Function at 0x14003da70
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x14004e010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
lea r14, [rbp + 0x5f]
movabs r15, 0xff00ff00ff00ff00
mov qword [rbp + 0x2f], r15
mov qword [rbp + 0x37], r14
mov rsi, qword [r14]
xor rsi, r15
mov qword [rbp + 0x27], rsi
xor edi, edi
mov qword [r14], rdi
call fcn.14003d7e0
xor edx, edx
lea r8d, [rdi + 0x3b]
lea rcx, str.Onion_ESPONLY
call fcn.14000c920
mov rax, qword [0x14004e960]
mov rcx, qword [rax + 0x1cd0]
mov byte [rcx + 0xc1], 1
call fcn.1400105e0
mov rbx, qword [0x14004e960]
lea rcx, [rbx + 0x1e38]
movss xmm1, dword [rbx + 0x1690]
movss xmm0, dword [rbx + 0x1694]
mov dword [rbp - 0x49], send
movss dword [rbp - 0x45], xmm1
movss dword [rbp - 0x41], xmm0
lea rdx, [rbp - 0x49]
call fcn.140020b60
mov qword [rbx + 0x1690], rdi
mov rbx, qword [0x14004e960]
lea rcx, [rbx + 0x1e38]
movss xmm1, dword [rbx + 0x1688]
movss xmm0, dword [rbx + 0x168c]
mov dword [rbp - 0x49], send
movss dword [rbp - 0x45], xmm1
movss dword [rbp - 0x41], xmm0
lea rdx, [rbp - 0x49]
call fcn.140020b60
mov qword [rbx + 0x1688], rdi
mov rdx, qword [0x14004e960]
movsxd rax, dword [rdx + 0x1e38]
lea rcx, [rax + rax*2]
mov r8, qword [rdx + 0x1e40]
movsxd rax, dword [r8 + rcx*4 - 0xc]
lea r10, [rax + rax*2]
lea r11, [0x140041e30]
mov r9d, dword [r11 + r10*4 + 8]
cmp dword [r11 + r10*4], 8
jne 0x14003dbe6
mov eax, dword [r11 + r10*4 + 4]
cmp eax, 1
jne 0x14003dbc7
mov eax, dword [r8 + rcx*4 - 8]
mov dword [r9 + rdx + 0x1640], eax
jmp 0x14003dbe6
cmp eax, 2
jne 0x14003dbe6
mov eax, dword [r8 + rcx*4 - 8]
mov dword [r9 + rdx + 0x1640], eax
mov eax, dword [r8 + rcx*4 - 4]
mov dword [r9 + rdx + 0x1644], eax
movsxd rcx, dword [rdx + 0x1e38]
lea eax, [rcx - 1]
mov dword [rdx + 0x1e38], eax
lea rax, [rcx - 2]
lea rcx, [rax + rax*2]
mov r8, qword [rdx + 0x1e40]
movsxd rax, dword [r8 + rcx*4]
lea r10, [rax + rax*2]
mov r9d, dword [r11 + r10*4 + 8]
cmp dword [r11 + r10*4], 8
jne 0x14003dc51
mov eax, dword [r11 + r10*4 + 4]
cmp eax, 1
jne 0x14003dc32
mov eax, dword [r8 + rcx*4 + 4]
mov dword [r9 + rdx + 0x1640], eax
jmp 0x14003dc51
cmp eax, 2
jne 0x14003dc51
mov eax, dword [r8 + rcx*4 + 4]
mov dword [r9 + rdx + 0x1640], eax
mov eax, dword [r8 + rcx*4 + 8]
mov dword [r9 + rdx + 0x1644], eax
dec dword [rdx + 0x1e38]
call fcn.1400106f0
movss xmm1, dword [0x140046254]
xorps xmm0, xmm0
call fcn.140010440
call fcn.1400105e0
call fcn.140035ef0
movdqa xmm0, xmmword [0x140046700]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x140046350]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x140046820]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x1400467c0]
movdqa xmmword [rbp + 7], xmm1
mov word [rbp + 0x17], 0x100
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x40
jb 0x14003dcc0
mov byte [rbp + 0x18], 0
lea rcx, [rbp - 0x29]
call fcn.140033fd0
movdqa xmm0, xmmword [0x140046340]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x140046730]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x140046810]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm1, xmmword [0x140046840]
movdqa xmmword [rbp + 7], xmm1
mov dword [rbp + 0x17], 0xf8ffb7f3
mov dword [rbp + 0x1b], 0xf0bcfef7
mov dword [rbp + 0x1f], 0x80d5f1fb
mov word [rbp + 0x23], 0x100
mov rcx, rdi
nop
lea eax, [rcx + 0x56]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 0x4c
jb 0x14003dd30
mov byte [rbp + 0x24], 0
lea rcx, [rbp - 0x29]
call fcn.140033fd0
mov dword [rbp - 0x39], 0x43960000
mov dword [rbp - 0x35], 0x42480000
mov dword [rbp - 0x49], 0x3d39381a
mov dword [rbp - 0x45], 0x3834187a
mov dword [rbp - 0x41], 0x1002b3f
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0xa
jb 0x14003dd80
mov byte [rbp - 0x3e], 0
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x49]
call fcn.1400349c0
test al, al
je 0x14003ddaa
call fcn.14003d1b0
mov dword [rbp - 0x39], 0x43960000
mov dword [rbp - 0x35], 0x42480000
mov dword [rbp - 0x49], 0x2d312f13
mov dword [rbp - 0x45], 0x3834187a
mov dword [rbp - 0x41], 0x1002b3f
nop dword [rax]
lea eax, [rdi + 0x56]
xor byte [rbp + rdi - 0x49], al
inc rdi
cmp rdi, 0xa
jb 0x14003ddd0
mov byte [rbp - 0x3e], 0
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x49]
call fcn.1400349c0
test al, al
je 0x14003de01
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14000f7e0
nop
xor rsi, r15
mov qword [r14], rsi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14003f4b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret