Function at 0x1400f0cc0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
mov qword [rsp + 0x10], rsi
xchg rdi, r12
mov qword [rsp + 0x18], r12
xchg rdi, r12
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
xchg rcx, r14
mov rbx, r14
xchg r14, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x390646f
add r8d, 0x5bdbf0c8
xor r8d, 0x1dbb94f6
sub r8d, 0x29fe57bf
add r8d, 0x51e8b611
add r8d, 0x1488e882
sub r8d, 0x151ffd75
sub r8d, 0x6a2b0118
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
sub rcx, 0xfffffffffffffa28
call fcn.14007b4f0
xor ebx, ebx
mov dword [rsp + 0x32], 0x49fddf91
xor dword [rsp + 0x32], 0x6763fe93
add dword [rsp + 0x32], 0x242b1923
sub dword [rsp + 0x32], 0x5095b249
add dword [rsp + 0x32], 0x19f87a1f
sub dword [rsp + 0x32], 0x1692df0d
add dword [rsp + 0x32], 0x76d803ad
sub dword [rsp + 0x32], 0x775c88f3
add dword [rsp + 0x32], 0xf1e2594e
mov edx, ebx
mov dword [rsp + 0x42], 0x673b3070
sub dword [rsp + 0x42], 0x4c3c0850
xor dword [rsp + 0x42], 0x6f8f106e
sub dword [rsp + 0x42], 0xbfb361d
xor dword [rsp + 0x42], 0x17d06761
add dword [rsp + 0x42], 0x80d899df
xchg r8, r11
mov r11, rax
xchg r11, r8
mov dword [rsp + 0x46], 0x1283f148
add dword [rsp + 0x46], 0x1a72428
add dword [rsp + 0x46], 0xb38e289
xor dword [rsp + 0x46], 0x40a168bd
xor dword [rsp + 0x46], 0x4a49de3d
add dword [rsp + 0x46], 0x416d8173
xor dword [rsp + 0x46], 0x5883a25c
add dword [rsp + 0x46], 0xf0f89e7a
mov dword [rsp + 0x36], 0x6f7533f6
sub dword [rsp + 0x36], 0x1e21be1a
add dword [rsp + 0x36], 0x2863e802
xor dword [rsp + 0x36], 0x15609bd
sub dword [rsp + 0x36], 0x33b83593
add dword [rsp + 0x36], 0xefab604
add dword [rsp + 0x36], 0x6abfa4a
add dword [rsp + 0x36], 0x9c2727d8
mov dword [rsp + 0x4a], 0x7e34c269
sub dword [rsp + 0x4a], 0x23e830fb
xor dword [rsp + 0x4a], 0x47d974d9
add dword [rsp + 0x4a], 0x3c166ba
add dword [rsp + 0x4a], 0x18d7085c
add dword [rsp + 0x4a], 0x305f739c
sub dword [rsp + 0x4a], 0x13407c89
xor dword [rsp + 0x4a], 0xfa352e1
add dword [rsp + 0x4a], 0xa63ce67c
mov dword [rsp + 0x4e], 0x1d6db420
add dword [rsp + 0x4e], 0x1a80d0a6
xor dword [rsp + 0x4e], 0x7e63f187
sub dword [rsp + 0x4e], 0x9619a2e
add dword [rsp + 0x4e], 0x157552b6
sub dword [rsp + 0x4e], 0x4708488
xor dword [rsp + 0x4e], 0x827a97c
add dword [rsp + 0x4e], 0xa662ff30
mov dword [rsp + 0x3a], 0x3356dcf9
xor dword [rsp + 0x3a], 0x55a2e642
xor dword [rsp + 0x3a], 0x2ccbf706
add dword [rsp + 0x3a], 0x29ed1783
sub dword [rsp + 0x3a], 0x37e9fe34
sub dword [rsp + 0x3a], 0xb82f204
xor dword [rsp + 0x3a], 0xc64903fe
mov dword [rsp + 0x52], 0x5a69df01
xor dword [rsp + 0x52], 0x4f2e1495
xor dword [rsp + 0x52], 0x6ee23d42
sub dword [rsp + 0x52], 0x52c6b33b
add dword [rsp + 0x52], 0x3cef413f
sub dword [rsp + 0x52], 0x610d2b16
xor dword [rsp + 0x52], 0x5ec78815
sub dword [rsp + 0x52], 0x9cbbe92
xor dword [rsp + 0x52], 0xaf47ec43
mov dword [rsp + 0x56], 0x5459ea06
sub dword [rsp + 0x56], 0x66f16d6
xor dword [rsp + 0x56], 0x1ff7da9d
sub dword [rsp + 0x56], 0x3051c5c9
add dword [rsp + 0x56], 0x4848e2a4
xor dword [rsp + 0x56], 0x339d1f47
add dword [rsp + 0x56], 0xa5f1c5b0
mov word [rsp + 0x3e], 0x2dd5
add word [rsp + 0x3e], 0x3b59
sub word [rsp + 0x3e], 0x4353
xor word [rsp + 0x3e], 0x46f1
sub word [rsp + 0x3e], 0x2364
xor word [rsp + 0x3e], 0x7d34
sub word [rsp + 0x3e], 0x156a
sub word [rsp + 0x3e], 0x49d
