Function at 0x140042cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
mov r12, r8
mov r13, rdx
mov rbx, rcx
call fcn.1400d5450
mov rsi, rax
xor edi, edi
test rax, rax
jne 0x140042dee
mov dword [rbp + 0x7f], 0xf0f7eff7
mov word [rbp + 0x83], 0x100
mov ecx, edi
nop word [rax + rax]
lea eax, [rcx - 0x67]
xor byte [rbp + rcx + 0x7f], al
inc rcx
cmp rcx, 4
jb 0x140042d20
mov byte [rbp + 0x84], dil
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dil
mov r8d, 4
lea rdx, [rbp + 0x7f]
mov rcx, rbx
call fcn.14002b310
nop
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x140042d93
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140042d8e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140042de7
mov rcx, r8
call fcn.1400d43b4
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x1400432fa
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x1400432f5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x1400432f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov qword [rsp + 0x50], rdi
mov qword [rbp - 0x79], rdi
mov qword [rbp - 0x71], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], dil
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x39], 0
mov r8, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140042e27
mov r8, qword [r12]
mov edx, 0x2712
mov rcx, rsi
call fcn.1400d8f70
mov edx, 0x51
lea r8d, [rdx - 0x50]
mov rcx, rsi
call fcn.1400d8f70
lea r8, str.keyauth.win
mov edx, 0x27c1
mov rcx, rsi
call fcn.1400d8f70
mov edx, 0x40
lea r8d, [rdx - 0x3f]
mov rcx, rsi
call fcn.1400d8f70
mov edx, 0xac
mov r8d, 1
mov rcx, rsi
call fcn.1400d8f70
mov r8, r13
cmp qword [r13 + 0x18], 0x10
jb 0x140042e8b
mov r8, qword [r13]
mov edx, 0x271f
mov rcx, rsi
call fcn.1400d8f70
lea r8, [0x1400414e0]
mov edx, 0x4e2b
mov rcx, rsi
call fcn.1400d8f70
lea r8, [rsp + 0x50]
mov edx, 0x2711
mov rcx, rsi
call fcn.1400d8f70
lea r8, [0x140041560]
mov edx, 0x4e6f
mov rcx, rsi
call fcn.1400d8f70
lea r8, [rbp - 0x39]
mov edx, 0x272d
mov rcx, rsi
call fcn.1400d8f70
mov rcx, rsi
call fcn.1400d5510
test eax, eax
je 0x140042f31
mov ecx, eax
call fcn.1400d60c0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140042f10
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14002b310
lea rcx, [rsp + 0x30]
call fcn.140043340
lea rax, [rsp + 0x30]
mov qword [rbp + 0x7f], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov r15, qword [rbp - 0x79]
lea r14, [rsp + 0x50]
cmp qword [rbp - 0x71], 0x10
cmovae r14, qword [rsp + 0x50]
cmp r15, 0x10
jae 0x140042f73
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x30], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x140042fed
mov rbx, r15
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140042fca
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140043332
mov rcx, rax
call fcn.1400d4128
mov rcx, rax
test rax, rax
je 0x140042fc3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140042fd9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140042fd6
call fcn.1400d4128
jmp 0x140042fd9
mov rax, rdi
mov qword [rsp + 0x30], rax
lea r8, [r15 + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rbx
lea rax, [rbp - 0x11]
mov qword [rbp - 0x19], rax
mov rdx, r12
lea rcx, [rbp - 0x11]
call fcn.140048a30
mov rbx, rax
mov rdx, r13
lea rcx, [rbp - 0x61]
call fcn.140048a30
nop
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rax
call fcn.140043fc0
lea r8, [rbp - 0x69]
mov edx, 0x400022
mov rcx, rsi
call fcn.1400d5420
test eax, eax
jne 0x1400431b5
xor sil, sil
mov r14d, edi
mov rcx, qword [rbp - 0x69]
cmp dword [rcx], edi
jle 0x140043141
mov r15, rdi
nop dword [rax]
mov rax, qword [rcx + 8]
mov rbx, qword [r15 + rax]
test rbx, rbx
je 0x14004312c
movdqa xmm0, xmmword [0x140162320]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xc9c8c3df
mov word [rsp + 0x44], 0xde
mov byte [rsp + 0x46], 1
mov rcx, rdi
nop word [rax + rax]
lea eax, [rcx - 0x67]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x15
jb 0x1400430a0
mov byte [rsp + 0x46], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140043118
mov dword [rsp + 0x20], 0xbbefffd5
mov dword [rsp + 0x24], 0xcedabeee
mov dword [rsp + 0x28], 0xd4dad0c2
mov word [rsp + 0x2c], Ordinal_211
mov byte [rsp + 0x2e], 1
mov rax, rdi
nop
lea ecx, [rax - 0x67]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0xd
jb 0x1400430f0
mov byte [rsp + 0x2e], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14004311b
mov sil, 1
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140043071
mov rcx, qword [rbp - 0x69]
inc r14d
add r15, 8
cmp r14d, dword [rcx]
jl 0x140043060
test sil, sil
jne 0x1400431b5
movdqa xmm0, xmmword [0x140162220]
movdqu xmmword [rbp - 0x61], xmm0
movdqa xmm1, xmmword [0x1401622f0]
movdqu xmmword [rbp - 0x51], xmm1
mov dword [rbp - 0x41], 0xd8ded3df
mov word [rbp - 0x3d], 0x100
mov rcx, rdi
nop dword [rax + rax]
lea eax, [rcx - 0x67]
xor byte [rbp + rcx - 0x61], al
inc rcx
cmp rcx, 0x24
jb 0x140043170
mov byte [rbp - 0x3c], 0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov r8d, Ordinal_41
lea rdx, [rbp - 0x61]
lea rcx, [rsp + 0x30]
call fcn.14002b310
lea rcx, [rsp + 0x30]
call fcn.140043340
mov rbx, qword [rbp + 0x67]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x79]
movups xmmword [rbx + 0x10], xmm1
mov qword [rbp - 0x79], rdi
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x71], rax
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x14004321d
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043214
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043214
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
mov rax, qword [rbp - 0x71]
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x39], 0
cmp rax, 0x10
jb 0x140043269
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043264
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043264
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
mov qword [rbp - 0x79], rdi
mov qword [rbp - 0x71], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x1400432b1
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x1400432ac
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140043324
mov rcx, r8
call fcn.1400d43b4
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x1400432fa
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x1400432f5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004332b
mov rcx, r8
call fcn.1400d43b4
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], reloc.WS2_32.dll_ntohs
mov rax, rbx
mov byte [r12], 0
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140002f40
int3