Function at 0x140004cd0
Capabilities:
Encode data using xor
Encrypt data using speck
Hash data using murmur3

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x4878
call fcn.140035d50
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x47f0], 0xfffffffffffffffe
mov r12, r9
mov rdi, r8
mov r13, rdx
mov r15, rcx
mov ebx, 1
mov esi, 1
test r9, r9
je 0x140004d3b
setns al
js 0x140005ade
movzx r14d, al
mov rcx, r12
mov rdx, r14
call fcn.140007dc0
mov rsi, rax
test rax, rax
je 0x140005ae5
mov r14, qword [rbp + 0x4868]
mov rcx, rsi
mov rdx, rdi
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
test r14, r14
je 0x140004d78
setns al
js 0x140005af2
movzx edi, al
mov rcx, r14
mov rdx, rdi
call fcn.140007dc0
mov rbx, rax
test rax, rax
je 0x140005b07
mov qword [rbp + 0x47d0], rbx
mov rdx, qword [rbp + 0x4860]
mov rcx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
xor edi, edi
lea rcx, [rbp - 0x58]
mov r8d, 0x2010
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x1ff8]
mov r8d, 0x27c0
xor edx, edx
call sub.VCRUNTIME140.dll_memset
test r12, r12
je 0x140005559
cmp r12, 1
je 0x140005565
cmp r12, 2
jbe 0x140005576
cmp r12, 3
je 0x140005587
movzx ecx, byte [rsi]
movzx edx, byte [rsi + 1]
movzx r8d, byte [rsi + 2]
movzx ebx, byte [rsi + 3]
shl ebx, 0x18
shl edx, 8
or edx, ecx
shl r8d, 0x10
or r8d, edx
or r8d, ebx
mov dword [rbp + 0x1fb8], r8d
cmp r12, 5
jb 0x140005598
je 0x1400055a9
cmp r12, 7
jb 0x1400055ba
je 0x1400055cb
movzx ecx, byte [rsi + 4]
movzx edx, byte [rsi + 5]
movzx ebx, byte [rsi + 6]
movzx edi, byte [rsi + 7]
shl edi, 0x18
shl edx, 8
or edx, ecx
shl ebx, 0x10
or ebx, edx
or ebx, edi
mov dword [rbp + 0x1fbc], ebx
cmp r12, 9
jb 0x1400055dc
je 0x1400055ed
cmp r12, 0xb
jb 0x1400055fe
je 0x14000560f
movzx ecx, byte [rsi + 8]
movzx edx, byte [rsi + 9]
movzx ebx, byte [rsi + 0xa]
movzx edi, byte [rsi + 0xb]
shl edi, 0x18
shl edx, 8
or edx, ecx
shl ebx, 0x10
or ebx, edx
or ebx, edi
mov dword [rbp + 0x1fc0], ebx
cmp r12, 0xd
jb 0x140005620
je 0x140005631
cmp r12, 0xf
jb 0x140005642
je 0x140005653
movzx ecx, byte [rsi + 0xc]
movzx edx, byte [rsi + 0xd]
movzx ebx, byte [rsi + 0xe]
movzx edi, byte [rsi + 0xf]
shl edi, 0x18
shl edx, 8
or edx, ecx
shl ebx, 0x10
or ebx, edx
or ebx, edi
mov dword [rbp + 0x1fc4], ebx
cmp r12, 0x11
jb 0x140005664
je 0x140005675
cmp r12, 0x13
jb 0x140005686
je 0x140005697
movzx ecx, byte [rsi + 0x10]
movzx edx, byte [rsi + 0x11]
movzx ebx, byte [rsi + 0x12]
movzx edi, byte [rsi + 0x13]
shl edi, 0x18
shl edx, 8
or edx, ecx
shl ebx, 0x10
or ebx, edx
or ebx, edi
mov dword [rbp + 0x1fc8], ebx
cmp r12, 0x15
jb 0x1400056a8
je 0x1400056b6
cmp r12, 0x17
jb 0x1400056c7
je 0x1400056d8
movzx ecx, byte [rsi + 0x14]
movzx edx, byte [rsi + 0x15]
movzx ebx, byte [rsi + 0x16]
movzx edi, byte [rsi + 0x17]
shl edi, 0x18
shl edx, 8
or edx, ecx
shl ebx, 0x10
or ebx, edx
or ebx, edi
mov dword [rbp + 0x1fcc], ebx
cmp r12, 0x19
jb 0x1400056e9
je 0x1400056f7
cmp r12, 0x1b
jb 0x140005705
je 0x140005713
movzx ecx, byte [rsi + 0x18]
movzx edx, byte [rsi + 0x19]
movzx ebx, byte [rsi + 0x1a]
movzx edi, byte [rsi + 0x1b]
shl edi, 0x18
shl edx, 8
or edx, ecx
shl ebx, 0x10
or ebx, edx
or ebx, edi
mov dword [rbp + 0x1fd0], ebx
cmp r12, 0x1d
jb 0x140005724
mov rdx, qword [rbp + 0x4868]
je 0x14000574e
cmp r12, 0x1f
jb 0x140005775
je 0x14000579c
movzx ecx, byte [rsi + 0x1c]
movzx eax, byte [rsi + 0x1d]
movzx ebx, byte [rsi + 0x1e]
movzx edi, byte [rsi + 0x1f]
shl edi, 0x18
shl eax, 8
or eax, ecx
shl ebx, 0x10
or ebx, eax
or ebx, edi
mov dword [rbp + 0x1fd4], ebx
test rdx, rdx
je 0x1400057c3
cmp rdx, 1
je 0x1400057d8
cmp rdx, 2
jbe 0x1400057f0
cmp rdx, 3
je 0x140005808
mov rax, qword [rbp + 0x47d0]
movzx r9d, byte [rax]
movzx ecx, byte [rax + 1]
movzx ebx, byte [rax + 2]
movzx edi, byte [rax + 3]
shl edi, 0x18
shl ecx, 8
or ecx, r9d
shl ebx, 0x10
or ebx, ecx
or ebx, edi
mov dword [rbp + 0x1fd8], ebx
cmp rdx, 5
jb 0x140005820
je 0x140005838
cmp rdx, 7
jb 0x140005850
je 0x140005868
movzx r9d, byte [rax + 4]
movzx ecx, byte [rax + 5]
movzx ebx, byte [rax + 6]
movzx edi, byte [rax + 7]
shl edi, 0x18
shl ecx, 8
or ecx, r9d
shl ebx, 0x10
or ebx, ecx
or ebx, edi
mov dword [rbp + 0x1fdc], ebx
cmp rdx, 9
jb 0x140005880
je 0x140005898
cmp rdx, 0xb
jb 0x1400058b0
je 0x1400058c8
movzx r9d, byte [rax + 8]
movzx ecx, byte [rax + 9]
movzx ebx, byte [rax + 0xa]
movzx edi, byte [rax + 0xb]
shl edi, 0x18
shl ecx, 8
or ecx, r9d
shl ebx, 0x10
or ebx, ecx
or ebx, edi
mov dword [rbp + 0x1fe0], ebx
cmp rdx, 0xd
jb 0x1400058e0
je 0x1400058f8
cmp rdx, 0xf
jb 0x140005910
je 0x140005928
movzx r9d, byte [rax + 0xc]
movzx ecx, byte [rax + 0xd]
movzx ebx, byte [rax + 0xe]
movzx edi, byte [rax + 0xf]
shl edi, 0x18
shl ecx, 8
or ecx, r9d
shl ebx, 0x10
or ebx, ecx
or ebx, edi
mov dword [rbp + 0x1fe4], ebx
cmp rdx, 0x11
jb 0x140005940
je 0x140005958
cmp rdx, 0x13
jb 0x140005970
je 0x140005988
movzx r9d, byte [rax + 0x10]
movzx ecx, byte [rax + 0x11]
movzx ebx, byte [rax + 0x12]
movzx edi, byte [rax + 0x13]
shl edi, 0x18
shl ecx, 8
or ecx, r9d
shl ebx, 0x10
or ebx, ecx
or ebx, edi
mov dword [rbp + 0x1fe8], ebx
cmp rdx, 0x15
jb 0x1400059a0
je 0x1400059b8
cmp rdx, 0x17
jb 0x1400059d0
je 0x1400059e8
movzx r9d, byte [rax + 0x14]
movzx ecx, byte [rax + 0x15]
movzx ebx, byte [rax + 0x16]
movzx edi, byte [rax + 0x17]
shl edi, 0x18
shl ecx, 8
or ecx, r9d
shl ebx, 0x10
or ebx, ecx
or ebx, edi
mov dword [rbp + 0x1fec], ebx
cmp rdx, 0x19
jb 0x140005a00
je 0x140005a15
cmp rdx, 0x1b
jb 0x140005a2a
je 0x140005a3f
movzx r9d, byte [rax + 0x18]
movzx ecx, byte [rax + 0x19]
movzx ebx, byte [rax + 0x1a]
movzx edi, byte [rax + 0x1b]
shl edi, 0x18
shl ecx, 8
or ecx, r9d
shl ebx, 0x10
or ebx, ecx
or ebx, edi
mov dword [rbp + 0x1ff0], ebx
cmp rdx, 0x1d
jb 0x140005a54
je 0x140005a78
cmp rdx, 0x1f
jb 0x140005a9c
je 0x140005abd
mov qword [rbp + 0x47e8], r15
mov r15, r13
mov r14, rsi
mov r13, r12
lea r12, [rbp + 0xfa8]
mov rax, qword [rbp + 0x47d0]
movzx ecx, byte [rax + 0x1c]
movzx edx, byte [rax + 0x1d]
movzx edi, byte [rax + 0x1e]
movzx esi, byte [rax + 0x1f]
shl esi, 0x18
shl edx, 8
or edx, ecx
shl edi, 0x10
or edi, edx
or edi, esi
mov dword [rbp + 0x1ff4], edi
mov ecx, reloc.WS2_32.dll_recv
nop dword [rax + rax]
mov edi, dword [rbp + rcx*4 + 0x1fb0]
mov esi, edi
rol esi, 0xf
mov edx, edi
rol edx, 0xd
mov ebx, dword [rbp + rcx*4 + 0x1f7c]
xor edx, esi
shr edi, 0xa
xor edi, edx
mov edx, ebx
rol edx, 0x19
mov eax, ebx
rol eax, 0xe
xor eax, edx
mov edx, ebx
shr edx, 3
xor edx, eax
add r8d, dword [rbp + rcx*4 + 0x1f9c]
add r8d, edi
add r8d, edx
add r8d, ecx
mov dword [rbp + rcx*4 + 0x1fb8], r8d
lea rax, [rcx + 1]
mov r8d, ebx
mov rcx, rax
cmp rax, 0xa00
jne 0x140005260
lea rdx, [rbp + 0x27b8]
lea rsi, [rbp - 0x58]
mov r8d, 0x1000
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0x37b8]
mov r8d, 0x1000
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov dword [rbp + 0x1fb0], 0
mov edi, 0x1000
nop word [rax + rax]
mov rcx, rsi
call fcn.140004b50
dec edi
jne 0x140005300
mov rdx, qword [rbp + 0x4868]
mov r8, rdx
not r8
shr r8, 0x3f
mov rcx, qword [rbp + 0x47d0]
call fcn.140007dd0
mov rdx, r13
mov r8, r13
not r8
shr r8, 0x3f
mov rcx, r14
call fcn.140007dd0
mov qword [rbp + 0x47b8], 0
mov qword [rbp + 0x47c0], 1
mov qword [rbp + 0x47c8], 0
lea rcx, [rbp + 0x1fb8]
call fcn.1400103c0
mov rsi, qword [rbp + 0x47e8]
lea rcx, [rbp + 0x1fb8]
mov dl, 1
call fcn.1400103f0
mov rcx, rax
mov rdx, rsi
mov r8, r15
call fcn.140010430
mov rbx, rdx
test rax, rax
jne 0x1400054ca
mov qword [rbp + 0x47d8], rbx
lea rcx, [rbp + 0x1fb8]
lea rdx, [rbp + 0x47d8]
lea r8, [rbp + 0x47b8]
call fcn.140010360
cmp qword [rbp + 0x1fb8], 0
mov rcx, qword [rbp + 0x47d8]
je 0x1400053de
mov rbx, qword [rbp + 0x1fc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400054ca
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rbp + 0x47c8]
test rdi, rdi
je 0x14000545a
mov rcx, qword [rbp + 0x1fa8]
xor ebx, ebx
lea r14, [rbp - 0x58]
nop dword [rax]
test rcx, rcx
jne 0x14000541a
mov rcx, r14
call fcn.140004b50
mov dword [rbp + 0x1fb4], eax
mov rcx, qword [rbp + 0x1fa8]
cmp rcx, 4
jae 0x14000552f
movzx eax, byte [rbp + rcx + 0x1fb4]
inc ecx
and ecx, 3
mov qword [rbp + 0x1fa8], rcx
mov rdx, qword [rbp + 0x47c8]
cmp rbx, rdx
jae 0x140005545
mov rdx, qword [rbp + 0x47c0]
xor byte [rdx + rbx], al
inc rbx
cmp rdi, rbx
jne 0x140005400
lea rcx, [rbp + 0x1fb8]
call fcn.1400103c0
lea rcx, [rbp + 0x1fb8]
mov dl, 1
call fcn.140010400
mov rcx, rax
mov dl, 1
call fcn.140010410
mov rcx, rax
mov rdx, rsi
mov r8, r15
call fcn.140010430
mov rbx, rdx
test rax, rax
jne 0x1400054ca
mov qword [rbp + 0x47d8], rbx
mov rdx, qword [rbp + 0x47c0]
mov r8, qword [rbp + 0x47c8]
lea rcx, [rbp + 0x47d8]
call fcn.140003df0
mov rbx, rax
mov rcx, qword [rbp + 0x47d8]
test rax, rax
je 0x140005503
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x47b8]
test rdx, rdx
je 0x1400054ec
mov rcx, qword [rbp + 0x47c0]
mov r8, rdx
not r8
shr r8, 0x3f
call fcn.140007dd0
mov rax, rbx
add rsp, 0x4878
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x47b8]
test rdx, rdx
je 0x14000552b
mov rcx, qword [rbp + 0x47c0]
mov r8, rdx
not r8
shr r8, 0x3f
call fcn.140007dd0
xor ebx, ebx
jmp 0x1400054ec
lea r8, str.srccrypto.rs
mov edx, 4
call fcn.1400377e0
jmp 0x140005b20
lea r8, str.srccrypto.rs
mov rcx, rbx
call fcn.1400377e0
jmp 0x140005b20
mov qword [rbp + 0x47e8], rsi
jmp 0x140005730
mov qword [rbp + 0x47e8], rsi
mov ecx, 1
jmp 0x14000575a
mov qword [rbp + 0x47e8], rsi
mov ecx, 2
jmp 0x140005781
mov qword [rbp + 0x47e8], rsi
mov ecx, 3
jmp 0x1400057a8
mov qword [rbp + 0x47e8], rsi
mov edi, 4
jmp 0x140005730
mov qword [rbp + 0x47e8], rsi
mov ecx, 5
jmp 0x14000575a
mov qword [rbp + 0x47e8], rsi
mov ecx, 6
jmp 0x140005781
mov qword [rbp + 0x47e8], rsi
mov ecx, 7
jmp 0x1400057a8
mov qword [rbp + 0x47e8], rsi
mov edi, 8
jmp 0x140005730
mov qword [rbp + 0x47e8], rsi
mov ecx, 9
jmp 0x14000575a
mov qword [rbp + 0x47e8], rsi
mov ecx, 0xa
jmp 0x140005781
mov qword [rbp + 0x47e8], rsi
mov ecx, listen
jmp 0x1400057a8
mov qword [rbp + 0x47e8], rsi
mov edi, listen
jmp 0x140005730
mov qword [rbp + 0x47e8], rsi
mov ecx, reloc.WS2_32.dll_listen
jmp 0x14000575a
mov qword [rbp + 0x47e8], rsi
mov ecx, recv
jmp 0x140005781
mov qword [rbp + 0x47e8], rsi
mov ecx, send
jmp 0x1400057a8
mov qword [rbp + 0x47e8], rsi
mov edi, reloc.WS2_32.dll_recv
jmp 0x140005730
mov qword [rbp + 0x47e8], rsi
mov ecx, send
jmp 0x14000575a
mov qword [rbp + 0x47e8], rsi
mov ecx, send
jmp 0x140005781
mov qword [rbp + 0x47e8], rsi
mov ecx, reloc.WS2_32.dll_send
jmp 0x1400057a8
mov qword [rbp + 0x47e8], rsi
mov edi, 0x14
jmp 0x140005730
mov qword [rbp + 0x47e8], rsi
mov ecx, 0x15
jmp 0x14000575a
mov qword [rbp + 0x47e8], rsi
mov ecx, 0x16
jmp 0x140005781
mov qword [rbp + 0x47e8], rsi
mov ecx, 0x17
jmp 0x1400057a8
mov qword [rbp + 0x47e8], rsi
mov edi, 0x18
jmp 0x140005730
mov qword [rbp + 0x47e8], rsi
mov ecx, 0x19
jmp 0x14000575a
mov qword [rbp + 0x47e8], rsi
mov ecx, 0x1a
jmp 0x140005781
mov qword [rbp + 0x47e8], rsi
mov ecx, 0x1b
jmp 0x1400057a8
mov qword [rbp + 0x47e8], rsi
mov edi, 0x1c
lea r8, str.srccrypto.rs
mov rcx, rdi
mov qword [rbp + 0x47e0], r12
mov rdx, r12
call fcn.1400377e0
jmp 0x140005b20
mov qword [rbp + 0x47e8], rsi
mov ecx, 0x1d
lea r8, str.srccrypto.rs
mov qword [rbp + 0x47e0], r12
mov rdx, r12
call fcn.1400377e0
jmp 0x140005b20
mov qword [rbp + 0x47e8], rsi
mov ecx, 0x1e
lea r8, str.srccrypto.rs
mov qword [rbp + 0x47e0], r12
mov rdx, r12
call fcn.1400377e0
jmp 0x140005b20
mov qword [rbp + 0x47e8], rsi
mov ecx, 0x1f
lea r8, str.srccrypto.rs
mov qword [rbp + 0x47e0], r12
mov rdx, r12
call fcn.1400377e0
jmp 0x140005b20
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
xor ecx, ecx
jmp 0x140005a67
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 1
jmp 0x140005a8b
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 2
jmp 0x140005aaf
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 3
jmp 0x140005ad0
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 4
jmp 0x140005a67
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 5
jmp 0x140005a8b
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 6
jmp 0x140005aaf
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 7
jmp 0x140005ad0
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 8
jmp 0x140005a67
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 9
jmp 0x140005a8b
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0xa
jmp 0x140005aaf
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, listen
jmp 0x140005ad0
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, listen
jmp 0x140005a67
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, reloc.WS2_32.dll_listen
jmp 0x140005a8b
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, recv
jmp 0x140005aaf
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, send
jmp 0x140005ad0
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, reloc.WS2_32.dll_recv
jmp 0x140005a67
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, send
jmp 0x140005a8b
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, send
jmp 0x140005aaf
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, reloc.WS2_32.dll_send
jmp 0x140005ad0
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x14
jmp 0x140005a67
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x15
jmp 0x140005a8b
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x16
jmp 0x140005aaf
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x17
jmp 0x140005ad0
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x18
jmp 0x140005a67
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x19
jmp 0x140005a8b
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x1a
jmp 0x140005aaf
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x1b
jmp 0x140005ad0
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x1c
lea r8, str.srccrypto.rs
call fcn.1400377e0
jmp 0x140005b20
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x1d
lea r8, str.srccrypto.rs
call fcn.1400377e0
jmp 0x140005b20
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x1e
lea r8, str.srccrypto.rs
call fcn.1400377e0
jmp 0x140005b20
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov ecx, 0x1f
lea r8, str.srccrypto.rs
call fcn.1400377e0
jmp 0x140005b20
call fcn.14002f200
ud2
mov rcx, r12
mov rdx, r14
call fcn.140037670
ud2
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
call fcn.14002f200
jmp 0x140005b20
mov qword [rbp + 0x47e8], rsi
mov qword [rbp + 0x47e0], r12
mov rcx, r14
mov rdx, rdi
call fcn.140037670
ud2