Function at 0x1400d5e40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x140221290]
xor eax, dword [0x140221294]
add eax, 0x5be4f18a
and eax, 0x96527d29
xor eax, 0x80102100
add eax, 0x95d311aa
jb 0x1400d5eb0
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
sub rsp, 0x20
call fcn.1400d5520
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x140221298]
mov ecx, dword [0x14022129c]
mov edx, eax
and edx, ecx
or eax, ecx
add eax, edx
imul eax, eax, 0x3f230d3f
add eax, 0xc23e61a0
mov r12d, eax
xor r12d, 0xda7861c6
and r12d, eax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov rdi, rsp
mov r15, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
sub rsp, 0x20
mov rcx, r15
mov rdx, rbx
call fcn.140150750
add rsp, 0x20
cmp r12d, 0x4e066c9d
je 0x1400d5eb0
mov rcx, rax
mov r8, rdx
nop word cs:[rax + rax]
mov eax, dword [0x1402212a0]
mov edx, dword [0x1402212a4]
mov r9d, edx
not r9d
mov r10d, eax
and r10d, r9d
or r9d, eax
not r9d
imul r9d, r10d
mov r10d, eax
and r10d, edx
or eax, edx
imul eax, r10d
add eax, r9d
mov edx, eax
not edx
mov r9d, eax
and r9d, 0xa8a0f23d
and edx, 0x575f0dc2
imul edx, r9d
mov r9d, eax
and r9d, 0x575f0dc2
or eax, 0x575f0dc2
imul eax, r9d
add eax, edx
add eax, 0x566e394
not eax
and eax, 0x813300b1
add eax, 0xb42e557a
jb 0x1400d5f30
nop word cs:[rax + rax]
mov eax, dword [0x1402212a8]
xor edx, edx
div dword [0x1402212ac]
add eax, 0xf5a5014b
cmp eax, 0x1998d56f
jb 0x1400d5fb0
test rcx, rcx
je 0x1400d6660
nop word cs:[rax + rax]
mov eax, dword [0x1402212b0]
imul eax, dword [0x1402212b4]
mov edx, eax
not edx
and edx, 0xc6937444
and eax, 0x396c8bbb
sub eax, edx
and eax, 0xe565e48d
add eax, 0xa9cfcac7
cmp eax, 0xb4572a4f
jb 0x1400d5fe0
cmp r8, 2
jne 0x1400d6069
movzx eax, word [rcx]
nop dword [rax + rax]
mov edx, dword [0x1402212b8]
and edx, dword [0x1402212bc]
add edx, 0xee40af10
not edx
or edx, 0x42fac41f
cmp edx, 0x7777813a
jb 0x1400d6020
movzx eax, ax
cmp eax, 0x2e2e
jne 0x1400d6069
mov eax, 2
xor r9d, r9d
test rcx, rcx
cmovne r9, rcx
test r9, r9
jne 0x1400d6200
jmp 0x1400d6660
lea r9, [rcx + r8]
nop dword [rax]
mov eax, dword [0x1402212c0]
xor edx, edx
div dword [0x1402212c4]
mov edx, eax
xor edx, 0x82710404
xor eax, 0x48151
or edx, 0x448cb1d9
or eax, 0xbb734e26
and eax, edx
not eax
add eax, 0xdb0ce098
cmp eax, 0x532c25e7
jb 0x1400d6070
mov rax, r8
nop dword [rax]
mov r10, rax
nop word cs:[rax + rax]
mov eax, dword [0x1402212c8]
xor edx, edx
div dword [0x1402212cc]
mov edx, eax
not edx
or edx, 0xcbd72b29
or eax, 0x3428d4d6
and eax, edx
mov edx, eax
not edx
mov r11d, eax
and r11d, 0x2c04d450
and edx, 0xd3fb2baf
imul edx, r11d
mov r11d, eax
and r11d, 0xd3fb2baf
or eax, 0xd3fb2baf
imul eax, r11d
add eax, edx
xor eax, 0x6bafe1cd
cmp eax, 0x554c666d
jb 0x1400d60c0
cmp r9, rcx
je 0x1400d6172
mov eax, dword [0x1402212d0]
xor edx, edx
div dword [0x1402212d4]
add eax, 0x94c7cdc8
or eax, 0xef289aff
cmp eax, 0xd6fa862c
jb 0x1400d611d
cmp byte [r9 - 1], 0x2e
lea r9, [r9 - 1]
lea rax, [r10 - 1]
jne 0x1400d60b0
test rax, rax
je 0x1400d618b
sub r8, r10
mov r9, rcx
add r9, r10
test rcx, rcx
cmovne r9, rcx
test r9, r9
jne 0x1400d6200
jmp 0x1400d6660
mov r9, rcx
mov rax, r8
xor ecx, ecx
test rcx, rcx
cmovne r9, rcx
test r9, r9
jne 0x1400d6200
jmp 0x1400d6660
xor r9d, r9d
nop
mov eax, dword [0x1402212d8]
xor eax, dword [0x1402212dc]
mov edx, eax
and edx, 0x7a4d407d
and eax, 0x444004
add eax, eax
sub edx, eax
add edx, 0x545c86
mov eax, edx
not eax
mov r10d, edx
and r10d, 0x3faad67b
and eax, 0xc0552984
imul eax, r10d
mov r10d, edx
and r10d, 0xc0552984
or edx, 0xc0552984
imul edx, r10d
add edx, eax
cmp edx, 0xe0ea874d
ja 0x1400d6190
mov rax, r8
test rcx, rcx
cmovne r9, rcx
test r9, r9
je 0x1400d6660
nop dword [rax + rax]
mov edx, dword [0x1402212e8]
and edx, dword [0x1402212ec]
or edx, 0xd17786d7
mov r10d, edx
and r10d, 0x652dff6a
add r10d, r10d
neg r10d
add edx, r10d
add edx, 0xe52dff6a
imul r10, rdx, 0x3a4decb9
shr r10, 0x3d
test rcx, rcx
mov rdx, rax
cmove rdx, r8
cmp r10d, 0x173d59c2
je 0x1400d6200
add r9, rdx
nop dword [rax]
mov eax, dword [0x1402212f0]
xor edx, edx
div dword [0x1402212f4]
add eax, 0xd6f2e270
xor eax, 0xb249cf3d
add eax, 0x9a8ad37d
cmp eax, 0x47c573d1
jb 0x1400d6250
movabs rax, 0xc97971f5ecf1baa1
lea rcx, [r9 + rax]
sub rcx, r15
sub rcx, rax
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400d6290
cmp r9, r15
je 0x1400d63a8
xor eax, eax
nop
test al, al
jne 0x1400d62a0
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400d62b0
cmp rbx, rcx
jbe 0x1400d62d0
cmp byte [r15 + rcx], 0xbf
jg 0x1400d6340
jmp 0x1400d6636
mov eax, dword [0x1402212f8]
xor edx, edx
div dword [0x1402212fc]
mov edx, eax
not edx
or edx, 0x44260241
and eax, 0x3ad00c12
and edx, 0x442f9345
or edx, eax
mov eax, edx
not eax
mov r8d, eax
and r8d, 0xb91e
and edx, 0x3edd0641
imul edx, r8d
mov r8d, eax
and r8d, 0xbbd944a0
or eax, 0xbfdd46e1
imul eax, r8d
add eax, edx
cmp eax, 0xc4fada8a
je 0x1400d62d0
cmp rbx, rcx
jne 0x1400d6636
nop word cs:[rax + rax]
mov eax, dword [0x140221300]
xor edx, edx
div dword [0x140221304]
add eax, 0xa7c202ad
cmp eax, 0x4b605981
jb 0x1400d6340
mov eax, 0xf48872dd
nop
mov edx, dword [0x140221308]
mov r8d, dword [0x14022130c]
not edx
not r8d
or r8d, edx
not r8d
mov edx, r8d
and edx, 0xdbff884c
or r8d, 0xdbff884c
add r8d, edx
xor r8d, 0xf635e5c7
imul r8, rax
shr r8, 0x3e
cmp r8d, 0x12d542f8
je 0x1400d6360
cmp rbx, rcx
jb 0x1400d63af
mov qword [rsi + 0x10], rcx
mov rbx, rcx
mov rcx, qword [rsi]
mov rax, rcx
not rax
and rax, rbx
mov rdx, rbx
not rdx
and rdx, rcx
sub rdx, rax
cmp rdx, 3
ja 0x1400d67fd
nop word cs:[rax + rax]
mov eax, dword [0x140221328]
add eax, dword [0x14022132c]
xor eax, 0x96751a61
add eax, 0x9e41e3d4
imul rax, rax, 0x756f844f
shr rax, 0x3e
cmp eax, 0x7c6c6b53
je 0x1400d63e0
mov eax, 0xf2a9da6d
nop dword [rax]
mov edx, dword [0x140221330]
mov r8d, dword [0x140221334]
mov r9d, edx
not r9d
and r9d, r8d
not r8d
and r8d, edx
sub r8d, r9d
mov edx, r8d
xor edx, 0x10860840
and edx, 0x56860dd0
xor r8d, 0xcf4187b8
lea edx, [r8 + rdx*2]
imul rdx, rax
shr rdx, 0x3d
cmp edx, 0xd9860888
ja 0x1400d6410
cmp rbx, 0xfffffffffffffffb
ja 0x1400d6861
add rbx, 4
nop word [rax + rax]
mov eax, dword [0x140221338]
mov edx, dword [0x14022133c]
mov r8d, eax
and r8d, edx
or eax, edx
add eax, r8d
mov edx, eax
and edx, 0x2028c500
and eax, 0x20008400
mov r8d, edx
xor r8d, 0x49695b1c
add r8d, edx
sub r8d, eax
cmp r8d, 0x63cd5a14
jb 0x1400d6470
mov r8, rbx
not r8
shr r8, 0x3f
nop word [rax + rax]
mov eax, dword [0x140221340]
mov edx, dword [0x140221344]
mov r9d, edx
and r9d, eax
add eax, edx
sub eax, r9d
xor eax, 0xfe5abb47
imul rdx, rax, 0x3c44fee9
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1c
imul eax, eax, 0x366aff3b
cmp eax, 0xc2272e75
je 0x1400d64c0
mov eax, dword [0x140221348]
xor edx, edx
div dword [0x14022134c]
nop dword [rax + rax]
mov eax, dword [0x140221350]
and eax, dword [0x140221354]
or eax, 0xdffa87e9
add eax, 0xb5b979fe
cmp eax, 0xa451022e
jb 0x1400d6510
test rcx, rcx
je 0x1400d662f
mov eax, dword [0x140221358]
mov edx, dword [0x14022135c]
add eax, edx
add eax, 0x13c5309e
mov edx, eax
not edx
mov r9d, eax
and r9d, 0x76b99979
and edx, 0x89466686
imul edx, r9d
mov r9d, eax
and r9d, 0x89466686
or eax, 0x89466686
imul eax, r9d
add eax, edx
cmp eax, 0x5265c563
jne 0x1400d6580
mov qword [r14], r15
mov eax, dword [0x140221360]
mov edx, dword [0x140221364]
mov r9d, edx
not r9d
mov r10d, eax
and r10d, r9d
or r9d, eax
not r9d
imul r9d, r10d
mov r10d, eax
and r10d, edx
or eax, edx
imul eax, r10d
add eax, r9d
mov edx, eax
and edx, 0xac3e95a
mov r9d, edx
not r9d
and r9d, 0xd9bc1ba3
mov r10d, eax
and r10d, 0x243e058
imul r10d, r9d
and eax, 0x8800902
or edx, 0xd9bc1ba3
imul edx, eax
add edx, r10d
and edx, 0xed4b8836
mov qword [r14], r15
cmp edx, 0xbb9b0f0d
je 0x1400d6580
mov eax, dword [0x140221368]
mov edx, dword [0x14022136c]
mov r9d, eax
and r9d, edx
add r9d, r9d
add eax, edx
sub eax, r9d
or eax, 0xa0e0c300
xor eax, 0x82418320
or eax, 0x5d1e3c9e
cmp eax, 0x6892e8d0
jae 0x1400d66f8
jmp 0x1400d6732
xor eax, eax
jmp 0x1400d673d
mov eax, dword [0x140221310]
and eax, dword [0x140221314]
add eax, 0xa996f6c1
imul rax, rax, 0x319b71bb
shr rax, 0x3d
or eax, 0xbf53084c
cmp eax, 0xf3e36dcb
jbe 0x1400d669d
jmp 0x1400d66c9
mov eax, dword [0x1402212e0]
mov ecx, dword [0x1402212e4]
add eax, ecx
add eax, 0xda84554b
mov ecx, eax
xor ecx, 0xc80e78ed
and ecx, eax
imul rax, rcx, 0x65b6d4bb
shr rax, 0x3d
cmp eax, 0xe728696c
ja 0x1400d6660
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x140221318]
add eax, dword [0x14022131c]
mov ecx, eax
xor ecx, 0xaf0ae64
and ecx, eax
add ecx, 0xadade51
and ecx, 0x8d2892c
ud2
ud2
mov eax, dword [str.fgm_a]
mov edx, dword [0x140221374]
mov r9d, eax
not r9d
and r9d, edx
not edx
and edx, eax
sub edx, r9d
add edx, 0xf114e988
and edx, 0x1f925278
xor edx, 0x16805278
mov qword [r14 + 0x10], rcx
cmp edx, 0xe463ec19
jbe 0x1400d6738
mov qword [r14 + 0x10], rcx
jmp 0x1400d66f8
mov eax, 1
mov qword [r14 + 8], rax
sub rsp, 0x20
mov rcx, rdi
mov rdx, r8
mov r8, rbx
mov r9, r14
call fcn.140150370
add rsp, 0x20
cmp qword [rdi], 0
jne 0x1400d6823
mov eax, dword [0x140221380]
sub eax, dword [0x140221384]
imul rax, rax, 0x7c0e9959
shr rax, 0x3c
or eax, 0xa751c5fc
and eax, 0xa751c5fe
cmp eax, 0xd809e470
jne 0x1400d67a0
mov rax, qword [rdi + 8]
mov qword [rsi + 8], rax
nop word cs:[rax + rax]
mov eax, dword [0x140221388]
xor edx, edx
div dword [0x14022138c]
add eax, 0x60db6599
mov ecx, eax
not ecx
and ecx, 0xc81350f8
and eax, 0x37ecaf07
sub eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x27c52a1c
and ecx, 0xd83ad5e3
imul ecx, edx
mov edx, eax
and edx, 0xd83ad5e3
or eax, 0xd83ad5e3
imul eax, edx
add eax, ecx
mov rcx, qword [rdi + 8]
mov qword [rsi + 8], rcx
cmp eax, 0xb4ff7db2
ja 0x1400d67a0
mov qword [rsi], rbx
mov eax, dword [0x140221398]
and eax, dword [0x14022139c]
add eax, 0xbcb529dd
or eax, 0xbfa3f3d7
cmp eax, 0x5adc49a4
jne 0x1400d689d
jmp 0x1400d6900
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400d6830
nop word cs:[rax + rax]
mov eax, dword [0x140221378]
mov ecx, dword [0x14022137c]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
and eax, 0x20045524
cmp eax, 0x21600985
je 0x1400d6840
ud2
mov eax, dword [0x1402213a0]
mov ecx, dword [0x1402213a4]
mov edx, eax
xor edx, ecx
not edx
and edx, ecx
add edx, edx
sub ecx, edx
lea edx, [rax + rcx]
add edx, 0xa4a45795
add eax, ecx
not edx
or edx, 0xf0d3234
add eax, edx
add eax, 0xa4a45795
imul edi, eax, 0x2099ba07
add edi, 0x2099ba07
sub rsp, 0x20
lea rdx, [0x140207113]
mov r8d, 1
mov rcx, rsi
call fcn.1400c1020
add rsp, 0x20
cmp edi, 0x3ccaf67c
jbe 0x1400d6922
sub rsp, 0x20
lea rdx, [0x140207113]
mov r8d, 1
mov rcx, rsi
call fcn.1400c1020
add rsp, 0x20
jmp 0x1400d689d
mov eax, dword [0x1402213a8]
mov ecx, dword [0x1402213ac]
mov edx, eax
not edx
mov r8d, ecx
not r8d
mov r9d, edx
and r9d, 0xb2f677cf
and eax, 0x4d098830
or eax, r9d
or edx, r8d
and r8d, 0xb2f677cf
and ecx, 0x4d098830
or ecx, r8d
xor ecx, eax
not edx
or edx, ecx
mov eax, 0xbdf696b1
imul rax, rdx
shr rax, 0x3f
add eax, 0xf0a239e7
xor eax, 0x10726184
cmp eax, 0x849ba030
jae 0x1400d699e
sub rsp, 0x20
lea rdx, str.exe.NULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
mov r8d, 3
mov rcx, rsi
call fcn.1400c1020
add rsp, 0x20
lea rdi, str.exe.NULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
nop word cs:[rax + rax]
mov eax, dword [0x1402213b0]
xor edx, edx
div dword [0x1402213b4]
imul ebx, eax, 0xb4ab52db
mov eax, ebx
not eax
mov ecx, ebx
or ecx, 0x4c51b923
mov edx, ecx
and edx, 0xbb550aa
and eax, 0xb00a0654
imul eax, edx
and ecx, 0xf44aaf55
or ebx, 0xfc5bbf77
imul ebx, ecx
add ebx, eax
sub rsp, 0x20
mov r8d, 3
mov rcx, rsi
mov rdx, rdi
call fcn.1400c1020
add rsp, 0x20
cmp ebx, 0x57455903
ja 0x1400d69b0
nop word cs:[rax + rax]
mov eax, dword [0x1402213b8]
sub eax, dword [0x1402213bc]
add eax, 0x894cc0bf
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x593fbadf
and ecx, 0xa6c04520
imul ecx, edx
mov edx, eax
and edx, 0xa6c04520
or eax, 0xa6c04520
imul eax, edx
add eax, ecx
and eax, 0xc9f7a1c0
cmp eax, 0xd858374a
jae 0x1400d6a20
jmp 0x1400d6660