Function at 0x1400ad870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x1401c7b80]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, rdx
mov rsi, rcx
mov rax, qword [rdx]
lea rdx, [rsp + 0x30]
mov rcx, r15
call qword [rax + 0x78]
mov r12, qword [rax + 8]
xor ebx, ebx
mov edi, ebx
mov rcx, rsi
call fcn.1400a7280
cmp eax, 0xb
jne 0x1400ada07
mov rcx, rsi
call fcn.1400f5e70
test al, al
je 0x1400ada07
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a2630
mov r14, rax
mov rcx, rax
call fcn.140102e00
test al, al
je 0x1400ada07
mov r8, rsi
mov rdx, r15
lea rcx, [rbp - 0x79]
call fcn.14009f710
nop
mov r8, rsi
mov rdx, r15
lea rcx, [rbp - 0x31]
call fcn.14009f710
nop
mov rcx, rsi
call fcn.1400f5f20
mov r15, qword [rax + 0x28]
mov rcx, rsi
call fcn.1400f5f20
mov rsi, qword [rax + 0x28]
mov rax, qword [r14]
lea rdx, [rbp - 0x79]
mov rcx, r14
call qword [rax + Ordinal_41]
mov rax, qword [r14]
lea rdx, [rbp - 0x31]
mov rcx, r14
call qword [rax + 0x30]
mov rcx, qword [rbp - 0x71]
mov rax, qword [rcx]
lea r8, [rbp - 0x31]
lea rdx, [rbp - 0x79]
call qword [rax + 0x20]
test al, al
jne 0x1400ad9bf
lea rdx, [rbp - 0x69]
mov rcx, r15
call fcn.1400b1610
lea rbx, [rax + 2]
lea rdx, [rbp - 0x41]
lea rcx, [rsi + 0x48]
call fcn.1400b1880
add rbx, rax
mov ecx, ebx
or ecx, 1
bsr edx, ecx
lea edx, [rdx + rdx*8]
add edx, 0x49
shr rdx, 6
add rdx, rbx
add rdi, rdx
mov rcx, qword [rbp - 0x71]
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
call qword [rax + Ordinal_147]
mov rcx, qword [rbp - 0x71]
mov rax, qword [rcx]
lea r8, [rbp - 0x31]
lea rdx, [rbp - 0x79]
call qword [rax + 0x20]
test al, al
je 0x1400ad960
mov rcx, qword [rbp - 0x29]
mov rax, qword [rcx]
lea rdx, [rbp - 0x31]
call qword [rax + pe_nt_image_headers64]
cmp dword [rbp - 1], 9
jne 0x1400ad9e0
lea rcx, [rbp - 0x21]
call fcn.140004db0
nop
mov rcx, qword [rbp - 0x71]
mov r8, qword [rcx]
lea rdx, [rbp - 0x79]
call qword [r8 + pe_nt_image_headers64]
cmp dword [rbp - 0x49], 9
jne 0x1400ada02
lea rcx, [rbp - 0x69]
call fcn.140004db0
nop
jmp case.default.0x1400ada7f
movzx eax, byte [rsi + 1]
and al, 0x60
cmp al, 0x60
jne 0x1400ada24
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a1800
mov r14d, eax
jmp 0x1400ada59
mov rax, qword [rsi + 0x20]
mov rcx, qword [rax + 0x20]
cmp byte [rcx + 0x4b], bl
je 0x1400ada39
mov r14d, 1
jmp 0x1400ada59
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a3c90
mov rcx, rbx
mov r14d, 1
test al, al
cmovne rcx, r14
mov r14, rcx
mov rcx, rsi
call fcn.1400a7280
dec eax
cmp eax, 0x11
ja case.default.0x1400ada7f
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xadf58]
add rcx, rdx
jmp rcx
movzx eax, byte [rsi + 1]
and al, 0x60
cmp al, 0x60
jne 0x1400adacd
test r14, r14
je case.default.0x1400ada7f
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a2ec0
movsxd rcx, eax
or rcx, 1
bsr rax, rcx
lea ecx, [rax*8 + 0x49]
add ecx, eax
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x1400ada94
jmp case.default.0x1400ada7f
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a23b0
movsxd rcx, eax
or rcx, 1
bsr rax, rcx
lea edi, [rax*8 + 0x49]
add edi, eax
jmp 0x1400adcab
movzx eax, byte [rsi + 1]
and al, 0x60
cmp al, 0x60
jne 0x1400adb43
test r14, r14
je case.default.0x1400ada7f
nop word [rax + rax]
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a2f90
or rax, 1
bsr rcx, rax
lea ecx, [rcx + rcx*8]
add ecx, 0x49
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x1400adb10
jmp case.default.0x1400ada7f
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a2500
or rax, 1
bsr rcx, rax
jmp 0x1400adca2
movzx eax, byte [rsi + 1]
and al, 0x60
cmp al, 0x60
jne 0x1400adbae
test r14, r14
je case.default.0x1400ada7f
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a2ec0
mov ecx, eax
sar ecx, 0x1f
add eax, eax
xor ecx, eax
or ecx, 1
bsr eax, ecx
lea ecx, [rax*8 + 0x49]
add ecx, eax
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x1400adb71
jmp case.default.0x1400ada7f
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a23b0
mov ecx, eax
sar ecx, 0x1f
add eax, eax
xor ecx, eax
or ecx, 1
bsr eax, ecx
lea edi, [rax*8 + 0x49]
add edi, eax
jmp 0x1400adcab
movzx eax, byte [rsi + 1]
and al, 0x60
cmp al, 0x60
jne 0x1400adc30
test r14, r14
je case.default.0x1400ada7f
nop dword [rax]
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a2f90
mov rcx, rax
sar rcx, 0x3f
add rax, rax
xor rcx, rax
or rcx, 1
bsr rax, rcx
lea ecx, [rax*8 + 0x49]
add ecx, eax
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x1400adbf0
jmp case.default.0x1400ada7f
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a2500
mov rcx, rax
sar rcx, 0x3f
add rax, rax
xor rcx, rax
jmp 0x1400adade
movzx eax, byte [rsi + 1]
and al, 0x60
cmp al, 0x60
jne 0x1400adc8e
test r14, r14
je case.default.0x1400ada7f
nop
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a3330
or eax, 1
bsr ecx, eax
lea ecx, [rcx + rcx*8]
add ecx, 0x49
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x1400adc60
jmp case.default.0x1400ada7f
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a37d0
or eax, 1
bsr ecx, eax
lea edi, [rcx*8 + 0x49]
add edi, ecx
shr rdi, 6
mov rax, rdi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1401339b0
mov rbx, qword [rsp + 0x150]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, byte [rsi + 1]
and al, 0x60
cmp al, 0x60
jne 0x1400add20
test r14, r14
je case.default.0x1400ada7f
nop dword [rax + rax]
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a3400
or rax, 1
bsr rcx, rax
lea ecx, [rcx + rcx*8]
add ecx, 0x49
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x1400adcf0
jmp case.default.0x1400ada7f
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a38f0
or rax, 1
bsr rcx, rax
jmp 0x1400adca2
lea rdi, [r14*4]
jmp case.default.0x1400ada7f
lea rdi, [r14*8]
jmp case.default.0x1400ada7f
mov rdi, r14
jmp case.default.0x1400ada7f
movzx eax, byte [rsi + 1]
and al, 0x60
cmp al, 0x60
jne 0x1400add9a
test r14, r14
je case.default.0x1400ada7f
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a3060
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + gethostname]
add rdi, rax
inc rbx
cmp rbx, r14
jb 0x1400add70
jmp case.default.0x1400ada7f
xor r9d, r9d
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a26a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + gethostname]
mov rdi, rax
jmp case.default.0x1400ada7f
movzx eax, byte [rsi + 1]
and al, 0x60
cmp al, 0x60
jne 0x1400ade0f
test r14, r14
je case.default.0x1400ada7f
nop
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a3060
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + gethostname]
mov ecx, eax
or ecx, 1
bsr edx, ecx
lea edx, [rdx + rdx*8]
add edx, 0x49
shr rdx, 6
add rdx, rax
add rdi, rdx
inc rbx
cmp rbx, r14
jb 0x1400addd0
jmp case.default.0x1400ada7f
xor r9d, r9d
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a26a0
mov rcx, rax
call fcn.1400a9240
mov rdi, rax
jmp case.default.0x1400ada7f
movzx eax, byte [rsi + 1]
and al, 0x60
cmp al, 0x60
jne 0x1400ade7d
test r14, r14
je case.default.0x1400ada7f
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a2c40
movsxd rcx, dword [rax + 4]
or rcx, 1
bsr rax, rcx
lea ecx, [rax*8 + 0x49]
add ecx, eax
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x1400ade43
jmp case.default.0x1400ada7f
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1400a1e80
movsxd rcx, dword [rax + 4]
jmp 0x1400adade
mov r13, rbx
test r14, r14
je case.default.0x1400ada7f
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rsp + 0x40], 0
movzx eax, byte [rsi + 1]
and al, 0x60
mov r8, rsi
mov rdx, r15
mov rcx, r12
cmp al, 0x60
jne 0x1400adedf
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, r13d
call fcn.1400a3260
jmp 0x1400adee9
lea r9, [rsp + 0x40]
call fcn.1400a3660
mov rdx, qword [rax + 0x10]
mov eax, edx
or eax, 1
bsr ecx, eax
lea ecx, [rcx + rcx*8]
add ecx, 0x49
shr rcx, 6
add rcx, rdx
add rdi, rcx
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400adf3e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400adf39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400adf4f
call fcn.140133ef4
inc r13
cmp r13, r14
jae case.default.0x1400ada7f
jmp 0x1400adea0
call fcn.14013d094
int3