Function at 0x1400a1bf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2b8]
mov eax, 0x3b8
call fcn.140189b30
sub rsp, rax
mov rax, qword [0x14028a3e8]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rax, qword [rbp + 0x320]
mov edi, reloc.advapi32.dll_AdjustTokenPrivileges
mov rbx, qword [rbp + 0x330]
mov r14d, 0x28
mov qword [rsp + 0x68], rax
mov rsi, r8
mov rax, qword [rbp + 0x338]
mov qword [rbp - 0x70], rax
lea r13d, [rdi - 0x38]
mov qword [rsp + 0x50], r9
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x78], r14
mov byte [rsp + 0x20], 1
cmp rbx, 0x100000
jae 0x1400a2526
call fcn.1400b58d0
mov rcx, rax
call fcn.140064830
mov ecx, eax
cmp eax, 0x2a1
jg 0x1400a1d88
je 0x1400a1d4a
cmp eax, 4
je 0x1400a1d0c
cmp eax, edi
je 0x1400a1cdd
cmp eax, 0x2a0
jne 0x1400a1d95
lea rcx, [rbp - 0x20]
call fcn.1400d8c90
test eax, eax
jle 0x1400a2526
mov r12d, DecryptFileW
lea rcx, [0x1400a27a0]
mov qword [rsp + 0x30], r12
lea rax, [0x1400d8d00]
jmp 0x1400a1e06
lea rcx, [rbp - 0x20]
call fcn.1400d7300
test eax, eax
jle 0x1400a2526
mov r12d, shutdown
lea rcx, [0x1400a2710]
mov qword [rsp + 0x30], r12
lea rax, [0x1400d7360]
jmp 0x1400a1e06
lea rcx, [rbp - 0x20]
call fcn.1400dc9f0
test eax, eax
jle 0x1400a2526
mov r12d, reloc.WS2_32.dll_recv
mov byte [rsp + 0x20], 0
mov r14d, 0x30
mov qword [rsp + 0x30], r12
mov qword [rbp - 0x78], r14
lea rcx, [0x1400a2690]
lea rax, [0x1400dca40]
jmp 0x1400a1e06
lea rcx, [rbp - 0x20]
call fcn.1400d9fa0
test eax, eax
jle 0x1400a2526
mov r12d, 0x30
lea rax, [0x1400a2880]
mov qword [rsp + 0x40], rax
lea rax, [0x1400da9f0]
mov qword [rsp + 0x30], r12
lea edi, [r12 + 0x50]
lea r13d, [r12 - 0x20]
jmp 0x1400a1e0b
sub ecx, 0x2a2
je 0x1400a1dd6
cmp ecx, 1
je 0x1400a1daa
test rsi, rsi
je 0x1400a2526
mov qword [rsi], 0
jmp 0x1400a2526
lea rcx, [rbp - 0x20]
call fcn.1400d88e0
test eax, eax
jle 0x1400a2526
mov r12d, 0x1c
lea rcx, [0x1400a27a0]
mov qword [rsp + 0x30], r12
lea rax, [0x1400d8d00]
jmp 0x1400a1e06
lea rcx, [rbp - 0x20]
call fcn.1400da960
test eax, eax
jle 0x1400a2526
mov r12, rdi
mov qword [rsp + 0x30], rdi
mov edi, 0x80
lea rcx, [0x1400a2880]
lea rax, [0x1400da9f0]
lea r13d, [rdi - 0x70]
mov qword [rsp + 0x40], rcx
movzx r11d, byte [rbp + 0x348]
mov esi, reloc.WS2_32.dll_listen
mov qword [rsp + 0x28], rax
test r11b, r11b
je 0x1400a1e30
mov rsi, qword [rbp + 0x340]
add rsi, 0xb
add rsi, r14
mov r14, qword [rbp + 0x328]
test r11b, r11b
mov eax, 2
mov r10d, 6
cmovne r10d, eax
mov r8, rsi
xor edx, edx
mov qword [rsp + 0x78], r10
sub r8, r12
dec rbx
add r14, r8
xor r15d, r15d
mov ecx, r15d
lea rax, [r8 + r13]
add rax, rdi
add rax, rbx
mov ebx, r15d
div rdi
xor edx, edx
mov r9, rax
mov rax, r14
div rdi
mov rax, r14
mov qword [rbp - 0x80], rdx
xor edx, edx
div rdi
xor edx, edx
mov qword [rbp - 0x68], rax
lea rax, [r14 + r13]
div rdi
test r11b, r11b
mov qword [rbp - 0x60], rax
setne cl
lea rdx, [rcx + r10]
mov rcx, r9
sub rcx, r10
cmp r9, rdx
jbe 0x1400a1eb9
mov rbx, rcx
imul rbx, rdi
cmp r9, rdx
cmovbe rcx, r15
lea r14, [r14*8]
mov qword [rsp + 0x70], rcx
test r11b, r11b
jne 0x1400a1f9c
mov r8, rdi
lea rcx, [rbp + 0x110]
xor edx, edx
lea r14, [r14 + rdi*8]
call fcn.14018b3d0
mov rax, qword [rbp + 0x340]
cmp rax, 0x80
ja 0x1400a2526
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x110]
mov r8, rax
call fcn.14018af60
movdqa xmm2, xmmword [str.6666666666666666jjjjjjjjjjjjjjjjSRTP_AES128_CM_SHA1_80]
mov rax, r15
nop dword [rax]
movdqu xmm0, xmmword [rbp + rax + 0x110]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0x110], xmm1
movdqu xmm0, xmmword [rbp + rax + 0x120]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0x120], xmm1
movdqu xmm0, xmmword [rbp + rax + 0x130]
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rbp + rax + 0x130], xmm0
movdqu xmm0, xmmword [rbp + rax + 0x140]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0x140], xmm1
add rax, 0x40
cmp rax, rdi
jb 0x1400a1f20
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x20]
call qword [rsp + 0x28]
mov rax, r14
lea rcx, [rbp + 0xc0]
shr rax, 0x18
xor edx, edx
mov qword [rsp + 0x58], rax
mov rax, r14
shr rax, 0x10
mov qword [rsp + 0x48], rax
mov rax, r14
shr rax, 8
mov qword [rsp + 0x38], rax
cmp byte [rsp + 0x20], r15b
je 0x1400a200a
lea r8, [r13 - 4]
call fcn.14018b3d0
mov rax, qword [rsp + 0x58]
mov byte [rbp + r13 + 0xbc], al
mov rax, qword [rsp + 0x48]
mov byte [rbp + r13 + 0xbd], al
mov rax, qword [rsp + 0x38]
mov byte [rbp + r13 + 0xbe], al
mov byte [rbp + r13 + 0xbf], r14b
jmp 0x1400a2041
mov r8, r13
call fcn.14018b3d0
mov rax, qword [rsp + 0x58]
mov byte [rbp + r13 + 0xbb], al
mov rax, qword [rsp + 0x48]
mov byte [rbp + r13 + 0xba], al
mov rax, qword [rsp + 0x38]
mov byte [rbp + r13 + 0xb9], al
mov byte [rbp + r13 + 0xb8], r14b
test rbx, rbx
je 0x1400a217b
cmp byte [rbp + 0x348], r15b
je 0x1400a20f6
cmp rsi, rdi
jbe 0x1400a2526
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x20]
mov r14, rsi
sub r14, rdi
mov qword [rsp + 0x38], r14
call qword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x190]
add rdx, rdi
mov r8, r14
call fcn.14018af60
mov r8, rdi
lea rcx, [rbp + 0x190]
sub r8, r14
add rcx, r14
mov r14, qword [rsp + 0x68]
mov rdx, r14
call fcn.14018af60
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x20]
call qword [rsp + 0x28]
xor edx, edx
mov rax, rbx
div rdi
dec rax
cmp rax, 1
jbe 0x1400a217b
sub r14, qword [rsp + 0x38]
lea r15, [rax - 1]
mov r12, qword [rsp + 0x28]
add r14, rdi
mov rdx, r14
lea rcx, [rbp - 0x20]
call r12
add r14, rdi
sub r15, 1
jne 0x1400a20e1
jmp 0x1400a2173
mov rcx, qword [rsp + 0x50]
lea r8, [rdi - 0xd]
mov r14, qword [rsp + 0x68]
mov rdx, r14
mov eax, dword [rcx + 8]
movsd xmm0, qword [rcx]
mov dword [rbp + 0x198], eax
movzx eax, byte [rcx + 0xc]
lea rcx, [rbp + 0x19d]
mov byte [rbp + 0x19c], al
movsd qword [rbp + 0x190], xmm0
call fcn.14018af60
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x20]
call qword [rsp + 0x28]
xor edx, edx
mov rax, rbx
div rdi
cmp rax, 1
jbe 0x1400a217b
mov r12, qword [rsp + 0x28]
lea r15, [rax - 1]
add r14, 0xfffffffffffffff3
add r14, rdi
nop
mov rdx, r14
lea rcx, [rbp - 0x20]
call r12
add r14, rdi
sub r15, 1
jne 0x1400a2160
mov r12, qword [rsp + 0x30]
xor r15d, r15d
mov r8, qword [rsp + 0x70]
xor eax, eax
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rax
mov rax, qword [rsp + 0x78]
add rax, r8
mov qword [rbp - 0x50], rax
cmp r8, rax
ja 0x1400a2486
mov rcx, qword [rbp - 0x80]
mov rax, rcx
movaps xmmword [rsp + 0x3a0], xmm6
shr rax, 0x3f
mov r9, rcx
mov qword [rbp - 0x80], rax
not r9
lea rdx, [rcx + 1]
mov qword [rbp - 0x48], r9
mov rax, rdx
mov qword [rsp + 0x48], rdx
shr rax, 0x3f
mov qword [rsp + 0x38], rax
mov rax, rdi
sub rax, r13
mov qword [rsp + 0x78], rax
mov rax, rcx
sub rax, rdi
lea rax, [rbp + rax + 0xc1]
add rax, r13
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x211]
add rax, rcx
mov qword [rbp - 0x58], rax
nop dword [rax]
nop dword [rax + rax]
mov rax, r8
mov r10, r9
xor rax, qword [rbp - 0x68]
lea r13, [rax - 1]
not rax
shr rax, 0x3f
shr r13, 0x3f
and r13b, al
mov rax, r8
xor rax, qword [rbp - 0x60]
neg r13b
lea r14, [rax - 1]
not rax
shr rax, 0x3f
shr r14, 0x3f
and r14b, al
neg r14b
movsx eax, r14b
movd xmm6, eax
movzx eax, r14b
not al
punpcklbw xmm6, xmm6
mov byte [rsp + 0x20], al
or al, r13b
movzx r12d, byte [rsp + 0x20]
punpcklwd xmm6, xmm6
mov byte [rsp + 0x21], al
pshufd xmm6, xmm6, 0
xor r11b, r11b
cmp rbx, rsi
jae 0x1400a22b6
mov rax, qword [rsp + 0x50]
jmp 0x1400a22cd
mov rax, qword [rbp + 0x330]
add rax, rsi
cmp rbx, rax
jae 0x1400a22d2
mov rax, qword [rsp + 0x68]
sub rax, rsi
movzx r11d, byte [rax + rbx]
mov rcx, qword [rbp - 0x80]
lea r9, [rdx + r10]
mov rdx, r9
lea r15, [r10 + 1]
shr rdx, 0x3f
mov r8, r15
shr r8, 0x3f
movzx eax, dl
xor al, cl
xor r8b, cl
or r8b, al
movzx ecx, dl
xor cl, byte [rsp + 0x38]
xor r8b, dl
dec r8b
mov rax, r10
shr rax, 0x3f
and r8b, r13b
xor al, byte [rsp + 0x38]
inc rbx
or al, cl
movzx ecx, r8b
xor al, dl
not cl
dec al
and cl, r11b
and al, r13b
and r8b, 0x80
not al
or cl, r8b
and al, cl
and al, byte [rsp + 0x21]
cmp r9, qword [rsp + 0x78]
jb 0x1400a234f
mov rcx, qword [rsp + 0x58]
and al, r12b
movzx edx, byte [rcx + r10]
and dl, r14b
or al, dl
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rsp + 0x48]
mov byte [rcx + r10], al
mov r10, r15
lea rax, [rdx + r15]
cmp rax, rdi
jb 0x1400a22a7
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 0x20]
call qword [rsp + 0x28]
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 0x20]
call qword [rsp + reloc.advapi32.dll_AdjustTokenPrivileges]
mov r12, qword [rsp + 0x30]
xor r15d, r15d
mov ecx, r15d
cmp r12, 0x40
jb 0x1400a243f
mov rax, r12
and rax, 0xffffffffffffffc0
movdqu xmm0, xmmword [rbp + rcx + 0xd0]
movdqu xmm1, xmmword [rbp + rcx + 0x210]
pand xmm1, xmm6
por xmm1, xmm0
movdqu xmmword [rbp + rcx + 0xd0], xmm1
movdqu xmm0, xmmword [rbp + rcx + 0xe0]
movdqu xmm1, xmmword [rbp + rcx + 0x220]
pand xmm1, xmm6
por xmm1, xmm0
movdqu xmmword [rbp + rcx + 0xe0], xmm1
movdqu xmm0, xmmword [rbp + rcx + 0xf0]
movdqu xmm1, xmmword [rbp + rcx + 0x230]
pand xmm1, xmm6
por xmm1, xmm0
movdqu xmmword [rbp + rcx + 0xf0], xmm1
movdqu xmm0, xmmword [rbp + rcx + 0x100]
movdqu xmm1, xmmword [rbp + rcx + 0x240]
pand xmm1, xmm6
por xmm1, xmm0
movdqu xmmword [rbp + rcx + 0x100], xmm1
add rcx, 0x40
cmp rcx, rax
jb 0x1400a23a6
cmp rcx, r12
jae 0x1400a245e
movzx eax, byte [rbp + rcx + 0x210]
and al, r14b
or byte [rbp + rcx + 0xd0], al
inc rcx
cmp rcx, r12
jb 0x1400a2444
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x48]
inc r8
mov r9, qword [rbp - 0x48]
mov qword [rsp + 0x70], r8
cmp r8, qword [rbp - 0x50]
jbe 0x1400a2240
movaps xmm6, xmmword [rsp + 0x3a0]
call fcn.1400b6240
mov rbx, rax
test rax, rax
je 0x1400a251e
mov rcx, qword [rbp - 0x40]
call fcn.1400b58d0
mov rdx, rax
xor r8d, r8d
mov rcx, rbx
call fcn.1400b5d20
test eax, eax
jle 0x1400a251e
cmp byte [rbp + 0x348], 0
je 0x1400a254b
mov rdi, qword [rbp - 0x78]
lea rcx, [rbp + 0x110]
mov r8, rdi
mov edx, 0x5c
call fcn.14018b3d0
mov r8, qword [rbp + 0x340]
mov rcx, rbx
mov rdx, qword [rbp - 0x70]
call fcn.1400b5f70
test eax, eax
jle 0x1400a251e
mov r8, rdi
lea rdx, [rbp + 0x110]
mov rcx, rbx
call fcn.1400b5f70
test eax, eax
jle 0x1400a251e
mov r8, r12
lea rdx, [rbp + 0xd0]
mov rcx, rbx
call fcn.1400b5f70
test eax, eax
jg 0x1400a260d
mov rcx, rbx
call fcn.1400b6200
xor eax, eax
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.140189130
add rsp, 0x3b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
movdqa xmm2, xmmword [0x1401ec090]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rbp + r15 + 0x110]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + r15 + 0x110], xmm1
movdqu xmm0, xmmword [rbp + r15 + 0x120]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + r15 + 0x120], xmm1
movdqu xmm0, xmmword [rbp + r15 + 0x130]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + r15 + 0x130], xmm1
movdqu xmm0, xmmword [rbp + r15 + 0x140]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + r15 + 0x140], xmm1
add r15, 0x40
cmp r15, rdi
jb 0x1400a2560
mov r8, rdi
lea rdx, [rbp + 0x110]
mov rcx, rbx
call fcn.1400b5f70
test eax, eax
jle 0x1400a251e
mov r8, r12
lea rdx, [rbp + 0xd0]
mov rcx, rbx
call fcn.1400b5f70
test eax, eax
jle 0x1400a251e
mov rdx, qword [rbp - 0x38]
lea r8, [rsp + 0x60]
mov rcx, rbx
call fcn.1400b5b40
test eax, eax
je 0x1400a2632
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400a2632
mov eax, dword [rsp + 0x60]
mov qword [rcx], rax
mov rcx, rbx
call fcn.1400b6200
mov eax, 1
jmp 0x1400a2528