Function at 0x140073f60
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [0x1403f2078]
xor rax, rsp
mov qword [rbp + 0x530], rax
mov byte [rsp + 0x60], dl
mov r12, rcx
mov qword [rbp + 0x48], rcx
mov dword [rsp + 0x40], 0xd8d8dffb
mov dword [rsp + 0x44], 0xddcadcfd
mov dword [rsp + 0x48], 0xfadec7d8
mov dword [rsp + 0x4c], 0x100e1f0
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xe
jb 0x140073fd0
mov byte [rsp + 0x4f], bl
mov qword [rbp + 0x130], rbx
movdqa xmm0, xmmword [0x14016e3f0]
movdqu xmmword [rbp + 0x140], xmm0
mov byte [rbp + 0x130], 0
lea rax, [rsp + 0x40]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp byte [rax + r8], 0
jne 0x140074011
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x130]
call fcn.140007030
nop
mov dword [rsp + 0x40], 0xdafcfe99
mov dword [rsp + 0x44], 0xe7c3dcd4
mov dword [rsp + 0x48], 0x100c3fc
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x140074050
mov byte [rsp + 0x4b], 0
mov qword [rbp + 0x110], rbx
movdqa xmm0, xmmword [0x14016e3f0]
movdqu xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], 0
mov r8d, 0xa
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x110]
call fcn.140007030
nop
movdqa xmm0, xmmword [0x140143790]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x140143820]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x140143800]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1401437c0]
movdqa xmmword [rbp - 0x30], xmm1
mov word [rbp - 0x20], 0x100
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x57]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x40
jb 0x1400740e0
mov byte [rbp - 0x1f], 0
mov qword [rbp + 0xf0], rbx
movdqa xmm0, xmmword [0x14016e3f0]
movdqu xmmword [rbp + 0x100], xmm0
mov byte [rbp + 0xf0], 0
lea rax, [rbp - 0x60]
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140074120
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xf0]
call fcn.140007030
nop
mov dword [rsp + 0x68], 0x9e849c
mov byte [rsp + 0x6c], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 3
jb 0x140074150
mov byte [rsp + 0x6c], 0
mov qword [rbp + 0xd0], rbx
movdqa xmm0, xmmword [0x14016e3f0]
movdqu xmmword [rbp + 0xe0], xmm0
mov byte [rbp + 0xd0], 0
lea rax, [rsp + 0x68]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140074190
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xd0]
call fcn.140007030
nop
movdqa xmm0, xmmword [0x1401436d0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x93d5d3ce
mov dword [rsp + 0x54], 0xefd6cedc
mov dword [rsp + 0x58], 0xebf2ecf0
mov word [rsp + 0x5c], 0x100
mov rcx, rbx
nop dword [rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x1c
jb 0x1400741e0
mov byte [rsp + 0x5d], 0
mov qword [rbp + 0xb0], rbx
movdqa xmm0, xmmword [0x14016e3f0]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
lea rax, [rsp + 0x40]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140074220
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.140007030
nop
movdqa xmm0, xmmword [0x140143750]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xddd5d5d0
mov dword [rsp + 0x54], 0x10097d1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x16
jb 0x140074260
mov byte [rsp + 0x57], 0
mov qword [rbp + 0x90], rbx
movdqa xmm0, xmmword [0x14016e3f0]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
lea rax, [rsp + 0x40]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400742a0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x90]
call fcn.140007030
nop
lea rax, [rbp + 0x70]
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rbx
lea r14, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae r14, qword [rbp + 0x90]
movabs rcx, 0x7fffffffffffffff
mov edi, reloc.WS2_32.dll_ntohs
mov r13, qword [rbp + 0xa0]
cmp r13, 0x10
jae 0x140074316
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x70], xmm0
mov esi, edi
jmp 0x140074395
mov rsi, r13
or rsi, rdi
cmp rsi, rcx
cmova rsi, rcx
mov rcx, rsi
add rcx, 1
cmovb rcx, r15
cmp rcx, 0x1000
jb 0x140074369
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140074882
mov rcx, rax
call fcn.140135744
mov rcx, rax
test rax, rax
je 0x140074362
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140074378
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140074375
call fcn.140135744
jmp 0x140074378
mov rax, rbx
mov qword [rbp + 0x70], rax
lea r8, [r13 + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movabs rcx, 0x7fffffffffffffff
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], rsi
lea rax, [rbp + 0x50]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
lea rsi, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0x10
cmovae rsi, qword [rbp + 0xb0]
mov r14, qword [rbp + 0xc0]
cmp r14, 0x10
jae 0x1400743e4
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x50], xmm0
jmp 0x14007445a
mov rdi, r14
or rdi, 0xf
cmp rdi, rcx
cmova rdi, rcx
mov rcx, rdi
add rcx, 1
cmovb rcx, r15
cmp rcx, 0x1000
jb 0x140074438
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14007487c
mov rcx, rax
call fcn.140135744
mov rcx, rax
test rax, rax
je 0x140074431
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140074447
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140074444
call fcn.140135744
jmp 0x140074447
mov rax, rbx
mov qword [rbp + 0x50], rax
lea r8, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], rdi
lea rax, [rbp + 0x150]
mov qword [rbp - 8], rax
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x150]
call fcn.140005f70
mov r14, rax
lea rax, [rbp + 8]
mov qword [rbp], rax
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 8]
call fcn.140005f70
mov rsi, rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x70], rax
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x28]
call fcn.140005f70
mov rdi, rax
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x80]
call fcn.140005f70
nop
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
mov r9, rsi
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.140065c50
nop
mov qword [rbp + 0x150], rbx
movdqa xmm0, xmmword [0x14016e3f0]
movdqu xmmword [rbp + 0x160], xmm0
mov byte [rbp + 0x150], 0
lea rcx, [rbp + 0x280]
call fcn.1400036d0
cmp byte [rsp + 0x60], 0
je 0x1400746da
mov dword [rsp + 0x40], 0xc7f790ea
mov dword [rsp + 0x44], 0xc481d7c8
mov dword [rsp + 0x48], 0x100c6c9
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x57]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x140074550
mov byte [rsp + 0x4b], 0
mov qword [rbp + 0x50], rbx
movdqa xmm0, xmmword [0x14016e3f0]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
lea rax, [rsp + 0x40]
nop
inc r15
cmp byte [rax + r15], 0
jne 0x140074580
mov r8, r15
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.140007030
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x170]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rdx, qword [rbp + 0x50]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
lea rcx, [rbp + 0x170]
call fcn.140005730
mov rax, qword [rbp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x170], rax
mov rax, qword [rbp + 0x170]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x16c], edx
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x48], 1
mov rax, qword [rbp + 0x170]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x1b8]
mov qword [rsp + 0x70], rax
test rax, rax
sete byte [rsp + 0x78]
mov byte [rsp + 0x79], 0
mov qword [rbp + 0x70], rbx
movdqa xmm0, xmmword [0x14016e3f0]
movdqu xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], 0
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x70]
call fcn.140062580
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140005f70
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.140004220
cmp byte [rbp + 0x4c0], 0
jne 0x1400746b5
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rbp + 0x70]
call fcn.140005ed0
nop
lea rcx, [rbp + 0x170]
call fcn.140003600
nop
lea rcx, [rbp + 0x50]
call fcn.140005ed0
jmp 0x1400747da
mov rdx, r12
lea rcx, [rbp - 0x80]
call fcn.140005f70
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.140004220
cmp byte [rbp + 0x4c0], 0
jne 0x14007470a
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x170]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0xc7f790ea
mov dword [rsp + 0x44], 0xc481d7c8
mov dword [rsp + 0x48], 0x100c6c9
nop word [rax + rax]
lea eax, [rbx - 0x57]
xor byte [rsp + rbx + 0x40], al
inc rbx
cmp rbx, 0xa
jb 0x140074740
mov byte [rsp + 0x4b], 0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x170]
call fcn.140065430
nop
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140074788
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
lea rcx, [rbp + 0x170]
call fcn.140055f80
lea rcx, [rbp + 0x178]
call fcn.140006210
test rax, rax
jne 0x1400747cd
mov rax, qword [rbp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x170]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp + 0x170]
call fcn.140014570
nop
lea rcx, [rbp + 0x150]
call fcn.140005ed0
nop
lea rcx, [rbp + 0x280]
call fcn.140066ba0
nop
lea rcx, [rbp + 0x90]
call fcn.140005ed0
nop
lea rcx, [rbp + 0xb0]
call fcn.140005ed0
nop
lea rcx, [rbp + 0xd0]
call fcn.140005ed0
nop
lea rcx, [rbp + 0xf0]
call fcn.140005ed0
nop
lea rcx, [rbp + 0x110]
call fcn.140005ed0
nop
lea rcx, [rbp + 0x130]
call fcn.140005ed0
nop
mov rcx, r12
call fcn.140005ed0
mov al, 1
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.1401358a0
lea r11, [rsp + 0x640]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001510
nop
call fcn.140001510
int3