Function at 0x14001b840
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov eax, dword [0x140042b4c]
mov edi, 0x2d3
mov dword [rsp + 0x24], eax
movzx eax, byte [0x140042b48]
xor al, 0x4f
mov dword [rsp + 0x34], 0x4d0
mov byte [0x140042b57], al
movzx eax, byte [0x140042b6c]
add al, 0x38
or byte [0x140042b54], al
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
cmp dword [0x140042a88], 1
mov r8d, 0x196
mov r9d, dword [0x140042b34]
movzx ecx, byte [0x140042b81]
sete r10b
movzx edx, byte [0x140042b55]
xor ebx, ebx
lea eax, [r9 - 0x23c]
mov dword [0x140042a8c], eax
and cl, r10b
mov dword [0x140042b5c], ebx
test r9d, r9d
setne al
or dl, al
sub r8, 1
jne 0x14001b8c1
mov byte [0x140042b81], cl
mov byte [0x140042b55], dl
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, dword [0x140042b44]
mov eax, 0x7b
and edx, dword [0x140042b2c]
movzx ebp, byte [0x140042a87]
mov r8d, dword [0x140042b48]
mov ecx, ebp
mov dword [0x140042b44], edx
and ecx, 1
nop word [rax + rax]
xor r8d, ecx
sub rax, 1
jne 0x14001b920
mov r9d, dword [0x140042b68]
movzx eax, r8b
movzx r12d, byte [0x140042b54]
mov r13d, r9d
movzx esi, byte [0x140042b65]
and r13d, 0x3ed
movzx r10d, byte [0x140042a62]
cmp r12b, 0x96
mov dword [0x140042b48], r8d
sete cl
xor al, 0x9f
lea r14d, [rsi + 0x90]
mov byte [rsp + 0xb0], al
mov byte [0x140042b81], al
mov eax, 0x46f
mov dword [rsp + 0x20], r14d
or r10b, cl
sub rax, 1
jne 0x14001b983
or dword [0x140042b84], 1
lea r11d, [rax + 1]
movzx r15d, byte [0x140042a86]
mov byte [0x140042a62], r10b
test r15b, r15b
je 0x14001b9bd
movzx ecx, r12b
mov eax, 0xfffffb38
shr eax, cl
test eax, eax
mov eax, r11d
jne 0x14001b9bf
mov eax, ebx
xor r9d, eax
mov ecx, r14d
movzx eax, byte [0x140042b57]
mov r14d, dword [0x140042b6c]
inc al
mov byte [rsp + 0xa0], al
movzx eax, byte [0x140042b83]
shl eax, cl
sar eax, 0x1f
sub r13d, eax
cmp edx, dword [rsp + 0x24]
mov dword [rsp + 0x38], r13d
sete al
and sil, al
mov byte [0x140042b65], sil
cmp ecx, 0x96
jne 0x14001ba7d
cmp byte [0x140042b55], bl
je 0x14001ba7d
movsx eax, byte [0x140042b66]
inc r10b
imul ecx, eax, 0x15
mov eax, 0xcccccccd
mov byte [0x140042a62], r10b
mul ecx
imul ecx, r14d, 0x96
mov eax, edx
shr eax, 2
mov dword [rsp + 0x24], eax
mov eax, dword [0x140042b78]
sub eax, dword [0x140042b30]
mov dword [rsp + 0x28], eax
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], ecx
movzx ecx, byte [0x140042b64]
sar eax, 0x1f
and al, r15b
and cl, al
mov byte [rsp + 0xb8], cl
mov ecx, dword [rsp + 0x28]
jmp 0x14001ba95
movzx eax, byte [0x140042b64]
mov ecx, dword [0x140042b78]
mov byte [rsp + 0xb8], al
mov dword [rsp + 0x28], ecx
movzx eax, cl
mov ecx, dword [0x140042b28]
xor al, 0x84
mov dword [rsp + 0x2c], ecx
add r12b, al
movzx eax, sil
imul r15d, eax, 0x4c8
mov eax, 0x55555556
mov byte [rsp + 0xa8], r12b
mov r12d, 0xe
imul r15d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub r15d, eax
movzx eax, r15b
mov dword [rsp + 0x30], eax
movsx eax, byte [0x140042a63]
test eax, 0x7ff
jne 0x14001bb00
mov eax, 0x277
mov edx, r12d
sub eax, ecx
mov esi, ebx
movzx ecx, al
shr edx, cl
test edx, edx
je 0x14001bb03
mov esi, r11d
mov edx, dword [0x140042b4c]
add edx, 7
mov dword [rsp + 0x40], edx
test r9d, r9d
jne 0x14001bb22
test r8d, r8d
jne 0x14001bb22
mov ecx, dword [0x140042b7c]
jmp 0x14001bb68
mov eax, dword [0x140042b40]
xor r13d, r11d
mov ecx, dword [0x140042b7c]
inc eax
movsx r9d, byte [0x140042b55]
and ecx, eax
movzx eax, byte [0x140042b80]
and r9d, edi
xor r9d, dword [rsp + 0x20]
or eax, edx
or eax, 0x29b
mov dword [rsp + 0x38], r13d
sub esi, eax
mov eax, dword [rsp + 0x30]
or eax, dword [0x140042a88]
mov dword [rsp + 0x2c], eax
lea eax, [r13 + 0x149]
mov r13d, 0xac
or ecx, eax
mov eax, 0xaaaaaaab
mov dword [rsp + 0x3c], ecx
imul ecx, dword [0x140042b84], 7
add ecx, dword [rsp + 0x24]
mul ecx
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x14001bc11
sub ecx, r11d
je 0x14001bbf0
sub ecx, r11d
je 0x14001bbe4
cmp ecx, r11d
je 0x14001bbb6
mov eax, dword [rsp + 0x2c]
xor eax, 0x277
and dword [0x140042a8c], eax
jmp 0x14001bc1d
cmp dword [0x140042b40], ebx
je 0x14001bbc6
mov eax, r11d
test r15b, r15b
jne 0x14001bbc8
mov eax, ebx
movzx ecx, byte [rsp + 0xb0]
mov r14d, ebx
add cl, al
mov byte [rsp + 0xb0], cl
mov byte [0x140042b81], cl
jmp 0x14001bc1d
mov r14d, dword [0x140042b3c]
and r14d, r13d
jmp 0x14001bc1d
mov ecx, dword [rsp + 0x2c]
cmp esi, 0x4c8
sete al
dec ecx
xor byte [0x140042b56], al
add r8d, ecx
mov dword [0x140042b48], r8d
jmp 0x14001bc1d
xor r9d, dword [rsp + 0x30]
xor r9d, dword [0x140042b4c]
movsx eax, byte [rsp + 0xb8]
mov ecx, dword [rsp + 0x40]
or eax, 0x1e1
movzx edx, byte [rsp + 0xa8]
xor r14d, eax
shl r12d, cl
mov eax, 0x30
mov dword [0x140042b6c], r14d
and r12d, edx
nop dword [rax + rax]
sub r9d, r12d
sub rax, r11
jne 0x14001bc50
sub dword [rsp + 0x30], edx
mov eax, ebx
mov r12d, dword [rsp + 0x38]
setne al
movsx ecx, r10b
add r12d, eax
mov dword [0x140042b68], r9d
mov eax, dword [0x140042b34]
shr eax, 1
add esi, eax
mov dword [0x140042b58], r12d
mov dword [0x140042b5c], esi
cmp ecx, r13d
jle 0x14001bca4
movzx eax, byte [rsp + 0xa0]
xor r9d, eax
mov dword [0x140042b68], r9d
jmp 0x14001bcac
movzx eax, byte [rsp + 0xa0]
mov ecx, dword [0x140042b3c]
mov r10d, dword [0x140042b30]
and cl, 0x77
movzx r9d, byte [0x140042b82]
add al, cl
mov byte [rsp + 0xa0], al
add r10d, 0x2b
mov byte [0x140042b57], al
mov ecx, esi
mov eax, 0xcccccccd
mov dword [0x140042b2c], ebx
mul r10d
shr edx, 2
lea eax, [rdx + rdx*4]
movzx edx, byte [0x140042b80]
sub ecx, eax
and edx, 3
movzx eax, byte [rsp + 0xa8]
add r10d, ecx
mov ecx, dword [rsp + 0x2c]
inc al
mov byte [rsp + 0xb8], al
add ecx, 0xffffff54
movzx eax, byte [0x140042b83]
mov dword [0x140042b60], eax
mov eax, r9d
xor eax, r11d
mov dword [rsp + 0x38], edx
and dword [0x140042b40], eax
lea eax, [rdx - 0x277]
or ecx, eax
je 0x14001bd49
cmp dword [0x140042b4c], ebx
mov eax, r11d
jne 0x14001bd4b
mov eax, ebx
or byte [0x140042b55], al
mov edx, ebx
mov ecx, dword [rsp + 0x28]
movsx eax, byte [0x140042b88]
and eax, r10d
sub ecx, eax
mov eax, r8d
mov dword [rsp + 0x28], ecx
mov dword [0x140042b78], ecx
mov ecx, dword [rsp + 0x20]
shr eax, cl
movsx ecx, byte [rsp + 0xb8]
test eax, eax
mov eax, 0x15
setne dl
shl r8d, cl
sub dword [0x140042b38], edx
mov edx, dword [rsp + 0x20]
mov ecx, edx
shl r8d, cl
mov ecx, dword [0x140042b44]
shl eax, cl
mov ecx, edx
and r8d, eax
mov eax, dword [rsp + 0x24]
add dword [0x140042b30], r8d
mov r8d, dword [rsp + 0x28]
shr eax, cl
and eax, dword [rsp + 0x40]
movzx ecx, al
movzx eax, byte [rsp + 0xa8]
shl r8b, cl
mov ecx, dword [rsp + 0x34]
and al, r8b
mov r8d, dword [rsp + 0x3c]
mov byte [0x140042b54], al
lea eax, [r10 - 0x2d3]
xor eax, 0x4c8
mov r10d, ebx
cmp dword [rsp + 0x2c], eax
mov eax, 0xc6
sete r10b
or r8d, r11d
add ecx, 0xffffffeb
mov dword [0x140042b28], r10d
and ecx, edx
mov dword [rsp + 0x3c], r8d
or ecx, r8d
mov dword [0x140042b7c], r8d
dec eax
test ecx, ecx
je 0x14001be29
mov byte [0x140042b64], r11b
test bpl, bpl
jne 0x14001be2f
mov byte [0x140042b64], bl
test eax, eax
jne 0x14001be17
mov ecx, dword [rsp + 0x34]
mov eax, ebx
add ecx, 0x3ed
mov r8d, edx
and ecx, dword [0x140042b84]
test edx, edx
sete al
sar r8d, 0x15
xor r8d, dword [rsp + 0x34]
or ecx, eax
sub dword [0x140042b4c], ecx
add r8d, esi
mov dword [0x140042a64], r8d
lea eax, [r8 + 1]
lea edx, [rax + rax*2]
and edx, 7
je 0x14001bf3a
sub edx, r11d
je 0x14001bf12
sub edx, r11d
je 0x14001becd
cmp edx, r11d
je 0x14001bea6
mov eax, 0xaaaaaaab
mul dword [rsp + 0x20]
movsx eax, byte [0x140042b66]
mov edi, edx
shr edi, 1
add edi, eax
jmp 0x14001bf67
movzx eax, byte [rsp + 0xb0]
shr r15b, 2
add r15b, r8b
movsx ecx, r15b
cmp eax, ecx
sete al
xor bpl, al
mov byte [0x140042a87], bpl
jmp 0x14001bf67
movsx eax, byte [0x140042b55]
add eax, 0x152
jne 0x14001beec
mov eax, dword [rsp + 0x24]
sub eax, dword [rsp + 0x3c]
cmp eax, dword [rsp + 0x20]
jne 0x14001beec
mov r11d, ebx
movsx ecx, byte [rsp + 0xb8]
sub esi, r11d
sub r13d, ecx
mov dword [0x140042b5c], esi
xor r13d, 0x15
cmp r10d, r13d
sete bl
mov dword [0x140042b4c], ebx
jmp 0x14001bf67
test bpl, bpl
jne 0x14001bf20
cmp byte [rsp + 0xa0], bl
je 0x14001bf23
mov ebx, r11d
sub r9b, bl
mov byte [0x140042b82], r9b
and r9b, 0x15
mov byte [0x140042b57], r9b
jmp 0x14001bf67
movzx eax, byte [rsp + 0xa0]
movsx ecx, byte [rsp + 0xb8]
add eax, ecx
cmp eax, 0x4c8
jne 0x14001bf5a
cmp dword [rsp + 0x38], r12d
je 0x14001bf5d
mov r11d, ebx
sub r14d, r11d
mov dword [0x140042b6c], r14d
call qword [sym.imp.KERNEL32.dll_IsThreadAFiber]
call fcn.14001aa00
and edi, dword [rsp + 0x24]
movzx eax, di
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret