Function at 0x64a080
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x128
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x118], rbp
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x100], r12
xor ebp, ebp
test edx, edx
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x158]
mov qword [rsp + 0xe8], r15
movsxd r12, r9d
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x38], rcx
mov r15, r8
mov esi, 0xffffffff
mov rdi, rbp
mov r14, rbp
jle 0x64a3b6
test r9d, r9d
jle 0x64a3b6
mov qword [rsp + 0x120], rbx
movsxd rbx, dword [rsp + 0x150]
mov qword [rsp + 0xf8], r13
cmp ebx, r12d
jl 0x64a36c
cmp ebx, 0x2a
jl 0x64a36c
lea r13d, [rbx - 0x15]
lea r8d, [rsi + 0x7b]
lea rdx, [0x00768f28]
mov ecx, r13d
mov dword [rsp + 0x30], r13d
call fcn.005bde70
lea r8d, [rsi + 0x7c]
lea rdx, [0x00768f40]
mov ecx, ebx
mov rdi, rax
call fcn.005bde70
test rdi, rdi
mov r14, rax
je 0x64a415
test rax, rax
je 0x64a415
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
sub rbx, r12
mov r8, r12
lea rcx, [r14 + rbx]
mov rdx, r15
call sub.msvcrt.dll_memcpy
movzx r11d, byte [r14]
lea r12, [r14 + 0x15]
lea r15d, [r11 - 1]
not r11d
sar r11d, 0x1f
sar r15d, 0x1f
and r15d, r11d
call fcn.005b3d00
mov r9d, r13d
mov r13d, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x50]
mov r8, r12
mov edx, r13d
mov qword [rsp + 0x20], rax
call fcn.00649bc0
test eax, eax
jne 0x64a38c
lea rax, [rsp + 0x50]
lea r8, [r14 + 1]
mov rdx, rbp
sub r8, rax
nop
nop
lea rcx, [rsp + rdx + 0x50]
add rdx, 5
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
movzx eax, byte [r14 + rdx - 3]
xor byte [rcx + 1], al
movzx eax, byte [r14 + rdx - 2]
xor byte [rcx + 2], al
movzx eax, byte [r14 + rdx - 1]
xor byte [rcx + 3], al
movzx eax, byte [r14 + rdx]
xor byte [rcx + 4], al
cmp rdx, r13
jl 0x64a1f0
call fcn.005b3d00
movsxd rbx, dword [rsp + 0x30]
lea r8, [rsp + 0x50]
mov edx, ebx
mov r9d, r13d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.00649bc0
test eax, eax
jne 0x64a38c
test rbx, rbx
jle 0x64a270
mov rcx, rdi
sub r12, rdi
mov rdx, rbx
nop
movzx eax, byte [r12 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x64a260
call fcn.005b3d00
movsxd rdx, dword [rsp + 0x160]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x90]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.005d2f80
test eax, eax
je 0x64a38c
lea rdx, [rsp + 0x90]
mov r8, r13
mov rcx, rdi
call fcn.005cc5a0
mov r9d, ebp
mov r10, r13
lea ecx, [rax - 1]
not eax
sar ecx, 0x1f
sar eax, 0x1f
and ecx, eax
and r15d, ecx
cmp r13, rbx
jge 0x64a32f
nop
nop
nop
nop
movzx r8d, byte [r10 + rdi]
mov ecx, r9d
inc r10
mov eax, r8d
not ecx
xor eax, 1
lea edx, [rax - 1]
not eax
sar eax, 0x1f
sar edx, 0x1f
and edx, eax
and ecx, edx
or r9d, edx
mov eax, ecx
and ecx, r13d
inc r13d
not eax
and ebp, eax
lea eax, [r8 - 1]
not r8d
sar eax, 0x1f
sar r8d, 0x1f
or ebp, ecx
and eax, r8d
or eax, r9d
and r15d, eax
cmp r10, rbx
jl 0x64a2e0
test r15d, r9d
je 0x64a36c
mov esi, dword [rsp + 0x30]
lea eax, [rbp + 1]
sub esi, eax
cmp dword [rsp + 0x34], esi
jge 0x64a3fd
mov edx, 0x7a
lea r9, [0x00768f70]
mov dword [rsp + 0x20], Ordinal_200
lea ecx, [rdx - 0x76]
lea r8d, [rdx - 0xd]
call fcn.005ad900
mov esi, 0xffffffff
mov edx, 0x7a
lea r9, str..crypto_rsa_rsa_oaep.c
mov dword [rsp + 0x20], Ordinal_211
lea ecx, [rdx - 0x76]
lea r8d, [rdx - 1]
call fcn.005ad900
test rdi, rdi
mov r13, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x120]
je 0x64a3a9
mov rcx, rdi
call fcn.005be2c0
test r14, r14
je 0x64a3b6
mov rcx, r14
call fcn.005be2c0
mov r15, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xf0]
mov r12, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x108]
mov rbp, qword [rsp + 0x118]
mov eax, esi
mov rsi, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xd0]
call fcn.00693b90
add rsp, 0x128
ret
mov rcx, qword [rsp + 0x40]
movsxd rdx, eax
movsxd r8, esi
add rdx, rdi
call sub.msvcrt.dll_memcpy
jmp 0x64a38c
mov edx, 0x7a
lea r9, [0x00768f58]
mov dword [rsp + 0x20], 0x7e
lea ecx, [rdx - 0x76]
lea r8d, [rdx - 0x39]
call fcn.005ad900
jmp 0x64a38c