Function at 0x1400dec70
Capabilities:
Access pe header
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14016a080]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov r15, rcx
lea rcx, [0x14016a160]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r12d, dword [reloc.WS2_32.dll_accept]
xor ebx, ebx
mov r14, rax
test rax, rax
jne 0x1400dee8e
mov ecx, dword [0x14015dec0]
mov r8d, ebx
movzx eax, byte [0x14015dec6]
mov dword [rsp + 0x50], ecx
movzx ecx, word [0x14015dec4]
mov word [rsp + 0x54], cx
mov byte [rsp + 0x56], al
movups xmm0, xmmword [0x14015deb0]
movups xmmword [rsp + 0x40], xmm0
cmp r12d, 2
jl 0x1400dee3f
movdqa xmm0, xmmword [0x14015e110]
lea rcx, [rsp + 0x44]
movdqa xmm5, xmmword [0x14015e070]
movdqa xmm4, xmmword [0x14015e180]
movdqa xmm6, xmmword [0x14015e090]
movdqa xmmword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x30]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14015e0b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14015e0b0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x10
jl 0x1400ded30
cmp r8d, 0x17
jge 0x1400dee84
movsxd rax, r8d
lea r9, [rsp + 0x40]
add r9, rax
nop word [rax + rax]
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0x17
jl 0x1400dee50
lea rcx, [rsp + 0x40]
call fcn.1400ddfe0
mov dword [rbp + 0x20], ebx
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [rbp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, reloc.WS2_32.dll_sendto
mov dword [rsp + 0x58], eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [rbp + 0x20]
test esi, esi
je 0x1400dee91
test edi, edi
je 0x1400df6a2
mov rcx, qword gs:[0x58]
mov r12d, 4
mov qword [rsp + 0x178], r13
add r12, qword [rcx]
mov eax, dword [r12]
cmp dword [0x14059ed54], eax
jle 0x1400def1c
lea rcx, [0x14059ed54]
call fcn.140143000
cmp dword [0x14059ed54], 0xffffffff
jne 0x1400def1c
lea rcx, [0x140145710]
call fcn.1401432dc
lea rcx, [0x14059ed54]
call fcn.140142f94
mov eax, dword [r14 + 0x50]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x40], 4
mov dword [rbp - 0x20], esi
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x38], rbx
mov dword [rbp], 0x40
call fcn.1400de1c0
mov r13, qword [rbp - 8]
mov r8, r14
mov rcx, r13
call fcn.1400de870
test eax, eax
jne 0x1400df150
mov eax, dword [r12]
cmp dword [0x14059ed54], eax
jle 0x1400def96
lea rcx, [0x14059ed54]
call fcn.140143000
cmp dword [0x14059ed54], 0xffffffff
jne 0x1400def96
lea rcx, [0x140145710]
call fcn.1401432dc
lea rcx, [0x14059ed54]
call fcn.140142f94
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 5
mov dword [rbp - 0x80], esi
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x68], rbx
call fcn.1400de1c0
cmp byte [0x14015dd8d], bl
mov eax, dword [0x14015dd88]
movsd xmm0, qword [str.CW__V]
mov r15d, dword [reloc.WS2_32.dll_accept]
mov dword [rsp + 0x38], eax
movzx eax, word [0x14015dd8c]
mov word [rsp + 0x3c], ax
movsd qword [rsp + 0x30], xmm0
je 0x1400df144
mov r8d, ebx
cmp r15d, 2
jl 0x1400df103
movdqa xmm2, xmmword [0x14015e070]
mov r8d, 8
movdqa xmm3, xmmword [0x14015e080]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x14015e180]
movdqa xmm0, xmm2
mov eax, dword [0x14015e110]
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14015e090]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14015e0b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [str.CW__V]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rsp + 0x30], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14015e090]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14015e0b0]
movd xmm1, dword [rsp + 0x34]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x34], xmm2
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0xe
jl 0x1400df110
lea rcx, [rsp + 0x30]
call fcn.1400ddfe0
jmp 0x1400df157
mov r15d, dword [reloc.WS2_32.dll_accept]
mov rcx, rsi
mov r9, r14
mov edx, edi
call fcn.1400dea00
test eax, eax
jne 0x1400df35e
mov eax, dword [r12]
cmp dword [0x14059ed54], eax
jle 0x1400df1a5
lea rcx, [0x14059ed54]
call fcn.140143000
cmp dword [0x14059ed54], 0xffffffff
jne 0x1400df1a5
lea rcx, [0x140145710]
call fcn.1401432dc
lea rcx, [0x14059ed54]
call fcn.140142f94
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 5
mov dword [rbp - 0x80], esi
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x68], rbx
call fcn.1400de1c0
mov eax, dword [0x14015dd98]
mov r8d, ebx
movsd xmm0, qword [str.X_C_GB]
mov dword [rsp + 0x38], eax
movzx eax, word [0x14015dd9c]
mov word [rsp + 0x3c], ax
movzx eax, byte [0x14015dd9e]
mov byte [rsp + 0x3e], al
movsd qword [rsp + 0x30], xmm0
cmp r15d, 2
jl 0x1400df30a
movdqa xmm2, xmmword [0x14015e070]
mov r8d, 8
movdqa xmm3, xmmword [0x14015e080]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x14015e180]
movdqa xmm0, xmm2
mov eax, dword [0x14015e110]
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14015e090]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14015e0b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [str.X_C_GB]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rsp + 0x30], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14015e090]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14015e0b0]
movd xmm1, dword [rsp + 0x34]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x34], xmm2
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop word [rax + rax]
mov eax, 0x92492493
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0xf
jl 0x1400df320
lea rcx, [rsp + 0x30]
call fcn.1400ddfe0
movzx eax, word [r14 + 0x14]
movzx r15d, bx
add rax, 0x2c
cmp bx, word [r14 + 6]
jae 0x1400df401
lea rdi, [rax + r14]
lea rbx, [0x14016a160]
mov eax, dword [r12]
cmp dword [0x14059ed54], eax
jle 0x1400df3ba
lea rcx, [0x14059ed54]
call fcn.140143000
cmp dword [0x14059ed54], 0xffffffff
jne 0x1400df3ba
lea rcx, [0x140145710]
call fcn.1401432dc
lea rcx, [0x14059ed54]
call fcn.140142f94
mov eax, dword [rdi - 8]
lea rdx, [rsp + 0x60]
add rax, r13
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x70], rax
mov eax, dword [rdi]
add rax, rbx
mov dword [rbp - 0x80], esi
mov qword [rsp + 0x68], rax
mov eax, dword [rdi - 4]
mov qword [rsp + 0x78], rax
call fcn.1400de1c0
inc r15w
add rdi, 0x28
cmp r15w, word [r14 + 6]
jb 0x1400df381
mov edi, dword [rsp + 0x58]
xor ebx, ebx
mov r9, r14
mov r8, r13
mov edx, edi
mov rcx, rsi
call fcn.1400de590
movzx edi, word [r14 + 0x14]
movzx r15d, bx
add rdi, 0x28
cmp bx, word [r14 + 6]
jae 0x1400df4e7
add rdi, r14
mov rbx, r12
nop
mov eax, dword [rdi]
test eax, eax
je 0x1400df4d2
test dword [rdi + 0x14], 0x2000000
je 0x1400df4d2
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rbx]
mov r12, rax
cmp dword [0x14059ed54], ecx
jle 0x1400df495
lea rcx, [0x14059ed54]
call fcn.140143000
cmp dword [0x14059ed54], 0xffffffff
jne 0x1400df495
lea rcx, [0x140145710]
call fcn.1401432dc
lea rcx, [0x14059ed54]
call fcn.140142f94
mov eax, dword [rdi - 4]
lea rdx, [rsp + 0x60]
add rax, r13
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x70], rax
mov eax, dword [rdi]
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x80], esi
mov qword [rsp + 0x68], r12
call fcn.1400de1c0
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc r15w
add rdi, 0x28
cmp r15w, word [r14 + 6]
jb 0x1400df430
xor ebx, ebx
xor edx, edx
lea rcx, [0x14016a160]
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp byte [reloc.WLDAP32.dll_Ordinal_60], 0
movsd xmm0, qword [0x14015df08]
mov eax, dword [0x14015df10]
mov r13, qword [rsp + 0x178]
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x48], eax
je 0x1400df67f
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400df63f
movdqa xmm2, xmmword [0x14015e070]
mov ebx, 8
movdqa xmm3, xmmword [0x14015e080]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x14015e180]
movdqa xmm0, xmm2
mov eax, dword [0x14015e110]
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14015e090]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14015e0b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [0x14015df08]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rsp + 0x40], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14015e090]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14015e0b0]
movd xmm1, dword [rsp + 0x44]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x44], xmm2
movsxd rax, ebx
lea r8, [rsp + 0x40]
add r8, rax
nop word [rax + rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, bl
inc ebx
sub al, cl
add al, 0x31
xor byte [r8 - 1], al
cmp ebx, 0xc
jl 0x1400df650
lea rcx, [rsp + 0x40]
call fcn.1400ddfe0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400db4b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400df869
cmp byte [0x14015dedd], bl
mov eax, dword [0x14015ded8]
movups xmm0, xmmword [0x14015dec8]
mov dword [rsp + 0x50], eax
movzx eax, word [0x14015dedc]
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x54], ax
je 0x1400df85f
cmp r12d, 2
jl 0x1400df81c
movdqa xmm0, xmmword [0x14015e110]
lea rcx, [rsp + 0x44]
movdqa xmm5, xmmword [0x14015e070]
movdqa xmm4, xmmword [0x14015e180]
movdqa xmm6, xmmword [0x14015e090]
movdqa xmmword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x30]
nop dword [rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
mov eax, ebx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14015e0b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14015e0b0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp ebx, 0x10
jl 0x1400df710
cmp eax, 0x16
jge 0x1400df85f
movsxd rax, ebx
lea r8, [rsp + 0x40]
add r8, rax
nop word [rax + rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, bl
inc ebx
sub al, cl
add al, 0x31
xor byte [r8 - 1], al
cmp ebx, 0x16
jl 0x1400df830
lea rcx, [rsp + 0x40]
call fcn.1400ddfe0
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.140142f30
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret