Function at 0x4048ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x24], ebx
cmp dword [ebx + 8], edx
jne 0x404b12
mov ax, word [ebx + 0xc]
cmp ax, word [ebp + 8]
jne 0x404b12
mov cl, byte [ebx]
mov esi, dword [ebp + 0xc]
cmp cl, 0x14
jne 0x4048b2
mov eax, dword [esi + 4]
cmp eax, dword [ebx + 0x1c]
jne 0x4048a5
mov ax, word [esi + 2]
cmp ax, word [ebx + 0x20]
je 0x4048b2
inc dword [ebx + 0x104]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc dword [ebx + 0xcc]
movzx eax, byte [esi]
add eax, 0xffffffef
cmp eax, 7
ja case.0x4048c7.19
jmp dword [eax*4 + 0x404b1c]
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov edi, dword [ebp + 0x10]
lea ecx, [esi + 8]
add esp, 4
mov dword [ebx + 0x3c], eax
add edi, 0xfffffff8
mov dword [esp + 0x10], ecx
cmp byte [esi], 0x18
jne 0x40492e
mov eax, edi
lea esi, [ebx + 0x44]
cdq
and edx, 7
add edx, eax
sar edx, 3
test edx, edx
jle 0x404912
mov eax, dword [esi]
dec edx
xor dword [ecx], eax
mov eax, dword [esi + 4]
xor dword [ecx + 4], eax
add ecx, 8
test edx, edx
jg 0x404900
mov edx, edi
and edx, 7
jbe 0x40492e
sub esi, ecx
nop dword [eax + eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x404920
push edi
push dword [0x50b698]
call dword [0x50b69c]
mov esi, eax
test esi, esi
je 0x404b12
test edi, edi
je 0x40497b
mov eax, dword [esp + 0x10]
push edi
test eax, eax
je 0x40495e
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x40497b
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x16
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
push esi
push dword [0x50b698]
call dword [0x50b8fc]
inc dword [ebx + 0xd8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp + 0x10]
mov edx, esi
mov ecx, ebx
call fcn.00404270
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp cl, 4
jne 0x4049dd
mov ecx, esi
call fcn.004038e0
test eax, eax
je 0x4049dd
push str.sdwan_peer_AUTH_REJECTED
call fcn.00402ef0
add esp, 4
mov ecx, ebx
call fcn.00403680
inc dword [ebx + 0xec]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc dword [ebx + 0x10c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [ebx + 0x3c], eax
cmp byte [ebx], 5
jne 0x4049dd
mov ecx, esi
call fcn.004038e0
test eax, eax
je 0x4049dd
rdtsc
mov edi, eax
mov ecx, edx
mov ebx, 0x1a9fbe77
mov dword [esp + 0x20], edi
mul ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov esi, edx
mov eax, edi
mov edx, 0x624dd2f
mul edx
mov edi, eax
mov dword [esp + 0x14], edx
mov eax, ecx
mul ebx
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 0x10]
mov edx, 0x624dd2f
mul edx
add ecx, esi
mov dword [esp + 0x18], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [esp + 0x14]
adc ecx, 0
xor eax, eax
add ebx, ecx
mov ecx, dword [esp + 0x18]
adc eax, eax
add ecx, ebx
mov ebx, dword [esp + 0x20]
adc edx, eax
mov eax, dword [esp + 0x10]
sub ebx, ecx
sbb eax, edx
shrd ebx, eax, 1
shr eax, 1
add ebx, ecx
mov ecx, dword [esp + 0x24]
adc eax, edx
mov edx, dword [ebp + 0xc]
shrd ebx, eax, 9
sub ebx, dword [edx + 0x18]
mov dword [ecx + 0x28], ebx
cmp ebx, dword [ecx + 0x2c]
jbe 0x404a94
mov dword [ecx + 0x2c], ebx
cmp ebx, dword [ecx + 0x30]
jae 0x404a9c
mov dword [ecx + 0x30], ebx
mov eax, dword [ebp + 0x10]
inc dword [ecx + 0xf4]
add eax, 0xffffffd0
cmp eax, 0xc
jb 0x404b12
add edx, 0x30
cmp byte [edx], 0x53
jne 0x404b12
cmp byte [edx + 1], 0x44
jne 0x404b12
cmp byte [edx + 2], 0x52
jne 0x404b12
cmp byte [edx + 3], 0x54
jne 0x404b12
push eax
call fcn.00404640
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp cl, 5
jne 0x4049dd
mov ecx, esi
call fcn.004038e0
test eax, eax
je 0x4049dd
push str.peer_recv_CLOSE
call fcn.00402ef0
add esp, 4
mov byte [ebx], 6
inc dword [ebx + 0xf8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc dword [ebx + 0x11c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret