Function at 0x180021710
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1801eef68]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov ebx, dword [rsp + 0x50]
lea r12d, [rdx + 0x2a]
mov r14, r9
mov rsi, r8
mov edi, edx
mov r15, rcx
cmp edx, r12d
jae case.0x180021782.77
mov rbp, qword [rsp + 0x60]
lea rdx, [0x180000000]
xor r13d, r13d
lea eax, [rdi - 0x4b]
cmp eax, 0x63
ja case.0x180021782.82
movzx eax, byte [rdx + rax + 0x21a14]
mov ecx, dword [rdx + rax*4 + 0x219f4]
add rcx, rdx
jmp rcx
cmp byte [r15], 0x2d
jne 0x18002179d
cmp byte [r15 + 1], r13b
jne 0x18002179d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rbp, rax
jmp 0x1800217b9
lea rdx, [0x1801dde28]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
test rax, rax
je 0x18002197f
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
jmp 0x18002193f
mov rcx, qword [r15 + 8]
mov edx, PathMakeUniqueName
call fcn.180034320
jmp 0x18002193f
mov ebx, r13d
jmp case.0x180021782.82
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_setbuf]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_setbuf]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
jne 0x18002193a
nop
mov r8, rbp
lea rcx, [rsp + 0x70]
mov edx, 0x100
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x18002193a
movzx eax, byte [rsp + 0x70]
cmp al, 0x23
je 0x180021929
mov edi, r13d
cmp al, 0x2d
jne 0x18002187a
mov edi, 1
mov byte [rsp + 0x70], 0x20
mov edx, 0xa
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x180021891
mov byte [rax], r13b
mov edx, ILRemoveLastID
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x1800218a8
mov byte [rax], r13b
test edi, edi
jne 0x1800218c4
lea r8, [rsp + 0x70]
lea rdx, str.nT_X____d_
lea rcx, str._s:__s_n
call fcn.1800d6920
mov eax, dword [rsi]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], eax
mov ecx, 0xbd
call fcn.1800af5f0
test eax, eax
je 0x180021929
mov dword [rsp + 0x58], eax
lea r9, [rsp + 0x70]
mov eax, dword [rsi]
xor r8d, r8d
mov dword [rsp + 0x50], eax
xor edx, edx
lea rax, [rsp + 0x58]
xor ecx, ecx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
call fcn.180039c20
inc dword [0x1801f3790]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
je 0x180021840
mov edi, 0xa8
lea rdx, [0x180000000]
add edi, 6
cmp edi, r12d
jb 0x180021764
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1800d7250
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x1801f3790]
jmp 0x180021954
mov eax, dword [r14]
test eax, eax
je 0x1800219e7
nop dword [rax]
nop word [rax + rax]
dec dword [r14]
movzx eax, byte [rsi]
lea rsi, [rsi + 1]
mov r8d, dword [r15]
xor rax, r8
movzx ecx, al
shr r8d, 8
movzx eax, r8b
movzx edx, word [rdx + rcx*2 + 0xddbc0]
xor edx, eax
mov dword [r15], edx
lea rdx, [0x180000000]
cmp dword [r14], r13d
jne 0x1800219b0
mov eax, r13d
dec eax
mov dword [r14], eax
mov eax, dword [r15]
jmp 0x180021954