Function at 0x1400039a0
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x7e8
call fcn.140001ea7
xor r10d, r10d
mov edx, 0x56
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0xc0]
lea rcx, str.51_1A_6D_D9_11_89
mov qword [rsp + 0xc0], r10
mov qword [rsp + 0xb8], r10
mov qword [rsp + 0xb0], r10
mov qword [rsp + 0xa8], r10
mov qword [rsp + 0xa0], r10
mov qword [rsp + 0x98], r10
call fcn.140001ce6
test eax, eax
jne 0x140003a1a
mov eax, 1
jmp 0x14000455c
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0xb0]
mov edx, 6
lea rcx, str.C9_B5_07_F2_36_0F
call fcn.140001ce6
test eax, eax
je 0x140003a10
lea r9, [rsp + 0x98]
lea r8, [rsp + 0xa0]
mov edx, 3
lea rcx, str.FC_C3_36_7F_48_92
call fcn.140001ce6
mov r13d, eax
test eax, eax
je 0x140003a10
mov r15, qword [rsp + 0xb0]
mov r10, qword [rsp + 0xa8]
xor ecx, ecx
mov r8d, 0xff
movzx r11d, byte [r15 + 1]
mov eax, r11d
xor eax, ecx
cdq
idiv r8d
cmp edx, 0x42
je 0x140003a9c
inc ecx
cmp ecx, 0x100
jne 0x140003a84
xor eax, eax
cmp r10, rax
je 0x140003aac
xor byte [r15 + rax], cl
inc rax
jmp 0x140003a9e
test cl, cl
je 0x140003b46
mov r12, qword [rsp + 0xa0]
mov r10, qword [rsp + 0x98]
xor ecx, ecx
mov r8d, 0xff
movzx r11d, byte [r12 + 1]
mov eax, r11d
xor eax, ecx
cdq
idiv r8d
cmp edx, 0x50
je 0x140003aea
inc ecx
cmp ecx, 0x100
jne 0x140003ad2
xor eax, eax
cmp r10, rax
je 0x140003afa
xor byte [r12 + rax], cl
inc rax
jmp 0x140003aec
test cl, cl
je 0x140003a10
mov rax, qword [rsp + 0xb8]
xor r14d, r14d
mov rbp, qword [rsp + 0xc0]
lea rdi, [rsp + 0x310]
mov ecx, 0x40
lea rbx, [rsp + 0x310]
mov qword [rsp + 0x58], rax
test rbp, rbp
mov eax, r14d
rep stosd dword [rdi], eax
je 0x140003b46
cmp qword [rsp + 0x58], 0
sete byte [rsp + 0x50]
jne 0x140003b4e
or eax, 0xffffffff
jmp 0x14000455c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140003b85
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____HeapAlloc_Failed_With_Error:__d__n
mov edx, eax
call fcn.1400038c0
jmp 0x140003b46
mov rdi, rbx
mov ecx, 0x100
mov al, byte [rsp + 0x50]
rep stosb byte [rdi], al
mov ecx, 0x3c
mov eax, r14d
mov rdi, rbx
xor r9d, r9d
rep stosd dword [rdi], eax
mov qword [rsp + 0x192], r9
xor r14d, r14d
mov qword [rsp + 0x198], r9
mov word [rsp + 0x190], 1
mov eax, r14d
mov ecx, r14d
xor r8d, r8d
sar eax, 2
and ecx, 3
cdqe
shl rax, 4
add rax, rbx
mov r10b, byte [r15 + r8]
xor edx, edx
mov r11d, r10d
shr r10b, 1
and r11d, 1
shl r11d, cl
or word [rax + rdx*2], r11w
inc rdx
cmp rdx, 8
jne 0x140003bde
inc r8
add ecx, 4
cmp r8, 4
jne 0x140003bd8
inc r14d
add r15, 4
cmp r14d, 8
jne 0x140003bc0
xor eax, eax
lea r15, [rsp + 0x200]
lea rcx, [rsp + 0x320]
movzx edx, word [rcx + rax]
add rax, 2
sar edx, 3
and dx, 0x1111
mov word [rax + r15 - 2], dx
cmp rax, 0x10
jne 0x140003c24
xor edx, edx
lea rdi, [rsp + 0x190]
test edx, edx
jne 0x140003cff
mov rcx, r15
call fcn.1400016d0
xor eax, eax
mov dx, word [r15 + rax]
ror dx, 4
xor dx, word [rax + rdi]
mov word [r15 + rax], dx
add rax, 2
cmp rax, 0x10
jne 0x140003c5c
mov edx, dword [rsp + 0x19c]
mov ax, word [rsp + 0x19e]
mov word [rsp + 0x19e], dx
mov dx, word [rsp + 0x19a]
mov word [rsp + 0x19c], dx
mov edx, dword [rsp + 0x198]
mov word [rsp + 0x19a], dx
mov dx, word [rsp + 0x196]
xor edx, eax
mov word [rsp + 0x198], dx
mov edx, eax
xor edx, dword [rsp + 0x194]
mov word [rsp + 0x196], dx
mov dx, word [rsp + 0x192]
mov word [rsp + 0x194], dx
mov edx, eax
xor edx, dword [rsp + 0x190]
mov word [rsp + 0x192], dx
mov edx, r13d
mov word [rsp + 0x190], ax
jmp 0x140003d1e
cmp edx, 4
jne 0x140003d15
xor edx, edx
mov rcx, r15
call fcn.1400016d0
mov edx, 5
jmp 0x140003d1e
inc edx
cmp edx, 8
jne 0x140003d1e
xor edx, edx
mov eax, r14d
mov ecx, r14d
xor r8d, r8d
sar eax, 2
and ecx, 3
sub eax, 2
cdqe
shl rax, 4
lea r10, [rbx + rax]
lea r9, [rbx + rax + 0x20]
movzx eax, word [r10 + r8]
sar eax, cl
and ax, 0x1111
xor ax, word [r15 + r8]
mov word [r15 + r8], ax
and eax, 0x1111
shl eax, cl
or word [r9 + r8], ax
add r8, 2
cmp r8, 0x10
jne 0x140003d3f
inc r14d
cmp r14d, 0x3c
jne 0x140003c4a
mov rax, qword [rsp + 0x58]
movups xmm0, xmmword [r12]
mov rbx, rsi
and rax, 0xfffffffffffffff0
add rax, rsi
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x210]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x60]
movaps xmmword [rsp + 0x400], xmm0
cmp rbx, rax
je 0x140004149
xor r8d, r8d
movups xmm0, xmmword [rbp]
mov r9, rbp
mov qword [rsp + 0x200], r8
mov qword [rsp + 0x208], r8
xor r8d, r8d
mov ecx, r8d
xor edx, edx
lea rax, [rsp + 0x200]
mov r10b, byte [r9 + rdx]
mov r11, rax
mov edi, r10d
shr r10b, 1
and edi, 1
shl edi, cl
or word [rax], di
mov rdi, qword [rsp + 0x70]
add rax, 2
cmp rax, rdi
jne 0x140003dfe
inc rdx
add ecx, 4
cmp rdx, 4
jne 0x140003def
inc r8d
add r9, 4
cmp r8d, 4
jne 0x140003dea
mov rdx, qword [rsp + 0x78]
mov rcx, r11
lea r15, [rsp + 0x3e0]
call fcn.140001c8e
lea rax, [rsp + 0x310]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x50]
call fcn.140001c27
mov rcx, qword [rsp + 0x50]
mov edx, 1
call fcn.1400016d0
mov rcx, qword [rsp + 0x50]
mov rdx, r15
sub r15, 0x10
call fcn.140001c8e
mov edi, dword [rsp + 0x200]
mov r11w, word [rsp + 0x202]
mov r12w, word [rsp + 0x20e]
mov eax, dword [rsp + 0x204]
mov r10d, edi
mov ecx, r11d
mov dx, word [rsp + 0x206]
mov r9d, dword [rsp + 0x208]
ror cx, 4
ror ax, 4
xor eax, dword [rsp + 0x204]
mov r8w, word [rsp + 0x20a]
ror r10w, 4
ror r12w, 4
xor ecx, r11d
xor r12w, word [rsp + 0x20e]
xor r10d, edi
mov r13d, dword [rsp + 0x20c]
rol r11w, 4
rol di, 4
mov r14d, r10d
xor r10d, r12d
ror dx, 4
ror r14w, 4
xor r10d, r11d
mov r11d, ecx
xor edi, r12d
ror r11w, 4
xor dx, word [rsp + 0x206]
xor edi, r14d
ror r9w, 4
ror r8w, 4
xor r10d, r11d
ror r13w, 4
mov r14d, edi
mov r11d, dword [rsp + 0x204]
xor r9d, dword [rsp + 0x208]
xor r13d, dword [rsp + 0x20c]
xor r8w, word [rsp + 0x20a]
rol r11w, 4
xor r11d, ecx
mov ecx, eax
ror cx, 4
xor r11d, ecx
mov cx, word [rsp + 0x206]
xor eax, r12d
rol cx, 4
xor eax, ecx
mov ecx, edx
xor edx, r12d
ror r12w, 4
ror cx, 4
xor eax, ecx
mov ecx, dword [rsp + 0x208]
rol cx, 4
xor edx, ecx
mov ecx, r9d
ror cx, 4
xor edx, ecx
mov cx, word [rsp + 0x20a]
rol cx, 4
xor ecx, r9d
mov r9d, r8d
ror r9w, 4
xor ecx, r9d
mov r9d, dword [rsp + 0x20c]
rol r9w, 4
xor r9d, r8d
mov r8d, r13d
ror r8w, 4
xor r9d, r8d
mov r8w, word [rsp + 0x20e]
rol r8w, 4
xor r8d, r13d
mov r13d, r9d
xor r8d, r12d
rol r13w, 8
xor r13d, r9d
mov r12d, r8d
xor r14d, r13d
rol r12w, 8
mov word [rsp + 0x200], r14w
xor r12d, r8d
mov r14d, r13d
xor r14d, r12d
xor r14d, r10d
mov word [rsp + 0x202], r14w
mov r14d, edi
xor edi, r11d
rol r14w, 8
xor r14d, edi
mov edi, r10d
xor r10d, eax
rol di, 8
xor r14d, r12d
mov word [rsp + 0x204], r14w
xor edi, r10d
mov r10d, r11d
rol r11w, 8
xor r10d, edx
xor edi, r13d
xor r10d, r13d
mov word [rsp + 0x206], di
xor r10d, r11d
xor r10d, r12d
mov word [rsp + 0x208], r10w
mov r10d, eax
xchg al, ah
xor r10d, ecx
xor eax, r10d
xor eax, r12d
mov word [rsp + 0x20a], ax
mov eax, edx
xor edx, r9d
xchg al, ah
xor eax, edx
mov word [rsp + 0x20c], ax
mov eax, ecx
xor ecx, r8d
xchg al, ah
xor eax, ecx
mov word [rsp + 0x20e], ax
mov rax, qword [rsp + 0x68]
cmp r15, rax
jne 0x140003e55
mov rcx, qword [rsp + 0x50]
call fcn.140001c27
mov rcx, qword [rsp + 0x50]
mov edx, 1
call fcn.1400016d0
mov rcx, qword [rsp + 0x50]
mov rdx, r15
mov r11, rbx
xor r9d, r9d
call fcn.140001c8e
mov r10d, r9d
xor r8d, r8d
xor edx, edx
xor edi, edi
mov rax, qword [rsp + 0x50]
mov ecx, r10d
movzx eax, word [rax + rdx*2]
sar eax, cl
mov ecx, edx
inc rdx
and eax, 1
shl eax, cl
or edi, eax
cmp rdx, 8
jne 0x1400040e5
mov byte [r11 + r8], dil
inc r8
add r10d, 4
cmp r8, 4
jne 0x1400040e1
inc r9d
add r11, 4
cmp r9d, 4
jne 0x1400040db
xor eax, eax
lea rcx, [rsp + 0x400]
mov dl, byte [rcx + rax]
xor byte [rbx + rax], dl
inc rax
cmp rax, 0x10
jne 0x14000412d
add rbx, 0x10
add rbp, 0x10
jmp 0x140003db7
movabs rax, 0x57581e0005000000
lea rbx, [rsp + 0xe6]
movabs rdx, 0x130c00131a0a2410
mov r8d, 0xc
mov qword [rsp + 0xe6], rax
mov rcx, rbx
movabs rax, 0x1e090f5c57581e
lea rdi, [rsp + 0xf3]
mov qword [rsp + 0xeb], rax
movabs rax, 0x33000602000020
lea r13, [rsp + 0x102]
lea rbp, [rsp + 0x113]
mov qword [rsp + 0xf3], rax
movabs rax, 0x25101617000a00
lea r12, [rsp + 0x125]
lea r15, [rsp + 0xcd]
mov qword [rsp + 0xfa], rax
movabs rax, 0x402060d33000020
mov qword [rsp + 0x102], rax
movabs rax, 0x61d163516050020
mov qword [rsp + 0x113], rax
movabs rax, 0x1d05391703000020
mov qword [rsp + 0x10a], rdx
movabs rdx, 0xb081729160101
mov qword [rsp + 0x125], rax
movabs rax, 0x202270910000020
mov qword [rsp + 0x11b], rdx
movabs rdx, 0x1804173a1a01120a
mov qword [rsp + 0xcd], rax
movabs rax, 0xd26160807000020
mov qword [rsp + 0x12d], rdx
lea rdx, [0x140006154]
mov qword [rsp + 0xd9], rax
movabs rax, 0x170417010d2616
mov qword [rsp + 0xde], rax
mov byte [rsp + 0x112], 0
mov word [rsp + 0x123], 0x1c
mov dword [rsp + 0x134], 0x100018
mov dword [rsp + 0xd5], 0x90f0b
call fcn.140001ca5
mov r8d, 0xe
lea rdx, [0x140006158]
mov rcx, rdi
call fcn.140001ca5
mov r8d, 0x10
lea rdx, [0x14000615c]
mov rcx, r13
call fcn.140001ca5
mov r8d, 0x11
lea rdx, [0x140006160]
mov rcx, rbp
call fcn.140001ca5
mov r8d, 0x12
lea rdx, [0x140006164]
mov rcx, r12
call fcn.140001ca5
mov r8d, 0xb
lea rdx, [0x140006168]
mov rcx, r15
call fcn.140001ca5
lea rax, [rsp + 0xd9]
mov r8d, 0xc
lea rdx, [0x14000616c]
mov rcx, rax
mov qword [rsp + 0x50], rax
call fcn.140001ca5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140003a10
mov rdx, rdi
mov rcx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rdi
mov rdx, r13
mov rcx, rbx
mov r14, rax
call rdi
mov rdx, rbp
mov rcx, rbx
mov r13, rax
call rdi
mov rdx, r12
mov rcx, rbx
mov rbp, rax
call rdi
mov rdx, r15
mov rcx, rbx
mov r12, rax
call rdi
mov rcx, rbx
mov rdx, qword [rsp + 0x50]
mov r15, rax
call rdi
mov rbx, rax
test r14, r14
je 0x140003a10
test r13, r13
je 0x140003a10
test rbp, rbp
je 0x140003a10
test r12, r12
je 0x140003a10
test r15, r15
je 0x140003a10
test rax, rax
je 0x140003a10
xor eax, eax
mov ecx, 0x19
xor r9d, r9d
lea rdx, [rsp + 0x194]
mov qword [rsp + 0x90], rax
lea r8, [rsp + 0x190]
mov rdi, rdx
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x138]
mov qword [rsp + 0x80], rax
xor eax, eax
rep stosd dword [rdi], eax
mov rdi, rdx
mov ecx, 6
mov dword [rsp + 0x190], 0x68
rep stosd dword [rdi], eax
xor ecx, ecx
mov qword [rsp + 0x48], rdx
xor edx, edx
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
xor edx, edx
mov dword [rsp + 0x20], ecx
lea rcx, [0x140006170]
mov dword [rsp + 0x28], 4
call r14
test eax, eax
je 0x140003a10
mov rcx, qword [rsp + 0x140]
lea rdx, [rsp + 0x310]
mov dword [rsp + 0x340], 0x10000b
call r13
test eax, eax
je 0x140003a10
mov rax, qword [rsp + 0x398]
lea rdi, [rsp + 0x88]
mov rcx, qword [rsp + 0x138]
mov r9d, 8
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x90]
lea rdx, [rax + 0x10]
call rbp
test eax, eax
je 0x140003a10
mov qword [rsp + 0x20], rdi
mov rdx, qword [rsp + 0x90]
mov r9d, 0x40
lea r8, [rsp + 0x150]
mov rcx, qword [rsp + 0x138]
call rbp
test eax, eax
je 0x140003a10
movsxd rdx, dword [rsp + 0x18c]
mov qword [rsp + 0x20], rdi
mov r9d, 0x108
lea r8, [rsp + 0x200]
add rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x138]
call rbp
test eax, eax
je 0x140003a10
lea rax, [rsp + 0x80]
mov r9, qword [rsp + 0x58]
mov r8, rsi
mov edx, dword [rsp + 0x228]
mov qword [rsp + 0x20], rax
add rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x138]
call r12
test eax, eax
je 0x140003a10
mov rcx, qword [rsp + 0x140]
call rbx
inc eax
sete al
movzx eax, al
add rsp, 0x7e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret