Function at 0x1800033f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rdi, r8
mov r12, rdx
mov r15, rcx
xor esi, esi
mov dword [rbp - 0x48], esi
mov rbx, qword [rbp + 0x60]
cmp dword [rcx + 0x1c], 1
jl 0x180003442
mov rax, qword [rbx]
mov ecx, dword [rax + 4]
test ecx, ecx
je 0x180003434
cmp ecx, dword [r15 + 0x14]
je 0x180003442
mov rcx, r12
call qword [0x18000b2f8]
jmp 0x180003ae9
mov r8, r9
lea rdx, [rbp - 0x30]
mov rcx, r15
call fcn.180003b10
nop
mov rdx, rdi
lea rcx, [rbp - 0x50]
call qword [0x18000b308]
nop
mov rax, qword [rdi]
mov r9d, dword [r15 + 0x14]
mov eax, dword [rax + 4]
cdq
idiv r9d
mov eax, r9d
sub eax, edx
cdq
idiv r9d
mov ecx, dword [r15 + 0x30]
test ecx, ecx
je 0x1800034e7
sub ecx, 1
je 0x1800034d8
cmp ecx, 1
jne 0x1800034e7
mov r14d, esi
or r14d, 2
test edx, edx
jle 0x1800034cc
dec edx
xor r8d, r8d
lea rcx, [rbp - 0x38]
call qword [0x18000b300]
nop
mov dl, pe_nt_image_headers64
mov rcx, rax
call qword [0x18000b340]
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [0x18000b308]
mov dword [rbp - 0x48], r14d
lea rcx, [rbp - 0x38]
call qword [0x18000b110]
jmp 0x1800034fe
lea rcx, [rbp + 0x40]
call qword [0x18000b2f8]
jmp 0x1800034fa
test edx, edx
cmovne r9d, edx
movzx r8d, r9b
mov edx, r9d
jmp 0x1800034ea
xor r8d, r8d
lea rcx, [rbp + 0x40]
call qword [0x18000b300]
mov r14d, 2
mov dword [rbp - 0x48], r14d
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x50]
call qword [0x18000b350]
nop
lea rcx, [rbp + 0x40]
call qword [0x18000b110]
mov ecx, dword [r15 + 0x1c]
test ecx, ecx
je 0x180003a3b
sub ecx, 1
je 0x180003884
sub ecx, 1
je 0x1800036ad
cmp ecx, 1
je 0x180003548
mov rcx, r12
call qword [0x18000b2f8]
jmp 0x180003ad4
lea rcx, [rbp - 0x28]
call qword [0x18000b2f8]
nop
lea rcx, [rbp + 0x40]
call qword [0x18000b2f8]
nop
mov r9, rbx
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x38]
mov rcx, r15
call fcn.180002b30
nop
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [0x18000b350]
nop
lea rcx, [rbp - 0x38]
call qword [0x18000b110]
mov ecx, dword [r15 + 0x14]
mov ebx, ecx
mov rax, qword [rbp - 0x50]
cmp ecx, dword [rax + 4]
jge 0x1800035f8
nop dword [rax]
mov r8d, ecx
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x40]
call qword [0x18000b330]
nop
mov r9, rax
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x38]
mov rcx, r15
call fcn.180002b30
nop
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [0x18000b350]
nop
lea rcx, [rbp - 0x38]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x40]
call qword [0x18000b110]
mov ecx, dword [r15 + 0x14]
add ebx, ecx
mov rax, qword [rbp - 0x50]
cmp ebx, dword [rax + 4]
jl 0x1800035a0
lea rcx, [rbp - 0x50]
call qword [0x18000b378]
mov rbx, rax
lea rcx, [rbp + 0x40]
call qword [0x18000b378]
mov rdi, rax
lea rcx, [rbp - 0x40]
call qword [0x18000b2f8]
or r14d, 0x10
mov dword [rbp - 0x48], r14d
mov rcx, qword [rbp + 0x40]
mov r8d, dword [rcx + 4]
mov rcx, qword [rbp - 0x50]
mov edx, dword [rcx + 4]
cmp r8d, edx
cmovl edx, r8d
test edx, edx
jle 0x180003672
sub rdi, rbx
movzx r8d, byte [rdi + rbx]
xor r8b, byte [rbx]
mov edx, esi
lea rcx, [rbp - 0x40]
call qword [0x18000b358]
inc esi
lea rbx, [rbx + 1]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 4]
mov rax, qword [rbp - 0x50]
mov ecx, dword [rax + 4]
cmp edx, ecx
cmovl ecx, edx
cmp esi, ecx
jl 0x180003641
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call qword [0x18000b350]
nop
lea rcx, [rbp - 0x40]
call qword [0x18000b110]
lea rdx, [rbp - 0x28]
mov rcx, r12
call qword [0x18000b310]
nop
lea rcx, [rbp + 0x40]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x28]
jmp 0x180003acd
lea rcx, [rbp + 0x40]
call qword [0x18000b2f8]
nop
mov r9, rbx
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x18]
mov rcx, r15
call fcn.180002b30
mov rdi, rax
mov qword [rbp - 0x28], rax
mov r8d, dword [r15 + 0x14]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x50]
call qword [0x18000b328]
mov qword [rbp - 0x38], rax
mov rcx, rax
call qword [0x18000b378]
mov rbx, rax
mov rcx, rdi
call qword [0x18000b378]
mov r13, rax
lea rcx, [rbp - 0x40]
call qword [0x18000b2f8]
or r14d, 8
mov dword [rbp - 0x48], r14d
mov edi, esi
mov r14, qword [rbp - 0x28]
mov rcx, qword [r14]
mov r8d, dword [rcx + 4]
mov rcx, qword [rbp - 0x38]
mov rcx, qword [rcx]
mov edx, dword [rcx + 4]
cmp r8d, edx
cmovl edx, r8d
test edx, edx
jle 0x180003774
sub r13, rbx
mov r12, qword [rbp - 0x38]
nop dword [rax + rax]
movzx r8d, byte [rbx + r13]
xor r8b, byte [rbx]
mov edx, edi
lea rcx, [rbp - 0x40]
call qword [0x18000b358]
inc edi
lea rbx, [rbx + 1]
mov rax, qword [r14]
mov edx, dword [rax + 4]
mov rax, qword [r12]
mov ecx, dword [rax + 4]
cmp edx, ecx
cmovl ecx, edx
cmp edi, ecx
jl 0x180003740
mov r12, qword [rbp + 0x48]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x40]
call qword [0x18000b350]
nop
lea rcx, [rbp - 0x40]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x20]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x18]
call qword [0x18000b110]
mov rax, qword [rbp - 0x50]
mov r8d, dword [rax + 4]
test r8d, r8d
jle 0x180003871
mov edx, dword [r15 + 0x14]
nop dword [rax + rax]
lea ecx, [rdx + rsi]
cmp ecx, r8d
jge 0x180003862
mov r9d, edx
mov r8d, esi
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x40]
call qword [0x18000b338]
nop
mov r9, rax
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x38]
mov rcx, r15
call fcn.180002b30
mov rbx, rax
mov r9d, dword [r15 + 0x14]
lea r8d, [r9 + rsi]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x50]
call qword [0x18000b338]
nop
mov r9, rbx
mov r8, rax
lea rdx, [rbp - 0x18]
mov rcx, r15
call fcn.180002a70
nop
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [0x18000b350]
nop
lea rcx, [rbp - 0x18]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x20]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x38]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x40]
call qword [0x18000b110]
mov edx, dword [r15 + 0x14]
mov rax, qword [rbp - 0x50]
add esi, edx
mov r8d, dword [rax + 4]
cmp esi, r8d
jl 0x1800037c0
lea rdx, [rbp + 0x40]
mov rcx, r12
call qword [0x18000b310]
nop
jmp 0x180003ac9
lea rcx, [rbp - 0x40]
call qword [0x18000b2f8]
nop
mov rdx, rbx
lea rcx, [rbp - 0x28]
call qword [0x18000b308]
nop
mov ebx, esi
mov dword [rbp + 0x40], ebx
mov rax, qword [rbp - 0x50]
cmp dword [rax + 4], ebx
jle 0x180003a19
mov ecx, dword [r15 + 0x14]
nop dword [rax]
nop word [rax + rax]
mov r9d, ecx
mov r8d, ebx
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x50]
call qword [0x18000b338]
mov r13, rax
mov rcx, rax
call qword [0x18000b378]
mov rbx, rax
lea rcx, [rbp - 0x28]
call qword [0x18000b378]
mov r12, rax
lea rcx, [rbp - 0x38]
call qword [0x18000b2f8]
or r14d, 4
mov dword [rbp - 0x48], r14d
mov edi, esi
mov rcx, qword [rbp - 0x28]
mov r8d, dword [rcx + 4]
mov rcx, qword [r13]
mov edx, dword [rcx + 4]
cmp r8d, edx
cmovl edx, r8d
test edx, edx
jle 0x180003952
sub r12, rbx
movzx r8d, byte [r12 + rbx]
xor r8b, byte [rbx]
mov edx, edi
lea rcx, [rbp - 0x38]
call qword [0x18000b358]
inc edi
lea rbx, [rbx + 1]
mov rax, qword [rbp - 0x28]
mov edx, dword [rax + 4]
mov rax, qword [r13]
mov ecx, dword [rax + 4]
cmp edx, ecx
cmovl ecx, edx
cmp edi, ecx
jl 0x180003921
lea r9, [rbp - 0x38]
mov r8d, dword [r15 + 0x14]
mov ebx, dword [rbp + 0x40]
mov edx, ebx
lea rcx, [rbp - 0x50]
call qword [0x18000b360]
and r14d, 0xfffffffb
mov dword [rbp - 0x48], r14d
lea rcx, [rbp - 0x38]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x18]
call qword [0x18000b110]
mov r9d, dword [r15 + 0x14]
mov r8d, ebx
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x50]
call qword [0x18000b338]
nop
mov r9, rax
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x20]
mov rcx, r15
call fcn.180002b30
nop
mov rdx, rax
lea rcx, [rbp - 0x40]
call qword [0x18000b350]
nop
lea rcx, [rbp - 0x20]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x10]
call qword [0x18000b110]
mov r9d, dword [r15 + 0x14]
mov r8d, ebx
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x40]
call qword [0x18000b338]
mov rdx, rax
lea rcx, [rbp - 0x28]
call qword [0x18000b318]
lea rcx, [rbp - 8]
call qword [0x18000b110]
mov ecx, dword [r15 + 0x14]
add ebx, ecx
mov dword [rbp + 0x40], ebx
mov rax, qword [rbp - 0x50]
cmp ebx, dword [rax + 4]
jl 0x1800038c0
mov r12, qword [rbp + 0x48]
lea rdx, [rbp - 0x40]
mov rcx, r12
call qword [0x18000b310]
nop
lea rcx, [rbp - 0x28]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x40]
jmp 0x180003acd
lea rcx, [rbp + 0x40]
call qword [0x18000b2f8]
nop
mov rax, qword [rbp - 0x50]
cmp dword [rax + 4], 0
jle 0x180003abb
mov ecx, dword [r15 + 0x14]
nop dword [rax]
nop dword [rax + rax]
mov r9d, ecx
mov r8d, esi
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x50]
call qword [0x18000b338]
nop
mov r9, rax
lea r8, [rbp - 0x30]
lea rdx, [rbp - 8]
mov rcx, r15
call fcn.180002b30
nop
mov rdx, rax
lea rcx, [rbp + 0x40]
call qword [0x18000b350]
nop
lea rcx, [rbp - 8]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x10]
call qword [0x18000b110]
mov ecx, dword [r15 + 0x14]
add esi, ecx
mov rax, qword [rbp - 0x50]
cmp esi, dword [rax + 4]
jl 0x180003a60
lea rdx, [rbp + 0x40]
mov rcx, r12
call qword [0x18000b310]
nop
lea rcx, [rbp + 0x40]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x50]
call qword [0x18000b110]
nop
lea rcx, [rbp - 0x30]
call qword [0x18000b110]
mov rax, r12
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret