Function at 0x140001500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov ecx, 9
call fcn.140001a84
lea r8, [0x1400032d8]
xor edx, edx
lea r9, [0x1400032d9]
sub r8, rax
lea r10, [0x1400032da]
sub r9, rax
lea r11, str.cha__cyiaa
sub r10, rax
lea rbx, [0x1400032dc]
sub r11, rax
sub rbx, rax
lea rsi, [0x1400032dd]
sub rsi, rax
lea rcx, [rax + 2]
mov rdi, rax
nop word [rax + rax]
movzx eax, byte [r8 + rcx - 2]
lea rcx, [rcx + 8]
xor al, 0xd
add edx, 8
mov byte [rcx - 0xa], al
movzx eax, byte [r9 + rcx - 0xa]
xor al, 0xd
mov byte [rcx - 9], al
movzx eax, byte [rcx + r8 - 8]
xor al, 0xd
mov byte [rcx - 8], al
movzx eax, byte [rcx + r9 - 8]
xor al, 0xd
mov byte [rcx - 7], al
movzx eax, byte [r10 + rcx - 8]
xor al, 0xd
mov byte [rcx - 6], al
movzx eax, byte [r11 + rcx - 8]
xor al, 0xd
mov byte [rcx - 5], al
movzx eax, byte [rcx + rbx - 8]
xor al, 0xd
mov byte [rcx - 4], al
movzx eax, byte [rcx + rsi - 8]
xor al, 0xd
mov byte [rcx - 3], al
cmp edx, 8
jb 0x140001590
mov ecx, 0xd
mov byte [rdi + 8], 0
call fcn.140001a84
xor r8d, r8d
lea r9, str.AbliAdo
sub r9, rax
mov rsi, rax
mov rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
lea rdx, [rdx + 1]
xor cl, 0xd
inc r8d
mov byte [rdx - 1], cl
cmp r8d, 0xc
jb 0x140001620
mov ecx, 6
mov byte [rax + 0xc], 0
call fcn.140001a84
lea r8, [0x1400032e0]
xor edx, edx
lea r9, [0x1400032e1]
sub r8, rax
sub r9, rax
lea r10, [0x1400032e2]
sub r10, rax
lea rcx, [rax + 2]
mov rbx, rax
nop dword [rax]
movzx eax, byte [r8 + rcx - 2]
lea rcx, [rcx + 5]
xor al, 0xd
add edx, 5
mov byte [rcx - 7], al
movzx eax, byte [r9 + rcx - 7]
xor al, 0xd
mov byte [rcx - 6], al
movzx eax, byte [r8 + rcx - 5]
xor al, 0xd
mov byte [rcx - 5], al
movzx eax, byte [r9 + rcx - 5]
xor al, 0xd
mov byte [rcx - 4], al
movzx eax, byte [r10 + rcx - 5]
xor al, 0xd
mov byte [rcx - 3], al
cmp edx, 5
jb 0x140001670
lea rax, [rsp + 0x38]
mov byte [rbx + 5], 0
mov r8d, 3
mov qword [rsp + 0x30], rax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400010a0
mov rcx, qword [rsp + 0x30]
call fcn.1400012e0
mov rcx, rax
mov rdx, rsi
call fcn.140001430
mov rcx, qword [rsp + 0x30]
mov qword [0x140005180], rax
lea rax, [rsp + 0x38]
cmp rcx, rax
je 0x140001705
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, [rbp + 0x48]
mov r8d, 3
mov rdx, rbx
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x40]
call fcn.1400010a0
mov rcx, qword [rbp + 0x40]
call fcn.1400012e0
mov rcx, rax
lea rdx, str.TpAllocWork
call fcn.140001430
mov rcx, qword [rbp + 0x40]
mov r13, rax
lea rax, [rbp + 0x48]
cmp rcx, rax
je 0x14000174d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, [rbp + 0x158]
mov r8d, 3
mov rdx, rbx
mov qword [rbp + 0x150], rax
lea rcx, [rbp + 0x150]
call fcn.1400010a0
mov rcx, qword [rbp + 0x150]
call fcn.1400012e0
mov rcx, rax
lea rdx, str.TpPostWork
call fcn.140001430
mov rcx, qword [rbp + 0x150]
mov r12, rax
lea rax, [rbp + 0x158]
cmp rcx, rax
je 0x1400017a7
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, [rbp + 0x268]
mov r8d, 3
mov rdx, rbx
mov qword [rbp + 0x260], rax
lea rcx, [rbp + 0x260]
call fcn.1400010a0
mov rcx, qword [rbp + 0x260]
call fcn.1400012e0
mov rcx, rax
lea rdx, str.TpReleaseWork
call fcn.140001430
mov rcx, qword [rbp + 0x260]
mov r15, rax
lea rax, [rbp + 0x268]
cmp rcx, rax
je 0x140001801
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, [rbp + 0x378]
mov r8d, 3
mov rdx, rdi
mov qword [rbp + 0x370], rax
lea rcx, [rbp + 0x370]
call fcn.1400010a0
mov rcx, qword [rbp + 0x370]
call fcn.1400012e0
mov rcx, rax
lea rdx, str.WaitForSingleObject
call fcn.140001430
mov rcx, qword [rbp + 0x370]
mov r14, rax
lea rax, [rbp + 0x378]
cmp rcx, rax
je 0x14000185b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.advapi32
lea rdx, [0x140001020]
lea rcx, [rsp + 0x20]
call r13
mov rcx, qword [rsp + 0x20]
call r12
mov rcx, qword [rsp + 0x20]
call r15
mov edx, 0x1000
mov rcx, 0xffffffffffffffff
call r14
mov rcx, rdi
call fcn.140001a8c
mov rcx, rsi
call fcn.140001a8c
mov rcx, rbx
call fcn.140001a8c
lea rax, [rbp + 0x488]
mov r8d, 3
lea rdx, str.advapi32
mov qword [rbp + 0x480], rax
lea rcx, [rbp + 0x480]
call fcn.1400010a0
mov rcx, qword [rbp + 0x480]
call fcn.1400012e0
mov rcx, qword [rbp + 0x480]
mov rbx, rax
lea rax, [rbp + 0x488]
cmp rcx, rax
je 0x140001903
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, rbx
lea rcx, str.hWininet:__p_n
call fcn.140001950
xor eax, eax
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.140001d60
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret