Function at 0x14007a350
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x1401503a8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x21], rcx
mov qword [rbp - 0x11], rcx
mov qword [rbp + 0x17], rdx
xor r12d, r12d
mov dword [rbp - 0x29], r12d
call fcn.14008dea0
mov qword [rbp - 0x19], rax
mov qword [rbx], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r12b
mov dword [rbp - 0x29], 1
mov byte [rsp + 0x20], 0x5a
mov al, 0x7f
mov cl, 0x68
mov dl, 0x6a
xor r8d, r8d
xor al, 0x5a
mov byte [rsp + 0x21], al
xor cl, 0x5a
mov byte [rsp + 0x22], cl
xor dl, 0x5a
mov byte [rsp + 0x23], dl
mov byte [rsp + 0x24], r8b
mov qword [rbp - 0x71], r12
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x59], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x71], r8b
lea rax, [rsp + 0x21]
mov r13, 0xffffffffffffffff
mov r8, r13
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14007a400
lea rdx, [rsp + 0x21]
lea rcx, [rbp - 0x71]
call fcn.140003dc0
nop
mov byte [rsp + 0x20], 0x78
mov al, 0x58
xor ecx, ecx
xor al, 0x78
mov byte [rsp + 0x21], al
mov byte [rsp + 0x22], cl
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], cl
lea rax, [rsp + 0x21]
mov r8, r13
inc r8
cmp byte [rax + r8], cl
jne 0x14007a447
lea rdx, [rsp + 0x21]
lea rcx, [rbp - 0x49]
call fcn.140003dc0
nop
mov rbx, r12
mov rdi, qword [rbp - 0x39]
mov rax, qword [rbp - 0x49]
lea r14, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae r14, rax
mov rcx, rsi
mov qword [rsp + 0x20], rcx
mov r8, qword [rsi + 0x18]
cmp r8, 0x10
jb 0x14007a491
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rcx
mov r15, qword [rsi + 0x10]
cmp rdi, r15
ja 0x14007a56e
mov rax, r15
sub rax, rdi
cmp rbx, rax
ja 0x14007a56a
test rdi, rdi
je 0x14007a4ff
lea r13, [rax + rcx]
add rcx, rbx
lea r8, [r13 + 1]
sub r8, rcx
movsx edx, byte [r14]
call sub.VCRUNTIME140.dll_memchr
test rax, rax
mov rbx, rax
je 0x14007a56a
mov r8, rdi
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14007a4f6
inc rbx
lea r8, [r13 + 1]
sub r8, rbx
mov rcx, rbx
jmp 0x14007a4c0
sub rbx, qword [rsp + 0x20]
mov r8, qword [rsi + 0x18]
cmp rbx, 0xffffffffffffffff
je 0x14007a56a
cmp r15, rbx
jb 0x14007a9ab
mov rax, r15
sub rax, rbx
mov rdx, rdi
cmp rax, rdi
cmovb rdx, rax
mov rax, rsi
cmp r8, 0x10
jb 0x14007a52a
mov rax, qword [rsi]
lea rcx, [rax + rbx]
sub r15, rdx
mov qword [rsi + 0x10], r15
sub r15, rbx
lea r8, [r15 + 1]
add rdx, rcx
call sub.VCRUNTIME140.dll_memmove
lea r8, [rbp - 0x71]
cmp qword [rbp - 0x59], 0x10
cmovae r8, qword [rbp - 0x71]
mov r9, qword [rbp - 0x61]
mov rdx, rbx
mov rcx, rsi
call fcn.1400820d0
add rbx, qword [rbp - 0x61]
jmp 0x14007a466
mov rax, qword [rbp - 0x49]
mov rcx, qword [rbp - 0x31]
cmp rcx, 0x10
jb 0x14007a5ab
lea rdx, [rcx + 1]
mov rcx, qword [rbp - 0x49]
cmp rdx, 0x1000
jb 0x14007a5a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007a5a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
nop
mov rdx, qword [rbp - 0x59]
cmp rdx, 0x10
jb 0x14007a5e9
inc rdx
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a5e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007a5e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
movdqa xmm0, xmmword [0x14012e230]
movdqu xmmword [rbp - 0x71], xmm0
movdqa xmm1, xmmword [str._bxyuy.]
movdqu xmmword [rbp - 0x61], xmm1
mov rcx, r12
nop word [rax + rax]
movzx eax, byte [rbp - 0x71]
xor byte [rbp + rcx - 0x70], al
movzx eax, byte [rbp - 0x71]
xor byte [rbp + rcx - 0x6f], al
add rcx, 2
cmp rcx, 0x1e
jb 0x14007a610
mov byte [rbp - 0x52], 0
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x70]
mov r13, 0xffffffffffffffff
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14007a650
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x49]
call fcn.140003dc0
lea rdx, [rbp - 0x49]
lea rcx, [rsp + 0x28]
call fcn.140005100
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.140004020
mov rdx, rax
movdqa xmm0, xmmword [str.pG__FA_]
movdqu xmmword [rbp - 0x71], xmm0
movdqa xmm1, xmmword [0x14012e390]
movdqu xmmword [rbp - 0x61], xmm1
mov word [rbp - 0x51], 0x48
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp - 0x71]
xor byte [rbp + r12 - 0x70], al
movzx eax, byte [rbp - 0x71]
xor byte [rbp + r12 - 0x6f], al
add r12, 2
cmp r12, 0x20
jb 0x14007a6b0
mov byte [rbp - 0x50], 0
lea rax, [rbp - 0x70]
inc r13
cmp byte [rax + r13], 0
jne 0x14007a6d4
mov rcx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14007a6eb
mov rcx, qword [rdx]
mov r8, qword [rdx + 0x10]
cmp r8, r13
jne 0x14007a705
lea rdx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14007a705
xor bl, bl
jmp 0x14007a707
mov bl, 1
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x14007a745
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a740
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007a740
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
test bl, bl
je 0x14007a752
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r14, qword [rbp - 0x19]
test r14, r14
je 0x14007a959
mov r8, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14007a76c
mov r8, qword [rsi]
mov edx, 0x2712
mov rcx, r14
call fcn.140090c50
lea r8, [0x14008b2e0]
mov edx, 0x4e2b
mov rcx, r14
call fcn.140090c50
mov rdi, qword [rbp - 0x21]
mov r8, rdi
mov edx, 0x2711
mov rcx, r14
call fcn.140090c50
mov rcx, r14
call fcn.14008df60
mov ebx, eax
mov rcx, r14
call fcn.14008de80
cmp ebx, 7
jne 0x14007a95d
movdqa xmm1, xmmword [0x14012e440]
movdqu xmmword [rsp + 0x28], xmm1
movdqa xmm2, xmmword [0x14012de10]
movdqu xmmword [rsp + 0x38], xmm2
movdqa xmm3, xmmword [0x14012df60]
movdqu xmmword [rsp + 0x48], xmm3
mov dl, 8
mov r8b, 0x46
mov r9b, 0xa
movzx r10d, bl
mov r11b, reloc.WS2_32.dll_select
mov bl, 3
mov dil, reloc.WS2_32.dll_sendto
mov sil, 0x48
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x29], al
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
xor byte [rsp + 0x30], cl
xor byte [rsp + 0x31], cl
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x38], al
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor byte [rsp + 0x40], cl
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x48], al
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor byte [rsp + 0x50], cl
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor dl, cl
mov byte [rsp + 0x58], dl
xor r8b, cl
mov byte [rbp - 0x80], r8b
xor r9b, cl
mov byte [rbp - 0x7f], r9b
xor r10b, cl
mov byte [rbp - 0x7e], r10b
xor r11b, cl
mov byte [rbp - 0x7d], r11b
xor bl, cl
mov byte [rbp - 0x7c], bl
xor dil, cl
mov byte [rbp - 0x7b], dil
xor sil, cl
mov byte [rbp - 0x7a], sil
mov byte [rbp - 0x79], 0
lea rdx, [0x140066140]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [rsp + 0x29]
call fcn.1400622c0
mov dword [rsp + 0x20], 0xa
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x17]
call fcn.1400621c0
mov rcx, rax
call fcn.14006a690
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdi, qword [rbp - 0x21]
movzx edx, byte [0x140151070]
mov r8d, edx
test dl, dl
mov eax, 1
cmove r8d, eax
mov byte [0x140151070], r8b
mov rcx, rsi
call fcn.140003c40
mov rax, rdi
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400e2050
mov rbx, qword [rsp + 0x150]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14006f4d0
int3