xor word [rsp + 0x3e], 0xde1d
mov dword [rsp + 0x5a], 0x5474064a
sub dword [rsp + 0x5a], 0x3b699cf6
xor dword [rsp + 0x5a], 0x79e69c76
add dword [rsp + 0x5a], 0x91370d
add dword [rsp + 0x5a], 0x1e13fc3b
sub dword [rsp + 0x5a], 0x78f8a81a
add dword [rsp + 0x5a], 0xf8d67f2e
mov byte [rsp + 0x40], 0x47
xor byte [rsp + 0x40], 0x58
add byte [rsp + 0x40], 0x35
add byte [rsp + 0x40], 0x18
xor byte [rsp + 0x40], 0x4e
add byte [rsp + 0x40], 0xd4
mov dword [rsp + 0x5e], 0xbd530ca
xor dword [rsp + 0x5e], 0x1ab3f952
sub dword [rsp + 0x5e], 0x4b5f2e2
xor dword [rsp + 0x5e], 0x4bdd6b09
sub dword [rsp + 0x5e], 0x200659c6
add dword [rsp + 0x5e], 0x574c25d2
xor dword [rsp + 0x5e], 0x7eb376a5
nop
movzx eax, word [rsp + rdx*2 + 0x42]
movzx ecx, byte [rsp + rdx + 0x32]
add cx, ax
mov word [rsp + rdx*2 + 0x42], cx
mov byte [rsp + rdx + 0x32], bl
inc rdx
cmp rdx, 0xf
jb 0x1400f105a
lea rdx, [rsp + 0x42]
lea rcx, [rsp + 0x70]
call fcn.140086c80
xchg r14, rax
mov r14, rbx
xchg r14, rax
mov byte [rsp + rax + 0x42], bl
inc rax
cmp rax, 0x1e
jb 0x1400f1093
mov dword [rsp + 0x20], 0x6883461a
xor dword [rsp + 0x20], 0x4a3a3da9
add dword [rsp + 0x20], 0x35d9500b
xor dword [rsp + 0x20], 0x63b1c62c
add dword [rsp + 0x20], 0x984557b
xor dword [rsp + 0x20], 0x4ee2bab2
xor dword [rsp + 0x20], 0xfcb32f49
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov dword [rsp + 0x26], 0x3978b6e5
add dword [rsp + 0x26], 0x25b96571
xor dword [rsp + 0x26], 0x76f8c0a2
xor dword [rsp + 0x26], 0x4f757fe7
sub dword [rsp + 0x26], 0xb32ebdd
sub dword [rsp + 0x26], 0x70416f0
add dword [rsp + 0x26], 0xaaf45f09
mov dword [rsp + 0x2a], 0x9ffbfb4
add dword [rsp + 0x2a], 0x1322212d
xor dword [rsp + 0x2a], 0x3e700a4e
add dword [rsp + 0x2a], 0x4027a40c
sub dword [rsp + 0x2a], 0x52f5c538
xor dword [rsp + 0x2a], 0x28bc41
xor dword [rsp + 0x2a], 0x56460ef
xor dword [rsp + 0x2a], 0x454a47b7
add dword [rsp + 0x2a], 0xaef4ace2
mov byte [rsp + 0x24], 0x76
sub byte [rsp + 0x24], 0x2f
xor byte [rsp + 0x24], 0x74
sub byte [rsp + 0x24], 7
add byte [rsp + 0x24], 0x15
add byte [rsp + 0x24], 0xb5
mov dword [rsp + 0x2e], 0x4ff49292
sub dword [rsp + 0x2e], 0x117975e4
xor dword [rsp + 0x2e], 0x19f7de13
xor dword [rsp + 0x2e], 0xe162b53
add dword [rsp + 0x2e], 0x3de5d192
sub dword [rsp + 0x2e], 0x6a7dddb
sub dword [rsp + 0x2e], 0x60d7de29
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x26]
movzx edx, byte [rsp + rax + 0x20]
add dx, cx
mov word [rsp + rax*2 + 0x26], dx
mov byte [rsp + rax + 0x20], bl
inc rax
cmp rax, 5
jb 0x1400f11c3
mov r9d, 0x20e282c9
add r9d, 0x147aaa1e
add r9d, 0x44ce6b8e
sub r9d, 0x3090bfb5
sub r9d, 0x3d7c7761
add r9d, 0x70abbc1
add r9d, 0x4a783c27
sub r9d, 0x17109ec9
sub r9d, 0x4690ba6e
lea r8, [rsp + 0x26]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop word [rax + rax]
mov byte [rsp + rbx + 0x26], 0x51
xor byte [rsp + rbx + 0x26], 0x3c
xor byte [rsp + rbx + 0x26], 0x6b
xor byte [rsp + rbx + 0x26], 1
xor byte [rsp + rbx + 0x26], 0x1c
xor byte [rsp + rbx + 0x26], 0x69
xor byte [rsp + rbx + 0x26], 0x2b
xor byte [rsp + rbx + 0x26], 0x53
sub byte [rsp + rbx + 0x26], 0xa
inc rbx
cmp rbx, 0xa
jb 0x1400f123f
mov ecx, 0x33bd394a
xor ecx, 0x342533db
add ecx, 0x50d78123
sub ecx, 0x2612d065
sub ecx, 0x1df915b2
add ecx, 0x3795eb09
sub ecx, 0x2b098fa4
add ecx, 0xdf0ffefd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3