Function at 0x1400be2c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, rcx
mov qword [rsp + 0x48], rcx
movzx ecx, word [rdx + 2]
mov dword [rsp + 0x40], r9d
mov rbp, r8
mov qword [rsp + 0x38], r8
mov r13, rdx
call qword [sym.imp.WS2_32.dll_ntohs]
movzx r15d, ax
cmp ax, 8
jae 0x1400be326
mov r12d, 1
lock xadd dword [0x1402e67b8], r12d
or eax, 0xffffffff
jmp 0x1400be76c
mov qword [rsp + 0xb8], rbx
mov r12d, 1
mov qword [rsp + 0xb0], rsi
mov eax, r12d
mov qword [rsp + 0xa8], rdi
lock xadd dword [0x1402e67a8], eax
movzx ecx, word [r13 + 4]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [r13 + 6]
mov word [rsp + 0x34], ax
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [r14 + 0x680]
xor esi, esi
movzx edi, ax
mov word [rsp + 0x30], ax
test rcx, rcx
je 0x1400be3a9
test ax, ax
je 0x1400be3a9
movzx r8d, word [rcx + 2]
mov edx, esi
test r8d, r8d
jle 0x1400be3a9
add rcx, 4
cmp word [rcx], di
je 0x1400be46c
inc edx
add rcx, 2
cmp edx, r8d
jl 0x1400be395
mov eax, r12d
lock xadd dword [0x1402e67b0], eax
mov ebp, 6
mov r15, rsi
mov r14, rsi
mov r13d, esi
cmp ebp, 0xb0
jle 0x1400be61f
mov rcx, qword [0x1402e6b48]
call fcn.1401e3610
mov rdi, rax
test rax, rax
je 0x1400be41d
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov dword [rax + 0x18], esi
mov dword [rax + 0x1c], 2
mov word [rax + 0x20], r12w
add rax, 0x50
mov qword [rdi + 0x28], rsi
mov dword [rdi + 0x38], esi
mov qword [rdi + 0x30], rsi
mov qword [rdi + 0x10], rax
mov dword [rdi + 0x3c], esi
mov dword [rdi + 0x40], esi
mov word [rdi + 0x44], si
mov word [rdi + 0x46], si
mov qword [rdi + 0x48], rsi
mov rcx, qword [0x1402e6b50]
mov qword [rdi + 0x50], rsi
call fcn.1401e3610
mov rcx, qword [0x1402e6b58]
mov rbx, rax
call fcn.1401e3610
mov dword [rax], r12d
or dword [rdi + 0x1c], r12d
mov qword [rdi + 0x70], rax
mov eax, 0x800
mov qword [rdi + 0x50], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x58], rsi
mov qword [rdi + 0x60], rsi
mov dword [rdi + 0x68], 0x800
mov dword [rdi + 0x78], r12d
jmp 0x1400be6b8
movzx eax, word [rsp + 0x34]
cmp qword [r14 + 0x6b8], rsi
je 0x1400be488
cmp word [r14 + 0x6c4], ax
je 0x1400be575
mov rbx, qword [r14 + 0x690]
test rbx, rbx
je 0x1400be4a2
cmp word [rbx + 0x1c], ax
je 0x1400be4b0
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400be494
lock xadd dword [0x1402e67b4], r12d
jmp 0x1400be751
cmp word [r14 + 0x6c4], ax
je 0x1400be539
bt dword [r14 + 0x58], 8
mov rbp, qword [r14 + 8]
jb 0x1400be534
lea rdi, [rbp + 0x390]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rbp + 0x158]
bt r11d, 0x1c
jb 0x1400be51f
bt r11d, 0x1d
jb 0x1400be51f
bt r11d, 0x1e
jb 0x1400be51f
movzx r8d, word [rsp + 0x34]
xor r9d, r9d
mov edx, r12d
mov rcx, r14
call fcn.1400be790
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbp, qword [rsp + 0x38]
mov di, word [rsp + 0x30]
jmp 0x1400be539
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbp, qword [rsp + 0x38]
mov di, word [rsp + 0x30]
jmp 0x1400be539
mov rbp, qword [rsp + 0x38]
mov rcx, qword [r14 + 0x6b8]
test rcx, rcx
je 0x1400be54a
call fcn.1401e36c8
mov r8, qword [rbx + 0x10]
mov rdx, qword [r14 + 0x6a8]
mov rcx, qword [r14 + 0x698]
call fcn.1400bc7f0
mov qword [r14 + 0x6b8], rax
movzx eax, word [rsp + 0x34]
mov word [r14 + 0x6c4], ax
cmp di, r12w
je 0x1400be57f
mov edi, esi
jmp 0x1400be584
mov edi, reloc.WS2_32.dll_sendto
mov ebx, edi
movzx eax, r15w
lea rcx, [rbx + 8]
cmp rax, rcx
jb 0x1400be60a
lea rdx, [r13 + 8]
lea rcx, [rsp + 0x70]
mov r8, rbx
call fcn.1401e3ed0
lea r8d, [rdi + 3]
mov edi, dword [rsp + 0x40]
lea edx, [rdi + 8]
and r8d, 0xfffffffc
mov rcx, rbp
call fcn.1400be230
mov rdx, qword [r14 + 0x6b8]
movzx ecx, word [rsp + 0x30]
lea r11, [rsp + 0x50]
mov r9d, edi
mov r8, rbp
mov qword [rsp + 0x20], r11
call fcn.1400bd570
test rbx, rbx
je 0x1400be618
mov rdx, rsi
nop word [rax + rax]
movzx ecx, byte [rsp + rdx + 0x50]
movzx eax, byte [rsp + rdx + 0x70]
inc rdx
xor ecx, eax
or esi, ecx
sub rbx, r12
jne 0x1400be5f0
test esi, esi
je 0x1400be618
lock xadd dword [0x1402e67b8], r12d
jmp 0x1400be751
xor eax, eax
jmp 0x1400be754
test r13b, 2
je 0x1400be680
mov rcx, qword [0x1402e6b48]
call fcn.1401e3610
mov rdi, rax
test rax, rax
je 0x1400be674
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov dword [rax + 0x18], esi
mov dword [rax + 0x1c], 2
mov word [rax + 0x20], r12w
add rax, 0x50
mov qword [rdi + 0x28], rsi
mov dword [rdi + 0x38], esi
mov qword [rdi + 0x30], rsi
mov qword [rdi + 0x10], rax
mov dword [rdi + 0x3c], esi
mov dword [rdi + 0x40], esi
mov word [rdi + 0x44], si
mov word [rdi + 0x46], si
mov qword [rdi + 0x48], rsi
mov eax, 0xb0
cmp ebp, eax
cmovl eax, ebp
jmp 0x1400be6b8
mov rcx, qword [0x1402e6b48]
call fcn.1401e3610
mov rdi, rax
test rax, rax
je 0x1400be6ae
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov dword [rax + 0x18], esi
mov dword [rax + 0x1c], esi
mov word [rax + 0x20], r12w
add rax, 0x28
mov qword [rdi + 0x10], rax
mov eax, 0xd8
cmp ebp, eax
cmovl eax, ebp
test rdi, rdi
je 0x1400be744
cmp eax, 6
jl 0x1400be73f
sub ebp, eax
test r14, r14
je 0x1400be6d2
mov qword [r14], rdi
jmp 0x1400be6d5
mov r15, rdi
and r13d, 0xfffffffd
mov r14, rdi
test ebp, ebp
jg 0x1400be3c2
test r13b, 4
je 0x1400be6f0
or dword [rdi + 0x1c], 4
nop
test r15, r15
je 0x1400be751
add qword [r15 + 0x10], 4
mov rbx, qword [r15 + 0x10]
mov ecx, 0x105
call sub.WS2_32.dll_htons
mov ecx, 6
mov word [rbx], ax
call sub.WS2_32.dll_htons
movzx ecx, word [rsp + 0x30]
mov word [rbx + 2], ax
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [rsp + 0x48]
mov word [rbx + 4], ax
mov rdx, r15
mov dword [r15 + 0x18], 6
call fcn.1400aeab0
jmp 0x1400be751
mov rcx, rdi
jmp 0x1400be74c
test r15, r15
je 0x1400be751
mov rcx, r15
call fcn.140077120
or eax, 0xffffffff
mov rsi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rbp
ret