Function at 0x14001acd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x118]
sub rsp, 0x218
xor esi, esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
mov dword [rbp + 0x160], 0x60292e
mov byte [rbp + 0x164], 1
mov ecx, esi
nop dword [rax]
lea eax, [rcx + 0x4b]
xor byte [rbp + rcx + 0x160], al
inc rcx
cmp rcx, 3
jb 0x14001ad30
mov byte [rbp + 0x164], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
lea rax, [rbp + 0x160]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001ad70
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x68]
call fcn.14000cc40
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x1400b9c50]
movsxd rax, edx
lea r14, str.0123456789667ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
movzx ecx, byte [rax + r14]
mov qword [rsp + 0x30], 1
lea rax, [rsp + 0x20]
mov byte [rax], cl
mov byte [rax + 1], 0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x1400b9c50]
movsxd rax, edx
movzx r9d, byte [rax + r14]
mov rcx, qword [rsp + 0x30]
movzx ebx, byte [rbp + 0x160]
mov rdx, qword [rsp + 0x38]
cmp rcx, rdx
jae 0x14001ae09
lea rax, [rcx + 1]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14001ae1c
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.14000f730
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x1400b9c50]
movsxd rax, edx
movzx r9d, byte [rax + r14]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
cmp rcx, rdx
jae 0x14001ae63
lea rax, [rcx + 1]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14001ae76
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.14000f730
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x1400b9c50]
movsxd rax, edx
movzx r9d, byte [rax + r14]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
cmp rcx, rdx
jae 0x14001aebd
lea rax, [rcx + 1]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14001aed0
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.14000f730
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x1400b9c50]
movsxd rax, edx
movzx r9d, byte [rax + r14]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
cmp rcx, rdx
jae 0x14001af17
lea rax, [rcx + 1]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14001af2a
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.14000f730
mov dword [rbp + 0x160], 0x2b352965
mov word [rbp + 0x164], 0x100
mov rcx, rsi
lea eax, [rcx + 0x4b]
xor byte [rbp + rcx + 0x160], al
inc rcx
cmp rcx, 4
jb 0x14001af40
mov byte [rbp + 0x165], 0
movabs r8, 0x7fffffffffffffff
mov rax, r8
mov r12, qword [rbp - 0x58]
sub rax, r12
mov r13, qword [rsp + 0x30]
cmp rax, r13
jb 0x14001b30f
lea rdx, [rbp - 0x68]
mov r15, qword [rbp - 0x68]
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x178], rax
cmp rax, 0xf
cmova rdx, r15
mov qword [rbp + 0x168], rdx
lea rax, [rsp + 0x20]
mov r14, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov qword [rbp - 0x70], rcx
cmp rcx, 0xf
cmova rax, r14
mov qword [rbp + 0x170], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rax, [r12 + r13]
mov ebx, reloc.WS2_32.dll_ntohs
lea rsi, [rsp + 0x70]
cmp rax, rbx
jbe 0x14001b07a
mov rbx, rax
or rbx, 0xf
cmp rbx, r8
jbe 0x14001b02a
mov rbx, r8
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14008aeb8
test rax, rax
je 0x14001b052
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
lea rax, [r12 + r13]
mov rdx, qword [rbp + 0x168]
jmp 0x14001b075
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14001b059
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001b309
jmp 0x14001b004
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14001b073
call fcn.14008aeb8
mov rsi, rax
lea rax, [r12 + r13]
mov rdx, qword [rbp + 0x168]
jmp 0x14001b075
xor esi, esi
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rbx
mov r8, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r12 + rsi]
mov r8, r13
mov rdx, qword [rbp + 0x170]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r12 + r13]
mov byte [rsi + rax], 0
lea rax, [rbp + 0x160]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x14001b0b2
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x70]
call fcn.14001d670
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14001b13f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b13a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b13a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008aef4
movdqa xmm0, xmmword [0x140094c70]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov r8d, 0x104
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14001b20d
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x28]
call fcn.14000ce80
nop
lea rax, [rbp]
mov qword [rsp + 0x60], rax
lea rax, [rbp]
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14001b1b0
mov qword [rsp + 0x68], rdi
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.14000ce80
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 7
cmova rcx, qword [rbp - 0x48]
call fcn.14008c610
test eax, eax
jne 0x14001b2f2
lea rcx, [rbp - 0x48]
call fcn.14001d490
nop
lea rcx, [rbp - 0x28]
call fcn.14001d490
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14001b24d
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b248
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b248
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008aef4
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x14001b2a1
inc rdx
mov rax, r15
cmp rdx, 0x1000
jb 0x14001b298
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b298
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14008aef4
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14001b2de
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x14001b2d6
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b2d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14008aef4
add rsp, 0x218
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x48]
mov edx, eax
lea rcx, str.rename
call fcn.14001d110
nop
call fcn.14001d070
int3
call fcn.14001d540
int3