Function at 0x140002650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ecx, pe_nt_image_headers64
mov r13, r9
mov rdi, r8
mov rsi, rdx
call fcn.140015eb0
xor edx, edx
mov qword [rsp + 0x58], rax
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov r12, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsi]
lea r8, [r12 + 8]
add rcx, rdi
mov qword [rsp + 0x20], r8
movzx eax, byte [rcx]
movzx ebx, byte [rcx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [rcx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [rcx + 3]
shl ebx, 8
or ebx, eax
mov dword [r12], ebx
mov rcx, qword [rsi]
add rcx, rdi
movzx eax, byte [rcx + 5]
movzx edx, byte [rcx + 4]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 6]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 7]
shl edx, 8
or edx, eax
mov dword [r12 + 4], edx
mov rax, qword [rsi]
movzx ecx, byte [rax + rdi + 8]
lea rdx, [rax + rdi]
movzx eax, byte [rax + rdi + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
mov dword [r8], ecx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0xc]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0xf]
shl edx, 8
or edx, eax
mov dword [r12 + 0xc], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x10]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x11]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x12]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x13]
shl edx, 8
or edx, eax
mov dword [r12 + 0x10], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x14]
lea rcx, [rax + rdi]
movzx eax, byte [rcx + 0x15]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x16]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x17]
shl edx, 8
or edx, eax
mov dword [r12 + 0x14], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x18]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x19]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x1a]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x1b]
shl edx, 8
or edx, eax
mov dword [r12 + 0x18], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x1c]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x1d]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x1e]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x1f]
shl edx, 8
or edx, eax
mov dword [r12 + 0x1c], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x20]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x21]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x22]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x23]
shl edx, 8
or edx, eax
mov dword [r12 + 0x20], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x24]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x25]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x26]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x27]
shl edx, 8
or edx, eax
mov dword [r12 + 0x24], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x28]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x29]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x2a]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x2b]
shl edx, 8
or edx, eax
mov dword [r12 + 0x28], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x2c]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x2d]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x2e]
mov ebp, 6
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x2f]
shl edx, 8
or edx, eax
mov dword [r12 + 0x2c], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x30]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x31]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x32]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x33]
shl edx, 8
or edx, eax
mov dword [r12 + 0x30], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x34]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x35]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x36]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x37]
shl edx, 8
or edx, eax
mov dword [r12 + 0x34], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x38]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x39]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x3a]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x3b]
shl edx, 8
or edx, eax
mov dword [r12 + 0x38], edx
mov rax, qword [rsi]
movzx edx, byte [rax + rdi + 0x3c]
lea rcx, [rax + rdi]
movzx eax, byte [rax + rdi + 0x3d]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x3e]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 0x3f]
shl edx, 8
or edx, eax
mov rax, r12
mov dword [r12 + 0x3c], edx
mov r9d, dword [rax + 4]
mov edx, r9d
mov esi, dword [rax + 0x38]
mov r15d, esi
ror edx, 0x12
mov ecx, esi
ror ecx, 0x11
ror r15d, 0x13
xor r15d, ecx
mov ecx, esi
shr ecx, 0xa
xor r15d, ecx
mov ecx, r9d
ror ecx, 7
xor edx, ecx
mov ecx, r9d
shr ecx, 3
xor edx, ecx
add r15d, edx
add r15d, dword [rax + 0x24]
add r15d, ebx
mov dword [rax + 0x40], r15d
mov r11d, dword [rax + 8]
mov edx, r11d
mov r14d, dword [rax + 0x3c]
mov edi, r14d
ror edx, 0x12
mov ecx, r14d
ror ecx, 0x11
ror edi, 0x13
xor edi, ecx
mov ecx, r14d
shr ecx, 0xa
xor edi, ecx
mov ecx, r11d
ror ecx, 7
xor edx, ecx
mov ecx, r11d
shr ecx, 3
xor edx, ecx
mov ecx, r15d
ror ecx, 0x11
add edi, edx
add edi, dword [rax + 0x28]
add edi, r9d
mov r9d, r15d
ror r9d, 0x13
xor r9d, ecx
mov dword [rax + 0x44], edi
mov r10d, dword [rax + 0xc]
mov ecx, r15d
shr ecx, 0xa
mov edx, r10d
xor r9d, ecx
ror edx, 0x12
mov ecx, r10d
ror ecx, 7
xor edx, ecx
mov ecx, r10d
shr ecx, 3
xor edx, ecx
add r9d, edx
mov edx, edi
add r9d, dword [rax + 0x2c]
add r9d, r11d
ror edx, 0x13
mov dword [rax + 0x48], r9d
mov r11d, dword [rax + 0x10]
mov ebx, r11d
ror ebx, 0x12
mov ecx, r11d
ror ecx, 7
xor ebx, ecx
mov ecx, r11d
shr ecx, 3
xor ebx, ecx
mov ecx, edi
ror ecx, 0x11
xor edx, ecx
shr edi, 0xa
xor edx, edi
add ebx, edx
mov edi, r9d
add ebx, dword [rax + 0x30]
mov ecx, r9d
ror ecx, 0x11
add ebx, r10d
ror edi, 0x13
xor edi, ecx
mov dword [rax + 0x4c], ebx
mov r8d, dword [rax + 0x14]
mov edx, r8d
ror edx, 0x12
mov ecx, r8d
ror ecx, 7
xor edx, ecx
shr r9d, 0xa
mov ecx, r8d
xor edi, r9d
shr ecx, 3
xor edx, ecx
mov ecx, ebx
ror ecx, 0x11
add edi, edx
add edi, dword [rax + 0x34]
mov edx, ebx
add edi, r11d
ror edx, 0x13
xor edx, ecx
mov dword [rax + 0x50], edi
mov r9d, dword [rax + 0x18]
mov r11d, r9d
ror r11d, 0x12
mov ecx, r9d
ror ecx, 7
xor r11d, ecx
shr ebx, 0xa
xor edx, ebx
mov ecx, r9d
shr ecx, 3
xor r11d, ecx
lea ecx, [rsi + rdx]
mov edx, edi
add r11d, ecx
ror edx, 0x13
add r11d, r8d
mov dword [rax + 0x54], r11d
mov r10d, dword [rax + 0x1c]
mov r8d, r10d
ror r8d, 0x12
mov ecx, r10d
ror ecx, 7
xor r8d, ecx
mov ecx, r10d
shr ecx, 3
xor r8d, ecx
mov ecx, edi
ror ecx, 0x11
xor edx, ecx
shr edi, 0xa
xor edx, edi
lea ecx, [r14 + r8]
mov r8d, r11d
add edx, ecx
ror r8d, 0x13
add edx, r9d
mov ecx, r11d
ror ecx, 0x11
xor r8d, ecx
mov dword [rax + 0x58], edx
mov ebx, dword [rax + 0x20]
mov edx, ebx
ror edx, 0x12
mov ecx, ebx
ror ecx, 7
xor edx, ecx
shr r11d, 0xa
xor r8d, r11d
mov ecx, ebx
shr ecx, 3
xor edx, ecx
lea ecx, [r15 + r8]
add edx, ecx
lea rax, [rax + 0x20]
add edx, r10d
mov dword [rax + 0x3c], edx
sub rbp, 1
jne 0x140002970
mov r15, qword [r13]
lea r13, [0x14001a7c0]
mov rdx, qword [rsp + 0x20]
sub r13, r12
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x28], 8
mov eax, dword [r15]
mov ebx, eax
mov r11d, dword [r15 + 4]
mov r10d, dword [r15 + 8]
mov r9d, dword [r15 + 0xc]
mov r14d, dword [r15 + 0x10]
mov ebp, dword [r15 + 0x14]
mov esi, dword [r15 + 0x18]
mov edi, dword [r15 + 0x1c]
lea r15, [0x14001a7c4]
mov dword [rsp + 0xa0], eax
sub r15, r12
lea rax, [0x14001a7c8]
sub rax, r12
mov qword [rsp + 0x30], rax
lea rax, [0x14001a7cc]
sub rax, r12
mov qword [rsp + 0x38], rax
lea rax, [0x14001a7d0]
sub rax, r12
mov qword [rsp + 0x40], rax
lea rax, [0x14001a7d4]
sub rax, r12
mov r12, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
nop dword [rax]
nop word [rax + rax]
mov eax, r14d
mov r8d, r14d
ror eax, 0xb
mov ecx, r14d
ror r8d, 0x19
not ecx
xor r8d, eax
and ecx, esi
mov eax, r14d
ror eax, 6
xor r8d, eax
mov eax, ebp
and eax, r14d
xor ecx, eax
mov eax, ebx
add r8d, ecx
ror eax, 0xd
add r8d, dword [rdx + r13 - 8]
mov ecx, r11d
add r8d, dword [rdx - 8]
xor ecx, ebx
add r8d, edi
and ecx, r10d
add r9d, r8d
mov edi, ebx
ror edi, 0x16
xor edi, eax
mov eax, ebx
ror eax, 2
xor edi, eax
mov eax, r11d
and eax, ebx
xor ecx, eax
mov eax, r9d
ror eax, 0xb
add edi, ecx
add edi, r8d
mov ecx, r9d
not ecx
mov r8d, r9d
ror r8d, 0x19
and ecx, ebp
xor r8d, eax
mov eax, r9d
ror eax, 6
xor r8d, eax
mov eax, r14d
and eax, r9d
xor ecx, eax
mov rax, qword [rsp + 0x20]
add r8d, ecx
mov ecx, ebx
xor ecx, edi
and ecx, r11d
add r8d, dword [r15 + rax - 8]
add r8d, dword [rax - 4]
mov eax, edi
add r8d, esi
ror eax, 0xd
add r10d, r8d
mov esi, edi
ror esi, 0x16
xor esi, eax
mov eax, edi
ror eax, 2
xor esi, eax
mov eax, ebx
and eax, edi
xor ecx, eax
mov eax, r10d
add esi, ecx
ror eax, 0xb
add esi, r8d
mov ecx, r10d
mov r8d, r10d
not ecx
ror r8d, 0x19
xor r8d, eax
mov eax, r10d
ror eax, 6
xor r8d, eax
and ecx, r14d
mov eax, r9d
and eax, r10d
xor ecx, eax
mov rax, qword [rsp + 0x20]
add r8d, ecx
mov ecx, edi
xor ecx, esi
and ecx, ebx
add r8d, dword [rax + r13]
add r8d, dword [rax]
mov eax, esi
ror eax, 0xd
add r8d, ebp
add r11d, r8d
mov ebp, esi
ror ebp, 0x16
xor ebp, eax
mov eax, esi
ror eax, 2
xor ebp, eax
mov eax, edi
and eax, esi
xor ecx, eax
mov eax, r11d
ror eax, 0xb
add ebp, ecx
add ebp, r8d
mov ecx, r11d
not ecx
mov r8d, r11d
ror r8d, 0x19
and ecx, r9d
xor r8d, eax
mov eax, r11d
ror eax, 6
xor r8d, eax
mov eax, r10d
and eax, r11d
xor ecx, eax
mov rax, qword [rsp + 0x20]
add r8d, ecx
mov ecx, esi
xor ecx, ebp
and ecx, edi
add r8d, dword [r15 + rax]
add r8d, dword [rax + 4]
mov eax, ebp
add r8d, r14d
ror eax, 0xd
add ebx, r8d
mov r14d, ebp
ror r14d, 0x16
xor r14d, eax
mov eax, ebp
ror eax, 2
xor r14d, eax
mov eax, esi
and eax, ebp
xor ecx, eax
mov eax, ebx
ror eax, 0xb
add r14d, ecx
add r14d, r8d
mov ecx, ebx
not ecx
mov r8d, ebx
ror r8d, 0x19
and ecx, r10d
xor r8d, eax
mov eax, ebx
ror eax, 6
xor r8d, eax
mov eax, r11d
and eax, ebx
xor ecx, eax
mov rax, qword [rsp + 0x20]
add r8d, ecx
add r8d, dword [r12 + rax]
add r8d, dword [rax + 8]
add r8d, r9d
add edi, r8d
mov eax, r14d
ror eax, 0xd
mov ecx, ebp
xor ecx, r14d
mov r9d, r14d
and ecx, esi
ror r9d, 0x16
xor r9d, eax
mov eax, r14d
ror eax, 2
xor r9d, eax
mov eax, ebp
and eax, r14d
xor ecx, eax
mov eax, edi
ror eax, 0xb
add r9d, ecx
add r9d, r8d
mov ecx, edi
not ecx
mov r8d, edi
ror r8d, 0x19
and ecx, r11d
xor r8d, eax
mov eax, edi
ror eax, 6
xor r8d, eax
mov eax, ebx
and eax, edi
xor ecx, eax
mov rax, qword [rsp + 0x38]
add r8d, ecx
mov rcx, qword [rsp + 0x20]
add r8d, dword [rax + rcx]
mov eax, r9d
add r8d, dword [rcx + 0xc]
mov ecx, r14d
add r8d, r10d
ror eax, 0xd
add esi, r8d
xor ecx, r9d
and ecx, ebp
mov r10d, r9d
ror r10d, 0x16
xor r10d, eax
mov eax, r9d
ror eax, 2
xor r10d, eax
mov eax, r14d
and eax, r9d
xor ecx, eax
mov eax, esi
ror eax, 0xb
add r10d, ecx
add r10d, r8d
mov ecx, esi
not ecx
mov r8d, esi
ror r8d, 0x19
and ecx, ebx
xor r8d, eax
mov eax, esi
ror eax, 6
xor r8d, eax
mov eax, edi
and eax, esi
xor ecx, eax
mov rax, qword [rsp + 0x40]
add r8d, ecx
mov rcx, qword [rsp + 0x20]
add r8d, dword [rax + rcx]
mov eax, r10d
add r8d, dword [rcx + 0x10]
add r8d, r11d
ror eax, 0xd
mov r11d, r10d
ror r11d, 0x16
xor r11d, eax
mov eax, r10d
ror eax, 2
mov rdx, qword [rsp + 0x20]
xor r11d, eax
add ebp, r8d
mov ecx, r9d
xor ecx, r10d
mov eax, r9d
and eax, r10d
and ecx, r14d
xor ecx, eax
add rdx, 0x20
add r11d, ecx
mov eax, ebp
add r11d, r8d
ror eax, 0xb
mov ecx, ebp
mov r8d, ebp
ror r8d, 0x19
not ecx
xor r8d, eax
and ecx, edi
mov eax, ebp
ror eax, 6
xor r8d, eax
mov eax, esi
and eax, ebp
xor ecx, eax
mov rax, qword [rsp + 0x48]
add r8d, ecx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rdx
add r8d, dword [rax + rcx]
mov eax, r11d
add r8d, dword [rcx + 0x14]
mov ecx, r10d
add r8d, ebx
ror eax, 0xd
xor ecx, r11d
mov ebx, r11d
ror ebx, 0x16
and ecx, r9d
xor ebx, eax
add r14d, r8d
mov eax, r11d
ror eax, 2
xor ebx, eax
mov eax, r10d
and eax, r11d
xor ecx, eax
add ebx, ecx
add ebx, r8d
sub qword [rsp + 0x28], 1
jne 0x140002c00
mov r13, qword [rsp + 0xb8]
mov eax, dword [rsp + 0xa0]
mov r15, qword [rsp + 0x50]
add eax, ebx
mov r12, qword [rsp + 0x58]
mov dword [r15], eax
mov rax, qword [r13]
add dword [rax + 4], r11d
mov rax, qword [r13]
add dword [rax + 8], r10d
mov rax, qword [r13]
add dword [rax + 0xc], r9d
mov rax, qword [r13]
add dword [rax + 0x10], r14d
mov rax, qword [r13]
add dword [rax + 0x14], ebp
mov rax, qword [r13]
add dword [rax + 0x18], esi
mov rax, qword [r13]
add dword [rax + 0x1c], edi
test r12, r12
je 0x140002fbb
mov edx, pe_nt_image_headers64
mov rcx, r12
call fcn.14001613c
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret