Function at 0x1400fc120
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rbx, rcx
mov rsi, rdx
lea rcx, [0x1404b98c7]
call fcn.1402b13b0
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400fc57f
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
cmp dword [rax], 0x4550
jne 0x1400fc57f
test rax, rax
je 0x1400fc57f
mov ecx, dword [rax + 0xd8]
test ecx, ecx
jne 0x1400fc1f8
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x69]
call fcn.1400fc590
mov r9, rax
mov r10d, reloc.WS2_32.dll_socket
lea rdx, [rax + 2]
lea r8, [rax + 4]
nop
movsx ecx, byte [r9]
xor word [r8 - 2], cx
lea r8, [r8 + 8]
movsx ecx, byte [r9]
xor word [r8 - 8], cx
movsx eax, byte [r9]
xor word [r8 - 6], ax
movsx eax, byte [r9]
xor word [r8 - 4], ax
sub r10, 1
jne 0x1400fc1a0
xor r8d, r8d
mov rcx, rbx
mov word [rdx + 0xb8], r8w
call fcn.1400f9480
lea rdx, [0x1400f9670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
jmp 0x1400fc316
mov qword [rsp + 0xf0], rdi
mov rdi, qword [rcx + rbx + 0x58]
test rdi, rdi
jne 0x1400fc32b
xor r8d, r8d
mov dword [rbp - 0x69], 0x7b0020
mov word [rbp - 9], r8w
mov ecx, r8d
mov al, reloc.WLDAP32.dll_Ordinal_32
mov dword [rbp - 0x65], 0x7d000b
mov dword [rbp - 0x61], 0x730000
mov dword [rbp - 0x5d], 0x410054
mov dword [rbp - 0x59], 0x4b0043
mov dword [rbp - 0x55], 0x4f0063
mov dword [rbp - 0x51], 0x4b004f
mov dword [rbp - 0x4d], 0x450049
mov dword [rbp - 0x49], 0x4e0000
mov dword [rbp - 0x45], 0x54004f
mov dword [rbp - 0x41], 0x440000
mov dword [rbp - 0x3d], 0x460045
mov dword [rbp - 0x39], 0x4e0049
mov dword [rbp - 0x35], 0x440045
mov dword [rbp - 0x31], recvfrom
mov dword [rbp - 0x2d], 0x490046
mov dword [rbp - 0x29], 0x58
mov dword [rbp - 0x25], 0x4f0043
mov dword [rbp - 0x21], 0x4b004f
mov dword [rbp - 0x1d], 0x450049
mov dword [rbp - 0x19], 0x530000
mov dword [rbp - 0x15], 0x49004b
mov dword [rbp - 0x11], 0x500050
mov dword [rbp - 0xd], 0x440045
nop dword [rax]
nop word [rax + rax]
movsx eax, al
xor word [rbp + rcx*2 - 0x67], ax
inc rcx
cmp rcx, 0x2f
jae 0x1400fc2e7
movzx eax, byte [rbp - 0x69]
jmp 0x1400fc2d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x67]
mov word [rbp - 9], r8w
call fcn.1400f9480
lea rdx, [0x1400f9670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
mov rdi, qword [rsp + 0xf0]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
sub rbx, rsi
movabs rsi, 0x2b992ddfa232
add rdi, rbx
cmp qword [rdi], rsi
je 0x1400fc43e
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x69]
call fcn.1400fc750
mov r9, rax
mov r10d, 3
lea rdx, [rax + 2]
lea r8, [rax + 4]
nop word [rax + rax]
movsx ecx, byte [r9]
xor word [r8 - 2], cx
lea r8, [r8 + 0x22]
movsx ecx, byte [r9]
xor word [r8 - 0x22], cx
movsx eax, byte [r9]
xor word [r8 - 0x20], ax
movsx eax, byte [r9]
xor word [r8 - 0x1e], ax
movsx eax, byte [r9]
xor word [r8 - 0x1c], ax
movsx eax, byte [r9]
xor word [r8 - 0x1a], ax
movsx eax, byte [r9]
xor word [r8 - 0x18], ax
movsx eax, byte [r9]
xor word [r8 - 0x16], ax
movsx eax, byte [r9]
xor word [r8 - 0x14], ax
movsx eax, byte [r9]
xor word [r8 - 0x12], ax
movsx eax, byte [r9]
xor word [r8 - 0x10], ax
movsx eax, byte [r9]
xor word [r8 - 0xe], ax
movsx eax, byte [r9]
xor word [r8 - 0xc], ax
movsx eax, byte [r9]
xor word [r8 - 0xa], ax
movsx eax, byte [r9]
xor word [r8 - 8], ax
movsx eax, byte [r9]
xor word [r8 - 6], ax
movsx eax, byte [r9]
xor word [r8 - 4], ax
sub r10, 1
jne 0x1400fc370
xor r8d, r8d
mov rcx, rbx
mov word [rdx + 0x66], r8w
call fcn.1400f9480
lea rdx, [0x1400f9670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x1400fc30e
mov cl, reloc.WS2_32.dll_select
mov word [rbp - 0x69], reloc.WS2_32.dll_select
movsx r9d, cl
movzx eax, r9w
movzx r8d, r9w
xor ax, 0x49
xor r8w, 0x7b
mov word [rbp - 0x67], ax
movzx ecx, r9w
xor cx, 0x32
mov word [rbp - 0x5d], r8w
movzx eax, r9w
mov word [rbp - 0x59], r8w
xor ax, 0x39
mov word [rbp - 0x3d], r8w
mov word [rbp - 0x65], ax
movzx edx, r9w
movzx eax, r9w
mov word [rbp - 0x61], cx
xor ax, 0x4f
mov word [rbp - 0x53], cx
mov word [rbp - 0x63], ax
xor dx, 0x79
movzx eax, r9w
mov word [rbp - 0x49], dx
xor ax, 0x54
mov word [rbp - 0x47], cx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
xor r8d, r8d
mov word [rbp - 0x5f], ax
movzx eax, r9w
xor ax, 0x6a
mov word [rbp - 0x3f], dx
mov word [rbp - 0x5b], ax
lea rdx, [rbp - 0x67]
movzx eax, r9w
mov word [rbp - 0x39], r8w
xor ax, 0x7c
mov word [rbp - 0x57], ax
movzx eax, r9w
xor ax, 0x75
mov word [rbp - 0x55], ax
movzx eax, r9w
xor ax, 0x61
mov word [rbp - 0x51], ax
movzx eax, r9w
xor ax, 0x66
mov word [rbp - 0x4f], ax
movzx eax, r9w
xor ax, 0x73
mov word [rbp - 0x4d], ax
movzx eax, r9w
xor ax, 0x71
mov word [rbp - 0x4b], ax
mov word [rbp - 0x45], ax
movzx eax, r9w
xor ax, 0x7d
xor r9w, 0x77
mov word [rbp - 0x43], ax
mov word [rbp - 0x41], ax
mov word [rbp - 0x3b], r9w
call fcn.1400f9480
lea rdx, [0x1400f9670]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
xor rcx, rsi
cmp rcx, rsi
cmove rcx, rax
mov qword [rdi], rcx
jmp 0x1400fc30c
xor al, al
jmp 0x1400fc316