Function at 0x140066470
Capabilities:
Check for debugger via api
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x14017b4c0]
xor rax, rsp
mov qword [rbp + 0xe8], rax
mov dword [rsp + 0x48], edx
mov qword [rbp - 0x30], rcx
xor esi, esi
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov ebx, esi
mov qword [rbp + 0xd8], rbx
mov r13d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xe0], r13
mov byte [rbp + 0xc8], bl
mov dword [rsp + 0x44], esi
movabs r14, 0x5851f42d4c957f2d
test edx, edx
je 0x140066ad0
movzx ebx, byte [rsp + 0x40]
movzx edi, byte [rsp + 0x40]
movabs r15, 0x7fffffffffffffff
mov r8, qword [0x140188988]
lea rcx, [r8 + 0x20]
mov rdx, qword [r8 + 0x10]
mov r10, qword [rcx + 0x10]
mov rax, r15
sub rax, rdx
cmp rax, r10
jb 0x140066c38
mov r9, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140066531
mov r9, qword [r8]
cmp qword [rcx + 0x18], 0xf
jbe 0x14006653b
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
movzx edx, bl
lea rcx, [rbp + 0x60]
call fcn.140012da0
nop
lea r9, [rbp + 0x60]
mov r12, qword [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r9, r12
mov rcx, rsi
mov rdx, rsi
mov r8, qword [rbp + 0x70]
test r8, r8
je 0x1400665a1
nop word [rax + rax]
movsx rax, byte [r9 + rdx]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r8
jb 0x140066580
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x1400665c4
imul r8, r14
inc r8
jmp 0x1400665c7
mov r8, rax
mov rax, qword [0x140188988]
sub r8, qword [rax + 0x40]
cmp byte [rax + 0x48], 0
sete al
lea rcx, [0x14015bac4]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], 5
mov byte [rbp + 0x90], al
movabs rax, 0x5000000000000000
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x91], r8
movabs rax, 0x4000000000000001
mov qword [rbp + 0x88], rax
mov qword [rbp - 0x20], 2
lea rax, [rbp + 0x80]
mov qword [rbp - 0x18], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.14000fd40
nop
mov r8, qword [0x140188988]
lea rcx, [r8 + 0x20]
mov rdx, qword [r8 + 0x10]
mov r10, qword [rcx + 0x10]
mov rax, r15
sub rax, rdx
cmp rax, r10
jb 0x140066c32
mov r9, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140066685
mov r9, qword [r8]
cmp qword [rcx + 0x18], 0xf
jbe 0x14006668f
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
movzx edx, dil
lea rcx, [rbp + 0xa0]
call fcn.140012da0
nop
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r9, qword [rbp - 0x50]
mov rax, rsi
mov rdx, rsi
mov r8, qword [rbp - 0x40]
test r8, r8
je 0x1400666f1
nop dword [rax]
movsx rcx, byte [r9 + rdx]
add rcx, rax
imul rax, rcx, 0x401
mov rcx, rax
shr rcx, 6
xor rax, rcx
inc rdx
cmp rdx, r8
jb 0x1400666d0
lea rcx, [rax + rax*8]
mov rax, rcx
shr rax, 0xb
xor rax, rcx
imul rcx, rax, 0x8001
test rcx, rcx
jne 0x140066714
imul r8, r14
inc r8
jmp 0x140066717
mov r8, rcx
lea r10, [rbp + 0xa0]
mov r14, qword [rbp + 0xa0]
mov r15, qword [rbp + 0xb8]
cmp r15, 0xf
cmova r10, r14
mov rcx, rsi
mov rdx, rsi
mov r9, qword [rbp + 0xb0]
test r9, r9
je 0x140066771
nop word [rax + rax]
movsx rax, byte [rdx + r10]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r9
jb 0x140066750
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x14006679e
movabs rax, 0x5851f42d4c957f2d
imul r9, rax
inc r9
jmp 0x1400667a1
mov r9, rax
imul r9, r8
mov rcx, qword [0x140188988]
mov r8, qword [rcx + 0x40]
inc r8
xor edx, edx
mov rax, r9
div r8
lea rcx, [0x1401513cc]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], 2
mov qword [rbp + 8], rax
movabs rax, 0x4000000000000000
mov qword [rbp], rax
mov qword [rbp + 0x10], 1
lea rax, [rbp]
mov qword [rbp + 0x18], rax
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.14000fd40
nop
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r9, qword [rbp - 0x70]
mov rcx, rsi
mov rdx, rsi
mov r8, qword [rbp - 0x60]
test r8, r8
je 0x140066861
nop word [rax + rax]
movsx rax, byte [rdx + r9]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r8
jb 0x140066840
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x14006688e
movabs rax, 0x5851f42d4c957f2d
imul r8, rax
inc r8
jmp 0x140066891
mov r8, rax
mov r9d, dword [rsp + 0x44]
mov rcx, qword [rbp - 0x30]
movzx ecx, byte [r9 + rcx]
mov edx, ecx
sub edx, r9d
mov rax, qword [0x1401888c8]
cmp qword [rax + 0x10], r8
cmove edx, ecx
lea rax, str.:02X
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 6
mov dword [rbp + 0x38], edx
movabs rax, 0x2000000000000000
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x40], 1
lea rax, [rbp + 0x30]
mov qword [rbp + 0x48], rax
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14000fd40
nop
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
lea rcx, [rbp + 0xc8]
call fcn.14000b4a0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14006696c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066967
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066c14
call fcn.1400ce56c
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], r13
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400669b4
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400669af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066c1a
call fcn.1400ce56c
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], r13
mov byte [rbp - 0x70], 0
cmp r15, 0xf
jbe 0x1400669f8
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400669ef
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066c20
mov rcx, r14
call fcn.1400ce56c
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140066a33
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140066a2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066c26
call fcn.1400ce56c
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], r13
mov byte [rbp - 0x50], 0
mov rax, qword [rbp + 0x78]
cmp rax, 0xf
jbe 0x140066a7b
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140066a73
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066c2c
mov rcx, r12
call fcn.1400ce56c
mov r15d, dword [rsp + 0x48]
lea eax, [r15 - 1]
mov r14d, dword [rsp + 0x44]
cmp r14d, eax
jae 0x140066aa7
mov r8d, 1
lea rdx, [0x14015a0a8]
lea rcx, [rbp + 0xc8]
call fcn.14000b4a0
inc r14d
mov dword [rsp + 0x44], r14d
cmp r14d, r15d
movabs r14, 0x5851f42d4c957f2d
jb 0x1400664f8
mov r13, qword [rbp + 0xe0]
mov rbx, qword [rbp + 0xd8]
mov dword [rbp + 0xc0], esi
test rbx, rbx
je 0x140066b43
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp eax, 1
jne 0x140066b35
cmp dword [rbp + 0xc0], eax
jne 0x140066b35
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov edx, reloc.WLDAP32.dll_Ordinal_50
mov ecx, 0x63
test eax, eax
cmovne edx, ecx
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova rcx, qword [rbp + 0xc8]
mov rax, qword [rbp + 0xd8]
mov byte [rax + rcx - 1], dl
mov rbx, qword [rbp + 0xd8]
mov r13, qword [rbp + 0xe0]
lea rdx, [rbp + 0xc8]
mov r8, qword [rbp + 0xc8]
cmp r13, 0xf
cmova rdx, r8
mov rcx, rsi
test rbx, rbx
je 0x140066b82
movsx rax, byte [rcx + rdx]
add rax, rsi
imul rsi, rax, 0x401
mov rax, rsi
shr rax, 6
xor rsi, rax
inc rcx
cmp rcx, rbx
jb 0x140066b61
lea rax, [rsi + rsi*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x140066ba5
imul rbx, r14
inc rbx
jmp 0x140066ba8
mov rbx, rax
cmp r13, 0xf
jbe 0x140066bdb
lea rdx, [r13 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140066bd3
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066c0e
mov rcx, r8
call fcn.1400ce56c
mov rax, rbx
mov rcx, qword [rbp + 0xe8]
xor rcx, rsp
call fcn.1400ce1f0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.140002530
nop
call fcn.140002530
int3