Function at 0x140009100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x1400d3010]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov r12, rdx
mov rdi, rcx
mov qword [rbp - 0x68], rcx
lea rax, [rbp + 0x380]
mov qword [rbp + 0x330], rax
lea rdx, [0x1400d3070]
lea rcx, [rbp + 0x380]
call fcn.14000b650
mov rsi, rax
xor r13d, r13d
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], select
mov byte [rbp - 0x60], r13b
lea r8d, [r13 + 7]
lea rdx, str.version
lea rcx, [rbp - 0x60]
call fcn.140002960
nop
cmp dword [rdi + 8], 1
je 0x1400091d3
mov rcx, rdi
call fcn.140003da0
lea ecx, [r13 + 0x10]
call fcn.140055130
mov rbx, rax
mov qword [rsp + 0x30], rax
mov qword [rax], r13
mov qword [rax + 8], r13
lea ecx, [r13 + 0x50]
call fcn.140055130
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi], rbx
mov dword [rdi + 8], 1
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi]
call fcn.14000cb70
mov rcx, qword [rax]
add rcx, 0x40
mov rdx, rsi
call fcn.14000c660
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140009232
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000922d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000922d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400553bc
lea rax, [rbp + 0x380]
mov qword [rsp + 0x30], rax
lea rdx, [0x1400d3090]
lea rcx, [rbp + 0x380]
call fcn.14000b650
mov rsi, rax
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], select
mov byte [rbp - 0x60], 0
mov r8d, recv
lea rdx, str.accessToken
lea rcx, [rbp - 0x60]
call fcn.140002960
nop
cmp dword [rdi + 8], 1
je 0x1400092cc
mov rcx, rdi
call fcn.140003da0
mov ecx, reloc.WS2_32.dll_recv
call fcn.140055130
mov rbx, rax
mov qword [rbp + 0x330], rax
mov qword [rax], r13
mov qword [rax + 8], r13
mov ecx, 0x50
call fcn.140055130
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi], rbx
mov dword [rdi + 8], 1
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x330]
mov rcx, qword [rdi]
call fcn.14000cb70
mov rcx, qword [rax]
add rcx, 0x40
mov rdx, rsi
call fcn.14000c660
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14000932d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009328
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009328
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400553bc
lea rax, [rbp + 0x380]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x380]
call fcn.14002c7e0
mov rsi, rax
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], select
mov byte [rbp - 0x60], 0
mov r8d, 4
lea rdx, str.hwid
lea rcx, [rbp - 0x60]
call fcn.140002960
nop
cmp dword [rdi + 8], 1
je 0x1400093c0
mov rcx, rdi
call fcn.140003da0
mov ecx, reloc.WS2_32.dll_recv
call fcn.140055130
mov rbx, rax
mov qword [rbp + 0x330], rax
mov qword [rax], r13
mov qword [rax + 8], r13
mov ecx, 0x50
call fcn.140055130
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi], rbx
mov dword [rdi + 8], 1
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x330]
mov rcx, qword [rdi]
call fcn.14000cb70
mov rcx, qword [rax]
add rcx, 0x40
mov rdx, rsi
call fcn.14000c660
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140009421
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000941c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000941c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400553bc
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], select
mov byte [rbp - 0x60], 0
mov r8d, 2
lea rdx, [0x1400aff44]
lea rcx, [rbp - 0x60]
call fcn.140002960
lea r9, [rbp - 0x60]
mov r8d, 1
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.140004490
nop
mov dword [rsp + 0x30], 0xe26e65be
mov dword [rsp + 0x34], 0x17a08c0f
mov dword [rsp + 0x38], 0x299d9233
mov dword [rsp + 0x3c], 0x614c821b
mov dword [rsp + 0x40], 0x67068c
mov dword [rsp + 0x44], 0x191f3112
mov dword [rsp + 0x48], 0xe3fddcbd
mov dword [rsp + 0x4c], 0x864fcb4e
mov rbx, r13
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov byte [rbp + rbx + 0x380], al
inc rbx
cmp rbx, 0x20
jl 0x1400094a1
and byte [rbp + 0x39f], 0x7f
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x160]
call fcn.1400120b0
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x358]
call fcn.14000e720
lea r8, [rbp + 0x358]
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x20]
call fcn.14000e9b0
lea r8, [rbp + 0x358]
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x330]
call fcn.14000e9b0
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x3a0]
call fcn.140010040
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x330]
call fcn.140010040
movzx eax, byte [rbp + 0x330]
and eax, 1
shl eax, 7
xor byte [rbp + 0x3bf], al
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x290]
call fcn.140010ed0
lea r8, [rbp + 0x290]
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x20]
call fcn.140010830
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x358]
call fcn.14000e720
lea r8, [rbp + 0x358]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x330]
call fcn.14000e9b0
lea r8, [rbp + 0x358]
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14000e9b0
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x380]
call fcn.140010040
lea rdx, [rbp + 0x330]
lea rcx, [rsp + 0x30]
call fcn.140010040
movzx eax, byte [rsp + 0x30]
and eax, 1
shl eax, 7
xor byte [rbp + 0x39f], al
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0xa0]
call fcn.140001470
mov rcx, qword [rbp - 0x30]
xorps xmm0, xmm0
test rcx, rcx
js 0x140009606
cvtsi2ss xmm0, rcx
jmp 0x14000961b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mulss xmm0, dword [0x1400cab48]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
cvttss2si r14d, xmm0
shl r14d, 4
movsxd rsi, r14d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rdx, qword [rbp - 0x40]
mov r8, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsp + 0x30], 0x3020100
mov dword [rsp + 0x34], 0x7060504
mov dword [rsp + 0x38], 0xb0a0908
mov dword [rsp + 0x3c], 0xf0e0d0c
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0xa0]
call fcn.140001470
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rbp + 0x150], xmm0
mov rbx, r15
lea r8, [rbp + 0x150]
test r14d, r14d
je 0x1400096fd
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
nop word [rax + rax]
mov rcx, rbx
sub r8, rbx
mov edx, reloc.WS2_32.dll_recv
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400096d0
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call fcn.140001bc0
mov r8, rbx
add rbx, 0x10
sub rsi, 1
jne 0x1400096c0
mov qword [rbp + 0x340], r13
mov qword [rbp + 0x348], select
mov byte [rbp + 0x330], 0
mov r8d, 0x19
lea rdx, str.http:__api.haze.yt:8080_i
lea rcx, [rbp + 0x330]
call fcn.140002960
nop
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x200]
call fcn.140005700
nop
mov rdx, qword [rbp + 0x348]
cmp rdx, 0x10
jb 0x140009788
inc rdx
mov rcx, qword [rbp + 0x330]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009783
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009783
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400553bc
mov qword [rbp + 0x340], r13
mov qword [rbp + 0x348], select
mov byte [rbp + 0x330], 0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], select
mov byte [rbp - 0x60], 0
mov r8d, 9
lea rdx, str.publicKey
lea rcx, [rbp - 0x60]
call fcn.140002960
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.140003900
mov dword [rbp - 0x18], 3
mov r8d, 0x20
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x380]
call fcn.140002160
mov rbx, rax
mov qword [rsp + 0x30], rax
mov rdx, rax
lea rcx, [rbp + 0x3a0]
call fcn.14000b650
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140003900
mov dword [rbp - 8], 3
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140009858
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140009853
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140009a68
mov rcx, r8
call fcn.1400553bc
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], select
mov byte [rbx], 0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], select
mov byte [rbp - 0x60], 0
mov r8d, 7
lea rdx, str.payload
lea rcx, [rbp - 0x60]
call fcn.140002960
lea rdx, [rbp - 0x60]
lea rcx, [rbp]
call fcn.140003900
mov dword [rbp + 8], 3
mov r8d, r14d
mov rdx, r15
lea rcx, [rbp + 0x358]
call fcn.140002160
mov rbx, rax
mov qword [rsp + 0x30], rax
mov rdx, rax
lea rcx, [rbp + 0x3a0]
call fcn.14000b650
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140003900
mov dword [rbp + 0x18], 3
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140009917
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140009912
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140009a6f
mov rcx, r8
call fcn.1400553bc
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], select
mov byte [rbx], 0
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400039b0
nop
lea r9, [fcn.140003da0]
mov edx, reloc.WS2_32.dll_recv
lea r8d, [rdx - 0xc]
lea rcx, [rbp - 0x20]
call fcn.1400553f0
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x330], xmm0
mov qword [rbp + 0x340], r13
mov qword [rbp + 0x3b0], r13
mov qword [rbp + 0x3b8], select
mov byte [rbp + 0x3a0], 0
mov r8d, 2
lea rdx, [0x1400aff44]
lea rcx, [rbp + 0x3a0]
call fcn.140002960
lea r9, [rbp + 0x3a0]
mov r8d, 1
lea rdx, [rbp + 0x380]
lea rcx, [rsp + 0x50]
call fcn.140004490
mov rbx, rax
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], select
mov byte [rbp - 0x60], 0
mov r8d, 4
lea rdx, str.POST
lea rcx, [rbp - 0x60]
call fcn.140002960
nop
mov qword [rsp + 0x28], 0x2710
lea rax, [rbp + 0x330]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x200]
call fcn.140005d20
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140009a7b
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009a76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400553bc
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], select
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp + 0x398]
cmp rdx, 0x10
jb 0x140009acf
inc rdx
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009aca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009aca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400553bc
mov qword [rbp + 0x390], r13
mov qword [rbp + 0x398], select
mov byte [rbp + 0x380], 0
mov rcx, qword [rbp + 0x330]
test rcx, rcx
je 0x140009b54
mov rdx, qword [rbp + 0x338]
call fcn.14000d210
mov rdx, qword [rbp + 0x340]
mov rcx, qword [rbp + 0x330]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009b3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400553bc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x330], xmm0
mov qword [rbp + 0x340], r13
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov rsi, r13
mov r15, qword [rbp - 0x80]
mov r14, qword [rbp - 0x78]
cmp r15, r14
je 0x140009bd3
mov rsi, r14
sub rsi, r15
cmp rsi, 0x1000
jb 0x140009ba5
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x140009d29
call fcn.140055130
test rax, rax
je 0x140009c27
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140009bba
test rsi, rsi
je 0x140009bb7
mov rcx, rsi
call fcn.140055130
mov rbx, rax
jmp 0x140009bba
mov rbx, r13
add rsi, rbx
sub r14, r15
mov r8, r14
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
add r14, rbx
jmp 0x140009bdd
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
sub r14, rbx
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
mov r8, r14
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [r12], r14
test rbx, rbx
je 0x140009c3a
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140009c2e
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, rbx
call fcn.1400553bc
nop
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140009c83
mov rdx, qword [rbp - 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c72
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400553bc
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
lea rcx, [rsp + 0x68]
call fcn.14000b2d0
nop
lea rcx, [rsp + 0x50]
call fcn.140003da0
nop
lea rcx, [rbp + 0x200]
call fcn.140008fa0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140009ce4
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009cdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009cdf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400553bc
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], select
mov byte [rbp - 0x40], 0
mov rcx, rdi
call fcn.140003da0
mov rax, r15
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.140054e70
mov rbx, qword [rsp + 0x520]
add rsp, 0x4d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400020a0
nop
int3