Function at 0x140002db0
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
sub rsp, 0x28
mov r11, r8
mov r10, rcx
test rcx, rcx
je 0x14000335f
test r8, r8
je 0x14000335f
lea eax, [rdx - 0x80]
test eax, 0xffffff3f
jne 0x140003355
cmp edx, 0x140
je 0x140003355
mov qword [rsp + 0x20], rdi
cmp edx, 0x80
jne 0x140002e00
mov dword [r8 + 0xf0], 0xa
jmp 0x140002e1a
mov eax, reloc.WS2_32.dll_ntohl
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
cmp edx, 0xc0
cmove eax, ecx
mov dword [r8 + 0xf0], eax
movzx eax, byte [r10 + 1]
movzx edi, byte [r10]
lea r9, [r8 + 4]
shl edi, 8
mov qword [rsp + 0x30], rbx
xor edi, eax
movzx eax, byte [r10 + 2]
shl edi, 8
xor edi, eax
movzx eax, byte [r10 + 3]
shl edi, 8
xor edi, eax
mov dword [r8], edi
movzx eax, byte [r10 + 5]
movzx ecx, byte [r10 + 4]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 6]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 7]
shl ecx, 8
xor ecx, eax
mov dword [r9], ecx
movzx eax, byte [r10 + 9]
movzx ecx, byte [r10 + 8]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0xa]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0xb]
shl ecx, 8
xor ecx, eax
mov dword [r8 + 8], ecx
movzx eax, byte [r10 + 0xd]
movzx ecx, byte [r10 + 0xc]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0xe]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0xf]
shl ecx, 8
xor ecx, eax
mov dword [r8 + 0xc], ecx
cmp edx, 0x80
jne 0x140002fe0
mov edx, ecx
mov eax, ecx
lea rbx, str.ccccwwww
shr rax, 0x10
lea r10, [0x1401233b8]
movzx ecx, al
mov eax, edx
mov r8d, dword [rbx + rcx*4]
shr rax, 8
btc r8d, 0x18
movzx ecx, al
mov eax, dword [rbx + rcx*4]
and r8d, 0xff000000
and eax, 0xff0000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [rbx + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [rbx + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, edi
lea rdi, [0x140123394]
mov dword [r11 + 0x10], r8d
xor r8d, dword [r9]
mov dword [r11 + 0x14], r8d
xor r8d, dword [r11 + 8]
mov dword [r11 + 0x18], r8d
xor r8d, dword [r11 + 0xc]
mov dword [r11 + 0x1c], r8d
nop word [rax + rax]
mov edx, dword [r9 + 0x18]
lea r9, [r9 + 0x10]
add rdi, 4
mov eax, edx
shr rax, 8
movzx ecx, al
mov eax, edx
mov r8d, dword [rbx + rcx*4]
shr rax, 0x10
movzx ecx, al
and r8d, 0xff0000
mov eax, dword [rbx + rcx*4]
and eax, 0xff000000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [rbx + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [rbx + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, dword [r9 - 4]
xor r8d, dword [rdi - 4]
mov dword [r9 + 0xc], r8d
mov eax, dword [r9]
xor eax, r8d
mov dword [r9 + 0x10], eax
mov ecx, dword [r9 + 4]
xor ecx, eax
mov dword [r9 + 0x14], ecx
mov eax, dword [r9 + 8]
xor eax, ecx
mov dword [r9 + 0x18], eax
cmp rdi, r10
jne 0x140002f50
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
movzx eax, byte [r10 + 0x11]
movzx ecx, byte [r10 + 0x10]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0x12]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0x13]
shl ecx, 8
xor ecx, eax
mov dword [r8 + 0x10], ecx
movzx eax, byte [r10 + 0x15]
movzx ecx, byte [r10 + 0x14]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0x16]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0x17]
shl ecx, 8
xor ecx, eax
mov dword [r8 + 0x14], ecx
cmp edx, 0xc0
jne 0x140003165
mov edx, ecx
mov eax, ecx
lea rbx, str.ccccwwww
shr rax, 0x10
lea r10, [0x1401233b0]
movzx ecx, al
mov eax, edx
mov r8d, dword [rbx + rcx*4]
shr rax, 8
movzx ecx, al
btc r8d, 0x18
mov eax, dword [rbx + rcx*4]
and r8d, 0xff000000
and eax, 0xff0000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [rbx + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [rbx + rax*4]
lea rax, [r11 + 0x28]
and ecx, 0xff00
xor r8d, ecx
xor r8d, edi
lea rdi, [0x140123394]
mov dword [r11 + 0x18], r8d
xor r8d, dword [r9]
mov dword [r11 + 0x1c], r8d
xor r8d, dword [r11 + 8]
mov dword [r11 + 0x20], r8d
xor r8d, dword [r11 + 0xc]
mov dword [r11 + 0x24], r8d
nop dword [rax]
mov edx, dword [rax - 0x18]
mov ecx, dword [rax - 0x14]
lea rax, [rax + 0x18]
xor edx, dword [rax - 0x1c]
add rdi, 4
xor ecx, edx
mov dword [rax - 0x18], edx
mov dword [rax - 0x14], ecx
mov r8d, dword [rax - 0x14]
mov ecx, r8d
shr rcx, 8
movzx edx, cl
mov ecx, r8d
mov r9d, dword [rbx + rdx*4]
shr rcx, 0x10
movzx edx, cl
and r9d, 0xff0000
mov ecx, dword [rbx + rdx*4]
and ecx, 0xff000000
xor r9d, ecx
mov ecx, r8d
shr rcx, 0x18
movzx ecx, byte [rbx + rcx*4]
xor r9d, ecx
movzx ecx, r8b
mov edx, dword [rbx + rcx*4]
and edx, 0xff00
xor r9d, edx
xor r9d, dword [rax - 0x28]
xor r9d, dword [rdi - 4]
mov dword [rax - 0x10], r9d
mov ecx, dword [rax - 0x24]
xor ecx, r9d
mov dword [rax - 0xc], ecx
mov edx, dword [rax - 0x20]
xor edx, ecx
mov dword [rax - 8], edx
mov ecx, dword [rax - 0x1c]
xor ecx, edx
mov dword [rax - 4], ecx
cmp rdi, r10
jne 0x1400030c0
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
movzx eax, byte [r10 + 0x19]
movzx ecx, byte [r10 + 0x18]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0x1a]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0x1b]
shl ecx, 8
xor ecx, eax
mov dword [r8 + 0x18], ecx
movzx eax, byte [r10 + 0x1d]
movzx ecx, byte [r10 + 0x1c]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0x1e]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r10 + 0x1f]
shl ecx, 8
xor ecx, eax
mov dword [r8 + 0x1c], ecx
cmp edx, 0x100
jne 0x140002fcf
mov edx, ecx
mov eax, ecx
lea rbx, str.ccccwwww
shr rax, 0x10
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
movzx ecx, al
mov eax, edx
lea rsi, [r11 + 0x30]
mov r8d, dword [rbx + rcx*4]
shr rax, 8
lea rbp, [0x1401233ac]
btc r8d, 0x18
movzx ecx, al
mov eax, dword [rbx + rcx*4]
and r8d, 0xff000000
and eax, 0xff0000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [rbx + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [rbx + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, edi
lea rdi, [0x140123394]
mov dword [r11 + 0x20], r8d
xor r8d, dword [r9]
mov dword [r11 + 0x24], r8d
xor r8d, dword [r11 + 8]
mov dword [r11 + 0x28], r8d
xor r8d, dword [r11 + 0xc]
mov dword [r11 + 0x2c], r8d
nop dword [rax + rax]
mov edx, dword [rsi - 4]
mov eax, edx
shr rax, 0x10
movzx ecx, al
mov eax, edx
mov r8d, dword [rbx + rcx*4]
shr rax, 8
movzx ecx, al
and r8d, 0xff0000
mov eax, dword [rbx + rcx*4]
and eax, 0xff00
xor r8d, eax
mov eax, edx
shr rax, 0x18
mov ecx, dword [rbx + rax*4]
movzx eax, dl
and ecx, 0xff000000
xor r8d, ecx
movzx ecx, byte [rbx + rax*4]
mov eax, dword [rsi - 0x1c]
xor r8d, ecx
mov ecx, dword [rsi - 0x18]
xor r8d, dword [rsi - 0x20]
xor eax, r8d
mov dword [rsi], r8d
xor ecx, eax
mov dword [rsi + 4], eax
mov eax, dword [rsi - 0x14]
xor eax, ecx
mov dword [rsi + 8], ecx
mov dword [rsi + 0xc], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rsi + 0xc]
lea rsi, [rsi + 0x20]
mov eax, edx
add rdi, 4
shr rax, 8
movzx ecx, al
mov eax, edx
mov r8d, dword [rbx + rcx*4]
shr rax, 0x10
movzx ecx, al
and r8d, 0xff0000
mov eax, dword [rbx + rcx*4]
and eax, 0xff000000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [rbx + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [rbx + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, dword [rsi - 0x30]
xor r8d, dword [rdi - 4]
mov dword [rsi - 0x10], r8d
mov eax, dword [rsi - 0x2c]
xor eax, r8d
mov dword [rsi - 0xc], eax
mov ecx, dword [rsi - 0x28]
xor ecx, eax
mov dword [rsi - 8], ecx
mov eax, dword [rsi - 0x24]
xor eax, ecx
mov dword [rsi - 4], eax
cmp rdi, rbp
jne 0x140003250
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
mov eax, 0xfffffffe
add rsp, 0x28
ret
or eax, 0xffffffff
add rsp, 0x28
ret