Function at 0x140002160
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x118
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xd0], xmm7
movaps xmmword [rsp + 0xe0], xmm8
movaps xmmword [rsp + 0xf0], xmm9
movaps xmmword [rsp + 0x100], xmm10
movdqa xmm6, xmmword [str.ZAR_T]
mov edx, 0x34
movd xmm7, dword [0x140029150]
lea rbx, [rsp + 0x90]
mov rsi, rcx
movaps xmmword [rsp + 0x90], xmm6
movd dword [rsp + 0xa0], xmm7
mov rax, rbx
lea rcx, [rsp + 0xa4]
nop word [rax + rax]
xor word [rax], dx
add rax, 2
add edx, 1
cmp rcx, rax
jne 0x1400021e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov r15, rax
je 0x1400023e1
mov rax, qword [0x140029170]
mov edx, 0x4d3f
mov ecx, 0x34
movdqa xmm0, xmmword [str.zAgB_KCrR_QM__6]
mov word [rsp + 0xa8], dx
lea r8, [rsp + 0xaa]
sub ecx, ebx
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rax
mov rax, rbx
nop word [rax + rax]
lea edx, [rcx + rax]
xor byte [rax], dl
add rax, 1
cmp r8, rax
jne 0x140002248
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r12, rax
je 0x1400023e1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rbx
mov ecx, 6
xor edx, edx
mov r10, rax
xor eax, eax
mov r9d, 0x30
rep stosq qword [rdi], rax
mov r8, rbx
mov rcx, r10
mov qword [rsp + 0x20], 0
call r12
test eax, eax
jne 0x1400023e1
mov rax, qword [rsp + 0x98]
lea r12, [rsp + 0x80]
lea r10, [rsp + 0x50]
lea rbp, [rsp + 0x70]
lea rbx, [rsp + 0x64]
mov rax, qword [rax + 0x18]
mov r14, qword [rax + 0x20]
lea r8, [rax + 0x20]
cmp r8, r14
je 0x1400023d7
mov qword [rsp + 0x48], r15
mov r15, rbx
mov rbx, r8
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], rbp
nop word [rax + rax]
movzx eax, word [r14 + 0x38]
mov qword [rsp + 0x70], r12
mov rbp, qword [r14 + 0x40]
shr rax, 1
test rbp, rbp
jne 0x14000231f
test rax, rax
jne 0x140002615
lea rsi, [rax + rax]
cmp rax, 7
mov qword [rsp + 0x50], rax
ja 0x140002440
cmp rsi, 2
jne 0x140002420
movzx edx, word [rbp]
mov word [rsp + 0x80], dx
mov rdi, qword [rsp + 0x38]
mov rdx, r12
mov r13, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
xor eax, eax
mov word [rdx + rsi], ax
mov rax, rdi
mov edx, 0x34
movaps xmmword [rsp + 0x50], xmm6
movd dword [rsp + 0x60], xmm7
nop dword [rax + rax]
xor word [rax], dx
add rax, 2
add edx, 1
cmp rax, r15
jne 0x140002378
mov rcx, rdi
call sym.wcslen
xor r8d, r8d
mov rdx, rdi
mov rcx, r13
mov r9, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.find_wchar_t_const__unsigned_long_long__unsigned_long_long__const
cmp rax, 0xffffffffffffffff
jne 0x14000248b
mov rcx, qword [rsp + 0x70]
cmp rcx, r12
je 0x1400023c6
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov r14, qword [r14]
cmp rbx, r14
jne 0x140002300
mov r15, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
movaps xmm6, xmmword [rsp + 0xc0]
movaps xmm7, xmmword [rsp + 0xd0]
movaps xmm8, xmmword [rsp + 0xe0]
movaps xmm9, xmmword [rsp + 0xf0]
movaps xmm10, xmmword [rsp + 0x100]
add rsp, 0x118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rsi, rsi
je 0x140002348
lea rdi, [rsp + 0x50]
mov rcx, r12
lea r13, [rsp + 0x70]
jmp 0x14000246d
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov r13, rcx
mov rdi, rdx
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___._M_create_unsigned_long_long__unsigned_long_long_
mov rcx, rax
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov r8, rsi
mov rdx, rbp
call sym.memcpy
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x70]
lea rsi, [rax + rax]
jmp 0x140002355
mov rax, qword [0x140029190]
lea rdx, [rsp + 0x68]
mov rbx, r15
mov rsi, qword [rsp + 0x160]
mov r15, qword [rsp + 0x48]
movdqa xmm0, xmmword [str.zAw_TVYZHXhV257___b_3K_b]
movq xmm3, qword [0x140029138]
movq xmm10, qword [0x140029198]
movq xmm9, qword [0x1400291a0]
movq xmm8, qword [0x1400291a8]
movq xmm7, qword [0x1400291b0]
movq xmm4, qword [0x1400291b8]
movq xmm6, qword [str.44444444]
mov r14, qword [r14 + 0x20]
mov qword [rsp + 0x60], rax
mov rax, rdi
movaps xmmword [rsp + 0x50], xmm0
movdqa xmm2, xmm3
paddd xmm3, xmm10
add rax, 8
movdqa xmm1, xmm2
movdqa xmm5, xmm2
movdqa xmm0, xmm2
paddd xmm1, xmm9
punpcklwd xmm5, xmm1
punpcklwd xmm0, xmm1
movdqa xmm1, xmm2
paddd xmm2, xmm7
paddd xmm1, xmm8
pshufd xmm5, xmm5, 0x4e
punpcklwd xmm0, xmm5
pand xmm0, xmm4
movdqa xmm5, xmm1
punpcklwd xmm1, xmm2
punpcklwd xmm5, xmm2
pshufd xmm5, xmm5, 0x4e
punpcklwd xmm1, xmm5
pand xmm1, xmm4
packuswb xmm0, xmm1
pshufd xmm0, xmm0, 8
paddb xmm0, xmm6
movq xmm1, qword [rax - 8]
pxor xmm1, xmm0
movq qword [rax - 8], xmm1
cmp rdx, rax
jne 0x1400024fb
mov rdx, rdi
mov rcx, r14
call sym.GetFunctionAddress_void__char_const_
movdqa xmm0, xmmword [str.zApE_lRNIK__f.H]
mov ecx, 0x34
mov qword [rsi], rax
mov rax, rdi
mov dword [rsp + 0x60], 0x473f372b
sub ecx, edi
movaps xmmword [rsp + 0x50], xmm0
nop dword [rax]
lea edx, [rcx + rax]
xor byte [rax], dl
add rax, 1
cmp rbx, rax
jne 0x1400025a8
mov rdx, rdi
mov rcx, r14
call sym.GetFunctionAddress_void__char_const_
cmp qword [rsi], 0
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x70]
je 0x1400025f5
test rax, rax
je 0x1400025f5
cmp rcx, r12
je 0x1400023d7
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x1400023d7
cmp rcx, r12
je 0x1400023e1
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
jmp 0x1400023e1
lea rcx, [0x140029100]
call method.std.__throw_logic_error_char_const_
mov rbx, rax
mov rcx, r13
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___._M_dispose__
mov rcx, rbx
call dbg._Unwind_Resume
nop
nop
nop word cs:[rax + rax]