Function at 0x1400eeed0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c8
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov r10, qword [rcx + 8]
mov r11, rcx
mov eax, dword [rcx + 0x18]
mov r14, rdx
mov r12, qword [rcx + 0x38]
mov r15, r8
mov edi, dword [rcx + 0x34]
mov ebx, 1
mov rbp, qword [r11 + 0xf8]
mov r13, qword [r14]
mov dword [rsp + 0x3c], eax
add rax, r10
mov qword [rsp + 0xa0], rax
mov eax, edx
sub eax, r10d
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x24], eax
mov qword [rsp + 0x60], r8
mov r8d, edx
sub r8d, r10d
mov qword [rsp + 0x50], rbp
mov edx, ebx
mov qword [rsp + 0x88], r9
mov r9, qword [rcx + 0x70]
mov eax, r8d
mov ecx, dword [rcx + 0x100]
mov esi, r8d
shl edx, cl
mov ecx, dword [r11 + 0x1c]
sub esi, edx
sub eax, ecx
mov qword [rsp + 0x58], r9
cmp eax, edx
mov qword [rsp + 0x78], r12
mov eax, dword [r11 + 0x10c]
mov edx, gethostname
cmovbe esi, ecx
mov dword [rsp + 0x4c], edi
cmp dword [r11 + 0x28], 0
mov qword [rsp + 0x40], r10
cmovne esi, ecx
mov dword [rsp + 0x38], r8d
mov ecx, 6
mov dword [rsp + 0x74], esi
cmp eax, ecx
mov esi, 3
cmovb ecx, eax
mov rax, qword [r11 + 0x60]
shl ebx, cl
mov ecx, edx
sub ecx, dword [rbp + 0x34]
mov rbp, qword [rbp + 0x38]
mov qword [rsp + 0x30], rax
movabs rax, 0xcf1bbcdcbb000000
imul r13, rax
mov dword [rsp + 0x28], ebx
mov rax, r13
mov qword [rsp + 0x80], r13
shr rax, cl
mov ecx, eax
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x50]
shr rcx, 2
and ecx, 0x3fffffc0
add rbp, rcx
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x90], rbp
lea rax, [rax + rcx*4]
mov qword [rsp + 0x98], rax
prefetcht0 byte [rax]
prefetcht0 byte [rax + 0x40]
prefetcht0 byte [rbp]
prefetcht0 byte [rbp + 0x20]
xor ebp, ebp
mov dword [rsp + 0x48], 0x3f
cmp dword [r11 + 0x12c], ebp
jne 0x1400ef34a
mov r10d, dword [r11 + 0x2c]
mov rdi, r9
mov eax, dword [rsp + 0x24]
mov r8d, dword [rsp + 0x4c]
sub eax, r10d
mov ecx, r8d
cmp eax, 0x180
jbe 0x1400ef20a
lea eax, [r10 + 0x60]
mov dword [rsp + 0x20], r8d
cmp r10d, eax
jae 0x1400ef151
mov r12, qword [rsp + 0x40]
mov r15d, edx
mov rbx, qword [rsp + 0x78]
sub r15d, r8d
add r12, 8
mov edi, r10d
add r12, r10
mov r13, r9
mov esi, eax
movabs r14, 0xcf1bbcdcbb000000
nop dword [rax + rax]
mov rdx, qword [r12]
mov ecx, r15d
imul rdx, r14
xor rdx, qword [r11 + 0x60]
shr rdx, cl
mov eax, edx
shr rax, 2
and eax, 0x3fffffc0
prefetcht0 byte [r13 + rax*4]
prefetcht0 byte [r13 + rax*4 + 0x40]
prefetcht0 byte [rbx + rax]
prefetcht0 byte [rbx + rax + 0x20]
mov rax, rdi
lea r12, [r12 + 1]
and eax, 7
mov r9d, dword [r11 + rax*4 + 0x40]
mov r8d, r9d
mov dword [r11 + rax*4 + 0x40], edx
mov eax, ebp
shr r8, 2
and r8d, 0x3fffffc0
movzx ecx, byte [rbx + r8]
lea rdx, [rbx + r8]
dec ecx
and ecx, 0x3f
cmove eax, dword [rsp + 0x48]
inc rdi
add ecx, eax
mov byte [rdx], cl
mov eax, ecx
add rax, r8
mov byte [rdx + rcx], r9b
mov dword [r13 + rax*4], r10d
inc r10d
cmp r10d, esi
jb 0x1400ef0a0
mov eax, dword [r11 + 0x34]
mov esi, 3
mov rdi, qword [r11 + 0x70]
mov r12, qword [r11 + 0x38]
mov r14, qword [rsp + 0x68]
mov ebx, dword [rsp + 0x28]
lea edx, [rsi + 0x35]
mov r15, qword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r10d, dword [rsp + 0x24]
lea rax, [r14 + 1]
mov r13, qword [rsp + 0x40]
add r10d, 0xffffffe0
mov ecx, eax
mov r8d, r10d
sub ecx, r10d
sub ecx, r13d
inc ecx
lea r9, [r10 + r13]
cmp r9, rax
mov eax, 8
cmova ecx, ebp
cmp ecx, eax
cmova ecx, eax
lea eax, [rcx + r10]
cmp r10d, eax
jae 0x1400ef201
mov r15d, edx
mov r13d, ecx
sub r15d, dword [rsp + 0x20]
movabs rbx, 0xcf1bbcdcbb000000
mov rdx, qword [r9]
mov ecx, r15d
imul rdx, rbx
xor rdx, qword [r11 + 0x60]
shr rdx, cl
mov eax, edx
shr rax, 2
and eax, 0x3fffffc0
prefetcht0 byte [rdi + rax*4]
prefetcht0 byte [rdi + rax*4 + 0x40]
prefetcht0 byte [rax + r12]
prefetcht0 byte [rax + r12 + 0x20]
mov rax, r8
lea r9, [r9 + 1]
and eax, 7
inc r8
mov dword [r11 + rax*4 + 0x40], edx
sub r13, 1
jne 0x1400ef1a2
mov rdi, qword [r11 + 0x70]
mov r12, qword [r11 + 0x38]
mov ecx, dword [r11 + 0x34]
mov ebx, dword [rsp + 0x28]
mov r15, qword [rsp + 0x60]
jmp 0x1400ef205
mov ecx, dword [rsp + 0x20]
mov r9, qword [rsp + 0x58]
mov eax, dword [rsp + 0x24]
mov rdx, qword [r11 + 8]
cmp r10d, eax
jae 0x1400ef2e2
mov esi, gethostname
mov r13d, r10d
sub esi, ecx
lea r15, [rdx + 8]
add r15, r13
mov ebx, eax
movabs r14, 0xcf1bbcdcbb000000
nop dword [rax + rax]
mov rdx, qword [r15]
mov ecx, esi
imul rdx, r14
xor rdx, qword [r11 + 0x60]
shr rdx, cl
mov eax, edx
shr rax, 2
and eax, 0x3fffffc0
prefetcht0 byte [rdi + rax*4]
prefetcht0 byte [rdi + rax*4 + 0x40]
prefetcht0 byte [rax + r12]
prefetcht0 byte [rax + r12 + 0x20]
mov rax, r13
lea r15, [r15 + 1]
and eax, 7
mov r9d, dword [r11 + rax*4 + 0x40]
mov r8d, r9d
mov dword [r11 + rax*4 + 0x40], edx
mov eax, ebp
shr r8, 2
and r8d, 0x3fffffc0
movzx ecx, byte [r8 + r12]
lea rdx, [r8 + r12]
dec ecx
and ecx, 0x3f
cmove eax, dword [rsp + 0x48]
inc r13
add ecx, eax
mov byte [rdx], cl
mov eax, ecx
add rax, r8
mov byte [rdx + rcx], r9b
mov dword [rdi + rax*4], r10d
inc r10d
cmp r10d, ebx
jb 0x1400ef240
mov r14, qword [rsp + 0x68]
mov esi, 3
mov ebx, dword [rsp + 0x28]
mov r15, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov eax, dword [rsp + 0x24]
mov r8d, dword [rsp + 0x38]
mov ecx, gethostname
sub ecx, dword [rsp + 0x4c]
mov r10, qword [rsp + 0x40]
mov dword [r11 + 0x2c], eax
movabs rax, 0xcf1bbcdcbb000000
mov rdx, qword [r8 + r10 + 8]
imul rdx, rax
xor rdx, qword [rsp + 0x30]
shr rdx, cl
mov eax, edx
shr rax, 2
and eax, 0x3fffffc0
prefetcht0 byte [r9 + rax*4]
prefetcht0 byte [r9 + rax*4 + 0x40]
mov r12, qword [rsp + 0x78]
prefetcht0 byte [rax + r12]
prefetcht0 byte [rax + r12 + 0x20]
and r8d, 7
mov r13d, dword [r11 + r8*4 + 0x40]
mov dword [r11 + r8*4 + 0x40], edx
jmp 0x1400ef35b
xor r13, qword [rsp + 0x30]
sub edx, edi
movzx ecx, dl
mov dword [r11 + 0x2c], r8d
shr r13, cl
add dword [r11 + 0x68], r13d
mov eax, r13d
shr rax, 2
mov rdi, rbp
and eax, 0x3fffffc0
movdqu xmm0, xmmword [rax + r12]
lea rcx, [r9 + rax*4]
lea r9, [rax + r12]
mov qword [rsp + 0x30], rcx
movzx eax, byte [r9]
mov r12, rbp
mov qword [rsp + 0x68], r9
mov dword [rsp + 0x20], eax
movsx eax, r13b
movd xmm2, eax
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
movdqa xmm1, xmm2
pcmpeqb xmm1, xmm0
movdqu xmm0, xmmword [r9 + 0x10]
pmovmskb r8d, xmm1
movdqu xmm1, xmmword [r9 + 0x20]
pcmpeqb xmm0, xmm2
pmovmskb edx, xmm0
pcmpeqb xmm1, xmm2
movdqu xmm0, xmmword [r9 + 0x30]
pmovmskb ecx, xmm1
pcmpeqb xmm0, xmm2
pmovmskb eax, xmm0
movsxd r9, eax
shl r9, 0x10
movsxd rax, ecx
or r9, rax
movsxd rax, edx
mov edx, dword [rsp + 0x20]
shl r9, 0x10
and edx, 0x3f
or r9, rax
mov ecx, edx
shl r9, 0x10
neg ecx
movsxd rax, r8d
and ecx, 0x3f
or r9, rax
mov r8, r9
shl r8, cl
mov ecx, edx
shr r9, cl
or r8, r9
mov r9, qword [rsp + 0x30]
jbe 0x1400ef46c
mov edx, dword [rsp + 0x20]
mov r15d, dword [rsp + 0x74]
nop word [rax + rax]
test ebx, ebx
je 0x1400ef463
bsf rcx, r8
add ecx, edx
and ecx, 0x3f
je 0x1400ef45a
mov ecx, dword [r9 + rcx*4]
cmp ecx, r15d
jb 0x1400ef463
prefetcht0 byte [rcx + r10]
mov dword [rsp + r12*4 + 0xb0], ecx
inc r12
dec ebx
lea rax, [r8 - 1]
and r8, rax
ja 0x1400ef430
mov r15, qword [rsp + 0x60]
mov dword [rsp + 0x28], ebx
mov ecx, dword [rsp + 0x20]
mov eax, ebp
dec ecx
mov edx, 0x3f
and ecx, 0x3f
cmove eax, edx
add ecx, eax
mov rax, qword [rsp + 0x68]
mov byte [rax], cl
mov byte [rcx + rax], r13b
mov eax, dword [r11 + 0x2c]
mov dword [r9 + rcx*4], eax
inc dword [r11 + 0x2c]
test r12, r12
je 0x1400ef504
mov ebp, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x88]
nop dword [rax]
mov r13d, dword [rsp + rdi*4 + 0xb0]
mov eax, dword [rsi + r14 - 3]
lea rdx, [r10 + r13]
cmp dword [rdx + rsi - 3], eax
jne 0x1400ef4f6
mov r8, r15
mov rcx, r14
call fcn.1400e5100
mov rcx, rax
cmp rax, rsi
jbe 0x1400ef4f1
mov rsi, rax
mov eax, ebp
sub eax, r13d
add eax, 3
mov qword [rbx], rax
lea rax, [rcx + r14]
cmp rax, r15
je 0x1400ef4fe
mov r10, qword [rsp + 0x40]
inc rdi
cmp rdi, r12
jb 0x1400ef4b0
mov ebx, dword [rsp + 0x28]
xor ebp, ebp
mov rax, qword [rsp + 0x50]
mov r12, rbp
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
mov r10, qword [rax + 8]
movdqu xmm0, xmmword [r9]
mov r11, qword [rax]
movzx edi, byte [r9]
mov r13d, dword [rax + 0x18]
mov eax, r10d
sub eax, r11d
mov qword [rsp + 0x30], r10
add dword [rsp + 0x3c], eax
movsx eax, cl
mov qword [rsp + 0x50], r11
movd xmm2, eax
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
movdqa xmm1, xmm2
pcmpeqb xmm1, xmm0
movdqu xmm0, xmmword [r9 + 0x10]
pmovmskb r8d, xmm1
movdqa xmm1, xmm2
pcmpeqb xmm0, xmm2
pmovmskb edx, xmm0
movdqu xmm0, xmmword [r9 + 0x20]
pcmpeqb xmm1, xmm0
movdqu xmm0, xmmword [r9 + 0x30]
pmovmskb ecx, xmm1
pcmpeqb xmm0, xmm2
pmovmskb eax, xmm0
movsxd r9, eax
shl r9, 0x10
movsxd rax, ecx
or r9, rax
movsxd rax, edx
shl r9, 0x10
mov edx, edi
or r9, rax
and edx, 0x3f
movsxd rax, r8d
mov ecx, edx
shl r9, 0x10
neg ecx
or r9, rax
and ecx, 0x3f
mov r8, r9
shl r8, cl
mov ecx, edx
shr r9, cl
or r8, r9
jbe 0x1400ef6cc
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test ebx, ebx
je 0x1400ef611
bsf rcx, r8
add ecx, edi
and ecx, 0x3f
je 0x1400ef608
mov ecx, dword [rdx + rcx*4]
cmp ecx, r13d
jb 0x1400ef611
prefetcht0 byte [rcx + r10]
mov dword [rsp + rbp*4 + 0xb0], ecx
inc rbp
dec ebx
lea rax, [r8 - 1]
and r8, rax
ja 0x1400ef5e0
test rbp, rbp
je 0x1400ef6cc
nop word [rax + rax]
mov edi, dword [rsp + r12*4 + 0xb0]
mov eax, dword [r14]
add rdi, r10
cmp dword [rdi], eax
jne 0x1400ef6c0
add rdi, 4
lea r13, [r14 + 4]
mov rcx, r13
mov r8, r15
sub rcx, rdi
mov rdx, rdi
add rcx, r11
cmp rcx, r15
cmovb r8, rcx
mov rcx, r13
call fcn.1400e5100
mov r11, qword [rsp + 0x50]
mov rbx, rax
add rax, rdi
cmp rax, r11
jne 0x1400ef688
mov rdx, qword [rsp + 0xa0]
lea rcx, [rbx + r13]
mov r8, r15
call fcn.1400e5100
mov r11, qword [rsp + 0x50]
add rbx, rax
add rbx, 4
cmp rbx, rsi
jbe 0x1400ef6bb
mov eax, dword [rsp + 0x38]
mov rsi, rbx
sub eax, dword [rsp + r12*4 + 0xb0]
sub eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x88]
add eax, 3
mov qword [rcx], rax
lea rax, [rbx + r14]
cmp rax, r15
je 0x1400ef6cc
mov r10, qword [rsp + 0x30]
inc r12
cmp r12, rbp
jb 0x1400ef620
mov rax, rsi
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1401312e0
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret