Function at 0x140011dc0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0x250]
xor r12d, r12d
cmp dword [0x1401596fc], 5
mov ebx, r12d
mov qword [rbp - 0x78], rax
mov r14d, r12d
mov rax, qword [rbp + 0x258]
mov esi, r12d
mov qword [rbp - 0x68], rax
mov r13d, r12d
mov rax, qword [rbp + 0x260]
mov edi, 4
mov qword [rbp - 0x60], rax
mov rax, qword [rbp + 0x268]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rbp + 0x270]
mov qword [rsp + 0x78], r9
mov qword [rax], r12
mov qword [rsp + 0x70], r8
mov qword [rcx], r12
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rcx
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x70], r12
mov byte [rsp + 0x50], bl
jne 0x140012077
lea rcx, [0x140159a80]
mov dword [rbp - 0x30], r12d
mov dword [rbp + 0x18], 1
mov dword [rbp + 0x60], 3
mov dword [rbp + 0xa8], 5
mov dword [rbp + 0xf0], 6
mov dword [rbp + 0x138], 2
mov dword [rbp + 0x180], edi
call qword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
mov r15, rax
test rax, rax
je 0x140011ec8
lock dec dword [0x140159a90]
jmp 0x140011ee9
mov r8, qword [0x140159a98]
mov edx, edi
mov rcx, qword [0x140159238]
add r8, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r15, rax
lea rcx, [r15 + 0x12]
xor edx, edx
mov r8d, 0x162
call fcn.1400e6910
mov edx, 0x7ffe0018
mov dword [r15 + 0x10], 0x1640004
mov r8d, 0x7ffe0014
mov dword [r15 + 0x14], 0x2a
mov r9d, 0x7ffe001c
nop dword [rax + rax]
mov eax, dword [rdx]
mov dword [r15 + 0x1c], eax
mov eax, dword [r8]
mov ecx, dword [r15 + 0x1c]
mov dword [r15 + 0x18], eax
mov eax, dword [r9]
cmp ecx, eax
jne 0x140011f20
mov rax, qword [rsp + 0x58]
lea rcx, [r15 + 0x10]
mov qword [r15 + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [r15 + 0x30], rax
mov dword [r15 + 0x38], 0x1f8
call fcn.1400893c0
test eax, eax
js 0x140011f64
mov edi, dword [r15 + 0x20]
jmp 0x140011f66
mov edi, eax
mov eax, dword [0x140159a94]
cmp dword [0x140159a90], eax
jae 0x140011f8f
mov rdx, r15
lea rcx, [0x140159a80]
call qword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
lock inc dword [0x140159a90]
jmp 0x140011fa6
mov rcx, qword [0x140159238]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
js 0x140012072
mov edx, dword [rbp - 0x2c]
lea rcx, [rbp - 0x28]
call fcn.140063040
mov rcx, qword [rsp + 0x70]
mov edx, dword [rbp + 0x1c]
mov qword [rcx], rax
lea rcx, [rbp + 0x20]
call fcn.140063040
mov rcx, qword ds:[rsp + 0x78]
mov edx, dword [rbp + 0x64]
mov qword [rcx], rax
lea rcx, [rbp + 0x68]
call fcn.140063040
mov rcx, qword [rbp - 0x78]
mov edx, dword [rbp + 0xac]
mov qword [rcx], rax
lea rcx, [rbp + 0xb0]
call fcn.140063040
mov rcx, qword [rbp - 0x68]
mov edx, dword [rbp + 0xf4]
mov qword [rcx], rax
lea rcx, [rbp + 0xf8]
call fcn.140063040
mov rcx, qword [rbp - 0x60]
mov edx, dword [rbp + 0x13c]
mov qword [rcx], rax
lea rcx, [rbp + 0x140]
call fcn.140063040
mov rcx, qword [rbp - 0x58]
mov edx, dword [rbp + 0x184]
mov qword [rcx], rax
lea rcx, [rbp + 0x188]
call fcn.140063040
mov rcx, qword [rbp - 0x50]
mov edx, 4
mov r8d, 0x2000
mov byte [rsp + 0x50], 1
mov qword [rcx], rax
mov rcx, qword [0x140159238]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r15, rax
jmp 0x1400120e8
mov edi, 4
mov rcx, qword [0x140159238]
mov r8d, 0x2000
mov edx, edi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea rcx, [0x140111d80]
mov r15, rax
call fcn.140011460
lea rcx, str.SHA1
mov qword [rsp + 0x60], rax
call fcn.140011460
lea rcx, str.SHA256
mov qword [rsp + 0x68], rax
call fcn.140011460
lea rcx, str.SHA384
mov qword [rbp - 0x80], rax
mov r14, rax
call fcn.140011460
lea rcx, str.SHA512
mov qword ds:[rbp - 0x70], rax
mov rsi, rax
call fcn.140011460
mov r13, rax
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor r8d, r8d
mov dword [rsp + 0x30], 0x2000
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
lea r9, [0x140000000]
test eax, eax
js 0x140012208
lfence
nop dword [rax]
mov rax, qword [rbp - 0x38]
test eax, eax
je 0x140012208
mov edi, eax
mov r8, r15
not ebx
mov edx, eax
nop word [rax + rax]
movsx ecx, byte [r8]
lea r8, [r8 + 1]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
xor ebx, dword [r9 + rax*4 + 0x140b80]
sub rdx, 1
jne 0x140012150
not ebx
cmp byte [rsp + 0x50], r12b
jne 0x1400121c5
mov rcx, qword [rsp + 0x60]
mov r8, rdi
mov rdx, r15
call fcn.1400116e0
mov rcx, qword [rsp + 0x68]
mov r8, rdi
mov rdx, r15
call fcn.1400116e0
mov r8, rdi
mov rdx, r15
mov rcx, r14
call fcn.1400116e0
mov r8, rdi
mov rdx, r15
mov rcx, rsi
call fcn.1400116e0
mov r8, rdi
mov rdx, r15
mov rcx, r13
call fcn.1400116e0
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor r8d, r8d
mov dword [rsp + 0x30], 0x2000
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
lea r9, [0x140000000]
nop
test eax, eax
jns 0x140012130
mov rdx, qword [0x140159180]
mov ecx, 0x22
bswap ebx
mov eax, ebx
mov r14d, ebx
shr eax, 0x10
movzx esi, al
mov eax, ebx
shr eax, 8
shr r14d, 0x18
movzx edi, al
movzx ebx, bl
call fcn.1400601a0
mov rdx, rax
lea rcx, [rax + 0x10]
mov qword [rax], 0x10
mov qword [rax + 8], rcx
mov word [rcx + 0x10], r12w
lfence
mov rax, qword [rax + 8]
lea r8, [0x140000000]
mov ecx, ebx
and ebx, 0xf
shr rcx, 4
movsx ecx, byte [rcx + r8 + 0x1406e0]
mov word [rax], cx
mov rax, qword [rdx + 8]
movsx ecx, byte [rbx + r8 + 0x1406e0]
mov word [rax + 2], cx
mov eax, edi
shr rax, 4
and edi, 0xf
movsx ecx, byte [rax + r8 + 0x1406e0]
mov rax, qword [rdx + 8]
mov word [rax + 4], cx
mov rax, qword [rdx + 8]
movsx ecx, byte [rdi + r8 + 0x1406e0]
mov word [rax + 6], cx
mov eax, esi
shr rax, 4
and esi, 0xf
movsx ecx, byte [rax + r8 + 0x1406e0]
mov rax, qword [rdx + 8]
mov word [rax + 8], cx
mov rax, qword [rdx + 8]
movsx ecx, byte [rsi + r8 + 0x1406e0]
mov word [rax + 0xa], cx
mov eax, r14d
shr rax, 4
and r14d, 0xf
movsx ecx, byte [rax + r8 + 0x1406e0]
mov rax, qword [rdx + 8]
mov word [rax + 0xc], cx
mov rax, qword [rdx + 8]
movsx ecx, byte [r14 + r8 + 0x1406e0]
mov word [rax + 0xe], cx
mov rax, qword [rbp - 0x48]
mov qword [rax], rdx
cmp byte [rsp + 0x50], r12b
jne 0x14001244d
mov rsi, qword [rsp + 0x60]
xor r9d, r9d
mov r8d, dword [rsi + 0x1c]
mov rdx, qword [rsi + 0x28]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
js 0x140012342
mov edx, dword [rsi + 0x1c]
mov rcx, qword [rsi + 0x28]
call fcn.140063040
nop
jmp 0x140012345
mov rax, r12
mov r14, qword [rsp + 0x68]
xor r9d, r9d
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov r8d, dword [r14 + 0x1c]
mov rdx, qword [r14 + 0x28]
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
js 0x14001237a
mov edx, dword [r14 + 0x1c]
mov rcx, qword [r14 + 0x28]
call fcn.140063040
jmp 0x14001237d
mov rax, r12
mov rdi, qword [rbp - 0x80]
xor r9d, r9d
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
mov r8d, dword [rdi + 0x1c]
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
nop
test eax, eax
js 0x1400123b2
mov edx, dword [rdi + 0x1c]
mov rcx, qword [rdi + 0x28]
call fcn.140063040
jmp 0x1400123b5
mov rax, r12
mov rbx, qword [rbp - 0x70]
xor r9d, r9d
mov rcx, qword [rbp - 0x78]
mov qword [rcx], rax
mov r8d, dword [rbx + 0x1c]
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
js 0x1400123e7
mov edx, dword [rbx + 0x1c]
mov rcx, qword [rbx + 0x28]
call fcn.140063040
jmp 0x1400123ea
mov rax, r12
mov rcx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rcx], rax
mov r8d, dword [r13 + 0x1c]
mov rdx, qword [r13 + 0x28]
mov rcx, qword [r13 + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
js 0x14001241a
mov edx, dword [r13 + 0x1c]
mov rcx, qword [r13 + 0x28]
call fcn.140063040
mov r12, rax
mov rax, qword [rbp - 0x60]
mov rcx, r13
mov qword [rax], r12
call fcn.140011640
mov rcx, rbx
call fcn.140011640
mov rcx, rdi
call fcn.140011640
mov rcx, r14
call fcn.140011640
mov rcx, rsi
call fcn.140011640
mov rcx, qword [0x140159238]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret