Function at 0x140008520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400d1080]
xor rax, rsp
mov qword [rbp + 8], rax
mov r15, r8
mov r12, rdx
mov r13, rcx
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], r8
xor ebx, ebx
call fcn.140059870
mov r14, rax
test rax, rax
jne 0x14000864b
mov dword [rsp + 0x30], 0x97968c96
mov word [rsp + 0x34], 0x100
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x140008590
mov byte [rsp + 0x35], 0
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.14000f230
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x1400085f0
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x1400085eb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008644
mov rcx, r8
call fcn.1400a84a0
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r12], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140008b99
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140008b94
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140008b91
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
movups xmmword [rbp - 0x18], xmm0
movdqa xmm1, xmmword [0x1400c3450]
movdqu xmmword [rbp - 8], xmm1
mov byte [rbp - 0x18], 0
mov r8, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x140008684
mov r8, qword [r15]
mov edx, 0x2712
mov rcx, r14
call fcn.14005d390
mov edx, 0x51
lea r8d, [rdx - 0x50]
mov rcx, r14
call fcn.14005d390
mov dword [rsp + 0x20], 0x9a839c93
mov dword [rsp + 0x24], 0xd1968989
mov dword [rsp + 0x28], 0x6c6877
mov byte [rsp + 0x2c], 1
lea r8, [rsp + 0x20]
mov edx, 0x27c1
mov rcx, r14
call fcn.14005d390
mov edx, 0x40
lea r8d, [rdx - 0x3f]
mov rcx, r14
call fcn.14005d390
mov edx, 0xac
mov r8d, 1
mov rcx, r14
call fcn.14005d390
mov r8, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x140008704
mov r8, qword [r12]
mov edx, 0x271f
mov rcx, r14
call fcn.14005d390
lea r8, [0x140006fb0]
mov edx, 0x4e2b
mov rcx, r14
call fcn.14005d390
lea r8, [rbp - 0x38]
mov edx, 0x2711
mov rcx, r14
call fcn.14005d390
lea r8, [0x140007030]
mov edx, 0x4e6f
mov rcx, r14
call fcn.14005d390
lea r8, [rbp - 0x18]
mov edx, 0x272d
mov rcx, r14
call fcn.14005d390
mov rcx, r14
call fcn.140059930
test eax, eax
je 0x1400087b1
mov ecx, eax
call fcn.14005a4e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140008790
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000fd50
lea rcx, [rsp + 0x38]
call fcn.140008bf0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov rdi, qword [rbp - 0x28]
lea rsi, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rsi, qword [rbp - 0x38]
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x140008be1
cmp rdi, 0xf
ja 0x140008813
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x38], xmm0
jmp 0x1400088aa
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x14000884b
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400a8224
mov rcx, rax
test rax, rax
je 0x140008876
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000888b
mov rbx, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000887d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140008be7
jmp 0x14000882d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140008889
call fcn.1400a8224
jmp 0x14000888b
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rax, [rbp - 0x70]
mov qword [rbp - 0x78], rax
mov rdx, r15
lea rcx, [rbp - 0x70]
call fcn.14000d7b0
mov rbx, rax
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.14000d7b0
nop
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rax
call fcn.140009710
lea r8, [rbp - 0x50]
mov edx, 0x400022
mov rcx, r14
call fcn.140059840
test eax, eax
jne 0x140008a53
xor dil, dil
xor esi, esi
mov rcx, qword [rbp - 0x50]
cmp dword [rcx], esi
jle 0x1400089ef
xor r14d, r14d
nop dword [rax]
mov rax, qword [rcx + 8]
mov rbx, qword [r14 + rax]
test rbx, rbx
je 0x1400089dc
movdqa xmm0, xmmword [0x1400c3690]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x6e69607e
mov word [rsp + 0x4c], 0x7f
mov byte [rsp + 0x4e], 1
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x15
jb 0x140008950
mov byte [rsp + 0x4e], 0
lea rdx, [rsp + 0x38]
mov rcx, qword [rbx]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400089c8
mov dword [rsp + 0x20], 0xdc8e9cb4
mov dword [rsp + 0x24], 0x91bbdd8f
mov dword [rsp + 0x28], 0x737b7363
mov word [rsp + 0x2c], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x2e], 1
nop dword [rax]
lea ecx, [rax - 8]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0xd
jb 0x1400089a0
mov byte [rsp + 0x2e], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400089cb
mov dil, 1
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140008921
mov rcx, qword [rbp - 0x50]
inc esi
add r14, 8
cmp esi, dword [rcx]
jl 0x140008910
test dil, dil
jne 0x140008a53
movdqa xmm0, xmmword [0x1400c3550]
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x1400c36c0]
movdqu xmmword [rsp + 0x68], xmm1
mov dword [rsp + 0x78], 0x7f7f707e
mov word [rsp + 0x7c], 0x100
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 8]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 0x24
jb 0x140008a20
mov byte [rsp + 0x7d], 0
lea r8, [rsp + 0x7c]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.14000f230
lea rcx, [rsp + 0x38]
call fcn.140008bf0
xor ebx, ebx
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [r13], xmm0
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [r13 + 0x10], xmm1
mov qword [rbp - 0x28], rbx
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], rdx
mov byte [rbp - 0x38], bl
mov rax, qword [rbp]
cmp rax, rdx
jbe 0x140008ab9
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ab0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ab0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a84a0
mov rdx, qword [rbp - 0x20]
movdqa xmm0, xmmword [0x1400c3450]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], 0
cmp rdx, 0xf
jbe 0x140008b04
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008aff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008aff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a84a0
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140008b50
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x140008b4b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008bd3
mov rcx, r8
call fcn.1400a84a0
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r12], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140008b99
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140008b94
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008bda
mov rcx, r8
call fcn.1400a84a0
mov rax, r13
mov byte [r15], 0
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov qword [r15 + 0x10], rbx
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1400a8120
mov rbx, qword [rsp + 0x168]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001a30
int3
call fcn.140001990
int3