Function at 0x19c08
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
or qword [r11 - 0x78], 0xffffffffffffffff
and dword [rsp + 0x50], 0
lea rax, [r11 - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [r11 - 0x58]
mov r12, r9
mov r13, r8
movzx r14d, dx
mov r15d, ecx
mov qword [rsp + 0x20], rax
call fcn.00019288
mov esi, eax
test eax, eax
js 0x19eca
mov rbx, qword [rsp + 0x68]
mov ecx, ebx
shr ecx, 0xc
inc ecx
shl ecx, 0xc
mov ebp, ecx
mov edx, ecx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x19eca
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.00021090
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x88]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x70]
xor ebp, ebp
mov r9, r13
movzx r8d, r14w
mov edx, r15d
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x88], rbp
call fcn.00019530
mov rcx, qword [rsp + 0x70]
mov esi, eax
cmp rcx, 0xffffffffffffffff
je 0x19ceb
call fcn.000110ec
cmp esi, ebp
jl 0x19ebf
or r8d, 0xffffffff
cmp ebx, ebp
jbe 0x19d28
mov r9, rdi
mov r10d, ebx
movzx ecx, byte [r9]
mov eax, r8d
inc r9
xor rcx, rax
shr eax, 8
movzx edx, cl
lea rcx, [0x00028680]
mov r8d, dword [rcx + rdx*4]
xor r8d, eax
sub r10, 1
jne 0x19d01
not r8d
cmp dword [rsp + 0x110], r8d
je 0x19d4a
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc0000001
jmp 0x19ecc
mov r8d, dword [rsp + 0x50]
cmp r8d, ebp
je 0x19d5e
cmp r8d, 0x20
jb 0x19e56
lea rdx, [0x00024930]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00024a30]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movabs rbx, 0xfffff78000000014
lea rdx, [rsp + 0x60]
mov rax, qword [rbx]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
mov eax, 0xcccccccd
mul edi
shr edx, 2
add edx, dword [rsp + 0x60]
mov ecx, edx
call sub.ntoskrnl.exe_srand
call sub.ntoskrnl.exe_rand
cdq
and edx, 0x1f
add eax, edx
and eax, 0x1f
sub eax, edx
mov dword [rsp + 0x50], eax
call fcn.0001477c
and eax, 0x1f
mov dword [rsp + 0x50], eax
jne 0x19e2a
mov rax, qword [rbx]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
mov ecx, dword [rsp + 0x60]
call sub.ntoskrnl.exe_srand
call sub.ntoskrnl.exe_rand
mov r11d, eax
mov eax, 0x84210843
imul r11d
add edx, r11d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1f
sub r11d, edx
inc r11d
mov dword [rsp + 0x50], r11d
mov r8d, 4
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x20], r8d
call fcn.000128dc
mov r8d, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
mov edx, ebx
mov rcx, rdi
mov byte [0x00025bd8], 1
call fcn.00017aec
movzx ecx, byte [0x00025bd8]
lea rdx, [0x00024930]
cmp eax, ebp
cmove ecx, ebp
mov byte [0x00025bd8], cl
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x000249b0]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x78]
mov r9, rdi
mov r8d, 3
mov dword [rsp + 0x20], ebx
call fcn.000128dc
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret