Function at 0x140022680
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2e8
call fcn.1400035e0
sub rsp, rax
mov rax, qword [0x1401ad1c0]
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x308], rbx
mov qword [rsp + 0x2d8], rsi
mov qword [rsp + 0x2d0], rdi
mov qword [rsp + 0x2c8], r12
mov ebx, r8d
mov qword [rsp + 0x2c0], r13
add ebx, 0xfffffff0
mov qword [rsp + 0x2b0], r15
mov r15, rcx
lea rcx, [rsp + 0x40]
mov edi, ebx
mov esi, ebx
mov r12, rdx
mov dword [rsp + 0x30], ebx
and edi, 0xf
shr esi, 4
call fcn.14003cf40
lea r13, [r12 + 0x10]
lea rcx, [rsp + 0x40]
mov r8d, ebx
mov rdx, r13
call fcn.14003f460
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x240]
call fcn.14003f5f0
lea rcx, [rsp + 0x230]
mov r8d, reloc.WSOCK32.dll_recv
mov rdx, r12
call fcn.140029a50
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x288]
mov r8d, reloc.WSOCK32.dll_recv
call fcn.140029a50
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x258]
mov r8d, reloc.WSOCK32.dll_recv
call fcn.140029a50
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x268]
mov r8d, reloc.WSOCK32.dll_recv
call fcn.140029a50
lea r11, [rsp + 0x258]
lea rax, [rsp + 0x258]
shr rax, 0x20
mov rdx, r15
mov ecx, 1
mov word [r15 + 0x18], 0x140
mov dword [r15 + 0x12], r11d
mov word [r15 + 0x16], 4
mov qword [rsp + 0x38], rax
mov dword [r15 + 0x5c], eax
mov byte [r15 + 0x55], 1
mov word [r15 + 0x3e], 0
call fcn.140028870
lea rcx, str.______classic_aes_encrypt_hw:_LowAPI_status__u_n
movzx ebx, ax
mov byte [r15 + 0x55], 0
mov word [r15 + 0x16], 0
mov edx, ebx
call fcn.140028f30
movzx ecx, bx
call fcn.1400290c0
test eax, eax
jne 0x140022d11
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x298]
call fcn.140029a50
lea r9, [rsp + 0x258]
lea rcx, [rsp + 0xc0]
mov r8d, 0x80
mov dl, 1
call fcn.14003bff0
test eax, eax
jns 0x140022845
lea rcx, [0x1401c0948]
mov edx, eax
call fcn.140028f30
mov eax, 0x2bb
jmp 0x140022d11
lea rcx, [rsp + 0xa0]
xor r8d, r8d
mov dl, 2
call fcn.14003c140
test eax, eax
jns 0x140022873
lea rcx, [0x1401c0980]
mov edx, eax
call fcn.140028f30
mov eax, 0x2bb
jmp 0x140022d11
cmp esi, 1
jbe 0x140022898
lea eax, [rsi - 2]
lea rcx, [rsp + 0x220]
mov r8d, reloc.WSOCK32.dll_recv
shl eax, 4
lea rdx, [rax + r12 + 0x10]
call fcn.140029a50
jmp 0x1400228ab
xor edx, edx
lea rcx, [rsp + 0x220]
lea r8d, [rdx + 0x10]
call fcn.140029a30
test esi, esi
je 0x1400228ef
mov r9d, esi
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xa0]
mov r8, r13
shl r9d, 7
mov qword [rsp + 0x20], r13
call fcn.14003c830
test eax, eax
jns 0x1400228ef
lea rcx, [0x1401c09b8]
mov edx, eax
call fcn.140028f30
mov eax, 0x2bb
jmp 0x140022d11
test edi, edi
mov qword [rsp + 0x2e0], rbp
mov qword [rsp + 0x2b8], r14
je 0x140022a7c
lea eax, [rsi - 1]
lea r8, [rsp + 0x220]
lea r9, [rsp + 0x221]
shl eax, 4
lea r10, [rsp + 0x222]
lea r11, [rsp + 0x223]
lea rbx, [rax + r12 + 0x10]
mov ebp, 4
sub r8, rbx
sub r9, rbx
sub r10, rbx
sub r11, rbx
mov rcx, rbx
mov rdx, rbp
nop
nop
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
movzx eax, byte [r9 + rcx]
xor byte [rcx + 1], al
movzx eax, byte [r10 + rcx]
xor byte [rcx + 2], al
movzx eax, byte [r11 + rcx]
xor byte [rcx + 3], al
add rcx, rbp
dec rdx
jne 0x140022950
test edi, edi
je 0x14002298f
mov rcx, rbx
mov edx, edi
movzx eax, byte [rcx + 0x10]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x140022980
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x210]
mov r8d, edi
call fcn.140029a50
mov r11d, dword [rsp + 0x30]
mov r8d, reloc.WSOCK32.dll_recv
and r11d, 0xf
sub r8d, edi
lea rdx, [r11 + rbx]
lea rcx, [rsp + r11 + 0x210]
call fcn.140029a50
lea r11, [rsp + 0x210]
lea r8, [rsp + 0x210]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xa0]
mov r9d, 0x80
mov qword [rsp + 0x20], r11
call fcn.14003c830
test eax, eax
jns 0x140022a12
lea rcx, str.classic_aes_decrypt_ark:_aes_blockDecrypt_returned__d_n
mov edx, eax
call fcn.140028f30
mov eax, 0x2bb
jmp 0x140022d01
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x220]
add rcx, 4
xor byte [rsp + rcx + 0x20c], al
movzx eax, byte [rsp + rcx + 0x21d]
xor byte [rsp + rcx + 0x20d], al
movzx eax, byte [rsp + rcx + 0x21e]
xor byte [rsp + rcx + 0x20e], al
movzx eax, byte [rsp + rcx + 0x21f]
xor byte [rsp + rcx + 0x20f], al
dec rbp
jne 0x140022a14
lea rcx, [rbx + 0x10]
mov r8d, edi
mov rdx, rbx
call fcn.140029a50
lea r8d, [rbp + 0x10]
lea rdx, [rsp + 0x210]
mov rcx, rbx
call fcn.140029a50
lea rcx, [rsp + 0x40]
call fcn.14003cf40
mov r8d, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov rdx, r13
call fcn.14003f460
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x240]
call fcn.14003f5f0
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x258]
mov r8d, reloc.WSOCK32.dll_recv
call fcn.140029a50
lea rdx, [rsp + 0x288]
lea rcx, [rsp + 0x268]
mov r8d, reloc.WSOCK32.dll_recv
call fcn.140029a50
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x278]
mov r8d, reloc.WSOCK32.dll_recv
call fcn.140029a50
mov rax, qword [rsp + 0x38]
lea r11, [rsp + 0x258]
mov rdx, r15
mov ecx, 1
mov dword [r15 + 0x5c], eax
mov word [r15 + 0x18], 0x140
mov dword [r15 + 0x12], r11d
mov word [r15 + 0x16], 6
mov byte [r15 + 0x55], 2
mov word [r15 + 0x3e], 0
call fcn.140028870
movzx ebx, ax
lea rcx, str.______classic_aes_encrypt_hw:_LowAPI_status__u_n
mov byte [r15 + 0x55], 0
mov edx, ebx
mov word [r15 + 0x16], 0
call fcn.140028f30
movzx ecx, bx
call fcn.1400290c0
test eax, eax
mov ebp, eax
je 0x140022ce9
lea r9, [rsp + 0x298]
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0x80
call fcn.14003bff0
test eax, eax
jns 0x140022b9f
lea rcx, str.classic_aes_decrypt_ark:_aes_makeKey_returned__d_n
mov edx, eax
call fcn.140028f30
mov eax, 0x2bb
jmp 0x140022d01
lea rcx, [rsp + 0xa0]
xor r8d, r8d
mov dl, 2
call fcn.14003c140
test eax, eax
jns 0x140022bcd
lea rcx, str.classic_aes_decrypt_ark:_aes_cipherInit_returned__d_n
mov edx, eax
call fcn.140028f30
mov eax, 0x2bb
jmp 0x140022d01
test esi, esi
je 0x140022c11
mov r9d, esi
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xa0]
mov r8, r13
shl r9d, 7
mov qword [rsp + 0x20], r13
call fcn.14003c190
test eax, eax
jns 0x140022c11
lea rcx, [0x1401c0a98]
mov edx, eax
call fcn.140028f30
mov eax, 0x2bb
jmp 0x140022d01
test edi, edi
je 0x140022ccf
lea eax, [rsi - 1]
lea rcx, [rsp + 0x210]
mov r8d, reloc.WSOCK32.dll_recv
shl eax, 4
lea rbx, [rax + r12 + 0x10]
mov rdx, rbx
call fcn.140029a50
test edi, edi
je 0x140022c61
lea rcx, [rsp + 0x210]
lea rdx, [rbx + 0x10]
mov r8d, edi
nop
movzx eax, byte [rdx]
inc rcx
inc rdx
xor byte [rcx - 1], al
dec r8
jne 0x140022c50
lea rax, [rsp + 0x210]
lea r8, [rsp + 0x210]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xa0]
mov r9d, 0x80
mov qword [rsp + 0x20], rax
call fcn.14003c190
test eax, eax
jns 0x140022caa
lea rcx, str.classic_aes_encrypt_ark:_aes_blockEncrypt_returned__d_n
mov edx, eax
call fcn.140028f30
mov eax, 0x2bb
jmp 0x140022d01
lea rcx, [rbx + 0x10]
mov r8d, edi
mov rdx, rbx
call fcn.140029a50
lea rdx, [rsp + 0x210]
mov r8d, reloc.WSOCK32.dll_recv
mov rcx, rbx
call fcn.140029a50
lea rdx, [rsp + 0x230]
mov r8d, reloc.WSOCK32.dll_recv
mov rcx, r12
call fcn.140029a50
mov eax, ebp
jmp 0x140022d01
lea rdx, [rsp + 0x258]
mov r8d, reloc.WSOCK32.dll_recv
mov rcx, r12
call fcn.140029a50
xor eax, eax
mov rbp, qword [rsp + 0x2e0]
mov r14, qword [rsp + 0x2b8]
mov r15, qword [rsp + 0x2b0]
mov r13, qword [rsp + 0x2c0]
mov r12, qword [rsp + 0x2c8]
mov rdi, qword [rsp + 0x2d0]
mov rsi, qword [rsp + 0x2d8]
mov rbx, qword [rsp + 0x308]
mov rcx, qword [rsp + 0x2a8]
call fcn.14006b6a0
add rsp, 0x2e8
ret