Function at 0x4c16a0
Capabilities:
Check os version
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x57b94b
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0xbc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
mov edi, dword [esp + 0xfc]
mov eax, dword [esp + 0xf8]
mov ebx, dword [esp + 0xf0]
mov ebp, dword [esp + 0xf4]
mov esi, ecx
movzx ecx, byte [edi + 0x122]
push ecx
push str.encryptFragment
push edi
lea ecx, [esp + 0x30]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], eax
call fcn.00437770
mov dword [esp + 0xdc], 0
test ebx, ebx
jne 0x4c1754
push str.Nothing_to_TLS_encrypt.
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
mov ecx, edi
call eax
lea ecx, [esp + 0x24]
mov dword [esp + 0xdc], 0xffffffff
call fcn.004377b0
xor al, al
jmp 0x4c1f51
cmp dword [esi + 0xb0], 0
jne 0x4c177b
cmp byte [esi + 0x98], 0
jne 0x4c177b
mov ecx, dword [ebp]
push ecx
mov ecx, dword [esp + 0x20]
push ebx
call fcn.00448260
mov bl, al
jmp 0x4c1f3b
cmp dword [esp + 0xe8], 3
jne 0x4c1794
cmp dword [esp + 0xec], 4
mov byte [esp + 0x16], 1
je 0x4c1799
mov byte [esp + 0x16], 0
lea ecx, [esi + 0x24]
call fcn.00446f40
cmp dword [esi + 0xac], 6
jne 0x4c1972
mov eax, dword [esi + 0xc4]
add eax, dword [esi + 0xc0]
cmp eax, 0xc
je 0x4c17c9
push str.Nonce_length_not_correct_for_GCM_mode.
jmp 0x4c1730
lea ebx, [esi + 0x694]
mov ecx, ebx
call fcn.00446f40
lea ebp, [esi + 0xd0]
mov ecx, ebp
call fcn.0051d090
cmp byte [esp + 0x16], 0
je 0x4c18da
cmp eax, 0xc
je 0x4c181a
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.WriteIV_is_not_the_correct_length_for_TLS_1.3_GCM_mode.
mov ecx, edi
call eax
mov ecx, ebp
call fcn.0051d090
push eax
push str.fixedIV_len
mov ecx, edi
call fcn.004373b0
jmp 0x4c1739
mov ecx, dword [esi + 0xec]
mov edx, dword [esi + 0xf0]
mov dword [esp + 0x48], ecx
mov ecx, ebp
mov byte [esp + 0x44], 0
mov byte [esp + 0x45], 0
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
mov dword [esp + 0x4c], edx
call fcn.00446f60
lea ecx, [esp + 0x44]
mov ebp, eax
xor edx, edx
sub eax, ecx
mov dword [esp + 0x20], eax
jmp 0x4c1864
mov eax, dword [esp + 0x20]
lea ecx, [esp + edx + 0x44]
movzx eax, byte [eax + ecx]
xor byte [ecx], al
movzx eax, byte [edx + ebp + 1]
xor byte [ecx + 1], al
movzx eax, byte [edx + ebp + 2]
xor byte [ecx + 2], al
movzx eax, byte [edx + ebp + 3]
xor byte [ecx + 3], al
movzx eax, byte [edx + ebp + 4]
xor byte [ecx + 4], al
movzx eax, byte [edx + ebp + 5]
xor byte [ecx + 5], al
add edx, 6
cmp edx, 0xc
jl 0x4c1860
push 0xc
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esi + 0x24]
call fcn.00448260
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
add eax, 0x11
mov ecx, eax
push 5
lea edx, [esp + 0x38]
mov byte [esp + 0x38], 0x17
mov byte [esp + 0x39], 3
mov byte [esp + 0x3a], 3
shr ecx, 8
mov byte [esp + 0x3c], al
push edx
jmp 0x4c1967
cmp eax, 4
je 0x4c1906
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
push str.WriteIV_is_not_the_correct_length_for_GCM_mode.
mov ecx, edi
call edx
mov ecx, ebp
call fcn.0051d090
push eax
push str.fixedIV_len
mov ecx, edi
call fcn.004373b0
jmp 0x4c1739
push 8
lea ebp, [esi + 0xec]
push ebp
mov ecx, ebx
call fcn.00448260
lea eax, [esi + 0xd0]
push eax
lea ecx, [esi + 0x24]
call fcn.00449d90
push 8
push ebp
lea ecx, [esi + 0x24]
call fcn.00448260
mov al, byte [esp + 0xe4]
mov dl, byte [esp + 0xec]
mov cl, byte [esp + 0xe8]
mov byte [esp + 0x34], al
mov eax, dword [esp + 0x18]
mov byte [esp + 0x36], dl
movzx edx, byte [eax]
mov byte [esp + 0x35], cl
movzx ecx, byte [eax + 1]
push 5
lea eax, [esp + 0x38]
mov byte [esp + 0x3c], dl
push eax
mov byte [esp + 0x3f], cl
mov ecx, ebx
call fcn.00448260
cmp dword [esp + 0xe8], 3
jne 0x4c1bcf
cmp dword [esp + 0xec], 2
jl 0x4c1bcf
cmp dword [esi + 0xc4], 0
jbe 0x4c1bcf
lea ebp, [esi + 0x40]
mov ecx, ebp
call fcn.00446f40
cmp dword [esi + 0xac], 6
je 0x4c19be
mov ecx, dword [esi + 0xc4]
push ebp
push ecx
call fcn.00467710
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
mov ebx, dword [esp + 0x30]
push eax
push ebx
mov ecx, ebp
call fcn.00448260
cmp byte [esp + 0x16], 0
je 0x4c19e7
mov ecx, dword [esp + 0xe4]
push ecx
mov ecx, ebp
call fcn.00447e40
cmp dword [esi + 0xb0], 0
je 0x4c1a33
cmp dword [esi + 0xac], 6
je 0x4c1a33
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov eax, dword [esp + 0xe4]
push edi
lea edx, [esp + 0x54]
push edx
mov edx, dword [esp + 0xf4]
push ecx
push ebx
push edx
push 3
push eax
push 1
mov ecx, esi
call fcn.004c14b0
test eax, eax
je 0x4c1a33
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, ebp
call fcn.00448260
cmp byte [esi + 0x98], 0
je 0x4c1f22
mov eax, dword [esi + 0xac]
cmp eax, 6
je 0x4c1a83
cmp eax, 0x63
je 0x4c1a83
cmp eax, 7
je 0x4c1a83
mov ebx, dword [esi + 0xc4]
xor eax, eax
test ebx, ebx
je 0x4c1a71
mov ecx, ebp
call fcn.0051d090
inc eax
xor edx, edx
div ebx
mov eax, ebx
sub eax, edx
cmp eax, ebx
jne 0x4c1a77
xor eax, eax
lea edx, [eax + 1]
push edx
push eax
mov ecx, ebp
call fcn.00447f70
cmp dword [esi + 0xac], 6
jne 0x4c1a9b
lea eax, [esi + 0x24]
push eax
lea ecx, [esi + 0x648]
call fcn.004da500
mov ecx, dword [esp + 0x1c]
call fcn.0051d090
mov cl, byte [edi + 0x122]
xor ebx, ebx
mov dword [esp + 0x20], eax
mov al, byte [edi + 0x121]
mov byte [edi + 0x121], cl
cmp dword [esi + 0xac], 6
mov byte [esp + 0x17], al
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
jne 0x4c1b31
mov ecx, dword [esi + 0x6d8]
push edi
lea edx, [esi + 0x648]
push edx
lea eax, [esi + 0xf8]
push eax
call fcn.005431d0
test al, al
jne 0x4c1b18
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.TLS_gcm_encrypt_setup_failed.
mov ecx, edi
call eax
mov ecx, dword [esp + 0x18]
mov dword [ecx], ebx
jmp 0x4c1739
cmp byte [esp + 0x16], 0
jne 0x4c1b31
mov ecx, dword [esp + 0x1c]
push 8
lea edx, [esi + 0xec]
push edx
call fcn.00448260
mov eax, dword [esp + 0x1c]
push edi
push eax
mov ecx, ebp
lea ebx, [esi + 0x648]
call fcn.0051d090
push eax
mov ecx, ebp
call fcn.00446f60
mov ecx, dword [esi + 0x6d8]
push eax
push ebx
lea eax, [esi + 0xf8]
push eax
call fcn.004da700
mov cl, byte [esp + 0x17]
mov bl, al
mov byte [edi + 0x121], cl
test bl, bl
jne 0x4c1b7a
push str.Failed_to_encrypt_TLS_fragment
jmp 0x4c1730
cmp dword [esi + 0xac], 6
jne 0x4c1f0d
mov ecx, dword [esi + 0x6d8]
push edi
lea eax, [esi + 0x648]
push eax
lea eax, [esi + 0xf8]
push eax
call fcn.00543250
test al, al
jne 0x4c1baf
push str.TLS_gcm_encrypt_finalize_failed.
jmp 0x4c1730
add esi, 0x6b0
mov ecx, esi
call fcn.0051d090
cmp eax, 0x10
je 0x4c1f01
push str.GCM_auth_tag_is_not_16_bytes.
jmp 0x4c1730
lea ebp, [esi + 0x40]
mov ecx, ebp
call fcn.00446f40
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov ebx, dword [esp + 0x30]
push ecx
push ebx
mov ecx, ebp
call fcn.00448260
cmp byte [esp + 0x16], 0
je 0x4c1c02
mov edx, dword [esp + 0xe4]
push edx
mov ecx, ebp
call fcn.00447e40
cmp dword [esi + 0xb0], 0
je 0x4c1c51
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov ecx, dword [esp + 0xe8]
push edi
lea eax, [esp + 0x94]
push eax
mov eax, dword [esp + 0xf4]
push edx
mov edx, dword [esp + 0xf0]
push ebx
push eax
push ecx
push edx
push 1
mov ecx, esi
call fcn.004c14b0
test eax, eax
je 0x4c1c51
push eax
lea eax, [esp + 0x94]
push eax
mov ecx, ebp
call fcn.00448260
cmp byte [esi + 0x98], 0
je 0x4c1f22
mov eax, dword [esi + 0xac]
cmp eax, 6
je 0x4c1ca1
cmp eax, 0x63
je 0x4c1ca1
cmp eax, 7
je 0x4c1ca1
mov ebx, dword [esi + 0xc4]
xor eax, eax
test ebx, ebx
je 0x4c1c8f
mov ecx, ebp
call fcn.0051d090
inc eax
xor edx, edx
div ebx
mov eax, ebx
sub eax, edx
cmp eax, ebx
jne 0x4c1c95
xor eax, eax
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, ebp
call fcn.00447f70
cmp dword [esi + 0xac], 7
jne 0x4c1e41
lea ebx, [esi + 0x24]
push 0xc
mov ecx, ebx
call fcn.0044bb40
mov ebp, eax
test ebp, ebp
je 0x4c1d53
mov byte [ebp], 0
mov byte [ebp + 1], 0
mov byte [ebp + 2], 0
mov byte [ebp + 3], 0
mov edx, dword [esi + 0xec]
mov dword [ebp + 4], edx
mov eax, dword [esi + 0xf0]
push 0xc
mov ecx, ebx
mov dword [ebp + 8], eax
call fcn.00446f70
lea ebx, [esi + 0xd0]
mov ecx, ebx
call fcn.0051d090
cmp eax, 0xc
je 0x4c1d0b
push str.m_fixedIv_should_be_12_bytes
jmp 0x4c1730
mov ecx, ebx
call fcn.00446f60
lea edx, [eax + 2]
mov ecx, ebp
sub eax, ebp
mov ebp, 2
mov edi, edi
movzx ebx, byte [eax + ecx]
xor byte [ecx], bl
movzx ebx, byte [edx - 1]
xor byte [ecx + 1], bl
movzx ebx, byte [edx]
xor byte [ecx + 2], bl
movzx ebx, byte [edx + 1]
xor byte [ecx + 3], bl
movzx ebx, byte [edx + 2]
xor byte [ecx + 4], bl
movzx ebx, byte [edx + 3]
xor byte [ecx + 5], bl
add ecx, 6
add edx, 6
sub ebp, 1
jne 0x4c1d20
lea ebp, [esi + 0x694]
mov ecx, ebp
call fcn.00446f40
cmp byte [esp + 0x16], 0
je 0x4c1d95
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
add eax, 0x11
mov edx, eax
mov byte [esp + 0x38], al
shr edx, 8
push 5
lea eax, [esp + 0x38]
mov byte [esp + 0x38], 0x17
mov byte [esp + 0x39], 3
mov byte [esp + 0x3a], 3
mov byte [esp + 0x3b], dl
push eax
jmp 0x4c1de0
push 8
lea ecx, [esi + 0xec]
push ecx
mov ecx, ebp
call fcn.00448260
mov al, byte [esp + 0xe8]
mov dl, byte [esp + 0xe4]
mov cl, byte [esp + 0xec]
mov byte [esp + 0x3d], al
mov eax, dword [esp + 0x18]
mov byte [esp + 0x3c], dl
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
mov byte [esp + 0x3e], cl
push 5
lea ecx, [esp + 0x40]
mov byte [esp + 0x43], dl
mov byte [esp + 0x44], al
push ecx
mov ecx, ebp
call fcn.00448260
lea eax, [esi + 0x24]
lea ebp, [esi + 0x648]
push eax
mov ecx, ebp
call fcn.004da500
mov ecx, dword [esi + 0x6d8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push edi
lea ebx, [esi + 0xf8]
push ebx
push ebp
push 1
call eax
mov ecx, dword [esi + 0x6d8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
push edi
push ebp
push ebx
call eax
test al, al
jne 0x4c1e41
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.TLS_aead_encrypt_setup_failed.
mov ecx, edi
call eax
mov ecx, dword [esp + 0x18]
mov dword [ecx], 0
jmp 0x4c1739
mov ebp, dword [esp + 0x1c]
mov ecx, ebp
call fcn.0051d090
mov dl, byte [edi + 0x121]
push edi
push ebp
mov dword [esp + 0x28], eax
mov al, byte [edi + 0x122]
lea ebp, [esi + 0x40]
mov ecx, ebp
mov byte [esp + 0x1f], dl
mov byte [edi + 0x121], al
lea ebx, [esi + 0x648]
call fcn.0051d090
push eax
mov ecx, ebp
call fcn.00446f60
mov ecx, dword [esi + 0x6d8]
push eax
push ebx
lea eax, [esi + 0xf8]
push eax
call fcn.004da700
mov cl, byte [esp + 0x17]
mov bl, al
mov byte [edi + 0x121], cl
test bl, bl
jne 0x4c1eb2
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push str.Failed_to_encrypt_TLS_fragment.
mov ecx, edi
call eax
cmp dword [esi + 0xac], 7
jne 0x4c1f0d
mov ecx, dword [esi + 0x6d8]
mov edx, dword [ecx]
push edi
lea eax, [esi + 0x648]
push eax
lea eax, [esi + 0xf8]
push eax
mov eax, dword [edx + 0x28]
call eax
test al, al
jne 0x4c1ee5
push str.TLS_aead_encrypt_finalize_failed.
jmp 0x4c1730
add esi, 0x6b0
mov ecx, esi
call fcn.0051d090
cmp eax, 0x10
je 0x4c1f01
push str.AEAD_auth_tag_is_not_16_bytes.
jmp 0x4c1730
mov ecx, dword [esp + 0x1c]
push esi
call fcn.00449d90
mov bl, al
mov ecx, dword [esp + 0x1c]
call fcn.0051d090
sub eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
jmp 0x4c1f3b
mov ecx, dword [esp + 0x1c]
push ebp
call fcn.00449d90
mov ecx, ebp
mov bl, al
call fcn.0051d090
mov edx, dword [esp + 0x18]
mov dword [edx], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0xdc], 0xffffffff
call fcn.004377b0
mov al, bl
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xbc]
xor ecx, esp
call fcn.005550b0
add esp, 0xcc
ret 0x1c