Function at 0x140001c70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov rdi, rcx
mov ecx, 0x170800
mov rbp, rdx
call fcn.140108230
mov r8d, 0x170800
lea rdx, [0x14010e0b0]
lea rsi, [rsp + 0xb0]
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_memcpy
mov r10d, 0x424b
mov qword [rsp + 0xa0], rsi
xor ecx, ecx
movabs rax, 0x56315549336b7a55
mov byte [rsp + 0xba], 0
movabs r8, 0xcccccccccccccccd
mov qword [rsp + 0xb0], rax
mov word [rsp + 0xb8], r10w
mov qword [rsp + 0xa8], 0xa
nop dword [rax]
mov rax, rcx
mul r8
shr rdx, 3
lea rax, [rdx + rdx*4]
mov rdx, rcx
add rax, rax
sub rdx, rax
movzx eax, byte [rsp + rdx + 0xb0]
xor byte [rbx + rcx], al
add rcx, 1
cmp rcx, 0x170800
jne 0x140001d00
mov r14, qword [rbp]
mov rbp, qword [rbp + 8]
mov qword [rsp + 0xa0], rsi
lea r13, [rsp + 0xa0]
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x80], rbp
lea r15, [r14 + rbp]
cmp rbp, 7
ja 0x140001da0
mov r9, rbp
mov rdx, rsi
lea r12, [rsp + 0x80]
cmp r14, r15
je 0x140002208
xor eax, eax
nop
movsx cx, byte [r14 + rax]
mov word [rdx + rax*2], cx
add rax, 1
cmp rbp, rax
jne 0x140001d80
jmp 0x140001f1b
lea r12, [rsp + 0x80]
xor r8d, r8d
mov rcx, r13
mov rdx, r12
call fcn.1400f3350
mov r9, qword [rsp + 0x80]
mov qword [rsp + 0xa0], rax
mov rdx, rax
mov qword [rsp + 0xb0], r9
cmp r14, r15
je 0x140001f1b
lea rax, [rax + rbp*2]
lea rcx, [rbp - 1]
cmp r14, rax
jae 0x140001dec
cmp rdx, r15
jb 0x140001d7c
cmp rcx, 0xe
jbe 0x140002283
mov r8, rbp
mov rcx, rbp
pxor xmm3, xmm3
xor eax, eax
shr r8, 4
and rcx, 0xfffffffffffffff0
nop word [rax + rax]
movdqu xmm0, xmmword [r14 + rax]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
punpckhbw xmm0, xmm1
movups xmmword [rdx + rax*2], xmm2
movups xmmword [rdx + rax*2 + 0x10], xmm0
add rax, 0x10
cmp rcx, rax
jne 0x140001e10
mov rax, r8
lea r8, [r14 + rcx]
shl rax, 5
add rax, rdx
cmp rbp, rcx
je 0x140001f1b
sub rbp, rcx
lea r10, [rbp - 1]
cmp r10, 6
jbe 0x140001ea1
movq xmm0, qword [r14 + rcx]
pxor xmm1, xmm1
lea r10, [rdx + rcx*2]
mov rcx, rbp
and rcx, 0xfffffffffffffff8
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
lea rax, [rax + rcx*2]
add r8, rcx
and ebp, 7
punpcklbw xmm0, xmm1
punpcklbw xmm2, xmm1
pshufd xmm0, xmm0, 0x4e
movq qword [r10], xmm2
movq qword [r10 + 8], xmm0
je 0x140001f1b
movsx cx, byte [r8]
mov word [rax], cx
lea rcx, [r8 + 1]
cmp r15, rcx
je 0x140001f1b
movsx cx, byte [r8 + 1]
mov word [rax + 2], cx
lea rcx, [r8 + 2]
cmp r15, rcx
je 0x140001f1b
movsx cx, byte [r8 + 2]
mov word [rax + 4], cx
lea rcx, [r8 + 3]
cmp r15, rcx
je 0x140001f1b
movsx cx, byte [r8 + 3]
mov word [rax + 6], cx
lea rcx, [r8 + 4]
cmp r15, rcx
je 0x140001f1b
movsx cx, byte [r8 + 4]
mov word [rax + 8], cx
lea rcx, [r8 + 5]
cmp r15, rcx
je 0x140001f1b
movsx cx, byte [r8 + 5]
mov word [rax + 0xa], cx
lea rcx, [r8 + 6]
cmp r15, rcx
je 0x140001f1b
movsx cx, byte [r8 + 6]
mov word [rax + 0xc], cx
xor ecx, ecx
mov qword [rsp + 0xa8], r9
lea r14, [0x14010e090]
mov word [rdx + r9*2], cx
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov r8, qword [rdi + 8]
mov r15, qword [rdi]
xor r9d, r9d
lea rdi, [rsp + 0x90]
mov rcx, r12
mov rbp, rax
mov qword [rsp + 0x88], 0
lea rdx, [rax + r8]
mov qword [rsp + 0x80], rdi
mov word [rsp + 0x90], r9w
mov qword [rsp + 0x58], r8
call fcn.1400f2fe0
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsp + 0x58]
sub rax, qword [rsp + 0x88]
cmp rax, r8
jb 0x1400022d4
mov rdx, r15
mov rcx, r12
call fcn.1400f3190
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0x88]
cmp rax, rbp
jb 0x1400022e0
mov r8, rbp
mov rdx, r14
mov rcx, r12
call fcn.1400f3190
mov rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
lea rax, [rdx + r8]
cmp r9, rdi
je 0x140002210
cmp qword [rsp + 0x90], rax
jae 0x140002021
cmp rcx, rsi
je 0x140002278
mov r10, qword [rsp + 0xb0]
cmp r10, rax
jae 0x1400021a0
movabs rax, 0x1fffffffffffffff
sub rax, rdx
cmp rax, r8
jb 0x1400022ec
mov rdx, rcx
mov rcx, r12
call fcn.1400f3190
lea rbp, [rsp + 0x70]
lea rcx, [rax + 0x10]
mov qword [rsp + 0x60], rbp
mov rdx, qword [rax]
cmp rdx, rcx
je 0x140002230
mov qword [rsp + 0x60], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x70], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x68], rdx
xor edx, edx
mov qword [rax], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 8], 0
mov word [rax + 0x10], dx
cmp rcx, rdi
je 0x1400020a3
mov rax, qword [rsp + 0x90]
lea rdx, [rax + rax + 2]
call fcn.1401081f0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rsi
je 0x1400020c2
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + rax + 2]
call fcn.1401081f0
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002180
mov dword [rsp + 0x30], 0x170800
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], 0
mov rcx, rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
call fcn.140001bd0
mov rcx, rsi
test eax, eax
js 0x140002190
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x14000215d
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.1401081f0
mov edx, 0x170800
mov rcx, rbx
call fcn.1401081f0
mov eax, esi
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x60]
xor esi, esi
cmp rcx, rbp
jne 0x14000214e
jmp 0x14000215d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x140002144
mov qword [rsp + 0x20], rdx
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.1400edea0
lea rbp, [rsp + 0x70]
lea rcx, [rax + 0x10]
mov qword [rsp + 0x60], rbp
mov rdx, qword [rax]
cmp rdx, rcx
jne 0x14000205c
mov rdx, qword [rax + 8]
mov r9, rbp
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jb 0x140002245
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rbp + r9], r11
cmp edx, r10d
jb 0x1400021ea
lea r9, [rbp + rdx]
add rdx, rcx
jmp 0x140002245
xor r9d, r9d
jmp 0x140001f1b
cmp rax, 7
jbe 0x140002021
cmp rcx, rsi
jne 0x140002010
jmp 0x140002037
mov rdx, qword [rax + 8]
mov r9, rbp
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jae 0x140002290
xor r10d, r10d
test r8b, 4
je 0x14000225a
mov r10d, dword [rdx]
mov dword [r9], r10d
mov r10d, 4
and r8d, 2
je 0x14000206a
movzx edx, word [rdx + r10]
mov word [r9 + r10], dx
jmp 0x14000206a
mov r10d, 7
jmp 0x140002018
mov rax, rdx
mov r8, r14
xor ecx, ecx
jmp 0x140001e60
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rbp + r9], r11
cmp edx, r10d
jb 0x140002299
jmp 0x1400021fe
mov rcx, rbx
mov edx, 0x170800
call fcn.1401081f0
mov rcx, rsi
call fcn.140019c40
lea rcx, [0x14010e094]
call fcn.140109020
lea rcx, [0x14010e094]
call fcn.140109020
lea rcx, [0x14010e094]
call fcn.140109020
mov rcx, r12
mov rsi, rax
call fcn.1400ede80
mov rcx, r13
call fcn.1400ede80
jmp 0x1400022bf