Function at 0x1400236e0
Capabilities:
Encode data using xor
Get session user name
Hash data with crc32

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc38]
sub rsp, 0xd38
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x1400b14a0]
xor rax, rsp
mov qword [rbp + 0xc20], rax
mov qword [rbp + 0x30], r9
mov r12, r8
mov qword [rsp + 0x38], rdx
mov rdi, rcx
mov qword [rbp - 0x80], rcx
xor eax, eax
mov dword [rsp + 0x34], eax
mov word [rbp + 0x920], ax
mov dword [rbp + 0x800], 0x114
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x804]
call fcn.140062200
lea rcx, [rbp + 0x800]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdx, str.d._d._d
lea rcx, [0x140088718]
call fcn.140007130
mov r8, rax
mov eax, dword [rbp + 0x80c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x808]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x804]
mov edx, 0x40
lea rcx, [rbp + 0x920]
call fcn.14005c3b4
mov rdx, qword [rdi + 0x8e40]
lea rcx, [rbp + 0xa20]
call fcn.14004a4b0
or ebx, 0xffffffff
mov dword [rsp + 0x30], 0x80
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x9a0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140023818
lea r9, [rbp + 0x9a0]
mov r8d, dword [rsp + 0x30]
dec r8d
je 0x140023810
lea r10, [0x140087900]
mov ecx, ebx
movzx eax, byte [r9]
xor rcx, rax
movzx edx, cl
mov eax, ebx
shr eax, 8
mov ebx, dword [r10 + rdx*4]
xor ebx, eax
inc r9
dec r8d
jne 0x1400237f1
mov esi, ebx
not esi
mov dword [rsp + 0x34], esi
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x7d0]
call fcn.140001678
nop
lea rdx, [rbp + 0x7d0]
mov rcx, rdi
call fcn.140023080
lea r11, [rbp + 0x488]
mov qword [rbp + 0x178], r11
lea rax, [rbp + 0x4d8]
mov qword [rbp + 0x140], rax
lea rax, [rsp + 0x48]
mov qword [rbp + 0x188], rax
lea rax, [rbp + 0x2a8]
mov qword [rbp + 0x70], rax
lea rax, [rbp + 0x758]
mov qword [rbp + 0x100], rax
lea rax, [rbp + 0x618]
mov qword [rbp + 0x80], rax
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x180], rax
lea rax, [rbp + 0x2f8]
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x1b8]
mov qword [rbp + 0x110], rax
lea rax, [rbp + 0x528]
mov qword [rbp + 0xa0], rax
lea rax, [rbp + 0x348]
mov qword [rbp + 0x150], rax
lea rax, [rbp + 0x6b8]
mov qword [rbp + 0xb0], rax
lea rax, [rbp + 0x398]
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x578]
mov qword [rbp + 0xc0], rax
lea rax, [rbp + 0x3e8]
mov qword [rbp + 0x170], rax
lea rax, [rbp + 0x668]
mov qword [rbp + 0xd0], rax
lea rax, [rbp + 0x438]
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x5c8]
mov qword [rbp + 0xe0], rax
lea rax, [rbp + 0x230]
mov qword [rbp + 0x160], rax
lea rax, [rbp + 0x708]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x258]
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x280]
mov qword [rbp + 0x68], rax
lea rax, [rbp + 0x2d0]
mov qword [rbp + 0x78], rax
lea rax, [rbp + 0x320]
mov qword [rbp + 0x88], rax
lea rax, [rbp + 0x370]
mov qword [rbp + 0x98], rax
lea rax, [rbp + 0x3c0]
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0x190]
mov qword [rbp + 0xb8], rax
lea rax, [rbp + 0x410]
mov qword [rbp + 0xc8], rax
lea rax, [rbp + 0x460]
mov qword [rbp + 0xd8], rax
lea rax, [rbp + 0x4b0]
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x500]
mov qword [rbp + 0xf8], rax
lea rax, [rbp + 0x550]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x5a0]
mov qword [rbp + 0x118], rax
lea rax, [rbp + 0x5f0]
mov qword [rbp + 0x128], rax
lea rax, [rbp + 0x640]
mov qword [rbp + 0x138], rax
lea rax, [rbp + 0x690]
mov qword [rbp + 0x148], rax
lea rax, [rbp + 0x6e0]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x730]
mov qword [rbp + 0x168], rax
lea rax, [rbp + 0x780]
mov qword [rsp + 0x40], rax
lea rdx, [0x1400884c8]
lea rcx, [rbp + 0x488]
call fcn.14000264c
mov qword [rbp + 0x10], rax
lea rdx, [0x140089928]
lea rcx, [rbp + 0x4d8]
call fcn.14000264c
mov qword [rbp + 0x20], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140001678
lea rdx, [rdi + 0xba8]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x48]
call fcn.1400028b0
nop
lea rdx, str.mode_ext
lea rcx, [rbp + 0x2a8]
call fcn.14000264c
mov qword [rbp], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x758]
call fcn.140001678
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp + 0x758]
call fcn.1400028b0
nop
lea rdx, str.trace
lea rcx, [rbp + 0x618]
call fcn.14000264c
mov qword [rbp - 0x10], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1e0]
call fcn.140001678
lea rdx, [rdi + 0xc30]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x1e0]
call fcn.1400028b0
nop
lea rdx, str.last_page
lea rcx, [rbp + 0x2f8]
call fcn.14000264c
mov qword [rbp - 0x20], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1b8]
call fcn.140001678
lea rdx, [rdi + 0xc08]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x1b8]
call fcn.1400028b0
nop
lea rdx, str.support
lea rcx, [rbp + 0x528]
call fcn.14000264c
mov qword [rbp - 0x30], rax
lea rdx, [rbp + 0x348]
mov rcx, rdi
call fcn.140023030
mov qword [rbp - 0x50], rax
lea rdx, [0x1400898cc]
lea rcx, [rbp + 0x6b8]
call fcn.14000264c
mov qword [rbp - 0x40], rax
lea rdx, str.userName
lea rcx, [rbp + 0x398]
call fcn.14000264c
mov qword [rbp - 0x60], rax
lea rdx, str.appId
lea rcx, [rbp + 0x578]
call fcn.14000264c
mov qword [rbp - 0x70], rax
lea rdx, [rdi + 0x6c0]
lea rcx, [rbp + 0x3e8]
call fcn.14000264c
mov qword [rbp + 0x18], rax
lea rdx, str.downloadDate
lea rcx, [rbp + 0x668]
call fcn.14000264c
mov qword [rsp + 0x78], rax
lea rdx, [rbp + 0xa20]
lea rcx, [rbp + 0x438]
call fcn.14000264c
mov qword [rsp + 0x70], rax
lea rdx, str.serial
lea rcx, [rbp + 0x5c8]
call fcn.14000264c
mov qword [rbp - 0x28], rax
lea rcx, [rdi + 0x8e70]
call fcn.1400018c0
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.14000264c
mov qword [rbp + 8], rax
lea rdx, str.torrentHash
lea rcx, [rbp + 0x708]
call fcn.14000264c
mov qword [rbp - 0x38], rax
lea rdx, [rdi + 0x5b8]
lea rcx, [rbp + 0x258]
call fcn.14000264c
mov qword [rbp + 0x28], rax
lea rdx, [0x140089858]
lea rcx, [rbp + 0x280]
call fcn.14000264c
mov qword [rbp - 0x48], rax
lea rdx, [rdi + 0x538]
lea rcx, [rbp + 0x2d0]
call fcn.14000264c
mov qword [rbp - 8], rax
lea rdx, [0x140089850]
lea rcx, [rbp + 0x320]
call fcn.14000264c
mov qword [rbp - 0x58], rax
lea rdx, [rdi + 0x4b8]
lea rcx, [rbp + 0x370]
call fcn.14000264c
mov qword [rbp + 0x38], rax
lea rdx, [0x140089618]
lea rcx, [rbp + 0x3c0]
call fcn.14000264c
mov qword [rbp - 0x68], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x190]
call fcn.140001678
lea rdx, [rdi + 0x8fd8]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp + 0x190]
call fcn.1400028b0
nop
lea rdx, str.installId
lea rcx, [rbp + 0x410]
call fcn.14000264c
mov qword [rbp - 0x78], rax
lea rdx, [rbp + 0x920]
lea rcx, [rbp + 0x460]
call fcn.14000264c
mov qword [rbp + 0x50], rax
lea rdx, [0x140089830]
lea rcx, [rbp + 0x4b0]
call fcn.14000264c
mov qword [rbp - 0x18], rax
cmp word [rdi + 0x438], 0
jne 0x140023d88
mov r8, qword [rdi]
mov rcx, rdi
call qword [r8 + 0x60]
mov rcx, rax
lea rdx, [rdi + 0x438]
call fcn.1400054a0
lea rdx, [rdi + 0x438]
lea rcx, [rbp + 0x500]
call fcn.14000264c
mov qword [rbp + 0x48], rax
lea rdx, str.version
lea rcx, [rbp + 0x550]
call fcn.14000264c
mov qword [rbp + 0x40], rax
mov rdx, r12
lea rcx, [rbp + 0x5a0]
call fcn.14000264c
mov r15, rax
lea rdx, str.mode
lea rcx, [rbp + 0x5f0]
call fcn.14000264c
mov r14, rax
lea rbx, [rdi + 0x638]
lea rdx, [rbp + 0x640]
mov rcx, rbx
call fcn.1400286a0
mov r13, rax
lea rdx, str.i_user_id
lea rcx, [rbp + 0x690]
call fcn.14000264c
mov r12, rax
lea rdx, [rbp + 0x6e0]
mov rcx, rbx
call fcn.140028650
mov rsi, rax
lea rdx, str.s_user_id
lea rcx, [rbp + 0x730]
call fcn.14000264c
mov rdi, rax
lea rdx, [rbp + 0x780]
mov rcx, rbx
call fcn.140017d40
mov rbx, rax
lea rdx, [0x1400897d0]
lea rcx, [rbp + 0x208]
call fcn.14000264c
nop
mov r8, rbx
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.14004b5b0
nop
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, r13
mov rdx, r12
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, r15
mov rdx, r14
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, qword [rbp + 0x50]
mov rdx, qword [rbp - 0x18]
mov rcx, rax
call fcn.14004b5b0
nop
lea r8, [rbp + 0x190]
mov rdx, qword [rbp - 0x78]
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, qword [rbp + 0x38]
mov rdx, qword [rbp - 0x68]
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, qword [rbp - 8]
mov rdx, qword [rbp - 0x58]
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp - 0x48]
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, qword [rbp + 8]
mov rdx, qword [rbp - 0x38]
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x28]
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, qword [rbp + 0x18]
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call fcn.14004b5b0
mov rbx, rax
mov rdi, qword [rbp - 0x80]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x30]
mov r8d, eax
mov rdx, qword [rbp - 0x70]
mov rcx, rbx
call fcn.14004b630
nop
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rbp - 0x60]
mov rcx, rax
call fcn.14004b630
nop
mov r8, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x40]
mov rcx, rax
call fcn.14004b5b0
nop
lea r8, [rbp + 0x1b8]
mov rdx, qword [rbp - 0x30]
mov rcx, rax
call fcn.14004b5b0
nop
lea r8, [rbp + 0x1e0]
mov rdx, qword [rbp - 0x20]
mov rcx, rax
call fcn.14004b5b0
nop
lea r8, [rbp + 0x758]
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.14004b5b0
nop
lea r8, [rsp + 0x48]
mov rdx, qword [rbp]
mov rcx, rax
call fcn.14004b5b0
nop
mov r8, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.14004b5b0
mov r11d, dword [rdi + 0x8e48]
test r11d, r11d
je 0x140023fe9
cmp r11d, 1
jne 0x140024001
mov rcx, qword [rbp + 0x30]
mov rbx, qword [rsp + 0x38]
test rcx, rcx
je 0x140024006
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax]
jmp 0x140024006
mov rbx, qword [rsp + 0x38]
lea rcx, [rdi + 0x8fb0]
call fcn.1400026e0
test rax, rax
je 0x1400240aa
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x758]
call fcn.140001678
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rdi + 0x8fb0]
lea rcx, [rbp + 0x758]
call fcn.14000272c
lea r11, [rsp + 0x48]
mov qword [rsp + 0x40], r11
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140001678
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x758]
lea rcx, [rsp + 0x48]
call fcn.1400028b0
nop
lea rdx, str.errors
lea rcx, [rbp + 0x208]
call fcn.14000264c
nop
lea r8, [rsp + 0x48]
mov rdx, rax
mov rcx, rbx
call fcn.14004b5b0
nop
lea rcx, [rbp + 0x758]
call fcn.140001624
lea rdx, [0x1400882a8]
lea rcx, [rbp + 0x7a8]
call fcn.14000264c
nop
lea rdx, str._installKey
lea rcx, [rdi + 0xd20]
call fcn.140018060
test rax, rax
je 0x140024134
lea rdx, str._installKey
lea rcx, [rdi + 0xd20]
call fcn.140018060
mov rdx, rax
lea rcx, [rbp + 0x7a8]
call fcn.140002680
lea r8, [rbp + 0x7a8]
lea rdx, str.installKey_from_commangLine
lea rcx, [rbp + 0x780]
call fcn.14000d770
nop
mov rcx, rax
call fcn.1400018c0
mov r8, rax
lea rdx, str.INFO
mov rcx, qword [rdi + 0x8e40]
call fcn.140018920
nop
jmp 0x1400241a5
mov rdx, qword [rdi + 0x8e40]
lea rcx, [rbp + 0x780]
call fcn.140007450
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x7a8]
call fcn.14000272c
nop
lea rcx, [rbp + 0x780]
call fcn.140001624
lea r8, [rbp + 0x7a8]
lea rdx, str.installKey_from_fileName
lea rcx, [rbp + 0x780]
call fcn.14000d770
nop
mov rcx, rax
call fcn.1400018c0
mov r8, rax
lea rdx, str.INFO
mov rcx, qword [rdi + 0x8e40]
call fcn.140018920
nop
lea rcx, [rbp + 0x780]
call fcn.140001624
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140001678
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x7a8]
lea rcx, [rsp + 0x48]
call fcn.1400028b0
nop
lea rdx, str.installKey
lea rcx, [rbp + 0x208]
call fcn.14000264c
nop
lea r8, [rsp + 0x48]
mov rdx, rax
mov rcx, rbx
call fcn.14004b5b0
nop
lea rcx, [rbp + 0x7a8]
call fcn.140001624
nop
lea rcx, [rbp + 0x7d0]
call fcn.140001624
mov rcx, qword [rbp + 0xc20]
xor rcx, rsp
call fcn.14005ba60
add rsp, 0xd38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret