Function at 0x1401d6b40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r12
mov eax, 0x68
call fcn.1402563f0
sub rsp, rax
mov rax, qword [rcx + 0x178]
mov rbx, rcx
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x180]
mov rsi, r8
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 0x38]
mov r12, rdx
lea rcx, [r9 + rax]
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x1401d6f38
cmp rcx, r9
jb 0x1401d6f38
mov qword [rsp + 0x60], r13
mov qword [rbx + 0x38], rcx
lea rcx, [rbx + 0x170]
mov r13d, dword [rcx]
mov qword [rsp + 0x58], r14
xor r14d, r14d
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x90], r13d
cmp dword [rbx + 0x174], r14d
je 0x1401d6c1f
test r9, r9
jne 0x1401d6bec
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call fcn.1401d6420
mov dword [rbx + 0x174], r14d
xor eax, eax
jmp 0x1401d6f24
mov rax, qword [rbx + 0x40]
mov r13d, reloc.WS2_32.dll_recv
mov dword [rbx + 0x174], r14d
mov qword [rbx + 0x188], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x48], r14
mov dword [rsp + 0x90], r13d
mov qword [rbx + 0x190], rax
movzx eax, byte [rbx + 0xd]
mov qword [rsp + 0x98], rbp
movzx ebp, byte [rbx + 0xc]
shl ebp, 8
mov qword [rsp + 0x50], r15
mov r15d, r13d
or ebp, eax
movzx eax, byte [rbx + 0xe]
shl ebp, 8
or ebp, eax
movzx eax, byte [rbx + 0xf]
shl ebp, 8
or ebp, eax
and r15d, 0xf
mov dword [rsp + 0x20], r15d
je 0x1401d6cc3
movsxd rdx, r13d
nop dword [rax]
test rdi, rdi
je 0x1401d6c98
movzx ecx, byte [r15 + rbx + 0x10]
inc rdx
inc r13d
xor cl, byte [r12]
inc rsi
inc r12
mov byte [rsi - 1], cl
dec rdi
mov byte [rdx + rbx + 0x187], cl
inc r15d
and r15d, 0xf
mov dword [rsp + 0x20], r15d
jne 0x1401d6c60
jmp 0x1401d6ca1
test r15d, r15d
jne 0x1401d6f0d
lea r8, [rbx + 0x188]
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
mov r9d, r13d
call fcn.1401d6560
mov r13d, r14d
mov dword [rsp + 0x90], r14d
cmp rdi, 0x10
jb 0x1401d6cf0
test r13d, r13d
je 0x1401d6cf0
lea r8, [rbx + 0x188]
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
mov r9d, r13d
call fcn.1401d6560
mov r13d, r14d
mov dword [rsp + 0x90], r14d
cmp rdi, 0xc00
jb 0x1401d6ddb
mov r13, qword [rsp + 0x28]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdi
mov rcx, rdx
shr rcx, 0xb
mov rax, rcx
mov qword [rsp + 0x38], rcx
imul rax, rax, 0xfffffffffffff400
add rdi, rax
mov qword [rsp + 0xa8], rdi
mov rdi, qword [rsp + 0x30]
nop word [rax + rax]
mov r14d, 0xc0
nop word [rax + rax]
lea rdx, [rbx + 0x10]
mov r8, r13
mov rcx, rbx
call rdi
inc ebp
add rsi, 0x10
mov byte [rbx + 0xf], bpl
mov eax, ebp
add r12, 0x10
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, ebp
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, ebp
shr eax, 8
mov byte [rbx + 0xe], al
mov rax, qword [rbx + 0x10]
xor rax, qword [r12 - 0x10]
mov qword [rsi - 0x10], rax
mov rax, qword [r12 - 8]
xor rax, qword [rbx + 0x18]
dec r14
mov qword [rsi - 8], rax
jne 0x1401d6d50
lea r8, [rsi - 0xc00]
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
mov r9d, 0xc00
call fcn.1401d6560
dec qword [rsp + 0x38]
jne 0x1401d6d40
mov rdi, qword [rsp + 0xa8]
mov r13d, dword [rsp + 0x90]
mov r15d, dword [rsp + 0x20]
mov rax, rdi
and rax, 0xfffffffffffffff0
mov qword [rsp + 0x38], rax
je 0x1401d6ea1
cmp rdi, 0x10
jb 0x1401d6e8b
mov r13, qword [rsp + 0x28]
mov r14, rdi
shr r14, 4
mov rax, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov qword [rsp + 0xa8], rdi
mov rdi, qword [rsp + 0x30]
nop word [rax + rax]
lea rdx, [rbx + 0x10]
mov r8, r13
mov rcx, rbx
call rdi
inc ebp
add rsi, 0x10
mov byte [rbx + 0xf], bpl
mov eax, ebp
add r12, 0x10
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, ebp
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, ebp
shr eax, 8
mov byte [rbx + 0xe], al
mov rax, qword [rbx + 0x10]
xor rax, qword [r12 - 0x10]
mov qword [rsi - 0x10], rax
mov rax, qword [r12 - 8]
xor rax, qword [rbx + 0x18]
dec r14
mov qword [rsi - 8], rax
jne 0x1401d6e20
mov rdi, qword [rsp + 0xa8]
mov r13d, dword [rsp + 0x90]
mov r15d, dword [rsp + 0x20]
mov rax, qword [rsp + 0x38]
mov r8, rsi
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
sub r8, rax
mov r9, rax
call fcn.1401d6560
test rdi, rdi
je 0x1401d6f0d
mov r8, qword [rsp + 0x28]
lea rdx, [rbx + 0x10]
mov rcx, rbx
call qword [rsp + gethostbyaddr]
inc ebp
movsxd rdx, r15d
mov eax, ebp
mov byte [rbx + 0xf], bpl
add rdx, r12
shr eax, 0x18
sub rsi, r12
mov byte [rbx + 0xc], al
mov eax, ebp
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, ebp
shr eax, 8
mov byte [rbx + 0xe], al
movsxd rax, r13d
lea r8, [rax + rbx + 0x188]
sub rbx, r12
add r13d, edi
nop
movzx ecx, byte [rbx + rdx + 0x10]
movzx eax, byte [rdx]
inc r8
xor ecx, eax
inc rdx
dec rdi
mov byte [rsi + rdx - 1], cl
mov byte [r8 - 1], cl
jne 0x1401d6ef0
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x98]
mov r15, qword [rsp + 0x50]
mov dword [rax], r13d
xor eax, eax
mov r13, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
add rsp, 0x68
pop r12
pop rdi
pop rsi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x68
pop r12
pop rdi
pop rsi
pop rbx
ret