Function at 0x140049ba0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1b0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
mov rax, qword [0x1401160c0]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov r15, rdx
mov qword [rsp + 0x58], rdx
xor edi, edi
mov dword [rsp + 0x54], edi
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdx], dil
mov dword [rsp + 0x54], 1
add rcx, 0x3f0
call fcn.140064cd0
mov dword [rbp - 0x3f], edi
mov word [rbp - 0x3b], di
mov byte [rbp - 0x39], dil
mov dword [rbp - 0x60], 0x9af2b37
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0x80
mov eax, dword [0x140117870]
mov dword [rbp - 0x5c], eax
mov byte [rbp - 0x40], dil
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, Ordinal_45
lea r8, [rbp - 0x60]
mov edx, 0x228d14
mov rcx, qword [0x140117868]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.140063a70
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rdx, qword [rbp - 0x80]
mov rax, qword [rbp - 0x70]
lea r8, [rdx + rax*2]
lea rdx, [rbp - 0x80]
cmova rdx, qword [rbp - 0x80]
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140064fc0
nop
mov eax, dword [str.lwz7o]
mov dword [rsp + 0x40], eax
movdqa xmm8, xmmword [0x140102a00]
movdqa xmm9, xmmword [0x140102a40]
movdqa xmm10, xmmword [str.1111]
movdqa xmm6, xmmword [0x140102990]
movdqa xmm7, xmmword [0x140102fa0]
mov r12d, dword [reloc.WS2_32.dll_accept]
cmp byte [0x140101ad7], dil
je 0x140049da9
mov r8d, edi
cmp r12d, 2
jl 0x140049d6e
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
pmuldq xmm1, xmm7
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
movdqa xmm1, xmm6
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm9
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x40], xmm1
jmp 0x140049da9
lea r9, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140049d80
lea rax, [rsp + 0x40]
mov rbx, 0xffffffffffffffff
mov r14, rbx
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x140049dc0
mov rsi, qword [rsp + 0x70]
lea rcx, [rsp + 0x60]
mov r13, qword [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, r13
mov r8, rsi
cmp r14, rsi
cmovb r8, r14
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140049e45
cmp rsi, r14
jb 0x140049e45
ja 0x140049e45
mov eax, dword [str.lwyo8]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x14010243c]
mov byte [rsp + 0x40], 0x58
xor byte [rsp + 0x41], 0x35
xor byte [rsp + 0x42], 0x36
xor byte [rsp + 0x43], 0x37
xor al, 0x38
mov byte [rsp + 0x44], al
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140049e32
lea rdx, [rsp + 0x40]
jmp 0x14004a5d1
mov eax, dword [0x14010262c]
mov dword [rsp + 0x40], eax
cmp byte [0x14010262f], 0
je 0x140049ef9
mov r8d, edi
cmp r12d, 2
jl 0x140049ec3
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
pmuldq xmm1, xmm7
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
movdqa xmm1, xmm6
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm9
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x40], xmm1
jmp 0x140049ef9
lea r9, [rsp + 0x40]
nop dword [rax + rax]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140049ed0
lea rax, [rsp + 0x40]
mov r14, rbx
inc r14
cmp byte [rax + r14], 0
jne 0x140049f01
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, r13
mov r8, rsi
cmp r14, rsi
cmovb r8, r14
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004a013
cmp rsi, r14
jb 0x14004a013
ja 0x14004a013
mov eax, dword [0x14010235c]
mov dword [rsp + 0x40], eax
cmp byte [str.7yET8], 0
je 0x140049ff6
cmp r12d, 2
jl 0x140049fbc
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
pmuldq xmm1, xmm7
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm6, xmm0
andps xmm6, xmm8
packuswb xmm6, xmm6
packuswb xmm6, xmm6
paddb xmm6, xmm9
movd xmm0, eax
xorps xmm6, xmm0
movd dword [rsp + 0x40], xmm6
jmp 0x140049ff6
lea r8, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
mul edi
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, dil
sub al, cl
add al, 0x34
xor byte [r8], al
inc edi
lea r8, [r8 + 1]
cmp edi, 4
jl 0x140049fd0
lea rax, [rsp + 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004a000
lea rdx, [rsp + 0x40]
jmp 0x14004a5d1
mov eax, dword [0x140101b84]
mov dword [rsp + 0x40], eax
cmp byte [0x140101b87], 0
je 0x14004a0c9
mov r8d, edi
cmp r12d, 2
jl 0x14004a091
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
pmuldq xmm1, xmm7
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
movdqa xmm1, xmm6
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm9
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x40], xmm1
jmp 0x14004a0c9
lea r9, [rsp + 0x40]
nop word [rax + rax]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x14004a0a0
lea rax, [rsp + 0x40]
mov r14, rbx
inc r14
cmp byte [rax + r14], 0
jne 0x14004a0d1
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, r13
mov r8, rsi
cmp r14, rsi
cmovb r8, r14
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004a1e3
cmp rsi, r14
jb 0x14004a1e3
ja 0x14004a1e3
mov eax, dword [0x140101b84]
mov dword [rsp + 0x40], eax
cmp byte [0x140101b87], 0
je 0x14004a1c6
cmp r12d, 2
jl 0x14004a18c
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
pmuldq xmm1, xmm7
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm6, xmm0
andps xmm6, xmm8
packuswb xmm6, xmm6
packuswb xmm6, xmm6
paddb xmm6, xmm9
movd xmm0, eax
xorps xmm6, xmm0
movd dword [rsp + 0x40], xmm6
jmp 0x14004a1c6
lea r8, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
mul edi
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, dil
sub al, cl
add al, 0x34
xor byte [r8], al
inc edi
lea r8, [r8 + 1]
cmp edi, 4
jl 0x14004a1a0
lea rax, [rsp + 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004a1d0
lea rdx, [rsp + 0x40]
jmp 0x14004a5d1
mov eax, dword [str.lfn7]
mov dword [rsp + 0x40], eax
cmp byte [0x140101c37], 0
je 0x14004a299
mov r8d, edi
cmp r12d, 2
jl 0x14004a261
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
pmuldq xmm1, xmm7
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
movdqa xmm1, xmm6
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm9
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x40], xmm1
jmp 0x14004a299
lea r9, [rsp + 0x40]
nop word [rax + rax]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x14004a270
lea rax, [rsp + 0x40]
mov r14, rbx
inc r14
cmp byte [rax + r14], 0
jne 0x14004a2a1
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, r13
mov r8, rsi
cmp r14, rsi
cmovb r8, r14
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004a334
cmp rsi, r14
jb 0x14004a334
ja 0x14004a334
mov eax, dword [str.lwyo]
mov dword [rsp + 0x40], eax
movzx ecx, word [0x140101d20]
mov word [rsp + 0x44], cx
movzx eax, byte [0x140101d22]
mov byte [rsp + 0x40], 0x58
xor byte [rsp + 0x41], 0x35
xor byte [rsp + 0x42], 0x36
xor byte [rsp + 0x43], 0x37
xor cl, 0x38
mov byte [rsp + 0x44], cl
xor byte [rsp + 0x45], 0x39
xor al, 0x3a
mov byte [rsp + 0x46], al
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004a321
lea rdx, [rsp + 0x40]
jmp 0x14004a5d1
mov eax, dword [0x140101b04]
mov dword [rsp + 0x40], eax
cmp byte [0x140101b07], 0
je 0x14004a3e9
mov r8d, edi
cmp r12d, 2
jl 0x14004a3b2
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
pmuldq xmm1, xmm7
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
movdqa xmm1, xmm6
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm9
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x40], xmm1
jmp 0x14004a3e9
lea r9, [rsp + 0x40]
nop word [rax + rax]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x14004a3c0
lea rax, [rsp + 0x40]
mov r14, rbx
inc r14
cmp byte [rax + r14], 0
jne 0x14004a3f1
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, r13
mov r8, rsi
cmp r14, rsi
cmovb r8, r14
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004a484
cmp rsi, r14
jb 0x14004a484
ja 0x14004a484
movsd xmm0, qword [str.zxcwt_]
movsd qword [rsp + 0x40], xmm0
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_60]
mov byte [rsp + 0x40], Ordinal_79
xor byte [rsp + 0x41], 0x35
xor byte [rsp + 0x42], 0x36
xor byte [rsp + 0x43], 0x37
xor byte [rsp + 0x44], 0x38
xor byte [rsp + 0x45], 0x39
xor byte [rsp + 0x46], 0x3a
xor byte [rsp + 0x47], 0x3b
xor al, 0x3c
mov byte [rsp + 0x48], al
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004a471
lea rdx, [rsp + 0x40]
jmp 0x14004a5d1
mov eax, dword [0x140102024]
mov dword [rsp + 0x40], eax
cmp byte [0x140102027], 0
je 0x14004a526
cmp r12d, 2
jl 0x14004a4fb
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
pmuldq xmm1, xmm7
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm10
psubd xmm6, xmm0
andps xmm6, xmm8
packuswb xmm6, xmm6
packuswb xmm6, xmm6
paddb xmm6, xmm9
movd xmm0, eax
xorps xmm6, xmm0
movd dword [rsp + 0x40], xmm6
jmp 0x14004a526
lea r8, [rsp + 0x40]
mov eax, 0x5397829d
mul edi
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, dil
sub al, cl
add al, 0x34
xor byte [r8], al
inc edi
lea r8, [r8 + 1]
cmp edi, 4
jl 0x14004a500
lea rax, [rsp + 0x40]
mov rdi, rbx
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x14004a530
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, r13
mov r8, rsi
cmp rdi, rsi
cmovb r8, rdi
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004a59b
cmp rsi, rdi
jb 0x14004a59b
ja 0x14004a59b
movzx eax, word [0x140102298]
mov word [rsp + 0x40], ax
movzx eax, byte [0x14010229a]
mov byte [rsp + 0x40], 0x50
xor byte [rsp + 0x41], 0x35
xor al, 0x36
mov byte [rsp + 0x42], al
lea rax, [rsp + 0x40]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004a590
jmp 0x14004a5cc
movzx eax, word [0x140101cbc]
mov word [rsp + 0x40], ax
movzx eax, byte [0x140101cbe]
mov byte [rsp + 0x40], 0x41
xor byte [rsp + 0x41], 0x35
xor al, 0x36
mov byte [rsp + 0x42], al
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004a5c3
lea rdx, [rsp + 0x40]
mov r8, rbx
mov rcx, r15
call fcn.140064a00
nop
mov rax, qword [rsp + 0x78]
cmp rax, 0xf
jbe 0x14004a61d
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x14004a614
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a614
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.1400d29e0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14004a660
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a65b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a65b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d29e0
mov rax, r15
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400d2720
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret