Function at 0x14001a360
Capabilities:
Check if file exists
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401567f8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
mov qword [rbp - 0x50], rcx
xor r14d, r14d
call fcn.140006284
mov rcx, rax
test rax, rax
je 0x14001a787
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x18], rbx
lea ecx, [r14 + 1]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x1008
sub eax, edx
or eax, ecx
jge 0x14001a3d2
lea rcx, [rbp - 0x18]
call fcn.1400262ec
mov rbx, qword [rbp - 0x18]
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [rbx - 8], 1
jle 0x14001a3f9
mov edx, dword [rbx - 0x10]
lea rcx, [rbp - 0x18]
call fcn.1400251bc
mov rbx, qword [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
cmp dword [rbx - 8], 1
jle 0x14001a418
mov edx, dword [rbx - 0x10]
lea rcx, [rbp - 0x18]
call fcn.1400251bc
mov rbx, qword [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rdi, [rbx - 0x18]
test rbx, rbx
jne 0x14001a42f
mov eax, r14d
jmp 0x14001a443
movsxd rdx, dword [rdi + 0xc]
mov rcx, rbx
call fcn.1400be194
test eax, eax
js 0x14001a792
cmp eax, dword [rdi + 0xc]
jg 0x14001a792
mov dword [rdi + 8], eax
mov eax, eax
mov byte [rax + rbx], r14b
mov qword [rbp - 0x38], r14
mov dword [rbp - 0x30], 0x790a4135
mov word [rbp - 0x2c], 0x4170
mov r12d, 4
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
or r15, 0xffffffffffffffff
mov eax, dword [r12 + rbx]
cmp dword [0x1401607dc], eax
jle 0x14001a4d0
lea rcx, [0x1401607dc]
call fcn.1400b77a0
cmp dword [0x1401607dc], r15d
jne 0x14001a4d0
mov byte [0x14016068a], 1
mov eax, dword [rbp - 0x30]
mov dword [0x140160684], eax
movzx eax, word [rbp - 0x2c]
mov word [0x140160688], ax
lea rcx, [0x1400ff658]
call fcn.1400b7e90
lea rcx, [0x1401607dc]
call fcn.1400b7740
lea r8, [0x140160684]
cmp byte [0x14016068a], r14b
je 0x14001a50c
mov rdx, r14
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xad7941110d6b2541
shr rax, cl
xor byte [rdx + r8], al
inc rdx
cmp rdx, 6
jb 0x14001a4e3
mov byte [0x14016068a], r14b
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x38]
call fcn.14002202c
nop
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14001a54b
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
mov rdx, qword [rbp - 0x38]
mov r8, r15
inc r8
cmp byte [rdx + r8], r14b
jne 0x14001a53d
jmp 0x14001a659
mov dword [rbp - 0x28], 0xebc337e1
mov dword [rbp - 0x24], 0xbfdb1fad
mov dword [rbp - 0x20], 0xc5fe6dae
mov eax, dword [r12 + rbx]
cmp dword [0x140160b44], eax
jle 0x14001a5b6
lea rcx, [0x140160b44]
call fcn.1400b77a0
cmp dword [0x140160b44], r15d
jne 0x14001a5b6
mov byte [0x140160764], 1
movsd xmm0, qword [rbp - 0x28]
movsd qword [0x140160758], xmm0
mov eax, dword [rbp - 0x20]
mov dword [0x140160760], eax
lea rcx, [0x1400ff648]
call fcn.1400b7e90
lea rcx, [0x140160b44]
call fcn.1400b7740
lea r8, [0x140160758]
cmp byte [0x140160764], r14b
je 0x14001a5f2
mov rdx, r14
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xdbaf4383c59f19cf
shr rax, cl
xor byte [rdx + r8], al
inc rdx
cmp rdx, 0xc
jb 0x14001a5c9
mov byte [0x140160764], r14b
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x40]
call fcn.14002202c
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400223b0
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001a62d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14001a6a7
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
mov rdx, qword [rbp - 0x38]
mov r8, r15
inc r8
cmp byte [rdx + r8], r14b
jne 0x14001a650
mov rcx, rsi
call fcn.14002aaf4
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001a683
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
nop
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001a750
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + ioctlsocket]
jmp 0x14001a750
lea rcx, [rbp - 0x50]
call fcn.14001a7a0
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400223b0
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001a6de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
test eax, eax
je 0x14001a778
mov rdx, qword [rbp - 0x38]
mov r8, r15
inc r8
cmp byte [rdx + r8], r14b
jne 0x14001a701
mov rcx, rsi
call fcn.14002aaf4
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001a734
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
nop
mov ecx, r15d
lock xadd dword [rdi + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x14001a750
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rioctlsocket + 8]
mov rax, rsi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b7620
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor r8d, r8d
lea rdx, [0x14013b692]
jmp 0x14001a659
mov ecx, 0x80004005
call fcn.1400020e0
nop
mov ecx, 0x80070057
call fcn.1400020e0
int3