Function at 0x140132b00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push r13
push r15
mov eax, 0x58
call fcn.140243620
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rbx, rcx
mov rcx, qword [rcx + 0x38]
mov rsi, r9
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
mov r13, r8
mov r15, rdx
cmp rcx, rax
ja 0x140132e2e
cmp rcx, r9
jb 0x140132e2e
mov qword [rsp + 0x88], rbp
mov ebp, dword [rbx + 0x170]
mov qword [rsp + 0x50], rdi
xor edi, edi
mov qword [rbx + 0x38], rcx
mov dword [rsp + 0x80], ebp
cmp dword [rbx + 0x174], edi
je 0x140132bb9
lea rcx, [rbx + 0x40]
test r9, r9
jne 0x140132b96
lea rdx, [rbx + 0x60]
call fcn.140133ce0
xor eax, eax
mov dword [rbx + 0x174], edi
jmp 0x140132e16
movups xmm0, xmmword [rcx]
mov ebp, reloc.WS2_32.dll_recv
mov dword [rsp + 0x80], ebp
movups xmmword [rbx + 0x188], xmm0
mov qword [rcx], rdi
mov qword [rbx + 0x48], rdi
mov dword [rbx + 0x174], edi
movzx eax, byte [rbx + 0xd]
mov qword [rsp + 0x48], r12
movzx r12d, byte [rbx + 0xc]
shl r12d, 8
or r12d, eax
mov qword [rsp + 0x40], r14
movzx eax, byte [rbx + 0xe]
mov r14d, ebp
shl r12d, 8
or r12d, eax
movzx eax, byte [rbx + 0xf]
shl r12d, 8
or r12d, eax
and r14d, 0xf
mov dword [rsp + 0x30], r14d
je 0x140132c4f
test rsi, rsi
je 0x140132e04
movzx ecx, byte [r15]
dec rsi
mov eax, ebp
inc r15
inc ebp
mov byte [rax + rbx + 0x188], cl
xor cl, byte [r14 + rbx + 0x10]
mov byte [r13], cl
inc r13
inc r14d
and r14d, 0xf
jne 0x140132bf7
lea r8, [rbx + 0x188]
mov r9d, ebp
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call fcn.140133b20
mov ebp, edi
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x30], r14d
lea rax, [rbx + 0x60]
cmp rsi, 0x10
jb 0x140132c7c
test ebp, ebp
je 0x140132c7c
mov r9d, ebp
lea r8, [rbx + 0x188]
mov rdx, rax
lea rcx, [rbx + 0x40]
call fcn.140133b20
mov ebp, edi
mov dword [rsp + 0x80], edi
cmp rsi, 0xc00
jb 0x140132d27
mov rbp, qword [rsp + 0x38]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rsi
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add rsi, rax
nop dword [rax]
mov r9d, 0xc00
lea rdx, [rbx + 0x60]
mov r8, r15
lea rcx, [rbx + 0x40]
call fcn.140133b20
mov r9, rbp
mov qword [rsp + 0x20], rbx
mov r8d, 0xc0
mov rdx, r13
mov rcx, r15
call qword [rsp + SHCreateDirectory]
add r12d, 0xc0
add r13, 0xc00
mov eax, r12d
mov byte [rbx + 0xf], r12b
shr eax, 0x18
add r15, 0xc00
mov byte [rbx + 0xc], al
mov eax, r12d
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rbx + 0xe], al
sub rdi, 1
jne 0x140132cb0
mov ebp, dword [rsp + 0x80]
mov r14d, dword [rsp + 0x30]
mov rax, rsi
and rax, 0xfffffffffffffff0
mov qword [rsp + 0x98], rax
je 0x140132d9f
mov rdi, rax
lea rdx, [rbx + 0x60]
mov r9, rax
shr rdi, 4
mov r8, r15
lea rcx, [rbx + 0x40]
call fcn.140133b20
mov r9, qword [rsp + 0x38]
mov r8, rdi
mov rdx, r13
mov qword [rsp + 0x20], rbx
mov rcx, r15
call qword [rsp + SHCreateDirectory]
add r12d, edi
mov eax, r12d
mov byte [rbx + 0xf], r12b
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, r12d
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rbx + 0xe], al
mov rax, qword [rsp + 0x98]
add r13, rax
add r15, rax
sub rsi, rax
test rsi, rsi
je 0x140132e04
mov r8, qword [rsp + 0x38]
lea rdx, [rbx + 0x10]
mov rcx, rbx
call qword [rbx + 0x178]
inc r12d
mov eax, r12d
mov byte [rbx + 0xf], r12b
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, r12d
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rbx + 0xe], al
nop dword [rax + rax]
mov edx, r14d
inc r14d
mov eax, ebp
inc ebp
movzx ecx, byte [rdx + r15]
mov byte [rax + rbx + 0x188], cl
xor cl, byte [rdx + rbx + 0x10]
mov byte [rdx + r13], cl
sub rsi, 1
jne 0x140132de0
mov r12, qword [rsp + 0x48]
xor eax, eax
mov r14, qword [rsp + 0x40]
mov dword [rbx + 0x170], ebp
mov rbp, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x50]
add rsp, 0x58
pop r15
pop r13
pop rsi
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x58
pop r15
pop r13
pop rsi
pop rbx
ret