Function at 0x140041950
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2b8]
sub rsp, 0x378
movaps xmmword [rax - 0x58], xmm6
mov rbx, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rbp + 0x2d0], r15d
movsd xmm0, qword [str.SYWP_AAXWV_b_]
movsd qword [rbp - 0x68], xmm0
mov eax, dword [0x1401608d0]
mov dword [rbp - 0x60], eax
lea eax, [r15 + 4]
cmp byte [0x1401608d3], r15b
je 0x140041b00
mov r8d, r15d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140041ac6
movdqa xmm4, xmmword [0x1401621c0]
movd xmm6, eax
mov eax, Ordinal_32
movd xmm5, eax
movdqa xmm2, xmmword [0x140161fc0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140161ff0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401620b0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.00000000000000006666666666666666]
movd xmm0, dword [str.SYWP_AAXWV_b_]
pxor xmm2, xmm0
movd dword [rbp - 0x68], xmm2
movdqa xmm3, xmmword [0x140161fe0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140161ff0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401620b0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.00000000000000006666666666666666]
movd xmm0, dword [rbp - 0x64]
pxor xmm2, xmm0
movd dword [rbp - 0x64], xmm2
mov r8d, 8
mov eax, r8d
lea r9, [rbp - 0x68]
add r9, rax
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xc
jl 0x140041ad0
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
cmp byte [0x1411c2379], 0
jne 0x140041b42
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov r8d, 0x52
lea rdx, str.You_need_to_run_the_KeyAuthApp.init____function_before_any_other_KeyAuth_functions
lea rcx, [rbp - 0x10]
call fcn.14002b310
lea rcx, [rbp - 0x10]
call fcn.140043340
lea rcx, [rbp + 0x138]
call fcn.14005b290
nop
mov dword [rbp - 0x68], 0xf2ecf5bf
mov dword [rbp - 0x64], 0xc4f6ecf8
mov word [rbp - 0x60], 0x9c
mov byte [rbp - 0x5e], 1
mov dword [rbp - 0x70], 0xf1faf4bf
mov dword [rbp - 0x6c], 0x100a3f8
mov dword [rsp + 0x50], 0xeffee9bf
mov dword [rsp + 0x54], 0xcef0f7ee
mov dword [rsp + 0x58], 0x9ec6c8
mov byte [rsp + 0x5c], 1
mov dword [rbp + 0x2d8], 0xf5ecf2bf
mov dword [rbp + 0x2dc], 0x100a3f9
mov dword [rbp + 0x2d0], 0xe5fef1bf
mov word [rbp + 0x2d4], 0xa0
mov byte [rbp + 0x2d6], 1
mov dword [rsp + 0x70], 0xf9ebe3ed
mov dword [rsp + 0x74], 0xc3f6f2a0
mov dword [rsp + 0x78], 0xc1d0ccc4
mov word [rsp + 0x7c], 0x100
lea r8, [rbp + 0x2d0]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xb0]
call fcn.140042b40
nop
mov rdx, rbx
mov rcx, rax
call fcn.1400488d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp + 0x2d8]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x90]
call fcn.140040f10
nop
lea rdx, [rbp + 0x138]
mov rcx, rax
call fcn.1400488d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x108], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x70]
call fcn.140041840
nop
lea rdx, [rdi + 0x258]
mov rcx, rax
call fcn.1400488d0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x50]
call fcn.140040f10
nop
mov rdx, rdi
mov rcx, rax
call fcn.1400488d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r8, [rbp - 0x68]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140041130
nop
lea rdx, [rdi + 0x20]
mov rcx, rax
call fcn.1400488d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140041d6d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041d68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041d68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140041dbc
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041db6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041db6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x140041dfa
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041df5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041df5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x140041e4f
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041e49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041e49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140041e90
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041e8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041e8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x140041eeb
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041ee5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041ee5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x140041f2f
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041f2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041f2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140041f87
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041f81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041f81
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x140041fcb
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041fc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041fc6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
lea rax, [rbp + 0x30]
mov qword [rbp + 0xf0], rax
lea rdx, [rdi + 0x80]
lea rcx, [rbp + 0x30]
call fcn.140048a30
mov r14, rax
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
lea rdi, [rbp - 0x10]
mov r12, qword [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdi, r12
movabs rax, 0x7fffffffffffffff
mov rsi, qword [rbp]
cmp rsi, 0x10
jae 0x140042041
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x50], xmm0
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x1400420b0
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14004208e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140042b33
mov rcx, rax
call fcn.1400d4128
mov rcx, rax
test rax, rax
je 0x140042087
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14004209d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004209a
call fcn.1400d4128
jmp 0x14004209d
mov rax, r15
mov qword [rbp - 0x50], rax
lea r8, [rsi + 1]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rbx
mov r8, r14
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x10]
call fcn.140042cc0
nop
mov qword [rbp + 0x130], r15
lea r8, [rbp + 0xf8]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14004c5d0
nop
mov dword [rsp + 0x30], 0xefe8fff4
mov dword [rsp + 0x34], 0xfaf9fc
mov byte [rsp + 0x38], 1
mov rcx, r15
nop
lea eax, [rcx - 0x67]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 7
jb 0x140042100
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov r8d, 7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002b310
nop
mov rdi, qword [rbp + 0x2c0]
movzx eax, byte [rsp + 0x40]
test al, al
jne 0x1400421af
mov byte [rsp + 0x40], 1
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400d4128
mov rbx, rax
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov ecx, 0x50
call fcn.1400d4128
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x40]
call fcn.14004a780
movzx eax, byte [rsp + 0x40]
cmp al, 1
jne 0x1400421ce
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.14004d130
mov rdi, qword [rax]
add rdi, 0x40
mov qword [rbp - 0x50], r15
mov r13, r15
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], r13b
mov dword [rbp + 0x2d0], 0x17f
cmp byte [rdi], 3
jne 0x140042203
mov rdx, qword [rdi + 8]
lea rax, [rbp - 0x50]
cmp rax, rdx
je 0x140042221
jmp 0x140042206
mov rdx, r15
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140042214
mov rdx, qword [rdx]
lea rcx, [rbp - 0x50]
call fcn.14002b310
mov r13, qword [rbp - 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140042261
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004225c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004225c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
lea rcx, [rbp + 0x160]
call fcn.140046ae0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r15
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x68]
call fcn.14004f560
mov r14, qword [rbp - 0x68]
lea r15, [r14 + 0x20]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x10], xmm0
mov qword [rbp - 0x60], r15
mov rax, r15
sub rax, r14
lea r8, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae r8, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x2c0]
mov rdx, qword [rcx + 0x288]
add rcx, 0x278
cmp qword [rcx + 0x18], 0x10
jb 0x1400422e6
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9, qword [rbp + 0x20]
call fcn.14005a310
mov rsi, r14
cmp r14, r15
je 0x14004235e
movzx edi, byte [rsi]
lea rdx, [0x14003aff0]
lea rcx, [rbp + 0x170]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], Ordinal_50
mov edx, 2
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov r8, qword [rax]
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov rdx, qword [rax + 8]
call r8
mov edx, edi
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
inc rsi
cmp rsi, r15
jne 0x140042301
lea rdi, [0x1411c1060]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdi, qword [0x1411c1060]
xor r15d, r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r9
mov byte [rsp + 0x50], r15b
mov dword [rbp + 0x2d0], 0x4ff
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov rcx, qword [rbp + 0x1e8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x1400423e6
mov rax, qword [rbp + 0x1b8]
mov r8, qword [rax]
test r8, r8
je 0x1400423e6
mov rax, qword [rbp + 0x198]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x1e0]
cmovb r8, qword [rbp + 0x1e0]
sub r8, rdx
jmp 0x140042420
test cl, 4
jne 0x140042416
mov rax, qword [rbp + 0x1b0]
mov rcx, qword [rax]
test rcx, rcx
je 0x140042416
mov rax, qword [rbp + 0x190]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x1c8]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x140042420
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x140042434
lea rcx, [rsp + 0x50]
call fcn.14002b310
mov r9, qword [rsp + 0x68]
lea rdx, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
cmp r9, 0x10
cmovae rdx, r8
movsx ebx, byte [rdx + 7]
movsx eax, byte [rdi + 7]
xor ebx, eax
movsx ecx, byte [rdx + 6]
movsx eax, byte [rdi + 6]
xor ecx, eax
or ebx, ecx
movsx ecx, byte [rdx + 5]
movsx eax, byte [rdi + 5]
xor ecx, eax
or ebx, ecx
movsx ecx, byte [rdx + 4]
movsx eax, byte [rdi + 4]
xor ecx, eax
or ebx, ecx
movsx ecx, byte [rdx + 3]
movsx eax, byte [rdi + 3]
xor ecx, eax
or ebx, ecx
movsx ecx, byte [rdx + 2]
movsx eax, byte [rdi + 2]
xor ecx, eax
or ebx, ecx
movsx ecx, byte [rdx + 1]
movsx eax, byte [rdi + 1]
xor ecx, eax
or ebx, ecx
movsx ecx, byte [rdx]
movsx eax, byte [rdi]
xor ecx, eax
or ebx, ecx
cmp r9, 0x10
jb 0x1400424dc
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400424d4
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400424d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.1400d43b4
mov rsi, qword [rbp - 0x50]
test ebx, ebx
je 0x14004264a
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x6b
jb 0x140042b27
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, rsi
mov qword [rbp + 0x2d0], rdx
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
lea r15, [r13 + 0x6b]
mov edi, reloc.WS2_32.dll_ntohs
lea rbx, [rsp + 0x70]
cmp r15, rdi
jbe 0x1400425c1
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x140042575
mov rdi, rcx
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.1400d4128
test rax, rax
je 0x14004259d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rdx, qword [rbp + 0x2d0]
jmp 0x1400425bc
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400425a4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140042b2d
jmp 0x140042553
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400425ba
call fcn.1400d4128
mov rbx, rax
mov rdx, qword [rbp + 0x2d0]
jmp 0x1400425bc
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], rdi
movups xmm0, xmmword [str.Signature_checksum_failed._Request_was_tampered_with_or_session_ended_most_likely.__echo:__echo_Message:]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x14015e2e0]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [0x14015e2f0]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [0x14015e300]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [0x14015e310]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [0x14015e320]
movups xmmword [rbx + 0x50], xmm1
movsd xmm0, qword [0x14015e330]
movsd qword [rbx + 0x60], xmm0
movzx eax, word [0x14015e338]
mov word [rbx + 0x68], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rbx + 0x6a], al
lea rcx, [rbx + 0x6b]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r15], 0
lea rcx, [rsp + 0x70]
call fcn.140043340
xor r15d, r15d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.1400483e0
mov rdx, rax
mov rdi, qword [rbp + 0x2c0]
mov rcx, rdi
call fcn.14003dad0
mov dword [rsp + 0x30], 0xfff8efea
mov dword [rsp + 0x34], 0xecedf8
mov byte [rsp + 0x38], 1
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x67]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 7
jb 0x140042690
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov r8d, 7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002b310
nop
movzx eax, byte [rsp + 0x40]
test al, al
jne 0x140042738
mov byte [rsp + 0x40], 1
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400d4128
mov rbx, rax
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov ecx, 0x50
call fcn.1400d4128
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x40]
call fcn.14004a780
movzx eax, byte [rsp + 0x40]
cmp al, 1
jne 0x140042759
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.14004d130
mov rcx, qword [rax]
add rcx, 0x40
jmp 0x140042760
mov rcx, qword [rbp + 0x2c0]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, r15
movzx ebx, byte [rax]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400427ae
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400427a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400427a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
test bl, bl
je 0x1400428f6
mov dword [rbp + 0x2d0], 0xf3fdf4f0
mov word [rbp + 0x2d4], 0x100
mov rcx, r15
nop dword [rax]
lea eax, [rcx - 0x67]
xor byte [rbp + rcx + 0x2d0], al
inc rcx
cmp rcx, 4
jb 0x1400427d0
mov byte [rbp + 0x2d5], 0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x30], 0
mov r8d, 4
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp - 0x30]
call fcn.14002b310
nop
movzx eax, byte [rsp + 0x40]
test al, al
jne 0x14004287a
mov byte [rsp + 0x40], 1
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400d4128
mov rbx, rax
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov ecx, 0x50
call fcn.1400d4128
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x40]
call fcn.14004a780
movzx eax, byte [rsp + 0x40]
cmp al, 1
jne 0x14004289a
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.14004d130
mov rdx, qword [rax]
add rdx, 0x40
jmp 0x1400428a1
mov rdx, qword [rbp + 0x2c0]
lea rcx, [rsp + 0x50]
call fcn.1400483e0
mov rdx, rax
mov rcx, rdi
call fcn.14003c9d0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400428f6
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400428f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400428f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
nop
test r14, r14
je 0x140042933
mov rdx, qword [rbp - 0x58]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x14004292a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004292a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400d43b4
nop
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x160], rax
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x15c], edx
lea rcx, [rbp + 0x178]
call fcn.140046a20
lea rcx, [rbp + 0x180]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rax, qword [rbp - 0x38]
cmp rax, 0x10
jb 0x1400429cb
lea rdx, [rax + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400429c2
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400429c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400d43b4
nop
lea rcx, [rsp + 0x40]
call fcn.14004a780
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14004a230
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140042a23
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042a1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042a1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x10], 0
mov rax, qword [rbp + 8]
cmp rax, 0x10
jb 0x140042a73
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140042a6a
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042a6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1400d43b4
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, 0x10
jb 0x140042ab8
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042ab2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042ab2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d43b4
nop
mov rbx, qword [rbp + 0x2c8]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140042af5
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140042af0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140042b20
mov rcx, r8
call fcn.1400d43b4
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
movaps xmm6, xmmword [rsp + 0x360]
add rsp, 0x378
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140029530
nop
call fcn.140002f40
nop
call fcn.140002f40
int3