Function at 0x14000d0a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rbp + 0xa0], rax
xor r14d, r14d
lea rdx, str.https:__share.terminalshield.com_encrypted.txt
lea rcx, [rsp + 0x50]
call fcn.140014ef0
mov rsi, rax
cmp byte [rax], r14b
jne 0x14000d111
lea rbx, [rax + 1]
lea edi, [r14 + 0x2f]
nop
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000d100
lea rdx, [rsi + 1]
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], r14
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x14000d134
lea rcx, [rbp + 0x80]
call fcn.14001c360
nop
mov byte [rsp + 0x30], 0
call fcn.14002a79c
xor al, 0x43
mov byte [rsp + 0x31], al
call fcn.14002a79c
xor al, 0x69
mov byte [rsp + 0x32], al
call fcn.14002a79c
xor al, 0x70
mov byte [rsp + 0x33], al
call fcn.14002a79c
xor al, 0x68
mov byte [rsp + 0x34], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x35], al
call fcn.14002a79c
xor al, 0x72
mov byte [rsp + 0x36], al
call fcn.14002a79c
xor al, 0x4e
mov byte [rsp + 0x37], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x38], al
call fcn.14002a79c
xor al, 0x62
mov byte [rsp + 0x39], al
call fcn.14002a79c
xor al, 0x75
mov byte [rsp + 0x3a], al
call fcn.14002a79c
xor al, 0x6c
mov byte [rsp + 0x3b], al
call fcn.14002a79c
xor al, 0x61
mov byte [rsp + 0x3c], al
call fcn.14002a79c
xor al, 0x38
mov byte [rsp + 0x3d], al
call fcn.14002a79c
xor al, 0x33
mov byte [rsp + 0x3e], al
call fcn.14002a79c
mov byte [rsp + 0x3f], al
mov rbx, r14
call fcn.14002a79c
xor byte [rsp + rbx + 0x31], al
inc rbx
cmp rbx, 0xf
jb 0x14000d1f5
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], r14
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14000d222
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x60]
call fcn.14001c360
nop
mov byte [rbp], 0
call fcn.14002a79c
xor al, 0x51
mov byte [rbp + 1], al
call fcn.14002a79c
xor al, 0x75
mov byte [rbp + 2], al
call fcn.14002a79c
xor al, 0x40
mov byte [rbp + 3], al
call fcn.14002a79c
xor al, 0x6e
mov byte [rbp + 4], al
call fcn.14002a79c
xor al, 0x74
mov byte [rbp + 5], al
call fcn.14002a79c
xor al, 0x75
mov byte [rbp + 6], al
call fcn.14002a79c
xor al, 0x6d
mov byte [rbp + 7], al
call fcn.14002a79c
xor al, 0x23
mov byte [rbp + 8], al
call fcn.14002a79c
xor al, 0x37
mov byte [rbp + 9], al
call fcn.14002a79c
xor al, 0x42
mov byte [rbp + 0xa], al
call fcn.14002a79c
xor al, 0x6c
mov byte [rbp + 0xb], al
call fcn.14002a79c
xor al, 0x61
mov byte [rbp + 0xc], al
call fcn.14002a79c
xor al, 0x73
mov byte [rbp + 0xd], al
call fcn.14002a79c
xor al, 0x74
mov byte [rbp + 0xe], al
call fcn.14002a79c
xor al, 0x21
mov byte [rbp + 0xf], al
call fcn.14002a79c
mov byte [rbp + 0x10], al
mov rbx, r14
call fcn.14002a79c
xor byte [rbp + rbx + 1], al
inc rbx
cmp rbx, 0x10
jb 0x14000d2e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
lea rax, [rbp + 1]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000d310
lea rdx, [rbp + 1]
lea rcx, [rbp + 0x40]
call fcn.14001c360
nop
movabs r13, 0x7fffffffffffffff
movabs r15, 0x311cdad160000
movabs r12, 0x112e0be826d694b3
movsd xmm6, qword [0x140060020]
nop
mov qword [rbp + 0x18], r14
lea rcx, [rsp + 0x30]
call fcn.140014de0
mov rsi, rax
cmp byte [rax], 0
jne 0x14000d381
lea rbx, [rax + 1]
mov edi, 0x19
nop
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000d370
lea rdx, [rsi + 1]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14000d3a0
lea rcx, [rbp - 0x68]
call fcn.14001c360
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], 0
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x18]
call fcn.14000c540
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14000d436
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d430
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000db97
call fcn.14002b620
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000d474
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d46e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000db9d
call fcn.14002b620
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14000d4af
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d4aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dba3
call fcn.14002b620
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x68], 0
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14000d4e3
lea rcx, [rbp - 0x48]
call fcn.14001c360
nop
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x14000d520
lea rcx, [rsp + 0x50]
call fcn.14001c360
nop
mov rbx, qword [rbp + 0x18]
lea rcx, [rbx + 0x1d8]
lea rdx, [rsp + 0x50]
call fcn.1400163e0
lea rcx, [rbx + 0x1f8]
lea rdx, [rbp - 0x48]
call fcn.1400163e0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000d599
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d593
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dba9
call fcn.14002b620
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14000d5d4
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d5cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dbaf
call fcn.14002b620
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rdx, qword [rbp + 0x80]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14000d610
lea rcx, [rsp + 0x50]
call fcn.14001c360
nop
mov rbx, qword [rbp + 0x18]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
mov ecx, 0x60
call fcn.14002b748
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x20]
mov rcx, rbx
call fcn.14000c2f0
nop
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.14001b6a0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000d6c7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d6c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dbb5
call fcn.14002b620
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x14000d730
cmp dword [rax + 0x20], 0xc8
je 0x14000d9b9
lea rcx, [rsp + 0x50]
call fcn.140014c70
mov rsi, rax
cmp byte [rax], 0
jne 0x14000d709
lea rbx, [rax + 1]
mov edi, 0x22
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000d6f8
lea rdx, [rsi + 1]
lea rcx, [0x14006e580]
call fcn.140018c70
mov rcx, rax
mov rdx, qword [rbp + 0x20]
mov edx, dword [rdx + 0x20]
call fcn.140015d80
mov rcx, rax
jmp 0x14000d8ae
mov edi, dword [rbp + 0x28]
mov byte [rsp + 0x30], 0
call fcn.14002a79c
xor al, 0x52
mov byte [rsp + 0x31], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x32], al
call fcn.14002a79c
xor al, 0x71
mov byte [rsp + 0x33], al
call fcn.14002a79c
xor al, 0x75
mov byte [rsp + 0x34], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x35], al
call fcn.14002a79c
xor al, 0x73
mov byte [rsp + 0x36], al
call fcn.14002a79c
xor al, 0x74
mov byte [rsp + 0x37], al
call fcn.14002a79c
xor al, 0x20
mov byte [rsp + 0x38], al
call fcn.14002a79c
xor al, 0x66
mov byte [rsp + 0x39], al
call fcn.14002a79c
xor al, 0x61
mov byte [rsp + 0x3a], al
call fcn.14002a79c
xor al, 0x69
mov byte [rsp + 0x3b], al
call fcn.14002a79c
xor al, 0x6c
mov byte [rsp + 0x3c], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x3d], al
call fcn.14002a79c
xor al, 0x64
mov byte [rsp + 0x3e], al
call fcn.14002a79c
xor al, 0x3a
mov byte [rsp + 0x3f], al
call fcn.14002a79c
xor al, 0x20
mov byte [rsp + 0x40], al
call fcn.14002a79c
mov byte [rsp + 0x41], al
cmp byte [rsp + 0x30], 0
jne 0x14000d812
mov rbx, r14
nop dword [rax + rax]
call fcn.14002a79c
xor byte [rsp + rbx + 0x31], al
inc rbx
cmp rbx, 0x11
jb 0x14000d800
lea rdx, [rsp + 0x31]
lea rcx, [0x14006e580]
call fcn.140018c70
mov rbx, rax
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140002d90
nop
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14000d840
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, rbx
call fcn.14001ec10
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000d88a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d885
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000db91
call fcn.14002b620
lea rdx, [0x14005ee08]
mov rcx, rbx
call fcn.140018c70
mov rcx, rax
mov edx, edi
call fcn.140015d80
mov rcx, rax
call fcn.140018f20
mov rcx, rbx
call fcn.14001b610
lea rcx, [rbp - 8]
call fcn.140001550
mov rax, qword [rbp - 8]
movabs rcx, 0x7ffffffed5fa0dff
cmp rax, rcx
jge 0x14000d8de
movabs rbx, 0x12a05f200
add rbx, rax
jmp 0x14000d8e1
mov rbx, r13
lea rcx, [rbp - 0x80]
call fcn.140001550
mov rax, qword [rbp - 0x80]
cmp rax, rbx
jge 0x14000d971
mov rdi, rbx
sub rdi, rax
call fcn.140028a0c
imul rdx, rax, 0x64
xorps xmm0, xmm0
cvtsi2sd xmm0, rdi
comisd xmm0, xmm6
seta r8b
test r8b, r8b
lea rax, [rdx + r15]
jne 0x14000d91f
lea rax, [rdx + rdi]
mov qword [rsp + 0x30], rax
mov rcx, r15
test r8b, r8b
cmove rcx, rdi
add rcx, rdx
mov rax, r12
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp], rdx
imul rax, rdx, 0x3b9aca00
sub rcx, rax
mov dword [rbp + 8], ecx
lea rcx, [rbp]
call fcn.14002acf4
lea rcx, [rbp - 0x80]
call fcn.140001550
mov rax, qword [rbp - 0x80]
cmp rax, rbx
jl 0x14000d8f3
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.14001b6a0
mov rbx, qword [rbp + 0x20]
test rbx, rbx
je 0x14000d99d
mov rcx, rbx
call fcn.140002b90
mov edx, 0x128
mov rcx, rbx
call fcn.14002b620
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14000d350
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14000d350
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rcx
lea rbx, [rax + 0x58]
lea rax, [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14000d9e0
mov rdi, qword [rbx]
mov rbx, rdi
add rdi, qword [rax]
jmp 0x14000d9e6
mov rdi, qword [rax]
add rdi, rbx
movdqu xmmword [rbp], xmm0
mov qword [rbp + 0x10], r14
sub rdi, rbx
je 0x14000da1a
mov rdx, rdi
lea rcx, [rbp]
call fcn.14001e150
mov r8, rdi
mov rdx, rbx
mov rbx, qword [rbp]
mov rcx, rbx
call fcn.14004f600
lea rax, [rbx + rdi]
mov qword [rbp + 8], rax
lea rcx, [rbp]
call fcn.14000cd60
nop
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000da5f
mov rdx, qword [rbp + 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000da59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dbb5
call fcn.14002b620
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.14001b6a0
mov rbx, qword [rbp + 0x20]
test rbx, rbx
je 0x14000da8b
mov rcx, rbx
call fcn.140002b90
mov edx, 0x128
mov rcx, rbx
call fcn.14002b620
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14000da9f
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000dadb
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dad5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dbbb
call fcn.14002b620
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14000db17
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000db11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dbc1
call fcn.14002b620
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14000db54
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000db4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000db8b
call fcn.14002b620
mov al, 1
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14002b600
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003789c
nop
call fcn.14003789c
nop
call fcn.14003789c
nop
call fcn.14003789c
nop
call fcn.14003789c
nop
call fcn.14003789c
nop
call fcn.14003789c
nop
call fcn.14003789c
nop
call fcn.14003789c
nop
call fcn.14003789c
int3