Function at 0x1400025bc
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r14, rcx
mov dword [rbp - 0x80], 0x11c
lea rcx, [rbp - 0x7c]
xor edx, edx
mov r8d, 0x118
xor ebx, ebx
call sub.VCRUNTIME140.dll_memset
cmp word [0x14000eada], bx
mov esi, 0x3521cfb3
movups xmm0, xmmword [str.ZAR_T]
mov eax, dword [0x14000ead8]
mov dword [rsp + 0x40], eax
movups xmmword [rsp + 0x30], xmm0
je 0x14000266a
mov r8d, ebx
lea r9, [rsp + 0x30]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x35
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x34
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xa
jl 0x140002637
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x14000289a
cmp byte [0x14000eaed], bl
mov eax, dword [0x14000eae8]
movsd xmm0, qword [str.fAZp_MlNNWP.A]
mov dword [rsp + 0x28], eax
movzx eax, word [0x14000eaec]
mov word [rsp + 0x2c], ax
movsd qword [rsp + 0x20], xmm0
je 0x1400026e2
mov r8d, ebx
lea r9, [rsp + 0x20]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x35
mov al, r8b
inc r8d
sub al, cl
add al, 0x34
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x1400026b5
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002891
lea rcx, [rbp - 0x80]
call rax
test eax, eax
jne 0x140002891
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [rbp + 0x9a], 1
lea rdx, [rbp - 0x6c]
mov rcx, r14
setne sil
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x48]
mov r14w, 6
sub ax, r14w
mov r12d, 4
cmp ax, r12w
jbe 0x140002768
mov dil, bl
mov r8b, reloc.WS2_32.dll_socket
mov r9b, 0x1b
mov r15b, reloc.WS2_32.dll_send
mov r11b, recv
mov r10b, reloc.WS2_32.dll_inet_addr
mov dl, 7
mov r14b, 5
mov cl, 3
jmp 0x14000277f
mov dil, 1
mov r8b, 0x18
mov r9b, 0x1c
mov r15b, setsockopt
mov r11b, reloc.WS2_32.dll_recv
mov r10b, 0xc
mov dl, 8
mov cl, r12b
mov eax, dword [rbp - 0x7c]
sub eax, 5
je 0x14000284b
sub eax, 1
je 0x1400027d8
cmp eax, r12d
jne 0x14000288d
cmp dword [rbp - 0x74], 0x55f0
jae 0x1400027bd
test sil, sil
jne 0x1400027af
mov bl, r8b
jmp 0x14000288d
test dil, dil
setne bl
add bl, 0x19
jmp 0x14000288d
test sil, sil
jne 0x1400027ca
mov bl, r9b
jmp 0x14000288d
test dil, dil
setne bl
add bl, 0x1d
jmp 0x14000288d
mov eax, dword [rbp - 0x78]
test eax, eax
je 0x140002837
sub eax, 1
je 0x140002822
sub eax, 1
je 0x14000280d
cmp eax, 1
jne 0x14000288d
test sil, sil
jne 0x1400027ff
mov bl, r15b
jmp 0x14000288d
test dil, dil
setne bl
add bl, 0x15
jmp 0x14000288d
test sil, sil
jne 0x140002817
mov bl, r11b
jmp 0x14000288d
test dil, dil
setne bl
add bl, 0x11
jmp 0x14000288d
test sil, sil
jne 0x14000282c
mov bl, r10b
jmp 0x14000288d
test dil, dil
setne bl
add bl, 0xd
jmp 0x14000288d
test sil, sil
jne 0x140002840
mov bl, dl
jmp 0x14000288d
test dil, dil
setne bl
add bl, 9
jmp 0x14000288d
mov eax, dword [rbp - 0x78]
test eax, eax
je 0x140002885
sub eax, 1
je 0x140002881
cmp eax, 1
jne 0x14000288d
lea ecx, [rax + 0x58]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14000286e
mov bl, r14b
jmp 0x14000288d
test dil, dil
je 0x14000287d
test sil, sil
jne 0x14000287d
mov bl, r12b
jmp 0x14000288d
mov bl, 5
jmp 0x14000288d
mov bl, cl
jmp 0x14000288d
test dil, dil
setne bl
inc bl
mov al, bl
jmp 0x14000289c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14000c390
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret