Function at 0x1400c7e30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
mov r12, rcx
push rdi
push rsi
push rbx
mov rbx, rdx
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
call sub.msvcrt.dll_strlen
mov r8, rax
mov esi, eax
mov rax, qword [0x1403ee340]
mov r11, qword [rax + 8]
test r11, r11
je 0x1400c8110
mov r9, r12
cmp r8d, 0xb
jbe 0x1400c8588
mov r10d, r8d
mov r13d, 0x9e3779b9
mov edi, 0x9e3779b9
mov ecx, 0xfeedbeef
nop dword [rax + rax]
movzx edx, byte [r9 + 5]
movzx eax, byte [r9 + 6]
shl edx, 8
shl eax, 0x10
add edx, eax
movzx eax, byte [r9 + 4]
add edx, eax
movzx eax, byte [r9 + 7]
shl eax, 0x18
add edx, eax
movzx eax, byte [r9 + 9]
add edx, r13d
movzx r13d, byte [r9 + 0xa]
shl eax, 8
shl r13d, 0x10
add eax, r13d
movzx r13d, byte [r9 + 8]
add eax, r13d
movzx r13d, byte [r9 + 0xb]
shl r13d, 0x18
add eax, r13d
movzx r13d, byte [r9 + 2]
add eax, ecx
movzx ecx, byte [r9 + 1]
shl r13d, 0x10
shl ecx, 8
add ecx, r13d
movzx r13d, byte [r9]
add ecx, r13d
movzx r13d, byte [r9 + 3]
shl r13d, 0x18
add ecx, r13d
sub ecx, edx
sub edx, eax
sub ecx, eax
add ecx, edi
mov edi, eax
shr edi, 0xd
xor ecx, edi
mov edi, edx
mov edx, ecx
sub edi, ecx
sub eax, ecx
shl edx, 8
xor edx, edi
sub eax, edx
mov edi, eax
mov eax, edx
shr eax, 0xd
xor eax, edi
sub ecx, edx
sub r10d, 0xc
add r9, 0xc
mov edi, ecx
mov ecx, eax
sub edx, eax
sub edi, eax
shr ecx, 0xc
xor ecx, edi
mov edi, edx
mov edx, ecx
sub edi, ecx
sub eax, ecx
shl edx, 0x10
xor edx, edi
sub eax, edx
sub ecx, edx
mov edi, eax
mov eax, edx
shr eax, 5
xor eax, edi
mov edi, eax
sub ecx, eax
sub edx, eax
shr edi, 3
xor edi, ecx
mov r13d, edi
sub edx, edi
sub eax, edi
shl r13d, 0xa
xor r13d, edx
mov ecx, r13d
sub eax, r13d
shr ecx, 0xf
xor ecx, eax
cmp r10d, 0xb
ja 0x1400c7e90
add ecx, r8d
cmp r10d, 0xb
ja case.0x1400c7fa4.0
lea rdx, [0x1402968f4]
movsxd rax, dword [rdx + r10*4]
add rax, rdx
jmp rax
movzx eax, byte [r9 + 0xa]
shl eax, 0x18
add ecx, eax
movzx eax, byte [r9 + 9]
shl eax, 0x10
add ecx, eax
movzx eax, byte [r9 + 8]
shl eax, 8
add ecx, eax
movzx eax, byte [r9 + 7]
shl eax, 0x18
add r13d, eax
movzx eax, byte [r9 + 6]
shl eax, 0x10
add r13d, eax
movzx eax, byte [r9 + 5]
shl eax, 8
add r13d, eax
movzx eax, byte [r9 + 4]
add r13d, eax
movzx eax, byte [r9 + 3]
shl eax, 0x18
add edi, eax
movzx eax, byte [r9 + 2]
shl eax, 0x10
add edi, eax
movzx eax, byte [r9 + 1]
shl eax, 8
add edi, eax
movzx eax, byte [r9]
add edi, eax
lea eax, [rcx + r13]
mov edx, ecx
sub r13d, ecx
sub edi, eax
shr edx, 0xd
xor edx, edi
mov eax, edx
sub r13d, edx
sub ecx, edx
shl eax, 8
xor eax, r13d
sub ecx, eax
sub edx, eax
mov r9d, ecx
mov ecx, eax
shr ecx, 0xd
xor ecx, r9d
mov r9d, ecx
sub edx, ecx
sub eax, ecx
shr r9d, 0xc
xor r9d, edx
mov edx, r9d
sub eax, r9d
sub ecx, r9d
shl edx, 0x10
xor edx, eax
mov eax, edx
sub ecx, edx
sub r9d, edx
shr eax, 5
xor eax, ecx
mov ecx, eax
sub r9d, eax
sub edx, eax
shr ecx, 3
xor ecx, r9d
mov r13d, ecx
sub edx, ecx
sub eax, ecx
shl r13d, 0xa
xor r13d, edx
mov rdx, qword [r11 + 0x10]
sub eax, r13d
shr r13d, 0xf
xor r13d, eax
mov eax, dword [rdx + 8]
sub eax, 1
and eax, r13d
shl rax, 4
add rax, qword [rdx]
mov rdi, qword [rax]
test rdi, rdi
je 0x1400c8110
mov rax, qword [rdx + 0x20]
mov r15d, r8d
mov r14, rax
sub rdi, rax
neg r14
jmp 0x1400c80cc
mov rdi, qword [rdi + 0x30]
test rdi, rdi
je 0x1400c8110
add rdi, r14
cmp dword [rdi + 0x44], r13d
jne 0x1400c80c0
cmp dword [rdi + 0x40], esi
jne 0x1400c80c0
mov rcx, qword [rdi + 0x38]
mov r8, r15
mov rdx, r12
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400c80c0
nop word [rax + rax]
mov qword [rdi + 8], rbx
xor eax, eax
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 0x48
call sub.msvcrt.dll_malloc
mov rdi, rax
test rax, rax
je 0x1400c8645
mov rcx, r12
call fcn.140100eb0
mov qword [rdi], rax
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_strlen
mov r8, r12
mov r10, rax
cmp eax, 0xb
jbe 0x1400c8625
mov r9d, eax
mov r11d, 0x9e3779b9
mov eax, 0x9e3779b9
mov ecx, 0xfeedbeef
nop
movzx edx, byte [r8 + 5]
movzx esi, byte [r8 + 6]
shl edx, 8
shl esi, 0x10
add edx, esi
movzx esi, byte [r8 + 4]
add edx, esi
movzx esi, byte [r8 + 7]
shl esi, 0x18
add edx, esi
movzx esi, byte [r8 + 0xa]
add edx, eax
movzx eax, byte [r8 + 9]
shl esi, 0x10
shl eax, 8
add eax, esi
movzx esi, byte [r8 + 8]
add eax, esi
movzx esi, byte [r8 + 0xb]
shl esi, 0x18
add eax, esi
movzx esi, byte [r8 + 2]
add eax, ecx
movzx ecx, byte [r8 + 1]
shl esi, 0x10
shl ecx, 8
add ecx, esi
movzx esi, byte [r8]
add ecx, esi
movzx esi, byte [r8 + 3]
shl esi, 0x18
add ecx, esi
sub ecx, edx
sub edx, eax
sub ecx, eax
add ecx, r11d
mov r11d, eax
shr r11d, 0xd
xor ecx, r11d
sub edx, ecx
sub eax, ecx
mov r11d, edx
mov edx, ecx
shl edx, 8
xor edx, r11d
mov r11d, edx
sub eax, edx
shr r11d, 0xd
xor r11d, eax
sub ecx, edx
sub r9d, 0xc
add r8, 0xc
mov eax, r11d
sub ecx, r11d
sub edx, r11d
shr eax, 0xc
xor eax, ecx
mov ecx, eax
sub edx, eax
sub r11d, eax
shl ecx, 0x10
xor ecx, edx
mov edx, ecx
sub r11d, ecx
sub eax, ecx
shr edx, 5
xor edx, r11d
mov r11d, edx
sub eax, edx
sub ecx, edx
shr r11d, 3
xor r11d, eax
mov eax, r11d
sub ecx, r11d
sub edx, r11d
shl eax, 0xa
xor eax, ecx
mov ecx, eax
sub edx, eax
shr ecx, 0xf
xor ecx, edx
cmp r9d, 0xb
ja 0x1400c8160
add ecx, r10d
cmp r9d, 0xb
ja case.0x1400c8271.0
lea r10, [0x140296924]
movsxd rdx, dword [r10 + r9*4]
add rdx, r10
jmp rdx
movzx edx, byte [r8 + 0xa]
shl edx, 0x18
add ecx, edx
movzx edx, byte [r8 + 9]
shl edx, 0x10
add ecx, edx
movzx edx, byte [r8 + 8]
shl edx, 8
add ecx, edx
movzx edx, byte [r8 + 7]
shl edx, 0x18
add eax, edx
movzx edx, byte [r8 + 6]
shl edx, 0x10
add eax, edx
movzx edx, byte [r8 + 5]
shl edx, 8
add eax, edx
movzx edx, byte [r8 + 4]
add eax, edx
movzx edx, byte [r8 + 3]
shl edx, 0x18
add r11d, edx
movzx edx, byte [r8 + 2]
shl edx, 0x10
add r11d, edx
movzx edx, byte [r8 + 1]
shl edx, 8
add r11d, edx
movzx edx, byte [r8]
add r11d, edx
lea edx, [rcx + rax]
mov r8d, ecx
sub eax, ecx
mov qword [rdi + 0x38], r12
sub r11d, edx
shr r8d, 0xd
xor r8d, r11d
mov edx, r8d
sub eax, r8d
sub ecx, r8d
shl edx, 8
xor edx, eax
mov eax, edx
sub ecx, edx
sub r8d, edx
shr eax, 0xd
xor eax, ecx
mov ecx, eax
sub r8d, eax
sub edx, eax
shr ecx, 0xc
xor ecx, r8d
sub edx, ecx
sub eax, ecx
mov r8d, edx
mov edx, ecx
shl edx, 0x10
xor edx, r8d
sub eax, edx
sub ecx, edx
mov r8d, eax
mov eax, edx
shr eax, 5
xor eax, r8d
mov r8d, eax
sub ecx, eax
sub edx, eax
shr r8d, 3
xor ecx, r8d
mov esi, ecx
sub edx, ecx
sub eax, ecx
mov rcx, r12
shl esi, 0xa
xor esi, edx
sub eax, esi
shr esi, 0xf
xor esi, eax
mov dword [rdi + 0x44], esi
call sub.msvcrt.dll_strlen
mov r12, qword [0x1403ee340]
mov dword [rdi + 0x40], eax
mov rax, qword [r12 + 8]
test rax, rax
je 0x1400c85a0
mov rax, qword [rax + 0x10]
mov qword [rdi + 0x20], 0
lea r13, [rdi + 0x10]
mov qword [rdi + 0x10], rax
mov rax, qword [r12 + 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx + 0x18]
sub rax, qword [rdx + 0x20]
mov qword [rdi + 0x18], rax
mov rax, qword [r12 + 8]
mov rax, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
mov qword [rax + 0x10], rdi
mov rax, qword [r12 + 8]
mov rax, qword [rax + 0x10]
mov qword [rax + 0x18], r13
mov rax, qword [r12 + 8]
mov rax, qword [rax + 0x10]
add dword [rax + 0x10], 1
mov rax, qword [r12 + 8]
mov rdx, qword [rax + 0x10]
mov eax, dword [rdx + 8]
sub eax, 1
and eax, esi
shl rax, 4
add rax, qword [rdx]
mov rdx, qword [rax]
add dword [rax + 8], 1
mov qword [rdi + 0x28], 0
mov qword [rdi + 0x30], rdx
mov rdx, qword [rax]
test rdx, rdx
je 0x1400c8407
mov qword [rdx + 0x18], r13
mov edx, dword [rax + 0xc]
mov qword [rax], r13
lea edx, [rdx + rdx*4 + 5]
add edx, edx
cmp dword [rax + 8], edx
jb 0x1400c80f0
mov r13, qword [rdi + 0x10]
mov esi, dword [r13 + 0x34]
test esi, esi
jne 0x1400c80f0
mov ecx, dword [r13 + 8]
mov edx, 1
shl rcx, 5
call sub.msvcrt.dll_calloc
mov r12, rax
test rax, rax
je 0x1400c863d
mov edx, dword [r13 + 8]
mov eax, dword [r13 + 0x10]
mov ecx, dword [r13 + 0xc]
lea edx, [rdx + rdx - 1]
test edx, eax
setne dl
add ecx, 1
shr eax, cl
movzx edx, dl
add edx, eax
mov dword [r13 + 0x28], edx
mov rax, qword [rdi + 0x10]
mov dword [rax + 0x2c], 0
mov r8, qword [rdi + 0x10]
mov eax, dword [r8 + 8]
test eax, eax
je 0x1400c8539
xor r10d, r10d
nop dword [rax + rax]
mov edx, r10d
shl rdx, 4
add rdx, qword [r8]
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1400c84c7
jmp 0x1400c852c
mov qword [rcx + 0x18], rdx
mov r8, qword [rdi + 0x10]
mov qword [rax], rdx
test r9, r9
je 0x1400c8528
mov eax, dword [r8 + 8]
mov rdx, r9
lea eax, [rax + rax - 1]
and eax, dword [rdx + 0x34]
mov r9, qword [rdx + 0x20]
shl rax, 4
add rax, r12
mov ecx, dword [rax + 8]
add ecx, 1
mov dword [rax + 8], ecx
cmp ecx, dword [r8 + 0x28]
jbe 0x1400c8508
add dword [r8 + 0x2c], 1
mov r8, qword [rdi + 0x10]
mov ecx, dword [rax + 0xc]
mov r15d, dword [r8 + 0x28]
imul r15d, ecx
cmp dword [rax + 8], r15d
jbe 0x1400c8508
add ecx, 1
mov dword [rax + 0xc], ecx
mov qword [rdx + 0x18], 0
mov rcx, qword [rax]
mov qword [rdx + 0x20], rcx
test rcx, rcx
jne 0x1400c84b0
mov qword [rax], rdx
mov r8, qword [rdi + 0x10]
test r9, r9
jne 0x1400c84c0
mov eax, dword [r8 + 8]
add r10d, 1
cmp r10d, eax
jb 0x1400c8490
mov rcx, qword [r8]
call sub.msvcrt.dll_free
mov rax, qword [rdi + 0x10]
shl dword [rax + 8], 1
mov rax, qword [rdi + 0x10]
add dword [rax + 0xc], 1
mov rax, qword [rdi + 0x10]
mov qword [rax], r12
mov rax, qword [rdi + 0x10]
mov edx, dword [rax + 0x10]
shr edx, 1
cmp dword [rax + 0x2c], edx
jbe 0x1400c856b
mov esi, dword [rax + 0x30]
add esi, 1
mov dword [rax + 0x30], esi
mov rax, qword [rdi + 0x10]
cmp dword [rax + 0x30], 1
jbe 0x1400c80f0
mov dword [rax + 0x34], 1
jmp 0x1400c80f0
mov r10d, r8d
mov r13d, 0x9e3779b9
mov edi, 0x9e3779b9
mov ecx, 0xfeedbeef
jmp 0x1400c7f8d
pxor xmm0, xmm0
mov ecx, 0x40
movups xmmword [rdi + 0x18], xmm0
call sub.msvcrt.dll_malloc
mov qword [rdi + 0x10], rax
mov r14, rax
test rax, rax
je 0x1400c863d
lea r13, [rdi + 0x10]
mov qword [rax + 0x10], 0
mov edx, 1
mov ecx, 0x200
mov qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
mov qword [rax + 0x38], 0
mov qword [rax + 0x18], r13
mov rax, qword [0x140296a78]
mov qword [r14 + 0x20], 0x10
mov qword [r14 + 8], rax
call sub.msvcrt.dll_calloc
mov dword [r14 + 0x38], 0xa0111fe1
mov qword [r14], rax
test rax, rax
je 0x1400c863d
mov qword [r12 + 8], rdi
mov rax, rdi
jmp 0x1400c83c8
mov r9d, eax
mov r11d, 0x9e3779b9
mov eax, 0x9e3779b9
mov ecx, 0xfeedbeef
jmp 0x1400c825a
or ecx, 0xffffffff
call sub.msvcrt.dll_exit
lea rax, [0x1402968da]
mov r9d, 8
lea r8, str.dap_chain_node_dns_server
mov edx, 0x39
mov qword [rsp + 0x20], rax
lea rcx, str.dap_dns_zone_register
call fcn.14005a160
mov eax, 2
jmp 0x1400c80f6