Function at 0x14011d6a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x1402ba030]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx + 0xac2], 0
mov r12, r9
mov r13, qword [rcx + 0x1b0]
mov r14, r8
mov r15d, dword [rsp + 0xb8]
mov rbp, rdx
mov rsi, qword [rsp + 0xb0]
mov rbx, rcx
jne 0x14011d71b
cmp qword [rcx + 0xcb0], 0
lea rdi, [rcx + 0x6c8]
jne 0x14011d734
mov ecx, dword [rdi]
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx + 0xcb0], rax
test rax, rax
jne 0x14011d734
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x14011d9fc
test rsi, rsi
jne 0x14011d9f7
test r15d, r15d
jne 0x14011d9f7
lea rdi, [rcx + 0x6c8]
cmp byte [rbx + 0xac2], 0
je 0x14011d83a
test r14, r14
jne 0x14011d74d
xor eax, eax
jmp 0x14011d9fc
mov rax, qword [rbx + 0xd0]
test rax, rax
je 0x14011d762
cmp byte [rax + 0x18b], 0
jne 0x14011d77f
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x14011d800
cmp byte [rax + 0x18b], 0
je 0x14011d800
mov r10, qword [rbx + 0x18]
test r10, r10
jne 0x14011d7a1
lea rdx, str.No_associated_connection
mov rcx, rbx
call fcn.140105f20
mov eax, gethostname
jmp 0x14011d9fc
mov rax, qword [r10 + 0x350]
xor edi, edi
mov dword [rsp + 0x30], edi
cmp rax, 0xffffffffffffffff
je 0x14011d7c0
lea edx, [rdi + 1]
cmp rax, qword [r10 + 0x1b0]
je 0x14011d7c2
mov edx, edi
lea rcx, [rsp + 0x30]
mov eax, edx
mov qword [rsp + 0x20], rcx
mov r9, r14
mov rcx, rbx
mov r8, rbp
call qword [r10 + rax*8 + 0x1c8]
mov rbp, rax
test rax, rax
jns 0x14011d81a
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14011d7f9
cmp eax, 0x51
jne 0x14011d818
mov rbp, rdi
jmp 0x14011d81a
mov edi, gethostname
jmp 0x14011d81a
lea r9, [rsp + 0x30]
mov r8, r14
mov rdx, rbp
mov rcx, rbx
call fcn.1400e65e0
mov rbp, qword [rsp + 0x30]
mov edi, eax
mov r9, rbp
lea rdx, str.WS:_wanted_to_send__zu_bytes__sent__zu_bytes
mov r8, r14
mov rcx, rbx
call fcn.140106050
mov eax, edi
mov qword [r12], rbp
jmp 0x14011d9fc
mov ecx, dword [rdi]
sub ecx, 0xa
cmp r14, rcx
cmova r14, rcx
xor edi, edi
test r15b, 0x20
je 0x14011d8a0
test rsi, rsi
je 0x14011d870
mov r8d, r15d
mov rdx, rsi
mov rcx, rbx
call fcn.14011d500
mov r15, rax
sub rsi, r14
mov qword [r13 + 0x270], rsi
jmp 0x14011d8b1
mov rsi, qword [r13 + 0x270]
mov r15, rdi
cmp r14, rsi
jle 0x14011d864
mov r9, rsi
lea rdx, str.WS:_unaligned_frame_size__sending__zu_instead_of__zu_
mov r8, r14
mov rcx, rbx
call fcn.140106050
mov rsi, rdi
mov qword [r13 + 0x270], rdi
jmp 0x14011d8b1
mov r8d, r15d
mov rdx, r14
mov rcx, rbx
call fcn.14011d500
mov r15, rax
mov r11, qword [rbx + 0xcb0]
test r14, r14
je 0x14011d905
mov r8, qword [rbx + 0x1b0]
mov r10, r11
sub r10, rbp
mov r9, r14
add r10, r15
mov eax, dword [r8 + 0x278]
lea rbp, [rbp + 1]
movzx ecx, byte [rax + r8 + 0x209]
xor cl, byte [rbp - 1]
mov byte [r10 + rbp - 1], cl
mov eax, dword [r8 + 0x278]
inc eax
and eax, 3
mov dword [r8 + 0x278], eax
sub r9, 1
jne 0x14011d8d0
cmp byte [rbx + 0xa89], dil
je 0x14011d92d
add r14, r15
lea r9, [rsp + 0x30]
mov r8, r14
mov rdx, r11
mov rcx, rbx
call fcn.1400e65e0
mov rbp, qword [rsp + 0x30]
mov esi, eax
jmp 0x14011d98c
mov r10, qword [rbx + 0x18]
mov dword [rsp + 0x30], edi
mov rax, qword [r10 + 0x350]
cmp rax, 0xffffffffffffffff
je 0x14011d950
mov edx, 1
cmp rax, qword [r10 + 0x1b0]
je 0x14011d952
mov edx, edi
lea rcx, [rsp + 0x30]
mov eax, edx
mov qword [rsp + 0x20], rcx
add r14, r15
mov rcx, rbx
mov r9, r14
mov r8, r11
call qword [r10 + rax*8 + 0x1c8]
mov rbp, rax
test rax, rax
js 0x14011d97f
mov r9, rax
jmp 0x14011d9ad
mov esi, dword [rsp + 0x30]
test esi, esi
je 0x14011d9d9
cmp esi, 0x51
je 0x14011d9a7
mov r9, rbp
lea rdx, str.WS:_wanted_to_send__zu_bytes__sent__zu_bytes
mov r8, r14
mov rcx, rbx
call fcn.140106050
test esi, esi
jne 0x14011d9f3
jmp 0x14011d9c1
mov rbp, rdi
mov r9, rdi
mov r8, r14
lea rdx, str.WS:_wanted_to_send__zu_bytes__sent__zu_bytes
mov rcx, rbx
mov esi, edi
call fcn.140106050
cmp rbp, r15
jbe 0x14011d9d1
sub rbp, r15
mov eax, esi
mov qword [r12], rbp
jmp 0x14011d9fc
mov qword [r12], rdi
mov eax, esi
jmp 0x14011d9fc
mov r9, rax
lea rdx, str.WS:_wanted_to_send__zu_bytes__sent__zu_bytes
mov r8, r14
mov rcx, rbx
mov esi, gethostname
call fcn.140106050
mov eax, esi
jmp 0x14011d9fc
mov eax, Ordinal_46
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401526c0
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret