Function at 0x1400baf60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x80], r8
mov r15, rdx
mov qword [rsp + 0x88], rcx
mov eax, dword [0x141dd3bc0]
or eax, dword [0x141dd3bc4]
and eax, 0xe6e3beeb
imul eax, eax, 0x24fd9551
add eax, 0x870e597c
cmp eax, 0x2039c6d1
jb 0x1400bafc5
mov eax, dword [0x141dd3bc8]
or eax, dword [0x141dd3bcc]
mov qword [rsp + 0x68], 0
cmp eax, 0x5e5d1b4f
jne 0x1400bafd0
mov qword [rsp + 0x68], 0
jmp 0x1400bafa9
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x78], 0
mov r13d, 0x200
mov eax, 2
mov qword [rsp + 0x40], rax
mov r14, qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, 0x8f677fdb
xor eax, eax
mov qword [rsp + 0x30], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x38], rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd3bd0]
imul eax, dword [0x141dd3bd4]
xor eax, 0x1090c64
or eax, 0xc296529b
add eax, 0x73507c47
cmp eax, 0x4cec2f95
ja 0x1400bb020
cmp r13, 0x201
jae 0x1400bb075
mov eax, 0x200
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x48], rcx
lea rbx, [rsp + 0x98]
xor eax, eax
test al, al
je 0x1400bb120
jmp 0x1400bb106
sub r13, qword [rsp + 0x38]
nop word [rax + rax]
mov eax, dword [0x141dd3bd8]
xor eax, dword [0x141dd3bdc]
imul eax, eax, 0xe6bfd625
cmp eax, 0x5fd70cd5
je 0x1400bb080
sub rcx, qword [rsp + 0x38]
mov eax, dword [0x141dd3be0]
and eax, dword [0x141dd3be4]
imul rax, rax, 0x488e999
shr rax, 0x39
or eax, 0xf2ad991c
cmp eax, 0xd0179ec7
jb 0x1400bb09e
cmp r13, rcx
ja 0x1400bb31d
mov rax, qword [rsp + 0x30]
mov ecx, 0xffffffff
cmp rax, rcx
mov r13d, 0xffffffff
cmovb r13, rax
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x90], r13
mov rbx, qword [rsp + 0x40]
mov rax, r13
mov qword [rsp + 0x38], r13
xor eax, eax
test al, al
je 0x1400bb120
xor ecx, ecx
call r14
mov rcx, r15
mov edx, r13d
mov r8, rbx
xor r9d, r9d
call rsi
nop dword [rax]
mov eax, dword [str.WHd_]
sub eax, dword [0x141dd3bf4]
imul rax, rdi
shr rax, 0x3e
imul ebp, eax, 0x804c33e7
and ebp, 0x195e6de6
xor ecx, ecx
call r14
mov rcx, r15
mov edx, r13d
mov r8, rbx
xor r9d, r9d
call rsi
cmp ebp, 0x1226f37
je 0x1400bb120
mov r12d, eax
test eax, eax
jne 0x1400bb1c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x141dd3bf8]
xor ecx, dword [0x141dd3bfc]
or ecx, 0xa761ff8e
imul ecx, ecx, 0x9d4fea05
cmp ecx, 0xb9288877
je 0x1400bb168
nop dword [rax + rax]
mov ecx, dword [0x141dd3c00]
sub ecx, dword [0x141dd3c04]
imul rcx, rcx, 0x19dd8799
shr rcx, 0x3a
cmp ecx, 0xfd5d5a2f
je 0x1400bb190
test eax, eax
jne 0x1400bb439
nop word [rax + rax]
mov eax, dword [0x141dd3c38]
imul eax, dword [0x141dd3c3c]
xor eax, 0xb80ce38
imul eax, eax, 0xdde7f8bf
and eax, 0xe39313af
cmp eax, 0x7e7729da
jb 0x1400bb1c0
mov ebp, r12d
nop word [rax + rax]
mov eax, dword [str.__a4hk]
xor eax, dword [0x141dd3c44]
cmp eax, 0xd6197818
je 0x1400bb1f0
nop word cs:[rax + rax]
mov eax, dword [0x141dd3c48]
imul eax, dword [0x141dd3c4c]
add eax, 0x20b48d42
or eax, 0xe609144b
xor eax, 0x63400fad
cmp eax, 0x21e8f9b4
jb 0x1400bb210
cmp r13, rbp
jne 0x1400bb2a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0xc4c1644b
nop word cs:[rax + rax]
mov ecx, dword [0x141dd3c58]
sub ecx, dword [0x141dd3c5c]
add ecx, 0x7f4832b9
imul rcx, rdx
shr rcx, 0x3e
cmp ecx, 0x810c0749
je 0x1400bb250
cmp eax, 0x7a
mov rcx, qword [rsp + 0x48]
jne 0x1400bbbc8
cmp r13, 0x7fffffff
lea r13, [r13 + r13]
mov eax, 0xffffffff
cmova r13, rax
jmp 0x1400bb2f0
mov eax, dword [0x141dd3c60]
sub eax, dword [0x141dd3c64]
and eax, 0x52002500
cmp eax, 0x5a65c04e
ja 0x1400bb2a0
nop dword [rax + rax]
mov eax, dword [0x141dd3c68]
or eax, dword [0x141dd3c6c]
xor eax, 0xa524719e
imul eax, eax, 0x436793a9
cmp eax, 0x838031f6
je 0x1400bb2c0
cmp r13, rbp
jae 0x1400bb37a
mov r13, rbp
mov rcx, qword [rsp + 0x48]
nop
mov eax, dword [0x141dd3c70]
and eax, dword [0x141dd3c74]
and eax, 0x51b26c2c
add eax, 0xf964215c
imul rax, rax, 0x17dbfdf1
shr rax, 0x3b
cmp eax, 0x5435a3e9
je 0x1400bb2f0
jmp 0x1400bb020
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x68]
mov rdx, qword [rsp + 0x38]
mov r8, r13
call fcn.1400fce40
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov eax, dword [0x141dd3be8]
add eax, dword [0x141dd3bec]
or eax, 0x7526b7bd
imul eax, eax, 0x6be9245c
add eax, 0x52eec08c
mov rcx, qword [rsp + 0x70]
cmp eax, 0x2a4824
jb 0x1400bb348
mov qword [rsp + 0x40], rcx
jmp 0x1400bb0ca
cmp qword [rsp + 0x90], rbp
jb 0x1400bb5c1
mov rcx, qword [rsp + 0x80]
mov rdi, qword [rcx + 0x10]
lea rax, [rdi - 1]
cmp rax, 6
jb 0x1400bb5d0
mov rsi, qword [rcx]
mov r13, qword [rcx + 8]
nop dword [rax]
mov eax, dword [0x141dd3c78]
imul eax, dword [0x141dd3c7c]
and eax, 0x56582014
add eax, 0xa2bc1321
and eax, 0xed4c2231
cmp eax, 0xd48fdf0d
jb 0x1400bb3b0
nop word cs:[rax + rax]
mov eax, dword [0x141dd3c80]
or eax, dword [0x141dd3c84]
xor eax, 0x3b41e0c7
add eax, 0x19090f96
and eax, 0xef3858b8
cmp eax, 0x10abdbc8
je 0x1400bb3e0
test rdi, rdi
je 0x1400bb62d
lea rax, [rdi - 7]
cmp rax, rbp
jne 0x1400bb7a8
mov eax, dword [str.ycL0FT]
or eax, dword [0x141dd3c9c]
and eax, 0xb6df7e5e
cmp eax, 0x1f215c3c
jne 0x1400bb6e7
jmp 0x1400bb739
movabs rsi, 0x8000000000000000
mov eax, dword [0x141dd3c08]
or eax, dword [0x141dd3c0c]
add eax, 0x73803c20
imul rax, rax, 0x81a5c9d
shr rax, 0x3b
cmp eax, 0xae2df945
mov rbx, qword [rsp + 0x88]
jbe 0x1400bb483
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbx + 8], rax
mov qword [rbx], rsi
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word [rax + rax]
mov eax, dword [0x141dd3c10]
imul eax, dword [0x141dd3c14]
xor eax, 0x4006a244
and eax, 0x444ee355
imul edi, eax, 0xee4c46e2
call r12
shl rax, 0x20
or rax, 2
mov qword [rbx + 8], rax
mov qword [rbx], rsi
cmp edi, 0xff8b4e5f
ja 0x1400bb4a0
cmp qword [rsp + 0x30], 0
je 0x1400bb575
mov rsi, qword [0x141dda6a0]
mov eax, dword [0x141dd3c18]
xor edx, edx
div dword [0x141dd3c1c]
add eax, 0x47ce7b86
cmp eax, 0xf5c79ebf
jbe 0x1400bb512
mov rcx, rsi
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov ebx, dword [0x141dd3c20]
xor ebx, dword [0x141dd3c24]
xor ebx, 0xd625d691
add ebx, 0x9feb87b9
mov rcx, rsi
xor edx, edx
mov r8, r15
call rdi
cmp ebx, 0x8fc19f60
ja 0x1400bb520
nop word [rax + rax]
mov eax, dword [0x141dd3c28]
xor edx, edx
div dword [0x141dd3c2c]
add eax, 0x14c17e26
xor eax, 0xd30b6158
imul eax, eax, 0xe4dfcb51
cmp eax, 0x250a3c0a
je 0x1400bb550
mov rax, qword [r14]
nop dword [rax + rax]
mov ecx, dword [0x141dd3c30]
xor ecx, dword [0x141dd3c34]
add ecx, 0x4e94011b
or ecx, 0x1c87e296
cmp ecx, 0x996d6363
je 0x1400bb580
test rax, rax
je 0x1400bb6b0
mov r8, qword [r14 + 8]
mov rcx, qword [0x141dda6a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400bb6b0
xor eax, eax
test al, al
je 0x1400bbb7d
jmp 0x1400bbba8
mov eax, dword [0x141dd3c88]
imul eax, dword [0x141dd3c8c]
or eax, 0xeab8d390
mov ecx, 0xb75a3499
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xdc0db7ce
jne 0x1400bb600
ud2
mov eax, dword [0x141dd3c90]
sub eax, dword [0x141dd3c94]
add eax, 0x65123562
shr eax, 3
imul rax, rax, 0x1560a529
shr rax, 0x38
ud2
mov eax, dword [0x141dd3cb8]
sub eax, dword [0x141dd3cbc]
add eax, 0x275e30e2
shr eax, 1
mov ecx, 0x88cc7065
imul rcx, rax
shr rcx, 0x3b
xor ecx, 0x40009454
cmp ecx, 0x4aed414c
jbe 0x1400bb660
ud2
mov eax, dword [0x141dd3cc0]
add eax, dword [0x141dd3cc4]
xor eax, 0xfb321a8c
ud2
mov eax, dword [0x141dd3c50]
and eax, dword [0x141dd3c54]
imul eax, eax, 0x25980884
or eax, 0xb3456174
and eax, 0xbf55e7f4
cmp eax, 0xb052c50a
je 0x1400bb6b0
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x141dd3ca0]
and eax, dword [0x141dd3ca4]
xor eax, 0x188f8239
imul r15d, eax, 0xc06723fc
mov eax, 0xc81eed99
imul rax, r15
shr rax, 0x20
sub r15d, eax
shr r15d, 1
add r15d, eax
shr r15d, 0x1d
lea rdx, [r13 + 0xc]
lea r14, [rbp*2]
mov rcx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
cmp r15d, 0x53774482
jbe 0x1400bb750
lea rdx, [r13 + 0xc]
lea r8, [rbp*2]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
jmp 0x1400bb6e7
mov ecx, dword [0x141dd3ca8]
and ecx, dword [0x141dd3cac]
imul ecx, ecx, 0x85af8a99
add ecx, 0x7813792
and ecx, 0x454ec25
cmp ecx, 0x6a9d7949
je 0x1400bb750
nop word cs:[rax + rax]
mov ecx, dword [0x141dd3cb0]
or ecx, dword [0x141dd3cb4]
add ecx, 0x887b23d9
xor ecx, 0x45dcdf93
cmp ecx, 0x3753046f
ja 0x1400bb780
test eax, eax
je 0x1400bb86b
mov eax, dword [0x141dd3d00]
imul eax, dword [0x141dd3d04]
xor eax, 0xd09f15ed
mov ecx, 0x832df28b
imul rcx, rax
shr rcx, 0x3f
or ecx, 0x6e94eaa8
cmp ecx, 0x4efecfee
jae 0x1400bb7e0
mov word [r13 + 0xc], 0x43
nop dword [rax]
mov eax, dword [0x141dd3d08]
xor eax, dword [0x141dd3d0c]
add eax, 0xcf22a6b4
imul rax, rax, 0x3b7918d9
shr rax, 0x3c
mov word [r13 + 0xc], 0x43
cmp eax, 0xdb61ab0f
ja 0x1400bb7e0
nop word [rax + rax]
mov eax, dword [0x141dd3d10]
sub eax, dword [0x141dd3d14]
imul eax, eax, 0x93c68dc6
cmp eax, 0x30c67a8a
je 0x1400bb810
mov r14, rsi
mov r12, r13
mov rbp, rdi
mov eax, dword [0x141dd3d38]
xor eax, dword [0x141dd3d3c]
or eax, 0xe3b09092
xor eax, 0x29be9510
imul rax, rax, 0x1f806a05
shr rax, 0x3b
cmp eax, 0x7d78f84f
mov rcx, qword [rsp + 0x88]
jbe 0x1400bbac2
jmp 0x1400bbaf0
test r12d, r12d
je 0x1400bb94b
mov eax, dword [0x141dd3cd0]
and eax, dword [0x141dd3cd4]
add eax, 0x4a50a824
and eax, 0xa1eec3ad
imul rax, rax, 0x290af217
shr rax, 0x3c
cmp eax, 0x8f922208
jne 0x1400bb8b0
movzx eax, byte [0x141dda6b8]
xor ecx, ecx
mov rdx, r14
call fcn.1400bf230
nop dword [rax]
mov eax, dword [0x141dd3cd8]
mov ecx, dword [0x141dd3cdc]
lea edi, [rax + rcx]
add edi, 0x37bd8d22
xor edi, 0x40011602
and edi, 0xd217162b
movzx eax, byte [0x141dda6b8]
xor ecx, ecx
mov rdx, r14
call fcn.1400bf230
cmp edi, 0x85523b18
je 0x1400bb8b0
mov r15, rax
xor eax, eax
nop
test al, al
jne 0x1400bb8f0
nop word cs:[rax + rax]
mov eax, dword [0x141dd3ce0]
add eax, dword [0x141dd3ce4]
imul eax, eax, 0xbfe51f7e
cmp eax, 0xf2281ebc
je 0x1400bb900
test r15, r15
jne 0x1400bb951
mov eax, dword [0x141dd3ce8]
xor edx, edx
div dword [0x141dd3cec]
add eax, 0xfffd92bf
and eax, 0x278fd0a
add eax, 0x4701ed9c
cmp eax, 0xfc01125c
jbe 0x1400bba76
jmp 0x1400bba96
mov r15d, 2
mov eax, dword [0x141dd3d18]
sub eax, dword [0x141dd3d1c]
add eax, 0x741477d8
cmp eax, 0x6585467f
ja 0x1400bb9c1
mov eax, dword [0x141dd3d20]
add eax, dword [0x141dd3d24]
xor eax, 0x15001c7f
imul edi, eax, 0x75a26658
or edi, 0xc48e5400
mov rcx, r15
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rbp
lea rcx, [rsp + 0x50]
call fcn.1400da400
mov r12, qword [rsp + 0x58]
mov word [r12 + rbp*2], 0
cmp edi, 0x4a30aa24
jae 0x1400bb9f8
mov rcx, r15
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rbp
lea rcx, [rsp + 0x50]
call fcn.1400da400
mov rax, qword [rsp + 0x58]
mov word [rax + rbp*2], 0
jmp 0x1400bb969
inc rbp
mov r14, qword [rsp + 0x50]
test rsi, rsi
je 0x1400bb832
mov eax, dword [0x141dd3d28]
xor edx, edx
div dword [0x141dd3d2c]
xor eax, 0xff13374f
imul eax, eax, 0xd6310fc2
cmp eax, 0x6835d4f
jb 0x1400bba53
mov eax, dword [0x141dd3d30]
xor edx, edx
div dword [0x141dd3d34]
mov ebx, eax
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0x89beac3c
jne 0x1400bba67
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400bba29
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
jmp 0x1400bb832
mov eax, dword [0x141dd3cf0]
and eax, dword [0x141dd3cf4]
or eax, 0x7f2e8e54
imul eax, eax, 0x1507ccf4
ud2
ud2
mov eax, dword [0x141dd3d40]
imul eax, dword [0x141dd3d44]
or eax, 0xa421020c
xor eax, 0x3c200228
or eax, 0x3dcedd3
mov qword [rcx], r14
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], rbp
cmp eax, 0xd47329de
jbe 0x1400bbafd
mov qword [rcx], r14
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], rbp
jmp 0x1400bbac2
cmp qword [rsp + 0x30], 0
je 0x1400bbb3e
mov r8, qword [rsp + 0x70]
mov rcx, qword [0x141dda6a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dd3d48]
sub eax, dword [0x141dd3d4c]
or eax, 0xbc33df76
imul eax, eax, 0xe6328507
cmp eax, 0x9ed1c340
je 0x1400bbb20
mov eax, 0xc4789551
nop word cs:[rax + rax]
mov ecx, dword [0x141dd3d50]
or ecx, dword [0x141dd3d54]
imul rcx, rax
shr rcx, 0x3e
imul ecx, ecx, 0xbcdc2dbb
xor ecx, 0x37ea2025
cmp ecx, 0x8aee6b4a
ja 0x1400bbb50
jmp 0x1400bb6b0
mov eax, dword [0x141dd3d58]
and eax, dword [0x141dd3d5c]
imul rax, rax, 0x130f3d63
shr rax, 0x3b
or eax, 0xfb08bee4
imul eax, eax, 0xd1590ba6
ud2
ud2
ud2