Function at 0x1401e3fe0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov qword [rbp - 8], r8
mov qword [rbp], rdx
mov rsi, rcx
mov eax, dword [0x1415ceb30]
mov ecx, dword [0x1415ceb34]
mov edx, ecx
not edx
and edx, eax
xor ecx, eax
add ecx, eax
sub ecx, edx
mov eax, ecx
xor eax, 0x1409ab9
xor ecx, 0x8dfb20f2
and ecx, eax
cmp ecx, 0x84be9f3b
ja 0x1401e4069
mov eax, dword [0x1415ceb38]
add eax, dword [str.Y8c_tg]
imul eax, eax, 0xd35ff3fa
and eax, 0xc58c83e0
imul rcx, rax, 0x49243d85
shr rcx, 0x3d
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov r15, rsp
cmp ecx, 0x8208df01
jne 0x1401e4078
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
jmp 0x1401e402f
mov rbx, r9
shr rbx, 1
movabs r10, 0x7ffffffffffffffd
mov eax, dword [0x1415ceb40]
xor edx, edx
div dword [0x1415ceb44]
lea r14, [rbx + 1]
nop word [rax + rax]
mov eax, dword [0x1415ceb48]
mov ecx, dword [0x1415ceb4c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x68a11a64
and ecx, 0x975ee59b
imul ecx, edx
mov edx, eax
and edx, 0x975ee59b
or eax, 0x975ee59b
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xbbb9b844
and ecx, eax
add ecx, 0xb7b4082d
cmp ecx, 0x8c33d9e7
jb 0x1401e40a0
mov qword [rbp - 0x10], r9
cmp r9, r10
ja 0x1401e4155
lea r12, [r14 + r14]
mov eax, dword [0x1415ceb60]
mov ecx, dword [str._B]
mov edx, eax
not edx
and eax, ecx
not ecx
or ecx, edx
not eax
and eax, ecx
not eax
imul eax, eax, 0xf9d889b6
and eax, 0x546d9e4c
imul eax, eax, 0x84705fcd
cmp eax, 0x817358c1
jbe 0x1401e41da
jmp 0x1401e423a
mov eax, dword [0x1415ceb50]
xor eax, dword [0x1415ceb54]
lea ecx, [rax - 0xfbd3c22]
mov edx, ecx
and edx, 0xc67d9c7
xor ecx, 0xf3982638
add eax, ecx
add eax, 0xf042c3de
sub eax, edx
add eax, 0x28833c7c
cmp eax, 0x60131c1e
jbe 0x1401e4190
ud2
mov eax, dword [0x1415ceb58]
imul eax, dword [0x1415ceb5c]
mov ecx, eax
not ecx
and ecx, 0x2b2fdccc
mov edx, eax
and edx, 0xd4d02333
imul edx, ecx
mov ecx, eax
and ecx, 0x2b2fdccc
or eax, 0x2b2fdccc
imul eax, ecx
add eax, edx
imul eax, eax, 0xc4befeb8
xor eax, 0x1b90fde
ud2
ud2
mov eax, dword [0x1415ceb68]
mov ecx, dword [0x1415ceb6c]
not eax
not ecx
or ecx, eax
not ecx
shr ecx, 3
imul r13, rcx, 0x13c3648d
shr r13, 0x36
add r13d, 0xe5238c35
mov eax, r13d
xor eax, 0x14a74db8
and r13d, 0x61008047
add r13d, r13d
sub r13d, eax
movzx eax, byte [0x1415d3950]
sub rsp, 0x20
xor ecx, ecx
mov rdx, r12
call fcn.1401b5e70
add rsp, 0x20
cmp r13d, 0x3d75c9c7
jne 0x1401e4255
movzx eax, byte [0x1415d3950]
sub rsp, 0x20
xor ecx, ecx
mov rdx, r12
call fcn.140219830
add rsp, 0x20
jmp 0x1401e41da
mov rdi, rax
nop dword [rax + rax]
mov eax, dword [0x1415ceb70]
mov ecx, dword [0x1415ceb74]
mov edx, eax
and edx, ecx
or eax, ecx
add eax, edx
imul eax, eax, 0x12556dab
or eax, 0x6319fbf3
xor eax, 0x7e1686d4
cmp eax, 0x76f97f5f
ja 0x1401e4260
test rdi, rdi
mov r13, qword [rbp - 0x10]
je 0x1401e41d8
mov eax, 0xf30f01e1
nop dword [rax]
mov ecx, dword [0x1415ceb78]
mov edx, dword [0x1415ceb7c]
mov r8d, edx
not r8d
mov r9d, ecx
and r9d, r8d
or r8d, ecx
not r8d
imul r8d, r9d
mov r9d, ecx
and r9d, edx
or ecx, edx
imul ecx, r9d
add ecx, r8d
imul ecx, ecx, 0x251030af
add ecx, 0xc9856d2c
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x876e50e8
ja 0x1401e42a0
mov qword [r15], 0
sub rsp, 0x30
mov qword [rsp + 0x20], r15
mov rcx, qword [rbp]
mov rdx, qword [rbp - 8]
mov r8, rdi
mov r9, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add rsp, 0x30
movabs r12, 0x7ffffffffffffffd
nop
mov ecx, dword [0x1415ceb80]
imul ecx, dword [0x1415ceb84]
add ecx, 0xea9e2108
mov edx, ecx
and edx, 0x745f1727
or ecx, 0x745f1727
add ecx, edx
mov edx, ecx
xor edx, 0xfc77a04d
add edx, ecx
and ecx, 0x3885fb2
sub edx, ecx
cmp edx, 0x7890f881
jb 0x1401e4320
test eax, eax
je 0x1401e44ab
nop word cs:[rax + rax]
mov eax, dword [0x1415ceb88]
xor edx, edx
div dword [0x1415ceb8c]
and eax, 0x2f1d3385
xor eax, 0x9e9161d3
add eax, 0x68765009
cmp eax, 0xfb8b809a
ja 0x1401e4370
mov rcx, qword [r15]
nop word [rax + rax]
mov eax, dword [0x1415ceb90]
xor edx, edx
div dword [0x1415ceb94]
mov edx, eax
not edx
mov r8d, eax
and r8d, 0x10e05d54
and edx, 0xef1fa2ab
imul edx, r8d
mov r8d, eax
and r8d, 0xef1fa2ab
or eax, 0xef1fa2ab
imul eax, r8d
add eax, edx
cmp eax, 0xcc0ca73e
je 0x1401e43a0
mov eax, 0xaf8d113d
nop word [rax + rax]
mov edx, dword [0x1415ceb98]
or edx, dword [0x1415ceb9c]
xor edx, 0xa6902239
imul rdx, rax
shr rdx, 0x3e
or edx, 0x422e791c
cmp edx, 0x80cbcd29
ja 0x1401e43f0
cmp rcx, r13
jne 0x1401e451d
mov eax, dword [0x1415ceba8]
mov ecx, dword [0x1415cebac]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, eax
not ecx
and ecx, 0xf9f28a92
mov edx, eax
and edx, 0x60d756d
imul edx, ecx
mov ecx, eax
and ecx, 0xf9f28a92
or eax, 0xf9f28a92
imul eax, ecx
add eax, edx
mov ecx, eax
not ecx
and ecx, 0x63f3ee5
mov edx, eax
and edx, 0xf9c0c11a
imul edx, ecx
mov ecx, eax
and ecx, 0x63f3ee4
or eax, 0x63f3ee5
imul eax, ecx
add eax, edx
cmp eax, 0x33c06e02
jne 0x1401e460e
jmp 0x1401e462e
xor eax, eax
test al, al
je 0x1401e44be
sub rsp, 0x20
call sub.KERNEL32.dll_GetLastError
add rsp, 0x20
lea rbx, [0x14159f13a]
nop word cs:[rax + rax]
mov eax, dword [0x1415ceba0]
mov ecx, eax
not ecx
or ecx, dword [0x1415ceba4]
add eax, ecx
inc eax
mov r14d, eax
xor r14d, 0x4a0bc044
and r14d, eax
or r14d, 0xa5743e0a
add r14d, 0xf9f8f524
sub rsp, 0x20
call sub.KERNEL32.dll_GetLastError
add rsp, 0x20
cmp r14d, 0x60531a60
jbe 0x1401e44d0
mov r14d, 0x1b
jmp 0x1401e452a
mov r14d, 0x3a
lea rbx, [0x14159f100]
mov eax, dword [0x1415cebd8]
or eax, dword [str._b_O_]
mov ecx, eax
xor ecx, 0xee622e78
and ecx, eax
add ecx, 0xac93bcc8
mov eax, ecx
not eax
and eax, 0x24575549
mov edx, ecx
and edx, 0xdba8aab6
imul edx, eax
mov eax, ecx
and eax, 0x24575549
or ecx, 0x24575549
imul ecx, eax
add ecx, edx
cmp ecx, 0x4fdcb04
je 0x1401e45df
mov eax, dword [0x1415cebe0]
xor eax, dword [0x1415cebe4]
and eax, 0x94047ccc
mov r15d, eax
xor r15d, 0x10040080
or eax, 0x30c40182
or r15d, 0x20c02d42
and r15d, eax
not r15d
or r15d, 0xc50bd01c
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r14
lea rax, [r12 + 3]
mov qword [rsi], rax
mov rcx, qword [0x1415d3918]
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp r15d, 0xd095f659
jbe 0x1401e4700
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r14
lea rax, [r12 + 3]
mov qword [rsi], rax
mov rcx, qword [0x1415d3918]
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1401e4574
mov eax, dword [0x1415cebb0]
xor edx, edx
div dword [0x1415cebb4]
and eax, 0x110001
mov word [rdi + rbx*2], 0
cmp eax, 0xcacc34be
jne 0x1401e4636
mov word [rdi + rbx*2], 0
jmp 0x1401e460e
mov eax, dword [0x1415cebb8]
add eax, dword [0x1415cebbc]
not eax
or eax, 0xf6ec994e
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x9016290
and eax, 0x36968d67
imul eax, edx
mov edx, ecx
and edx, 0x120421
or ecx, 0x36968d67
imul ecx, edx
add ecx, eax
not ecx
and ecx, 0x4024fd7b
cmp ecx, 0x7a72cb39
ja 0x1401e46b6
mov eax, dword [0x1415cebc0]
and eax, dword [0x1415cebc4]
add eax, 0x917e97c1
mov ecx, eax
xor ecx, 0x2063c089
and ecx, eax
not ecx
or ecx, 0x5f042f56
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
cmp ecx, 0x8e8d557a
jne 0x1401e46d0
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x1401e4680
mov eax, dword [0x1415cebc8]
add eax, dword [0x1415cebcc]
mov ecx, eax
and ecx, 0x1d004652
xor ecx, 0x1a51c7f9
and eax, 0x5000002
add eax, eax
sub eax, ecx
or eax, 0xc52f901f
cmp eax, 0xbba6aaa8
je 0x1401e46d0
nop
mov eax, dword [0x1415cebd0]
mov ecx, dword [0x1415cebd4]
mov edx, eax
not edx
or eax, ecx
not ecx
and ecx, edx
not ecx
and ecx, eax
or ecx, 0x76cef9c8
shr ecx, 3
imul rax, rcx, 0x286cdee7
shr rax, 0x35
cmp eax, 0x2bb37331
je 0x1401e4700
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret