Function at 0x1800491a8
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0xcd0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0xcb0], rbx
mov qword [rbp + 0xcb8], rsi
mov rbx, r9
mov rsi, rcx
xor r14d, r14d
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], r14b
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x50]
call fcn.1800a02d0
mov rax, qword [rbx]
lea rdx, [rbp + 0x40]
mov rcx, rbx
call qword [rax + 0x38]
mov r8, qword [rbp + 0x40]
test r8, r8
je 0x180049352
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [r8 + rax*2], r14w
jne 0x180049216
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x180049292
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180049248
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18009d830
sub rsp, rcx
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x180049292
mov byte [rdi], r14b
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, ebx
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb r9, r9
and r9, rdi
jmp 0x180049295
mov r9, r14
lea r8, [0x1800ea990]
mov edx, 0x100
lea rcx, [rbp + 0x50]
call fcn.180004100
mov qword [rbp], r14
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], r14b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1800492c2
lea rcx, [rbp]
cmp rbx, 0xf
ja 0x1800492ec
mov qword [rbp + 0x10], rbx
mov r8, rbx
lea rdx, [rbp + 0x50]
call fcn.18009fc20
mov byte [rbp + rbx], r14b
jmp 0x1800492fc
lea r9, [rbp + 0x50]
mov r8b, r14b
mov rdx, rbx
call fcn.180003a38
nop
lea r8, [rbp + 0x20]
lea rdx, [rbp]
mov rcx, rsi
call fcn.180048074
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x180049348
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049343
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800494fd
call fcn.18009d1f4
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [0x18010a364], r14b
je 0x1800493b9
lea rbx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rbx, qword [rbp + 0x20]
lea rcx, [rbp + 0xcc8]
call fcn.18004718c
cmp byte [rax + 0x2f], r14b
je 0x1800493a5
mov r10, r14
mov cl, r10b
and cl, 7
shl cl, 3
movabs r8, 0xd993efbb19cfe32d
shr r8, cl
xor byte [r10 + rax], r8b
inc r10
cmp r10, 0x2f
jb 0x18004937e
mov byte [rax + 0x2f], r14b
mov r9, rbx
lea r8, [rbp + 0x50]
mov rdx, rax
mov ecx, 4
call fcn.18006a848
mov edi, 0x824
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x460]
call fcn.1800a02d0
mov ebx, 0x104
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x150]
call fcn.1800a02d0
mov r8d, ebx
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x360]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x150]
call fcn.1800a4da8
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rax, qword [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x360]
lea r8, [0x1800d3120]
mov edx, edi
lea rcx, [rbp + 0x460]
call fcn.180004100
lea rcx, [rbp]
call fcn.18003d8c0
nop
mov edx, 0x541
lea rcx, [rbp]
call fcn.18003e08c
xor r9d, r9d
mov r8d, edi
lea rdx, [rbp + 0x460]
lea rcx, [rbp]
call fcn.18003de9c
call fcn.180049c04
mov rcx, rax
mov r8d, 0x3e8
lea rdx, [rbp]
call fcn.180077c5c
nop
lea rcx, [rbp]
call fcn.18001d6c0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1800494dd
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800494d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800494f7
call fcn.18009d1f4
mov rbx, qword [rbp + 0xcb0]
mov rsi, qword [rbp + 0xcb8]
lea rsp, [rbp + 0xc90]
pop r14
pop rdi
pop rbp
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
int3