Function at 0x140001288
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x14001f040]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rcx
mov qword [rbp - 0x31], rcx
xor r13d, r13d
mov dword [rbp - 0x39], r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
movsxd rcx, dword [rax + 0x3c]
movzx eax, word [rcx + rax + 0x14]
lea r11, [r9 + 0x18]
add r11, rcx
add r11, rax
movzx r8d, r13w
movzx r10d, word [rcx + r9 + 6]
lea ebx, [r13 + 1]
cmp r13w, r10w
jae 0x140001325
movzx eax, r8w
lea rcx, [rax + rax*4]
lea rdx, [r11 + rcx*8]
cmp dword [rdx], 0x6164702e
jne 0x14000131b
cmp word [rdx + 4], 0x6174
jne 0x14000131b
cmp byte [rdx + 6], r13b
je 0x14000132e
add r8w, bx
cmp r8w, r10w
jb 0x1400012f9
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test rdx, rdx
je 0x140001325
mov r15d, dword [rdx + 0xc]
add r15, r9
mov ebx, dword [rdx + 8]
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov rsi, r13
mov qword [rbp - 0x19], r13
movabs rax, 0x7fffffffffffffff
sub rbx, 8
je 0x1400013a4
cmp rbx, rax
ja 0x140001566
mov rcx, rbx
cmp rbx, 0x1000
jb 0x140001378
call fcn.140001ba0
jmp 0x14000137d
call fcn.140001db0
mov rdi, rax
mov qword [rbp - 0x29], rax
lea rsi, [rax + rbx]
mov qword [rbp - 0x19], rsi
mov r8, rbx
lea rdx, [r15 + 8]
mov rcx, rax
call fcn.140011dc0
mov r15, rsi
mov qword [rbp - 0x21], rsi
jmp 0x1400013ac
mov r15, qword [rbp - 0x21]
mov rdi, qword [rbp - 0x29]
mov eax, r15d
sub eax, edi
cdq
sub eax, edx
sar eax, 1
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], rcx
movsxd rbx, eax
add rbx, rdi
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp + 0xf]
call fcn.140001858
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rax
mov r8, r15
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.140001858
nop
mov rbx, qword [rbp + 0xf]
mov rax, rbx
mov r12, qword [rbp + 0x17]
cmp rbx, r12
je 0x140001411
xor byte [rax], 0x9f
inc rax
cmp rax, r12
jne 0x140001406
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14], r13
mov qword [r14 + 8], r13
mov qword [r14 + 0x10], r13
mov dword [rbp - 0x39], 1
mov r13, qword [rbp - 1]
mov rcx, r13
mov r15, qword [rbp - 9]
sub rcx, r15
sub rcx, rbx
add rcx, r12
mov qword [rbp - 0x11], rcx
je 0x140001463
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000156c
lea rdx, [rbp - 0x11]
mov rcx, r14
call fcn.1400018f8
sub r12, rbx
mov rdx, qword [r14 + 8]
mov r9, r12
mov r8, rbx
mov rcx, r14
call fcn.1400019e8
sub r13, r15
mov rdx, qword [r14 + 8]
mov r9, r13
mov r8, r15
mov rcx, r14
call fcn.1400019e8
nop
mov r12d, 0x1000
test r15, r15
je 0x1400014ca
mov rdx, qword [rbp + 7]
sub rdx, r15
mov rax, r15
cmp rdx, r12
jb 0x1400014c1
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001572
mov rcx, r15
call fcn.140001dec
nop
test rbx, rbx
je 0x140001500
mov rdx, qword [rbp + 0x1f]
sub rdx, rbx
mov rax, rbx
cmp rdx, r12
jb 0x1400014f7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001578
mov rcx, rbx
call fcn.140001dec
nop
test rdi, rdi
je 0x140001530
sub rsi, rdi
mov rax, rdi
cmp rsi, r12
jb 0x140001525
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001560
mov rdx, rsi
mov rcx, rdi
call fcn.140001dec
mov rax, r14
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140001d90
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140008524
int3
call fcn.140001844
nop
call fcn.140001844
nop
call fcn.140008524
nop
call fcn.140008524
int3