Function at 0x14004f1b0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x78
cmp qword [rcx + 0x10], 0
mov rbx, rcx
jne 0x14004f1d0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rdi
mov edi, 0xfd2
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
xor r15d, r15d
mov word [rbp - 0x24], r15w
mov ecx, r15d
mov dword [rbp - 0x30], 0xf019f056
mov dword [rbp - 0x2c], 0xf055f004
mov dword [rbp - 0x28], 0xf054f050
mov byte [rbp - 0x22], 1
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x30], ax
inc rcx
cmp rcx, 6
jb 0x14004f220
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x22], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf019f056
mov rcx, r15
mov dword [rbp - 0x54], 0xf055f004
mov dword [rbp - 0x50], 0xf054f050
mov dword [rbp - 0x4c], 0xf040f019
mov dword [rbp - 0x48], 0xf044f058
mov dword [rbp - 0x44], 0xf05ef051
mov dword [rbp - 0x40], 0xf05ef054
mov dword [rbp - 0x3c], 0xf058
mov byte [rbp - 0x38], 1
nop dword [rax]
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0xf
jb 0x14004f290
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x38], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00cf01a
mov dword [rbp - 0x3c], 0xf008f012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f301
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00cf01a
mov dword [rbp - 0x3c], 0xf009f012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f372
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00cf01a
mov dword [rbp - 0x3c], 0xf00ef012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
nop dword [rax]
nop word [rax + rax]
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f3f0
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00cf01a
mov dword [rbp - 0x3c], 0xf00ff012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f461
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00cf01a
mov dword [rbp - 0x3c], 0xf00cf012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f4d2
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00cf01a
mov dword [rbp - 0x3c], 0xf00df012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
nop dword [rax]
nop word [rax + rax]
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f550
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00df01a
mov dword [rbp - 0x3c], 0xf004f012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f5c1
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00df01a
mov dword [rbp - 0x3c], 0xf005f012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f632
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00df01a
mov dword [rbp - 0x3c], 0xf00af012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
nop dword [rax]
nop word [rax + rax]
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f6b0
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00df01a
mov dword [rbp - 0x3c], 0xf00bf012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f721
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf047f06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf050f055
mov dword [rbp - 0x50], 0xf013f046
mov dword [rbp - 0x4c], 0xf05bf071
mov dword [rbp - 0x48], 0xf05ef051
mov dword [rbp - 0x44], 0xf05cf056
mov dword [rbp - 0x40], 0xf00df01a
mov dword [rbp - 0x3c], 0xf008f012
mov word [rbp - 0x38], r15w
mov byte [rbp - 0x36], 1
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x10
jb 0x14004f792
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x36], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov dword [rbp - 0x58], 0xf05df06d
mov rcx, r15
mov dword [rbp - 0x54], 0xf042f051
mov dword [rbp - 0x50], 0xf061f05a
mov dword [rbp - 0x4c], 0xf045f051
mov dword [rbp - 0x48], 0xf045f059
mov dword [rbp - 0x44], 0xf07af04c
mov dword [rbp - 0x40], 0xf052f056
mov dword [rbp - 0x3c], 0xf053f059
mov dword [rbp - 0x38], 0xf04a
mov byte [rbp - 0x34], 1
nop word [rax + rax]
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 - 0x58], ax
inc rcx
cmp rcx, 0x11
jb 0x14004f810
lea rdx, [rbp - 0x58]
mov byte [rbp - 0x34], r15b
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14004f8cc
mov ecx, 0x1f4
mov dword [0x140850e08], 0x7d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14004f888
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14004f883
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004f8c5
mov rcx, r8
call fcn.1400d6d80
mov r14, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov qword [rbx + 0x10], r15
mov byte [rbx], r15b
mov r15, qword [rsp + 0x60]
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
add rsp, 0x78
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004f180
int3