Function at 0x140052570
Capabilities:
Check for time delay via queryperformancecounter
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [r11 - 0x48]
sub rsp, 0x120
mov rax, qword [0x1400f3e08]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r9, qword [rcx + 0x20]
xor esi, esi
mov rdi, qword [rcx]
movzx r14d, dl
mov byte [rsp + 0x48], dl
mov rbx, rcx
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x40], 0
test r9, r9
je 0x140052ce8
mov rax, qword [rcx + 0x198]
cmp byte [rax + 0x5a], sil
je 0x140052cb3
movzx r10d, word [rcx + 0x17a]
movzx eax, word [rcx + 0x182]
movzx r15d, r10w
movzx edx, byte [rcx + 0x172]
sub r15w, ax
sub r15w, word [rcx + 0x184]
mov r12d, eax
add r12, qword [r9 + 8]
add dx, r10w
mov qword [r11 + 0x10], r13
test r14b, r14b
jne 0x14005262a
lea r13, [rcx + 0x178]
cmp byte [r13], 0xff
je 0x14005262a
movzx ecx, word [r9]
movzx eax, dx
sub ecx, eax
cmp ecx, 0x40
jge 0x14005267d
mov byte [rsp + 0x40], 1
test r14b, r14b
jne 0x14005265e
mov rax, qword [rbx + 0x18]
cmp word [rax], 1
jne 0x14005265e
mov rax, qword [0x1400f75a8]
mov ecx, dword [rax + 0xc8]
shr ecx, 2
test cl, 1
je 0x14005265e
movzx eax, word [r9]
mov word [rbx + 0x180], ax
movzx esi, word [rbx + 0x180]
lea r13, [rbx + 0x178]
cmp dx, si
jae 0x14005267d
sub si, dx
lea r14, [rbx + 0x179]
jmp 0x1400526a1
lea r14, [rbx + 0x179]
movzx ecx, r15w
movzx edx, byte [r14]
add rcx, rdx
cmp rcx, 4
jae 0x1400526c3
mov esi, 4
sub si, dx
sub si, r15w
test si, si
je 0x1400526c3
mov rcx, r10
movzx r8d, si
add rcx, qword [r9 + 8]
xor edx, edx
call fcn.1400819f0
add r15w, si
add word [rbx + 0x17a], si
cmp byte [r13], 0xff
je 0x1400526f4
movzx eax, byte [r14]
movzx ecx, byte [rbx + 0x172]
add cx, ax
mov eax, 0x4000
add cx, r15w
or cx, ax
movzx eax, word [rbx + 0x186]
ror cx, 8
mov word [rax + r12], cx
test byte [0x1400f8b3e], 0x80
je 0x140052795
mov rax, qword [rbx + 8]
movzx edx, r15w
add dx, word [rbx + 0x184]
mov r9, qword [rbx + 0x198]
mov rcx, qword [rax + 0x90]
mov eax, dword [rdi + 0xe4c]
mov r9, qword [r9 + 0x10]
mov dword [rsp + 0x30], eax
movzx r8d, byte [rcx + 0x21]
mov rcx, rdi
mov qword [rsp + 0x28], r12
mov word [rsp + 0x20], dx
xor edx, edx
call fcn.140012600
movzx ecx, word [rbx + 0x184]
mov rax, qword [rbx + 0x198]
mov word [rsp + 0x58], cx
lea esi, [r15 + rcx]
mov rbx, qword [rax + 0x10]
cmp cx, si
jae 0x140052790
lea rax, [rsp + 0x58]
movzx r9d, si
mov qword [rsp + 0x28], rax
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x20], r12
mov rcx, rdi
call fcn.14003e880
test al, al
je 0x140052790
movzx ecx, word [rsp + 0x58]
jmp 0x140052760
mov rbx, qword [rsp + 0x50]
xor esi, esi
cmp byte [rbx + 0x172], sil
je 0x140052b2c
mov rax, qword [rbx + 0x28]
cmp dword [rax], 3
jne 0x1400527ba
test byte [rdi + 0x132], 0x20
jne 0x140052b2c
test byte [0x1400f8b3f], 1
je 0x1400527ff
mov rax, qword [rbx + 0x198]
lea rdx, [0x1400cff60]
mov r9d, 2
mov qword [rbp - 0x58], 8
mov rcx, qword [rax + 8]
lea rax, [rsp + 0x50]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rcx
call fcn.140001460
mov rdx, qword [rbx + 0x198]
movzx ecx, byte [rbx + 0x172]
add word [rbx + 0x17a], cx
movzx r8d, word [rbx + 0x184]
lea eax, [r15 + rcx]
mov rcx, qword [rbx + 0x28]
movzx r15d, ax
lea r9, [r12 + r8]
mov qword [rsp + 0x28], r9
movzx eax, byte [rcx + 0x18]
mov byte [rsp + 0x60], al
movzx eax, byte [rcx + 0x19]
mov byte [rsp + 0x61], al
movzx eax, byte [rcx + 0x1a]
mov byte [rsp + 0x62], al
movzx eax, byte [rcx + 0x1b]
mov byte [rsp + 0x63], al
movzx eax, byte [rcx + 0x1c]
xor al, byte [rdx + 0x17]
mov byte [rsp + 0x64], al
movzx eax, byte [rcx + 0x1d]
xor al, byte [rdx + 0x16]
mov byte [rsp + 0x65], al
movzx eax, byte [rcx + 0x1e]
xor al, byte [rdx + 0x15]
mov byte [rsp + 0x66], al
movzx eax, byte [rcx + 0x1f]
xor al, byte [rdx + 0x14]
mov byte [rsp + 0x67], al
movzx eax, byte [rcx + 0x20]
xor al, byte [rdx + 0x13]
mov byte [rsp + 0x68], al
movzx eax, byte [rcx + 0x21]
xor al, byte [rdx + 0x12]
mov byte [rsp + 0x69], al
movzx eax, byte [rcx + 0x22]
xor al, byte [rdx + 0x11]
mov byte [rsp + 0x6a], al
movzx eax, byte [rcx + 0x23]
xor al, byte [rdx + 0x10]
lea rdx, [rsp + 0x60]
mov byte [rsp + 0x6b], al
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x58], r9
mov r9, r12
mov word [rsp + 0x20], r15w
call fcn.140057860
test eax, eax
jns 0x1400528ea
mov edx, SafeArrayLock
movsxd r8, eax
lea r9, str.Encryption_failure
mov word [rsp + 0x20], dx
mov rcx, rdi
call fcn.140017410
jmp 0x140052c98
test byte [0x1400f8b3f], 1
je 0x14005292f
mov rax, qword [rbx + 0x198]
lea rdx, [0x1400d0978]
mov r9d, 2
mov qword [rbp - 0x58], 8
mov rcx, qword [rax + 8]
lea rax, [rsp + 0x50]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rcx
call fcn.140001460
test byte [rdi + 0xf1], 4
je 0x140052a1f
mov rcx, qword [rsp + 0x58]
movzx eax, byte [r14]
sub rcx, rax
cmp byte [r13], 0xff
mov qword [rsp + 0x58], rcx
lea r8, [rcx + 4]
jne 0x1400529b0
movzx eax, byte [rbx + 0x170]
movups xmm0, xmmword [r8]
shr eax, 2
and eax, 0xf
shl eax, 4
movups xmmword [rax + rbx + 0x30], xmm0
movzx eax, byte [rbx + 0x170]
shr rax, 2
and eax, 0xf
mov qword [rbx + rax*8 + 0x130], r12
movzx eax, byte [rbx + 0x170]
lea ecx, [rax + 4]
xor cl, al
and cl, 0x3c
xor cl, al
mov byte [rbx + 0x170], cl
and cl, 0x3c
cmp cl, 0x20
jne 0x140052a1f
mov rcx, rbx
call fcn.140052470
jmp 0x140052a1f
mov rcx, qword [rbx + 0x28]
lea r9, [rbx + 0xb0]
mov dl, 1
mov rcx, qword [rcx + 0x10]
call fcn.140057cc0
test eax, eax
jns 0x1400529ee
mov ecx, 0xa
movsxd r8, eax
mov word [rsp + 0x20], cx
lea r9, str.HP_failure
lea edx, [rcx + 8]
mov rcx, rdi
call fcn.140017410
jmp 0x140052c98
movzx eax, byte [rbx + 0xb0]
xor dl, dl
and al, 0xf
xor byte [r12], al
cmp byte [r14], dl
jbe 0x140052a1f
mov r8, qword [rsp + 0x58]
movzx eax, dl
inc dl
lea rcx, [rax + r8]
movzx eax, byte [rax + rbx + 0xb1]
xor byte [rcx], al
cmp dl, byte [r14]
jb 0x140052a07
movsxd rax, dword [rbx + 0x174]
mov rcx, r15
mov rdx, qword [rdi + rax*8 + 0xad0]
movzx eax, byte [rbx + 0x172]
sub rcx, rax
add rcx, qword [rdx + 0x1a0]
mov qword [rdx + 0x1a0], rcx
cmp byte [r13], 0xff
jne 0x140052b71
lea rax, [rcx + 0x5dc]
cmp rax, qword [rdi + 0x68]
jb 0x140052b71
test byte [rdx + 0x1a8], 2
jne 0x140052b71
test byte [rdi + 0xf2], 1
je 0x140052b71
mov rcx, rdi
call fcn.14003a300
movsxd r14, eax
test eax, eax
jns 0x140052b15
test byte [0x1400f8b3b], 4
lea r15, str.Send_triggered_key_update
je 0x140052af5
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], r14d
mov qword [rbp - 0x60], rax
lea rdx, [0x1400d0688]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rdi
mov qword [rbp - 0x50], rax
mov r9d, 4
lea rax, [rbp - 0x70]
mov qword [rbp - 0x58], 8
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x48], 4
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], 0x1a
call fcn.140001460
mov eax, 0x19
mov r8, r14
mov r9, r15
mov word [rsp + 0x20], ax
mov rcx, rdi
lea edx, [rax - 7]
call fcn.140017410
jmp 0x140052c98
mov dl, 1
mov rcx, rdi
call fcn.14003a520
mov rax, qword [rdi + 0xb88]
mov qword [rbx + 0x28], rax
jmp 0x140052b71
test byte [0x1400f8b3f], 1
je 0x140052b71
mov rax, qword [rbx + 0x198]
lea rdx, [0x1400d0978]
mov r9d, 2
mov qword [rbp - 0x58], 8
mov rcx, qword [rax + 8]
lea rax, [rsp + 0x50]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rcx
call fcn.140001460
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r9, qword [0x1400f8b08]
xor edx, edx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
mov ecx, ecx
shr rax, 0x20
imul r10, rax, 0xf4240
mov rax, r10
div r9
mov rax, rdx
shl rax, 0x20
imul rdx, rcx, 0xf4240
mov rcx, qword [rbx + 0x198]
add rax, rdx
xor edx, edx
div r9
xor edx, edx
mov r8, rax
mov rax, r10
div r9
shl rax, 0x20
add r8, rax
mov qword [rcx + 0x20], r8
mov rax, qword [rbx + 0x198]
add r15w, word [rbx + 0x184]
mov word [rax + 0x28], r15w
mov rcx, qword [rbx + 0x198]
movzx eax, byte [rbx + 0x170]
shr al, 6
xor al, byte [rcx + 0x59]
and al, 1
xor byte [rcx + 0x59], al
test byte [0x1400f8b3b], 8
je 0x140052c44
mov r9, qword [rbx + 0x198]
movzx ecx, byte [r9 + 0x58]
and cl, 3
cmp cl, 3
jne 0x140052c21
mov cl, 5
jmp 0x140052c23
inc cl
movzx eax, word [r9 + 0x28]
lea rdx, [0x1400cff50]
mov r9, qword [r9 + 0x10]
mov r8, rdi
mov word [rsp + 0x28], ax
mov byte [rsp + 0x20], cl
call fcn.140013ad0
mov r8, qword [rbx + 0x198]
lea rcx, [rdi + 0xa50]
mov rdx, qword [rbx + 8]
call fcn.140044800
mov rax, qword [rbx + 0x198]
mov byte [rax + 0x5a], sil
mov rax, qword [rbx + 0x198]
test byte [rax + 0x58], 4
je 0x140052c98
or byte [rbx + 0x170], 2
movzx ecx, word [rax + 0x28]
mov eax, dword [rbx + 0x188]
cmp ecx, eax
jbe 0x140052c90
mov dword [rbx + 0x188], esi
jmp 0x140052c98
sub eax, ecx
mov dword [rbx + 0x188], eax
mov r13, qword [rsp + 0x158]
mov r12b, 1
movzx r14d, byte [rsp + 0x48]
cmp byte [rsp + 0x40], sil
jmp 0x140052dd8
dec qword [rdi + 0xd60]
movzx r12d, sil
movzx eax, word [rcx + 0x184]
sub word [rcx + 0x17a], ax
mov word [rcx + 0x184], si
jne 0x140052ceb
mov rdx, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x18]
call fcn.140058700
mov qword [rbx + 0x20], rsi
jmp 0x140052ceb
mov r12b, 1
mov rax, qword [rbx + 8]
cmp dword [rax + 0xd0], 0xffffffff
je 0x140052dc8
test byte [rdi + 0x10a], 4
jne 0x140052dc8
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r8, qword [0x1400f8b08]
xor edx, edx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
mov ecx, ecx
shr rax, 0x20
imul r9, rax, 0xf4240
mov rax, r9
div r8
mov rax, rdx
shl rax, 0x20
imul rdx, rcx, 0xf4240
add rax, rdx
xor edx, edx
div r8
xor edx, edx
mov rcx, rax
mov rax, r9
div r8
shl rax, 0x20
add rcx, rax
movzx eax, byte [rdi + 0x10a]
or al, 4
mov qword [rdi + 0xf78], rcx
mov byte [rdi + 0x10a], al
test byte [0x1400f8b3a], 0x10
je 0x140052dc8
mov byte [rsp + 0x48], al
lea rdx, [0x1400cfe20]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x70], rax
mov r9d, 3
lea rax, [rsp + 0x48]
mov qword [rsp + 0x78], 8
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x78], 1
call fcn.140001460
test r14b, r14b
je 0x140053031
cmp byte [rbx + 0x171], sil
je 0x140052fe1
cmp qword [rbx + 0x20], 0
je 0x140052e24
mov rax, qword [rbx + 0x198]
test byte [rax + 0x59], 1
je 0x140052df9
inc qword [rdi + 0xd70]
mov rax, qword [rbx + 0x20]
movzx ecx, word [rbx + 0x17a]
mov dword [rax], ecx
movzx eax, word [rbx + 0x17a]
inc byte [rbx + 0x171]
add dword [rbx + 0x17c], eax
mov qword [rbx + 0x20], rsi
mov word [rbx + 0x17a], si
lea r15, [rbx + 0x18]
test r14b, r14b
jne 0x140052e85
mov rdx, qword [r15]
cmp word [rdx], 1
jne 0x140052e85
mov rax, qword [rdx + 0x48]
movzx r9d, byte [rdx + 0x67]
mov rcx, qword [rax]
cmp r9b, byte [rcx + 0xd6]
jb 0x140052e7b
movzx r8d, word [rdx + 0x64]
test r8w, r8w
je 0x140052e77
cmp qword [rdx + 0x80], 0
je 0x140052e77
mov eax, r9d
mov ecx, 0xffff
add rax, rax
sub ecx, dword [rdx + rax*8 + 0x58]
sub ecx, dword [rdx + 0x78]
cmp r8d, ecx
jbe 0x140052e7b
mov al, 1
jmp 0x140052e7d
xor al, al
test al, al
je 0x140052faa
test byte [rbx + 0x170], 0x3c
je 0x140052e96
mov rcx, rbx
call fcn.140052470
test byte [0x1400f8b3c], 1
je 0x140052f28
movzx eax, byte [rbx + 0x171]
lea r9, str.Sending_batch.__hu_datagrams
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x20], eax
mov r8, r14
lea rcx, [rbp - 0x70]
mov edx, 0x80
call fcn.1400015d0
mov rax, qword [rbx]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x78], 8
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x140052ef0
lea rax, [rbp - 0x70]
mov dword [rbp - 0x74], esi
mov qword [rbp - 0x80], rax
lea rdx, [0x1400d0190]
lea rax, [rsp + 0x60]
inc r14d
mov r9d, 3
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x78], r14d
call fcn.140001460
mov rcx, qword [rbx + 8]
movzx eax, byte [rbx + 0x171]
mov r9d, dword [rbx + 0x17c]
mov r8, qword [r15]
lea rdx, [rcx + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x28]
call fcn.14000ae10
or byte [rbx + 0x170], 1
mov rax, qword [rbx + 0x198]
mov qword [r15], rsi
mov dword [rbx + 0x17c], esi
mov byte [rax + 0x5a], 0
test byte [0x1400f8b3f], 1
je 0x140052faa
mov rax, qword [rbx + 0x190]
lea rdx, [0x1400d0628]
mov qword [rsp + 0x50], rax
mov r9d, 2
lea rax, [rsp + 0x50]
mov qword [rbp - 0x58], 8
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.140001460
cmp dword [rdi + 0xe4c], 0xcf43336b
movzx ecx, byte [rbx + 0x178]
je 0x140052fc4
cmp cl, 3
je 0x140052fc8
jmp 0x140053031
test cl, cl
jne 0x140053031
xor r9d, r9d
mov word [rsp + 0x20], si
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 1]
call fcn.140017410
jmp 0x140053031
test r14b, r14b
je 0x140053031
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x140053003
mov rcx, qword [rbx + 0x18]
call fcn.140058700
mov qword [rbx + 0x20], rsi
mov word [rbx + 0x17a], si
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x140053031
cmp word [rdx], 1
jne 0x14005301c
mov rcx, rdx
call fcn.140063940
jmp 0x14005302d
mov rcx, qword [rdx + 0x18]
add rcx, 0x200
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
mov qword [rbx + 0x18], rsi
movzx eax, r12b
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14007f5b0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret