Function at 0x14000e5cc
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movzx eax, word [0x140049234]
mov r10, rcx
mov qword [rsp + 0x58], rax
movzx eax, word [0x140049250]
mov qword [rsp + 0x58], rax
mov al, byte [str.R._AUIVectorChanged]
mov eax, dword [0x140049240]
mov eax, 0xffffe355
mov word [rsp + 0x58], ax
mov byte [rsp + 0x58], 0x5f
mov byte [rsp + 0x58], 0x99
mov al, byte [0x1400491c3]
mov al, byte [0x1400491ae]
mov byte [rsp + 0x58], al
mov eax, dword [0x140049258]
mov qword [rsp + 0x58], 0x65a4
mov dword [rsp + 0x58], eax
movabs rax, 0x3bc8a46a03599
mov byte [rsp + 0x58], 0xbf
mov qword [rsp + 0x20], rax
mov al, byte [0x1400491de]
mov qword [rsp + 0x58], 0xca
mov al, byte [str.R._AUIVectorChanged]
movzx eax, byte [0x140049183]
mov qword [rsp + 0x58], rax
mov al, byte [0x1400491c4]
mov byte [rsp + 0x58], al
movzx eax, word [0x14004923c]
mov word [rsp + 0x58], ax
mov eax, 0xe0
mov word [rsp + 0x58], ax
mov al, byte [0x1400491db]
mov byte [rsp + 0x58], al
mov byte [rsp + 0x58], 0xb5
mov al, byte [0x1400491c3]
mov eax, 0x2fae
mov word [rsp + 0x58], ax
movzx eax, word [0x140049238]
mov byte [rsp + 0x58], al
mov al, byte [0x140049258]
mov byte [rsp + 0x58], al
movzx eax, word [0x140049234]
movzx ecx, word [0x140049238]
mov rax, qword [0x140049260]
cmp rcx, rax
je 0x14000e5a6
mov qword [0x1400491e8], 0xae
jmp 0x14000e5b6
mov rax, qword [rsp + 0x20]
xor rax, 0x3a9
mov qword [rsp + 0x20], rax
mov r9d, r8d
or rcx, 0xffffffffffffffff
mov r8, rdx
mov rdx, r10
add rsp, 0x38
jmp 0x14000e5cc
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
mov rax, qword [0x1400499b8]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x51], 0x654de95b
mov ebx, 0x8d6ee316
movzx eax, word [0x140049218]
mov r15d, 0x49
mov byte [rbp - 0x80], al
mov eax, dword [0x140049208]
mov byte [rsp + 0x58], al
mov eax, dword [0x14004925c]
mov qword [rbp - 0x59], 0x4caf555c
mov dword [rsp + 0x50], eax
movzx eax, byte [0x1400491c3]
mov qword [rbp - 0x51], rax
mov eax, 0xffffed92
mov word [rsp + 0x50], ax
mov qword [rbp - 0x59], 0x75216e9a
mov eax, dword [0x140049184]
mov word [rbp - 0x69], ax
mov r12, qword [0x140049260]
mov rax, qword [0x1400491e8]
mov dword [rbp - 0x65], eax
mov byte [rbp - 0x79], 0x2c
mov rax, qword [0x140049268]
mov word [rbp - 0x6d], ax
mov eax, 0xffff9682
mov word [rbp - 0x71], ax
movzx r13d, word [0x140049250]
mov eax, dword [0x140049230]
mov dword [rbp - 0x7d], eax
mov eax, dword [0x140049228]
mov byte [rsp + 0x50], 0x41
mov dword [rbp - 0x7d], eax
mov byte [rsp + 0x50], 0x96
mov rax, qword [0x140049268]
movzx eax, byte [0x140049183]
mov word [rsp + 0x50], ax
mov al, byte [0x140049270]
mov byte [rsp + 0x50], al
mov rax, qword [0x140049200]
mov dword [rbp - 0x7d], 0x2e7a6ea7
mov eax, 0xeeae
mov word [rsp + 0x50], ax
mov eax, dword [0x140353e60]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
add eax, 0x85
mov qword [rbp - 0x31], rcx
mov dword [rbp - 0x7d], eax
mov eax, dword [rsp + 0x50]
add eax, 0x73
mov dword [rbp - 0x45], r9d
mov dword [rbp - 0x7d], eax
mov eax, dword [0x14004916c]
imul eax, eax, 0x340c
mov qword [rbp - 0x41], r8
mov qword [rbp - 0x39], rdx
mov qword [rbp - 0x51], rax
mov eax, dword [rsp + 0x50]
add eax, 0x66
mov dword [rbp - 0x75], eax
mov rcx, qword [0x140049248]
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [rsp + 0x50], eax
xor r9d, r9d
mov al, byte [0x1400491ae]
lea r14d, [r15 + 0x5e]
mov eax, dword [rbp - 0x75]
mov r8d, r9d
xor eax, 0x2e8
mov esi, r9d
mov dword [rbp - 0x61], eax
mov al, byte [rbp - 0x79]
cmp qword [0x1400491e0], r9
movsx edi, byte [0x1400491c6]
mov eax, dword [0x140353e60]
sete sil
sub edi, 0xd415f5b
mov dword [rsp + 0x54], eax
mov eax, dword [0x140049208]
sete r8b
cmp eax, r8d
jne 0x14000e7be
movsx rcx, byte [0x1400491c6]
mov rax, qword [0x140049260]
cmp rax, rcx
jb 0x14000e7be
movzx ecx, byte [0x1400491c3]
mov rax, qword [rbp - 0x51]
not ecx
movsxd rdx, ecx
cmp rdx, rax
jl 0x14000e7f2
mov eax, dword [0x140049230]
add eax, 0x13bf3ec3
mov dword [0x140049254], eax
jmp 0x14000e7f2
mov eax, dword [rsp + 0x50]
mov eax, dword [0x140049254]
mov edx, dword [0x140049270]
add eax, 0xffffffb7
movzx ecx, byte [rbp - 0x79]
xor edx, r15d
imul edx, eax
mov eax, dword [0x14004920c]
and eax, r14d
imul eax, ecx
not edx
add eax, edx
mov qword [0x140049260], rax
mov eax, dword [rsp + 0x54]
mov ecx, r9d
add eax, 0x52a9
mov dword [rbp - 0x7d], eax
mov eax, dword [0x140049184]
cmp r8d, eax
movzx eax, byte [rsp + 0x58]
sete cl
cmp ecx, eax
jne 0x14000e863
movsx rcx, byte [0x1400491db]
mov rax, qword [0x1400491e8]
sub rcx, rax
mov rax, r9
cmp dword [0x14004923c], r15d
sete al
cmp rcx, rax
jne 0x14000e863
test r12w, r12w
je 0x14000e858
movzx ecx, byte [0x1400491c3]
mov eax, 0x2706
add cx, ax
mov word [0x140049234], cx
jmp 0x14000e863
mov rax, qword [rbp - 0x59]
mov byte [0x140049183], 0xc
mov eax, dword [rsp + 0x54]
add eax, 0xc30b
mov dword [rbp - 0x7d], eax
mov al, byte [str.R._AUIVectorChanged]
mov cl, byte [str.R._AUIVectorChanged]
xor cl, al
mov al, byte [str.R._AUIVectorChanged]
sub al, cl
mov byte [str.R._AUIVectorChanged], al
movzx eax, si
movsx ecx, word [rbp - 0x71]
xor ecx, 0x1d13
mov dword [0x140049244], ecx
mov ecx, 0xb4
sub ax, cx
mov rcx, rbx
mov word [0x140049250], ax
mov eax, dword [rsp + 0x54]
add eax, 0x17
mov dword [rbp - 0x75], eax
movzx edx, word [0x140049218]
movzx eax, word [0x140049218]
sub dx, ax
movzx eax, byte [0x1400491de]
sub dx, ax
mov eax, dword [0x140353e60]
mov word [0x140049218], dx
mov qword [rbp - 0x59], rax
mov eax, dword [rbp - 0x75]
xor eax, 0x1f2
mov dword [rbp - 0x49], eax
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov byte [0x1400491de], al
mov al, byte [0x1400491de]
test al, al
je 0x14000e936
cmp r14, qword [0x1400491f8]
je 0x14000e930
mov rax, qword [0x1400491e0]
sub rbx, 0x31
lea rdx, [rax + rax]
movsx rax, byte [rbp - 0x80]
sub rdx, rax
mov qword [0x1400491e0], rdx
jmp 0x14000e965
mov eax, dword [rsp + 0x50]
jmp 0x14000e965
mov al, byte [rsp + 0x58]
cmp al, 0x83
jb 0x14000e965
movzx eax, word [0x140049218]
sub ax, word [0x140049270]
mov word [0x140049218], ax
mov rax, qword [0x140049200]
add rax, 0x31
mov qword [0x140049200], rax
mov eax, dword [0x140353e60]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
add eax, 6
mov dword [rbp - 0x7d], eax
mov eax, dword [rsp + 0x54]
add eax, 0xef
mov dword [rbp - 0x75], eax
mov eax, dword [rsp + 0x54]
add eax, 0x35
mov dword [rbp - 0x7d], eax
call qword [sym.imp.USER32.dll_GetShellWindow]
mov cl, al
not cl
movzx edx, cl
xor ecx, ecx
shr edx, 7
cmp al, 6
setge cl
cmp edx, ecx
ja 0x14000e9c3
movsx rax, word [0x140417c00]
mov rcx, qword [0x140049248]
sub rcx, rax
mov qword [0x140049248], rcx
mov eax, dword [0x140049220]
mov r14d, edi
mov dword [rsp + 0x50], eax
mov ecx, 0x88
mov eax, dword [rbp - 0x75]
sub ecx, eax
mov eax, dword [rbp - 0x75]
sub r14d, dword [0x140049258]
add eax, ecx
mov dword [rbp - 0x7d], eax
add r14d, 0x438a
mov eax, dword [0x140353e60]
add r14d, esi
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
add eax, 0xf3
mov dword [rsp + 0x50], eax
xor eax, eax
cmp byte [0x1400491af], al
sete al
xor ecx, ecx
cmp r14, rax
sete cl
add ecx, esi
je 0x14000ea42
mov rax, qword [0x140049268]
test rax, rax
je 0x14000ea42
mov al, byte [0x1400491c3]
test al, al
sete al
add al, byte [0x140049254]
mov byte [rsp + 0x58], al
mov eax, dword [rsp + 0x54]
add eax, 0xb062
mov dword [rbp - 0x75], eax
mov eax, dword [0x140049240]
test eax, eax
je 0x14000ea6a
cmp qword [0x140049220], 0
je 0x14000ea6a
mov r8d, 1
jmp 0x14000ea6d
xor r8d, r8d
mov rax, qword [rbp - 0x59]
mov ecx, dword [0x140049230]
cmp rcx, rax
sbb edx, edx
xor ecx, ecx
and edx, r8d
cmp qword [0x1400491e0], rcx
sete cl
xor eax, eax
cmp ecx, dword [0x140049270]
setle al
cmp edx, eax
jae 0x14000eac6
movzx eax, word [0x1400367c0]
lea rcx, [rbp - 9]
movups xmm0, xmmword [str.DoGenericCallPkg_S]
mov word [rbp + 7], ax
mov al, byte [0x1400367c2]
mov byte [rbp + 9], al
movups xmmword [rbp - 9], xmm0
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rbx, eax
mov eax, dword [rsp + 0x54]
add eax, 0x6498
mov dword [rbp - 0x75], eax
mov rax, qword [0x140049200]
test rax, rax
jle 0x14000eb06
movzx eax, word [0x140049234]
mov ecx, 0xfdc6
xor ax, cx
mov ecx, 0x8a80
mov word [0x140049250], ax
movzx eax, di
and ax, cx
mov word [0x140049234], ax
mov ecx, dword [rbp - 0x75]
mov eax, dword [rsp + 0x50]
imul ecx, eax
mov eax, 0x5f7c48
sub eax, ecx
mov dword [rbp - 0x75], eax
mov eax, dword [0x140353e60]
mov dword [rsp + 0x54], eax
call qword [sym.imp.USER32.dll_GetFocus]
test rax, rax
je 0x14000eb46
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_GetSubMenu]
movsx ecx, word [rbp - 0x71]
not ecx
test ecx, ecx
jne 0x14000ebe3
mov rax, qword [rbp - 0x51]
test rax, rax
je 0x14000eb9b
movsx ecx, byte [0x1400491db]
xor esi, esi
mov eax, dword [0x140049240]
mov edx, esi
imul eax, ecx
mov ecx, esi
test eax, eax
movzx eax, word [0x140049250]
mov qword [0x1400491f8], 0xffffffffcc69cc7b
sete dl
test r14, r14
cmove cx, ax
and cx, dx
mov word [rsp + 0x50], cx
jmp 0x14000ebe5
cmp qword [0x1400491f8], 0
jne 0x14000ebb1
test r14, r14
je 0x14000ebb1
mov edx, 1
jmp 0x14000ebb3
xor edx, edx
movzx eax, word [0x140049234]
cmp eax, edx
jae 0x14000ebcf
mov eax, dword [rbp - 0x65]
sub eax, dword [0x14004920c]
mov dword [0x140049254], eax
jmp 0x14000ebe3
mov eax, dword [0x140049240]
mov eax, dword [0x14004916c]
test esi, esi
je 0x14000ebe3
movzx ebx, r12w
xor esi, esi
mov eax, dword [rsp + 0x54]
add eax, 0xdcbc
mov dword [rbp - 0x65], eax
movzx eax, byte [0x1400491c3]
mov ecx, eax
movzx eax, word [rbp - 0x6d]
add eax, ecx
sub bx, ax
mov word [rbp - 0x6d], bx
movzx eax, word [rbp - 0x69]
add ax, word [0x140049270]
mov word [rbp - 0x69], ax
mov eax, dword [rsp + 0x54]
add eax, 0x8eb9
mov dword [rbp - 0x65], eax
mov eax, dword [rsp + 0x54]
add eax, 0xeab5
mov dword [rbp - 0x65], eax
movzx ecx, byte [0x1400491c3]
mov rax, qword [0x140049260]
cmp rcx, rax
je 0x14000ec57
mov al, byte [0x140049270]
shl al, 4
mov byte [str.R._AUIVectorChanged], al
mov r15b, byte [0x1400491de]
movzx eax, word [0x1400367d0]
lea rcx, [rbp - 0x19]
movsd xmm0, qword [str.grant_type]
mov word [rbp - 0x11], ax
mov al, byte [0x1400367d2]
mov byte [rbp - 0xf], al
movsd qword [rbp - 0x19], xmm0
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov word [0x1400491dc], ax
mov dword [rbp - 0x65], esi
mov al, byte [0x1400491ae]
mov al, byte [rbp - 0x80]
mov eax, dword [0x140049184]
mov rax, qword [0x140049210]
movzx eax, word [rbp - 0x71]
mov al, byte [0x1400491c3]
mov byte [0x1400491c3], al
mov eax, dword [0x140353e60]
mov dword [rsp + 0x54], eax
mov ecx, dword [rsp + 0x54]
mov eax, dword [rbp - 0x61]
add ecx, eax
mov dword [rbp - 0x61], ecx
mov eax, 0x4d2b
movsx ecx, byte [0x1400491db]
sub cx, ax
mov word [0x1400491c4], cx
movzx ecx, byte [0x1400491c3]
sub rcx, 0x32
mov qword [0x140049268], rcx
mov ecx, dword [rsp + 0x54]
mov eax, dword [rbp - 0x49]
add ecx, eax
mov dword [rbp - 0x69], ecx
mov rax, qword [rbp - 0x59]
test rax, rax
je 0x14000ed15
movzx ecx, r15b
call qword [sym.imp.USER32.dll_IsZoomed]
mov word [rbp - 0x6d], ax
jmp 0x14000ed62
cmp dword [0x140049254], esi
je 0x14000ed32
mov al, byte [0x140353e60]
mov byte [rbp - 0x80], al
mov al, byte [0x1400491ae]
mov rax, qword [rbp - 0x59]
jmp 0x14000ed62
movsx rax, word [0x1400491c4]
cmp rax, qword [0x140049228]
je 0x14000ed62
test edi, edi
jne 0x14000ed62
movsx rdx, byte [0x1400491db]
mov rax, qword [0x140049268]
movsx ecx, al
imul ecx, edx
mov byte [0x1400491db], cl
mov ecx, dword [rsp + 0x54]
not r13d
mov eax, dword [rbp - 0x7d]
add ecx, eax
mov rbx, qword [rbp - 0x41]
mov edi, dword [rbp - 0x45]
mov r9, rbx
mov r8, qword [rbp - 0x39]
mov rdx, qword [rbp - 0x31]
mov dword [rbp - 0x7d], ecx
movzx ecx, word [0x140049250]
mov eax, dword [0x140049240]
sub cx, ax
mov word [0x140049250], cx
lea rcx, [0x140026752]
mov rax, qword [0x140049200]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x50], r13d
mov eax, dword [rbp - 0x75]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
call fcn.140012594
mov edx, dword [rbp - 0x69]
mov r8, rax
mov ecx, dword [rbp - 0x61]
imul edx, ecx
mov ecx, dword [rbp - 0x69]
sub edx, ecx
mov ecx, dword [rbp - 0x7d]
sub edx, ecx
mov ecx, dword [rbp - 0x69]
cmp edx, ecx
je 0x14000ee64
mov eax, dword [rbp - 0x65]
cmp r8, rax
jne 0x14000ee64
mov cl, byte [0x1400491de]
mov al, byte [0x1400491db]
sub cl, al
mov dword [rbp - 0x29], 0x8f9495c7
mov byte [0x1400491de], cl
mov rax, rsi
mov dword [rbp - 0x25], 0x8e949ddb
mov dword [rbp - 0x21], 0xc59f95
xor byte [rbp + rax - 0x29], 0xfb
inc rax
cmp rax, 0xb
jb 0x14000ee1f
mov qword [rsp + 0x40], rsi
lea r9d, [rdi - 1]
mov qword [rsp + 0x38], rsi
lea r8, [rbp - 0x29]
mov qword [rsp + 0x30], rsi
lea rcx, [0x140028eb0]
mov qword [rsp + 0x28], rsi
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call fcn.140012594
mov eax, 3
jmp 0x14000ee66
xor eax, eax
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1400267f0
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret