Function at 0x14000b1d0
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x140087118]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov r12, rdx
mov rdi, rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x38], rdx
xor ebx, ebx
mov qword [r11 - 0x78], rbx
movdqa xmm0, xmmword [0x14006abc0]
movdqu xmmword [r11 - 0x68], xmm0
mov byte [r11 - 0x78], bl
lea ecx, [rbx + 8]
call fcn.140066880
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14000b243
mov rcx, rax
call fcn.14000fb50
nop
mov dword [rsp + 0x80], 0xd1b0e09
mov dword [rsp + 0x84], 0xe6efe0ee
mov word [rsp + 0x88], 0x100
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x80], al
inc rcx
cmp rcx, 8
jb 0x14000b270
mov byte [rsp + 0x89], 0
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rbx
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000b2c0
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.1400025a0
nop
mov byte [0x140087610], 0
mov ecx, 0x1024
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x80], rax
xor edx, edx
mov r8d, 0x1024
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x1e211e0f
mov dword [rsp + 0x54], 0xf5ebf5e3
mov word [rsp + 0x58], 0xe1
mov byte [rsp + 0x5a], 1
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 9
jb 0x14000b330
mov byte [rsp + 0x5a], 0
mov qword [rsp + 0xd0], 9
mov qword [rsp + 0xd8], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rsp + 0x50]
movsd qword [rsp + 0xc0], xmm0
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0xc8], al
mov byte [rsp + 0xc9], 0
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x90]
call fcn.140011210
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000b3a2
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x160a1e1d
mov dword [rsp + 0x44], 0x100efef
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x14000b3c0
mov byte [rsp + 0x47], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000b42e
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b429
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b429
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
movdqa xmm0, xmmword [0x14006abc0]
movdqu xmmword [rsp + 0xa0], xmm0
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x14000b48d
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b488
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b488
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
lea rdx, [0x1400876f8]
lea rcx, [rsp + 0x90]
call fcn.140011210
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000b4ae
mov r8, qword [rax]
mov dword [rsp + 0x40], 0x170a081d
mov dword [rsp + 0x44], 0xe6e8df
mov byte [rsp + 0x48], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 7
jb 0x14000b4d0
mov byte [rsp + 0x48], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000b53e
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b539
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b539
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
lea rdx, [0x1400876d8]
lea rcx, [rsp + 0xc0]
call fcn.140002860
mov r8, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140015c60
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000b574
mov r8, qword [rax]
mov dword [rsp + 0x50], 0x170a081d
mov dword [rsp + 0x54], 0xeaf6efe5
mov dword [rsp + 0x58], 0xeef2e4e7
mov dword [rsp + 0x5c], 0x100e7e7
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0xe
jb 0x14000b5a0
mov byte [rsp + 0x5f], 0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xe0]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000b60e
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b609
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b609
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
lea rdx, [rdi + 0xa0]
lea rcx, [rsp + 0xc0]
call fcn.140002860
mov r8, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140015c60
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000b644
mov r8, qword [rax]
mov dword [rsp + 0x50], 0x111f151f
mov dword [rsp + 0x54], 0xdceee4ee
mov dword [rsp + 0x58], 0x100e1ed
mov rcx, rbx
nop
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0xa
jb 0x14000b660
mov byte [rsp + 0x5b], 0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xe0]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000b6ce
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b6c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
mov rdx, r12
lea rcx, [rsp + 0xc0]
call fcn.140002860
mov r8, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140015c60
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000b700
mov r8, qword [rax]
mov dword [rsp + 0x40], 0xc0d1811
mov dword [rsp + 0x44], 0xe7e6e1
mov byte [rsp + 0x48], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 7
jb 0x14000b720
mov byte [rsp + 0x48], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000b78e
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b789
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b789
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
lea r14, [rsp + 0x100]
mov r15, qword [rsp + 0x100]
mov r13, qword [rsp + 0x118]
cmp r13, 0x10
cmovae r14, r15
movabs rdi, 0x7fffffffffffffff
mov rsi, qword [rsp + 0x110]
cmp rsi, rdi
ja 0x14000bcf5
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp rsi, 0x10
jae 0x14000b801
mov qword [rsp + 0x60], rsi
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14000b848
mov rax, rsi
or rax, 0xf
cmp rax, rdi
ja 0x14000b81c
mov rdi, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rdi, rcx
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x50]
call fcn.140001d30
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140015c60
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000b86c
mov r8, qword [rax]
mov dword [rsp + 0x40], 0xd1b0e15
mov word [rsp + 0x44], 0x100
mov rcx, rbx
nop
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 4
jb 0x14000b880
mov byte [rsp + 0x45], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000b8ee
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b8e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b8e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
mov rsi, qword [rsp + 0x70]
mov rdx, rsi
lea rcx, [rsp + 0xc0]
call fcn.140002860
mov r8, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140015c60
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000b925
mov r8, qword [rax]
mov dword [rsp + 0x40], 0xb1f0f3e
mov dword [rsp + 0x44], 0x100e0f6
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 6
jb 0x14000b940
mov byte [rsp + 0x47], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.14000eb20
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14000b9ae
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b9a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b9a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
lea rcx, [rsp + 0xe0]
call fcn.14000edc0
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14000b9e0
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.1400025a0
mov dword [rsp + 0x70], 0x50170d1d
mov dword [rsp + 0x74], 0xaceeede4
mov word [rsp + 0x78], 0x100
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 8
jb 0x14000ba20
mov byte [rsp + 0x79], 0
movdqa xmm0, xmmword [0x14006ad80]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x60], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x7c]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0xf
jb 0x14000ba50
mov byte [rsp + 0x60], 0
xor eax, eax
mov word [rsp + 0x40], ax
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsp + 0x80]
mov r9, rdi
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.14000bd00
test al, al
jne 0x14000bb93
mov byte [0x140087611], 1
cmp r13, 0x10
jb 0x14000bae3
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000bada
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bc0f
mov rcx, r15
call fcn.1400668bc
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x14000bb26
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bc60
call fcn.1400668bc
movdqa xmm0, xmmword [0x14006abc0]
movdqu xmmword [rsp + 0xf0], xmm0
mov byte [rsp + 0xe0], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14000bb7b
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14000bb76
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000bc16
mov rcx, r8
call fcn.1400668bc
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r12], 0
jmp 0x14000bcc1
xor edx, edx
mov r8d, 0x1024
mov rcx, qword [0x140087760]
call sub.VCRUNTIME140.dll_memset
mov rdx, rdi
mov r8, qword [0x140087760]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r8], al
lea rdx, [rdx + 1]
lea r8, [r8 + 1]
test al, al
jne 0x14000bbc0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call fcn.1400063c0
nop
cmp r13, 0x10
jb 0x14000bc26
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000bc1d
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bc1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r15
call fcn.1400668bc
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x14000bc6d
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bc67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400668bc
nop
jmp 0x14000bc76
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14000bcae
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x14000bca9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000bcee
mov rcx, r8
call fcn.1400668bc
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r12], 0
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.140066950
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001ab0
nop
int3