5f415d19
mov word [rsp + 0x60], 0x100
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.18001e2a0
lea rcx, [rbp + 0x78]
call fcn.18000ee90
test al, al
jne 0x18003aa16
movdqa xmm0, xmmword [0x18013a4b0]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0x3e206a77
mov word [rbp + 0x14], Ordinal_35
mov byte [rbp + 0x16], 1
mov ecx, r15d
nop word [rax + rax]
lea eax, [rcx + 0x33]
xor byte [rbp + rcx], al
inc rcx
cmp rcx, 0x15
jb 0x18003a2f0
mov byte [rbp + 0x16], 0
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], reloc.WS2_32.dll_ntohs
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, [rbp]
lea rcx, [rbp + 0x18]
call fcn.180040d10
lea rcx, [rbp + 0x18]
call fcn.18000ee90
test al, al
jne 0x18003aa16
movdqa xmm0, xmmword [0x180138ea0]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0x70372131
mov dword [rsp + 0x7c], 0x262d6673
mov word [rbp - 0x80], Ordinal_41
mov byte [rbp - 0x7e], 1
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x33]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 0x19
jb 0x18003a370
mov byte [rbp - 0x7e], 0
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test rax, rax
jne 0x18003a3a3
cmp byte [0x180180816], al
je 0x18003a980
mov dword [rsp + 0x50], 0x60d0651
mov word [rsp + 0x54], 5
mov byte [rsp + 0x56], 1
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx + 0x33]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 5
jb 0x18003a3c0
mov byte [rsp + 0x56], 0
mov qword [rbp + 0x38], r15
movdqa xmm0, xmmword [0x180137dd0]
movdqu xmmword [rbp + 0x48], xmm0
mov r8d, 5
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x38]
call fcn.180040d10
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18003a419
mov rcx, qword [rdi]
cmp r8, qword [rbp + 0x48]
jne 0x18003a440
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18003a440
lea rcx, [rbp + 0x38]
call fcn.180040c10
mov dword [0x1801807d8], 0x300
jmp 0x18003a5b0
lea rcx, [rbp + 0x38]
call fcn.180040c10
mov dword [rsp + 0x48], 0x20c0651
mov word [rsp + 0x4c], 3
mov byte [rsp + 0x4e], 1
mov rcx, r15
lea eax, [rcx + 0x33]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 5
jb 0x18003a460
mov byte [rsp + 0x4e], 0
mov qword [rbp + 0x58], r15
movdqa xmm0, xmmword [0x180137dd0]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov r8d, 5
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x58]
call fcn.180040d10
nop
mov ebx, 0x1fd
mov dword [rbp - 0x78], ebx
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rdx, qword [rbp + 0x58]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18003a4c6
mov rcx, qword [rdi]
cmp r8, qword [rbp + 0x68]
jne 0x18003a4d9
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18003a560
mov dword [rsp + 0x40], 0xf050751
mov word [rsp + 0x44], 2
mov byte [rsp + 0x46], 1
mov rcx, r15
lea eax, [rcx + 0x33]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 5
jb 0x18003a4f0
mov byte [rsp + 0x46], 0
mov qword [rbp - 0x50], r15
movdqa xmm0, xmmword [0x180137dd0]
movdqu xmmword [rbp - 0x40], xmm0
mov r8d, 5
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.180040d10
mov ebx, 0x7ff
mov dword [rbp - 0x78], ebx
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18003a551
mov rcx, qword [rdi]
cmp r8, qword [rbp - 0x40]
jne 0x18003a565
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18003a565
mov sil, 1
jmp 0x18003a568
xor sil, sil
test bl, 2
je 0x18003a57d
and ebx, 0xfffffffd
mov dword [rbp - 0x78], ebx
lea rcx, [rbp - 0x50]
call fcn.180040c10
nop
test bl, 1
je 0x18003a58b
lea rcx, [rbp + 0x58]
call fcn.180040c10
test sil, sil
je 0x18003a5a6
mov dword [0x1801807d8], 0x300
mov dword [0x1801807d4], 0xe8
jmp 0x18003a5ba
mov dword [0x1801807d8], 0x320
mov dword [0x1801807d4], 0x88
mov dword [rsp + 0x30], 0x61564654
mov dword [rsp + 0x34], 0x555d565e
mov word [rsp + 0x38], Ordinal_79
mov byte [rsp + 0x3a], 1
mov rcx, r15
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x18003a5e0
mov byte [rsp + 0x3a], 0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x180184730], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x180184738], rax
movdqa xmm0, xmmword [0x180138d90]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x6820322a
mov dword [rbp - 0x5c], 0x252423
mov byte [rbp - 0x58], 1
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx + 0x33]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0x17
jb 0x18003a640
mov byte [rbp - 0x58], 0
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x180184800], rax
mov rsi, qword [0x180180750]
add rsi, r14
add r14, qword [0x180180758]
lea rdx, [0x1801806c0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1801806c0]
mov rcx, rax
call fcn.180010380
mov qword [0x180184808], rax
lea rdx, [0x1801806e0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1801806e0]
mov rcx, qword [0x180184800]
call fcn.180010380
mov qword [0x180184810], rax
mov rdx, qword [0x180184738]
mov rax, qword [0x180180710]
add rax, rdx
je 0x18003a6de
mov rax, qword [rax]
jmp 0x18003a6e1
mov rax, r15
mov qword [0x180184760], rax
mov rax, qword [0x180180718]
add rax, rdx
je 0x18003a6f9
mov rax, qword [rax]
jmp 0x18003a6fc
mov rax, r15
mov qword [0x180184768], rax
mov rax, qword [0x180180730]
add rax, rdx
je 0x18003a714
mov rax, qword [rax]
jmp 0x18003a717
mov rax, r15
mov qword [0x180184778], rax
mov rcx, qword [0x180180728]
add rcx, rdx
je 0x18003a72f
mov rax, qword [rcx]
jmp 0x18003a732
mov rax, r15
mov qword [0x180184770], rax
mov rcx, qword [0x180180738]
add rcx, rdx
mov qword [0x180184750], rcx
mov rcx, qword [0x180180720]
add rcx, rdx
mov qword [0x180184780], rcx
mov rcx, qword [0x180180740]
add rcx, rdx
lea rax, [rcx - 0xc]
mov qword [0x180184758], rax
lea rax, [rcx - 0xb]
test rax, rax
je 0x18003a77e
mov r8d, dword [rax]
jmp 0x18003a781
mov r8d, r15d
movsxd rax, r8d
add rcx, 0xfffffffffffffff9
add rcx, rax
mov qword [0x180184758], rcx
mov rcx, qword [0x180180760]
add rcx, rdx
mov qword [0x1801847b0], rcx
mov rcx, qword [0x180180770]
add rcx, rdx
mov qword [0x1801847b8], rcx
mov rcx, qword [0x180180778]
add rcx, rdx
mov qword [0x1801847c0], rcx
mov rcx, qword [0x180180768]
add rcx, rdx
mov qword [0x1801847c8], rcx
mov rcx, qword [0x180180780]
add rcx, rdx
mov qword [0x1801847d0], rcx
mov rcx, qword [0x180180788]
add rcx, rdx
mov qword [0x1801847d8], rcx
mov rcx, qword [0x180180790]
add rcx, rdx
mov qword [0x1801847e0], rcx
mov rcx, qword [0x1801807a0]
add rcx, rdx
mov qword [0x1801847f0], rcx
mov rcx, qword [0x180180798]
add rcx, rdx
mov qword [0x1801847e8], rcx
lea rcx, [rdx - 0x56]
add rcx, qword [0x180180748]
mov qword [0x180184690], rcx
mov rcx, qword [0x1801807a8]
add rcx, rdx
mov qword [0x180184688], rcx
mov rbx, r15
xor eax, eax
mov r12d, 1
lock cmpxchg dword [0x1801846f8], r12d
je 0x18003a887
cmp rbx, 0x20
jae 0x18003a86e
xor ecx, ecx
jmp 0x18003a871
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1801846f8], r12d
jne 0x18003a864
cmp qword [0x180184700], 0
jne 0x18003a8a5
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x180184700], rax
mov eax, r15d
xchg dword [0x1801846f8], eax
cmp byte [0x180180816], 0
je 0x18003a8d7
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x180039ba0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x18003a903
lea r8, [0x1801846d0]
lea rdx, [0x180039640]
mov rcx, r14
call fcn.1800a6fc0
lea r8, [0x1801846b0]
lea rdx, [0x180039740]
mov rcx, rsi
call fcn.1800a6fc0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x180184680]
lea rdx, [0x180039300]
mov rcx, qword [0x180184758]
call fcn.1800a6fc0
lea r8, [0x180184678]
lea rdx, [0x180039070]
mov rcx, qword [0x180184750]
call fcn.1800a6fc0
mov edx, r12d
xor ecx, ecx
call fcn.1800a72f0
nop
mov rcx, rdi
call fcn.180040c10
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.180112b70
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lea rax, [rbp + 0x78]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x43515b7e
mov dword [rsp + 0x34], 0x1a4a5d5b
mov dword [rsp + 0x38], 0x514f4e7e
mov word [rsp + 0x3c], 0x100
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.18003dc50
mov rbx, rax
movdqa xmm0, xmmword [0x180139520]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x180139480]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x1801385a0]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xf060d0d
mov dword [rbp - 0x1c], 0x4a064802
mov dword [rbp - 0x18], 0xb1b052d
mov dword [rbp - 0x14], 0x1005e22
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x50]
call fcn.18003ac90
nop
mov rdx, rbx
mov rcx, rax
call fcn.18000edc0
int3
lea rax, [rbp + 0x78]
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x180139620]
movdqu xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x78], 0x242c3022
mov dword [rsp + 0x7c], 0x3e20242e
mov word [rbp - 0x80], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0x7e], 1
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.18003c330
mov rbx, rax
movdqa xmm0, xmmword [0x180139ef0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x18013a680]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x180138780]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180138be0]
movdqa xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x1005a1c
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x50]
call fcn.18003ae50
nop
mov rdx, rbx
mov rcx, rax
call fcn.18000edc0
int3