Function at 0x140196f9c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
xor ebx, ebx
mov r13, r9
mov rsi, rcx
cmp byte [rcx + 8], bl
jne 0x140196fd4
mov edi, 0xc004d101
mov ecx, edi
jmp 0x1401971ec
mov rax, qword [rcx]
mov ebp, dword [rsp + 0xb0]
mov r12d, ebp
mov edi, dword [rax + 0x10]
sub r12d, edi
mov dword [rsp + 0xc0], edi
dec r12d
mov dword [rsp + 0x90], edi
mov dword [rsp + 0xb8], r12d
lea eax, [rdi + rdi]
cmp eax, edi
jb 0x1401971e5
lea eax, [r12 + rdi*2]
cmp r12d, eax
ja 0x1401971e5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14019703d
mov edi, 0x8007000e
jmp 0x140196fcd
lea rcx, [rax + rdi]
mov r9, rbx
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0xc0]
mov rcx, qword [rsi]
lea r15, [rax + rdi*2]
mov rdx, rbx
call fcn.1401968c8
mov edi, eax
test eax, eax
jns 0x14019706d
mov ecx, eax
jmp 0x1401971ec
mov r14d, dword [rsp + 0xc0]
lea eax, [r14*2 + 2]
cmp r14d, eax
ja 0x1401971e5
cmp ebp, eax
jb 0x1401971e5
mov rdx, qword [rsp + 0x30]
lea eax, [r14 + 1]
mov rcx, qword [rsi]
lea r8, [rsp + 0x90]
add rax, r13
mov dword [rsp + 0x28], r14d
sub ebp, r14d
mov qword [rsp + 0x38], rax
mov r9, rax
lea r13d, [rbp - 1]
mov dword [rsp + 0x20], r13d
call fcn.140196970
mov edi, eax
test eax, eax
js 0x140197066
mov edx, dword [rsp + 0x90]
cmp edx, r14d
ja 0x1401971e5
test edx, edx
je 0x140197106
mov r13, qword [rsp + 0xa8]
mov r8d, edx
mov rcx, qword [rsp + 0x30]
inc r13
sub r13, rcx
mov al, byte [rcx + r13]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1401970f3
lea r13d, [rbp - 1]
mov r9, qword [rsp + 0x30]
lea r8, [rsp + 0xb8]
mov rcx, qword [rsi]
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], edx
mov rdx, r15
call fcn.140196970
mov edi, eax
test eax, eax
js 0x140197066
mov ebp, dword [rsp + 0xb8]
cmp ebp, r13d
ja 0x1401971e5
test r13d, r13d
je 0x140197163
mov r8, qword [rsp + 0x38]
mov rcx, r15
sub r8, r15
mov edx, r13d
mov al, byte [r8 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140197154
mov esi, r14d
cmp r14d, ebp
jae 0x14019717a
mov eax, esi
cmp byte [rax + r15], 0
jne 0x14019717a
inc esi
cmp esi, ebp
jb 0x14019716b
cmp esi, ebp
je 0x1401971db
mov eax, esi
cmp byte [rax + r15], 1
jne 0x1401971db
mov r8, r14
mov rdx, rbx
mov rcx, r15
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1401971db
mov rax, qword [rsp + 0xa8]
cmp byte [rax], 0
jne 0x1401971db
mov rcx, qword [rsp + 0xa0]
sub esi, r14d
sub ebp, esi
sub ebp, r14d
dec ebp
mov eax, dword [rcx]
mov dword [rcx], ebp
cmp eax, ebp
jb 0x1401971e5
mov rcx, qword [rsp + 0x98]
lea edx, [r14 + 1]
add edx, esi
mov r8d, ebp
add rdx, r15
call sub.msvcrt.dll_memcpy
jmp 0x1401971f1
mov edi, 0xc004d210
jmp 0x140196fcd
mov ecx, 0x8007006f
mov edi, ecx
call fcn.14007ab24
mov ecx, edi
call fcn.14007ab44
test rbx, rbx
je 0x140197211
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret