Function at 0x14006e460
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 0
lea rdx, [rsp + 0x20]
call fcn.14006d6c0
test al, al
je 0x14006e6cd
mov byte [rbp + 0x58], reloc.WLDAP32.dll_Ordinal_30
mov byte [rbp + 0x59], 0x40
mov byte [rbp + 0x5a], 0x5d
mov byte [rbp + 0x5b], 0x41
mov byte [rbp + 0x5c], 0x49
mov byte [rbp + 0x5d], gethostname
movzx eax, byte [rbp + 0x58]
xor r9d, r9d
movabs rsi, 0x76ff865cc5370036
mov r10, rsi
lea rax, [rbp + 0x58]
sub r10, rax
lea r12d, [r9 + 0xf]
lea rdx, [rbp + 0x58]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r12d
cmp rcx, r12
cmovae rcx, r12
shl cl, 2
mov rax, rsi
shr rax, cl
and al, r12b
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rbp + r9 + 0x58], al
inc r9
cmp r9, 6
jb 0x14006e4d0
mov rbx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
cmp rbx, rdi
je 0x14006e543
nop word [rax + rax]
mov r15, qword [rbx]
mov r8d, 8
lea rdx, [rbp + 0x58]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14006e546
add rbx, 8
cmp rbx, rdi
jne 0x14006e520
xor r15d, r15d
mov byte [rbp + 0x68], 0x5e
mov byte [rbp + 0x69], 4
mov byte [rbp + 0x6a], reloc.WS2_32.dll_recvfrom
mov byte [rbp + 0x6b], reloc.WLDAP32.dll_Ordinal_30
mov byte [rbp + 0x6c], 2
mov byte [rbp + 0x6d], Ordinal_30
mov byte [rbp + 0x6e], 0x7e
movzx eax, byte [rbp + 0x68]
xor r10d, r10d
movabs rbx, 0x18fd9fb21882c770
mov r11, rbx
lea rax, [rbp + 0x68]
sub r11, rax
nop dword [rax]
lea r8, [rbp + 0x68]
add r8, r10
movsx r9, byte [r8]
mov rcx, r10
and ecx, r12d
cmp rcx, r12
cmovae rcx, r12
shl cl, 2
mov rdx, rbx
shr rdx, cl
and dl, r12b
lea eax, [r8 + r11]
xor dl, al
xor dl, r9b
mov byte [rbp + r10 + 0x68], dl
inc r10
cmp r10, 7
jb 0x14006e580
mov rbx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
cmp rbx, rdi
je 0x14006e5f3
nop dword [rax + rax]
mov r14, qword [rbx]
mov r8d, 8
lea rdx, [rbp + 0x68]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14006e5f6
add rbx, 8
cmp rbx, rdi
jne 0x14006e5d0
xor r14d, r14d
mov byte [rbp + 0x60], reloc.WLDAP32.dll_Ordinal_30
mov byte [rbp + 0x61], 0x50
mov byte [rbp + 0x62], 0x59
mov byte [rbp + 0x63], Ordinal_79
mov byte [rbp + 0x64], 0x5c
mov byte [rbp + 0x65], gethostname
movzx eax, byte [rbp + 0x60]
xor r9d, r9d
mov r10, rsi
lea rax, [rbp + 0x60]
sub r10, rax
nop
lea rdx, [rbp + 0x60]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r12d
cmp rcx, r12
cmovae rcx, r12
shl cl, 2
mov rax, rsi
shr rax, cl
and al, r12b
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rbp + r9 + 0x60], al
inc r9
cmp r9, 6
jb 0x14006e620
mov rdi, qword [rbp - 0x40]
mov rbx, rdi
mov r12, qword [rbp - 0x38]
cmp rdi, r12
je 0x14006e693
nop word [rax + rax]
mov rsi, qword [rbx]
mov r8d, 8
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14006e695
add rbx, 8
cmp rbx, r12
jne 0x14006e670
xor esi, esi
test r15, r15
je 0x14006e6d1
cmp r15, r14
jae 0x14006e6d1
cmp r14, rsi
jae 0x14006e6d1
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov eax, dword [r14 + 0xc]
mov rcx, qword [rbp + 8]
div ecx
test edx, edx
jne 0x14006e6d1
xor edx, edx
mov eax, dword [rsi + 0xc]
div ecx
test edx, edx
jne 0x14006e6d1
mov bl, 1
jmp 0x14006e6d3
mov rdi, qword [rbp - 0x40]
xor bl, bl
test rdi, rdi
je 0x14006e713
mov rdx, qword [rbp - 0x30]
sub rdx, rdi
and rdx, 0xfffffffffffffff8
mov rax, rdi
cmp rdx, 0x1000
jb 0x14006e70b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006e70b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400d3fd0
movzx eax, bl
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret