Function at 0x140001380
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x3d0
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
xor eax, eax
lea rcx, str.NTDLL.DLL
mov dword [rsp + 0x24], eax
call fcn.140001070
mov rcx, rax
lea rdx, str.NtDelayExecution
call fcn.1400011e0
mov edx, 0x1e
lea rcx, str._i__Delaying_Execution_Using__NtDelayExecution__For__0.3d_Seconds
mov rbx, rax
call fcn.140001010
mov qword [rsp + 0x20], 0xffffffffee1e5d00
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov rdi, rax
call rbx
test eax, eax
je 0x1400017e6
cmp eax, 0x102
je 0x1400017e6
mov edx, eax
lea rcx, str.____NtDelayExecution_Failed_With_Error_:_0x_0.8X__n
call fcn.140001010
lea rcx, str._n_t_t______DelayExecutionVia_NtDE_FAILED_______n
call fcn.140001010
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
lea rcx, str.NTDLL.DLL
xor eax, eax
mov dword [rsp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtWaitForSingleObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x1e
lea rcx, str._i__Delaying_Execution_Using__NtWaitForSingleObject__For__0.3d_Seconds
mov rbx, rax
call fcn.140001010
mov qword [rsp + 0x20], 0xffffffffee1e5d00
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rdi
mov rsi, rax
call rbx
test eax, eax
je 0x140001813
cmp eax, 0x102
je 0x140001813
mov edx, eax
lea rcx, str.____NtWaitForSingleObject_Failed_With_Error_:_0x_0.8X__n
call fcn.140001010
lea rcx, str._n_t_t______DelayExecutionVia_NtWFSO_FAILED_______n
call fcn.140001010
mov esi, 7
mov dword [rsp + 0x20], 0x67696163
mov eax, esi
mov dword [rsp + 0x24], 0x3131756f
lea rcx, [rsp + 0x30]
lea rdx, str.1111111WzkU5
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x1400014e0
mov eax, dword [rdx]
mov r8d, 0x37e
mov dword [rcx], eax
movzx eax, byte [rdx + 4]
lea rdx, [rsp + 0x37]
mov byte [rcx + 4], al
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memmove
mov ecx, 0x408
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movdqa xmm2, xmmword [0x140003830]
xor ebx, ebx
mov r9, rax
mov ecx, 8
mov qword [rax], rbx
lea rdx, [rax + 0x28]
nop word [rax + rax]
lea eax, [rcx - 8]
movd xmm0, eax
lea rdx, [rdx + 0x40]
pshufd xmm0, xmm0, 0
lea eax, [rcx - 4]
paddd xmm0, xmm2
movd xmm1, eax
movdqu xmmword [rdx - 0x60], xmm0
lea eax, [rcx + 4]
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movd xmm0, ecx
movdqu xmmword [rdx - 0x50], xmm1
add ecx, 0x10
movd xmm1, eax
pshufd xmm0, xmm0, 0
pshufd xmm1, xmm1, 0
paddd xmm0, xmm2
movdqu xmmword [rdx - 0x40], xmm0
lea eax, [rcx - 8]
paddd xmm1, xmm2
movdqu xmmword [rdx - 0x30], xmm1
cmp eax, 0x100
jl 0x140001580
mov r8d, ebx
mov r10, rbx
mov r11, rbx
nop dword [rax + rax]
add r8b, byte [rsp + r11 + 0x20]
mov edx, dword [r9 + r10*4 + 8]
add r8b, dl
movzx r8d, r8b
mov eax, dword [r9 + r8*4 + 8]
mov dword [r9 + r10*4 + 8], eax
lea rax, [r11 + 1]
inc r10
mov dword [r9 + r8*4 + 8], edx
cmp rax, rsi
mov r11, rbx
cmovl r11, rax
cmp r10, 0x100
jl 0x1400015f0
mov r10d, dword [r9]
mov r11, rbx
mov edi, dword [r9 + 4]
nop dword [rax]
nop dword [rax + rax]
inc r10b
movzx r10d, r10b
mov r8d, dword [r9 + r10*4 + 8]
lea eax, [rdi + r8]
movzx edi, al
mov ecx, dword [r9 + rdi*4 + 8]
mov dword [r9 + r10*4 + 8], ecx
mov dword [r9 + rdi*4 + 8], r8d
add r8b, cl
movzx eax, r8b
movzx ecx, byte [r9 + rax*4 + 8]
xor byte [rsp + r11 + 0x30], cl
inc r11
cmp r11, 0x384
jl 0x140001640
mov rcx, r9
mov dword [r9], r10d
mov dword [r9 + 4], edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movdqa xmm2, xmmword [0x140003840]
lea rax, [rsp + 0x40]
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x10]
lea rax, [rax + 0x40]
add ebx, 0x40
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp ebx, 0x380
jb 0x1400016a0
movsxd rax, ebx
cmp rax, 0x385
jae 0x140001721
lea rax, [rsp + rax + 0x30]
nop dword [rax]
nop word [rax + rax]
xor byte [rax], 0xcb
lea rax, [rax + 1]
inc ebx
cmp ebx, 0x385
jb 0x140001710
lea rcx, str.kernel32.dll
call fcn.140001070
mov rcx, rax
lea rdx, str.VirtualAlloc
call fcn.1400011e0
xor ecx, ecx
mov edx, 0x385
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call rax
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rsi, 1
jne 0x140001760
mov eax, dword [rdx]
mov dword [rcx], eax
movzx eax, byte [rdx + 4]
mov byte [rcx + 4], al
call r8
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140001ad0
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, edi
cmp eax, 0x7530
jb 0x140001415
mov edx, eax
lea rcx, str._n_t____T1____T0___d__n
call fcn.140001010
lea rcx, str.___DONE__n
jmp 0x14000141c
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, esi
cmp eax, 0x7530
jb 0x1400014aa
mov edx, eax
lea rcx, str._n_t____T1____T0___d__n
call fcn.140001010
lea rcx, str.___DONE__n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400014b6