Function at 0x140561aa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
movaps xmmword [rsp + 0x2e0], xmm6
mov rax, qword [0x1406dc5c0]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r12, rdx
mov r14, rcx
xor esi, esi
mov dword [rsp + 0x40], esi
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0xc0]
call fcn.14063d484
mov qword [rsp + 0x48], rsi
movdqa xmm0, xmmword [0x1406c10d0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], sil
lea r8d, [rsi + 8]
lea rdx, str.UD2D.log
lea rcx, [rsp + 0x48]
call fcn.14054ed20
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xc0]
call fcn.1405595f0
nop
lea rcx, [rsp + 0x48]
call fcn.14054ecc0
mov qword [rbp - 0x68], rsi
movdqa xmm0, xmmword [0x1406c10d0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], sil
xor r8d, r8d
lea rdx, [0x140677ee0]
lea rcx, [rbp - 0x68]
call fcn.14054ed20
nop
lea ecx, [rsi + 3]
call fcn.1405e4540
call fcn.1405e42e0
mov r13, rax
test rax, rax
je 0x14056215b
call fcn.1405621e0
mov rdi, rax
lea rbx, [rsi - 1]
cmp byte [rax + 0x7a], sil
je 0x140561bec
lea r8, [rax + 1]
mov r9, rbx
sub r9, rax
movabs r10, 0x4509d34b5f0f115b
nop word [rax + rax]
lea ecx, [r8 + r9]
and cl, 7
shl cl, 3
mov rdx, r10
shr rdx, cl
xor byte [r8 - 1], dl
movzx ecx, r8b
sub cl, dil
and cl, 7
shl cl, 3
mov rdx, r10
shr rdx, cl
xor byte [r8], dl
add r8, 2
lea rax, [r9 + r8]
cmp rax, 0x7a
jb 0x140561bb0
mov byte [rdi + 0x7a], 0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp - 0x40]
call fcn.14063d484
lea rax, [0x140678b08]
mov qword [rbp - 0x40], rax
lea rax, [0x140678a48]
mov qword [rbp - 0x30], rax
lea rcx, [rbp + 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x40], 1
xor r8d, r8d
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x40], rax
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx - 0x44], edx
lea rcx, [rbp - 0x28]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp - 0x28], rax
mov qword [rbp + 0x40], rsi
mov dword [rbp + 0x48], esi
movdqa xmm0, xmmword [0x1406c13f0]
mov word [rbp - 0x78], 0x4fd3
mov rax, qword gs:[0x58]
mov r15, qword [rax]
mov ecx, 0x9c4
mov eax, dword [rcx + r15]
test al, 1
jne 0x140561cff
or eax, 1
mov dword [rcx + r15], eax
mov eax, 0x8f8
mov esi, eax
lea rcx, [rax + r15]
mov byte [rcx + 0x12], 1
lea rax, [rcx + 0x11]
lea rdx, [rbp - 0x77]
cmp rcx, rdx
ja 0x140561ce5
lea rdx, [rsp + 0x78]
cmp rax, rdx
jb 0x140561ce5
movups xmmword [rcx], xmm0
movzx eax, word [rbp - 0x78]
mov word [rcx + 0x10], ax
jmp 0x140561cf0
movups xmmword [rcx], xmm0
movzx eax, word [rbp - 0x78]
mov word [rcx + 0x10], ax
lea rcx, [0x1406434b0]
call fcn.14063c804
nop
jmp 0x140561d04
mov esi, 0x8f8
lea r8, [rsi + r15]
cmp byte [r8 + 0x12], 0
je 0x140561d41
xor edx, edx
movabs r9, 0x211b3d99558b4ff1
nop dword [rax + rax]
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r9
shr rax, cl
xor byte [rdx + r8], al
inc rdx
cmp rdx, 0x12
jb 0x140561d20
mov byte [r8 + 0x12], 0
mov rdx, r8
lea rcx, [rbp - 0x30]
call fcn.14055c050
mov rsi, rax
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.14055f830
nop
cmp qword [rax + 0x18], 0x10
jb 0x140561d68
mov rax, qword [rax]
mov rdx, rax
mov rcx, rsi
call fcn.14055c050
mov rcx, rax
lea rdx, [0x140678924]
call fcn.14055c050
nop
lea rcx, [rsp + 0x48]
call fcn.14054ecc0
nop
xor r12d, r12d
mov qword [rsp + 0x48], r12
movdqa xmm6, xmmword [0x1406c10d0]
movdqu xmmword [rsp + 0x58], xmm6
mov byte [rsp + 0x48], r12b
mov dword [rsp + 0x40], 5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
mov ecx, dword [rbp + 0x48]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140561deb
mov rax, qword [rbp + 0x18]
mov r8, qword [rax]
test r8, r8
je 0x140561deb
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x40]
cmovb r8, qword [rbp + 0x40]
sub r8, rdx
jmp 0x140561e1b
test cl, 4
jne 0x140561e12
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
test rcx, rcx
je 0x140561e12
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x28]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x140561e1b
mov r8, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x140561e30
lea rcx, [rsp + 0x48]
call fcn.14054ed20
movdqu xmm6, xmmword [rsp + 0x58]
lea rcx, [rbp - 0x68]
call fcn.14054ecc0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm6
movdqa xmm0, xmmword [0x1406c10d0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x48]
call fcn.14054ecc0
mov qword [rsp + 0x48], r12
movdqa xmm0, xmmword [0x1406c10d0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov r8, rbx
nop
inc r8
cmp byte [r14 + r8], 0
jne 0x140561e80
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.14054ed20
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.14055f830
cmp qword [rax + 0x18], 0x10
jb 0x140561eb1
mov rax, qword [rax]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recvfrom
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa
lea r9, str.file
mov r8d, 1
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.1405e53b0
lea rcx, [rsp + 0x78]
call fcn.14054ecc0
nop
lea rcx, [rsp + 0x48]
call fcn.14054ecc0
lea rax, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rax, qword [rbp - 0x68]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recvfrom
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
lea r9, str.payload_json
mov r8d, 1
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.1405e53b0
mov r8, rdi
mov edx, 0x2712
mov rcx, r13
call fcn.1405e9430
xor r8d, r8d
lea edx, [r8 + 0x40]
mov rcx, r13
call fcn.1405e9430
xor r8d, r8d
lea edx, [r8 + 0x51]
mov rcx, r13
call fcn.1405e9430
mov r8, qword [rsp + 0x68]
mov edx, 0x2728
mov rcx, r13
call fcn.1405e9430
mov rcx, r13
call fcn.1405e4350
mov esi, eax
test eax, eax
je 0x140562105
movdqa xmm0, xmmword [0x1406c1d00]
mov dword [rbp - 0x78], 0x838c2514
mov dword [rbp - 0x74], 0x5d804a17
mov dword [rbp - 0x70], 0x839f691c
mov ecx, 0x8b0
mov eax, dword [rcx + r15]
test al, 1
jne 0x14056201e
or eax, 1
mov dword [rcx + r15], eax
mov eax, 0x690
mov edi, eax
lea rcx, [rax + r15]
mov byte [rcx + 0x1d], 1
lea rax, [rcx + 0x1c]
lea rdx, [rbp - 0x6c]
cmp rcx, rdx
ja 0x140561ff8
lea rdx, [rsp + 0x78]
cmp rax, rdx
jb 0x140561ff8
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp - 0x78]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rbp - 0x70]
mov dword [rcx + 0x18], eax
mov byte [rcx + 0x1c], WSAStartup
jmp 0x14056200f
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp - 0x78]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rbp - 0x70]
mov dword [rcx + 0x18], eax
mov byte [rcx + 0x1c], WSAStartup
lea rcx, [0x140643480]
call fcn.14063c804
nop
jmp 0x140562023
mov edi, 0x690
lea r9, [rdi + r15]
cmp byte [r9 + 0x1d], 0
je 0x140562061
mov rdx, r12
movabs r8, 0x31e92b71a3a50d79
nop dword [rax + rax]
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [rdx + r9], al
inc rdx
cmp rdx, 0x1d
jb 0x140562040
mov byte [r9 + 0x1d], 0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], 0
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [r9 + r8], 0
jne 0x140562080
mov rdx, r9
lea rcx, [rsp + 0x78]
call fcn.14054ed20
nop
mov ecx, esi
call fcn.1405e5ce0
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1405620a0
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140557910
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0xc0]
call fcn.140559aa0
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, qword [0x140646490]
call fcn.14055cc70
lea rdx, [0x140566920]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x78]
call fcn.14054ecc0
mov rcx, qword [rsp + 0x68]
call fcn.1405e53e0
mov rcx, r13
call fcn.1405e42c0
nop
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x40], rax
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx - 0x44], edx
lea rcx, [rbp - 0x28]
call fcn.140566430
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
call fcn.1405e44e0
nop
lea rcx, [rbp - 0x68]
call fcn.14054ecc0
nop
lea rcx, [rbp + 0xc8]
call fcn.14055bb30
test rax, rax
jne 0x14056219e
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xc0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, [rbp + 0xc0]
call fcn.140559990
nop
mov al, 1
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14063c0a0
mov rbx, qword [rsp + 0x340]
movaps xmm6, xmmword [rsp + 0x2e0]
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret