Function at 0x18001e820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x50
mov ebx, dword [rdx + 0x20]
mov r13, rdx
movzx eax, byte [rdx + 0x2b]
mov r14, r8
mov rdx, qword [rsp + 0xa8]
mov rsi, r9
mov rbp, rcx
movzx r8d, byte [rdx + 2]
test eax, eax
jne 0x18001eb67
mov rax, qword [rcx + r8*8 + 0x4a8]
mov r15, qword [rsp + 0xa0]
mov qword [rsp + 0x88], rax
movzx eax, byte [rdx + 3]
shr al, 1
and al, 3
jne 0x18001ebb4
add rsi, 0x10
mov qword [rsp + 0x80], rdi
xor edx, edx
mov qword [rsp + 0x90], r12
mov rax, rsi
mov qword [r14], r13
shr rax, 4
lea r8, [r14 + r15]
mov qword [rsp + 0x40], rax
movabs rcx, 0x1ffffffffffffffc
lea rax, [r15 - 0x40]
mov r15, qword [0x18015d458]
div rsi
mov eax, eax
add rax, 0x1f
shr rax, 3
and rax, rcx
xor ecx, ecx
add rax, 0x40
mov edi, ecx
and rax, 0xfffffffffffffff0
lea rcx, [rsi + 8]
mov qword [rsp + 0x48], rax
add rax, r14
add rcx, rax
cmp rcx, r8
ja 0x18001e92f
nop dword [rax]
mov edx, eax
mov rcx, rax
shr rcx, 4
sub edx, r14d
shl edx, 0xc
xor edx, ecx
movzx ecx, di
xor edx, dword [rbp + 0x18]
inc edi
and dword [rax + 0xc], 0xff0000ff
xor edx, r15d
shl ecx, 8
or dword [rax + 0xc], ecx
lea rcx, [rsi + 8]
mov dword [rax + 8], edx
mov byte [rax + 0xf], 0x80
add rax, rsi
add rcx, rax
cmp rcx, r8
jbe 0x18001e8f0
mov esi, edi
lea r12, [r14 + 0x30]
xor edx, edx
mov qword [r14 + 0x20], rsi
mov rcx, r12
mov qword [r14 + 0x28], r12
lea r8, [rsi + 7]
shr r8, 3
call sym.ntdll.dll_memset
mov ecx, edi
and ecx, 0x3f
je 0x18001e96c
mov eax, 1
shr rsi, 6
shl rax, cl
dec rax
not rax
or qword [r12 + rsi*8], rax
mov rax, qword [rsp + 0xa8]
xor r9d, r9d
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov word [r13 + 0x24], cx
mov word [r13 + 0x28], di
mov qword [r13], r8
movzx eax, byte [rax + 2]
mov byte [r13 + 0x2a], al
lea rax, [r13 + 0x10]
mov word [r13 + 0x26], r9w
mov qword [r13 + 8], r14
test al, 0xf
jne 0x1800ab67a
xor edx, edx
shl cx, 4
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov rax, qword [rsp + 0x48]
mov word [rsp + 0xa8], ax
mov eax, ebp
xor eax, r14d
mov word [rsp + 0xaa], cx
xor eax, r15d
xor eax, dword [rsp + 0xa8]
mov dword [r14 + 0x18], eax
mov eax, dword [r8 + 0xa4]
test eax, eax
je 0x18001eb85
inc word [r8 + 0xb0]
cmp word [r8 + 0xb0], 0x1c
ja 0x18001eba5
mov rax, qword [r8 + 0xa0]
mov rdx, rax
shr rdx, 0x20
inc edx
lea ecx, [rax + rdi]
mov dword [rsp + 0xa8], ecx
mov rcx, rax
shr rcx, 0x20
dec ecx
test edi, edi
cmovg ecx, edx
mov dword [rsp + 0xac], ecx
mov rcx, qword [rsp + 0xa8]
lock cmpxchg qword [r8 + 0xa0], rcx
jne 0x18001ea12
mov rax, qword [r8]
lea rsi, [0x18015a460]
mov r9d, 0xff
inc dword [rax + 0x20]
mov eax, dword [rax + 0x20]
mov dword [r8 + 0xa8], eax
mov rdx, qword gs:[0x30]
movzx ecx, word [rdx + 0x17b2]
mov r8d, ecx
inc cx
and cx, r9w
lea eax, [rcx + 1]
and ax, r9w
mov word [rdx + 0x17b2], ax
xor edx, edx
movzx eax, cx
movzx ecx, byte [r8 + rsi]
mov dword [r13 + 0x2c], 1
movzx eax, byte [rax + rsi]
shl ax, 7
movzx eax, ax
or eax, ecx
div edi
mov eax, ebx
shl edx, 0x10
mov dword [rsp + 0xa8], edx
mov word [rsp + 0xa8], di
mov ecx, dword [rsp + 0xa8]
lock cmpxchg dword [r13 + 0x20], ecx
test byte [0x18015d040], 2
jne 0x18001eb23
mov rax, qword gs:[0x30]
movzx ebx, word [rax + 0x17b2]
call fcn.18001ebf0
mov edi, eax
shl rdi, 0x20
call fcn.18001ebf0
mov ecx, eax
movabs rax, 0x7f7f7f7f7f7f7f7f
or rcx, rdi
and rcx, rax
mov eax, ebx
shr rax, 3
and eax, 0x1f
mov qword [rsi + rax*8], rcx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
test rcx, rcx
jne 0x1800ab685
mov ecx, 0x7ffe0380
cmp byte [rcx], 0
jne 0x1800ab6aa
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
lea rcx, [rax + rax*2]
mov rax, qword [rbp + r8*8 + 0x8b0]
add rax, 0xffffffffffffff40
shl rcx, 6
add rax, rcx
jmp 0x18001e861
mov rcx, qword [r8]
mov eax, dword [rcx + 0x24]
cmp eax, 0x20
jb 0x18001eb9d
mov word [r8 + 0xb0], r9w
jmp 0x18001ea12
add eax, 4
mov dword [rcx + 0x24], eax
jmp 0x18001eb90
mov rcx, qword [r8]
mov eax, dword [rcx + 0x24]
test eax, eax
je 0x18001eb90
add eax, 0xfffffffc
jmp 0x18001eba0
mov qword [rsp + 0x30], rdx
mov r8, r14
mov qword [rsp + 0x28], r15
mov rdx, r13
movzx r9d, al
mov rcx, rbp
mov qword [rsp + 0x20], rsi
call fcn.18010275c
test eax, eax
je 0x18001e87f
jmp 0x18001eb52
mov ecx, 0x80000002
call sym.ntdll.dll_RtlRaiseStatus
int3
cmp dword [rcx], 0
je 0x18001eb3c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x226
jmp 0x18001eb41
mov rax, qword gs:[0x60]
test byte [rax + 0x378], 1
je 0x18001eb4a
movzx r8d, word [r13 + 0x24]
movzx ecx, byte [r13 + 0x2b]
movzx r9d, word [r13 + 0x28]
mov rdx, qword [r13 + 8]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp + 0x18]
call fcn.1800fe7e4
nop
jmp 0x18001eb4a