Function at 0x180043890
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x1800b43d8]
xor rax, rsp
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0xa0]
xor ebx, ebx
mov r10, qword [rbp + 0x90]
mov r11, r8
mov rdi, qword [rbp + 0x98]
mov qword [rbp - 0x68], rax
mov r15, qword [rbp - 0x68]
mov r12, qword [rbp - 0x68]
mov qword [rbp - 0x48], rcx
mov ecx, dword [rbp + 0xa8]
imul eax, ecx, 0x34
mov qword [rbp + 8], r9
mov r9, qword [rbp - 0x68]
mov qword [rbp - 0x10], r8
mov r8d, ecx
mov qword [rbp], rdx
mov dword [rsp + 0x78], eax
mov edx, dword [rsp + 0x78]
mov r14d, dword [rsp + 0x78]
mov qword [rbp - 0x58], r10
mov qword [rbp - 8], rdi
mov dword [rbp - 0x80], ecx
mov qword [rsp + 0x70], r9
cmp ecx, eax
ja 0x180043f09
mov rcx, qword [rbp - 0x68]
mov esi, dword [rsp + 0x78]
mov rax, qword [rbp - 0x68]
mov r13d, dword [rsp + 0x78]
mov edi, dword [rbp - 0x38]
mov dword [rsp + 0x68], edx
mov edx, dword [rsp + 0x78]
mov dword [rsp + 0x60], edx
mov rdx, qword [rbp - 0x68]
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x20], rcx
mov dword [rsp + 0x6c], esi
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x34], r14d
nop word [rax + rax]
cmp r8d, 0x489
ja 0x180043c83
je 0x1800442ff
cmp r8d, 0xeb
ja 0x180043b2a
je 0x1800439f6
mov eax, r8d
sub eax, 0x15
je 0x1800439e9
sub eax, 0x54
je 0x1800442ff
cmp eax, 0x18
jne 0x180043ea4
mov esi, dword [r11]
mov rax, qword [rbp - 8]
mov dword [rbp - 0x18], esi
mov eax, dword [rax]
mov dword [rbp - 0x30], eax
cmp dword [r10 + 4], esi
jge 0x1800439da
lea r8, [rbp - 0x60]
mov dword [rbp - 0x60], esi
mov rdx, r10
mov ecx, 0xdf
call fcn.180016740
test eax, eax
jne 0x180043ece
mov r8d, dword [rbp - 0x80]
mov r10, qword [rbp - 0x58]
mov r9, qword [rsp + 0x70]
mov eax, dword [r10]
mov esi, dword [rsp + 0x6c]
mov dword [rbp - 0x28], eax
jmp 0x180043ea4
mov rax, qword [r11 + 0x18]
mov qword [rbp - 0x50], rax
jmp 0x180043ea4
test r11, r11
jne 0x180043a3d
mov qword [rsp + 0x48], rbx
lea rax, [0x1800a9369]
mov qword [rsp + 0x40], rbx
lea r8, str.changeemail.cmd
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea rax, [rbp - 0x60]
mov dword [rbp - 0x60], ebx
mov qword [rsp + 0x30], rax
mov edx, 0xcd
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.180026490
mov rsi, qword [rbp - 0x68]
test rsi, rsi
jne 0x180043a88
mov qword [rsp + 0x48], rbx
lea rax, [0x1800a9369]
mov qword [rsp + 0x40], rbx
lea r8, str.V686_delta1
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea rax, [rbp - 0x60]
mov dword [rbp - 0x60], ebx
mov qword [rsp + 0x30], rax
mov edx, 0xcd
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.180026490
mov rax, qword [rbp - 0x48]
mov dword [rsi], ebx
mov esi, 0xd4
mov eax, dword [rax]
mov dword [rsp + 0x60], eax
nop dword [rax]
mov eax, esi
sub eax, 0x28
je 0x180043af7
sub eax, 0x3a
je 0x180043b1c
cmp eax, 0x72
jne 0x180043b11
movsxd rax, dword [rsp + 0x60]
cmp eax, 0x1f
ja 0x180043ed6
shl rax, 7
lea rcx, [0x180000000]
cmp qword [rax + rcx + 0xed600], rbx
je 0x180043ed6
mov edi, ebx
mov dword [rbp - 0x38], ebx
mov dword [rsp + 0x60], ebx
mov r9, qword [rsp + 0x70]
mov r10, qword [rbp - 0x58]
mov r8d, dword [rbp - 0x80]
mov esi, dword [rsp + 0x6c]
jmp 0x180043ea4
mov r8d, dword [SHChangeNotifyDeregister]
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [0x1800ee6a0]
mov edi, eax
mov dword [rbp - 0x38], eax
add esi, 0x3a
cmp esi, 0x182
jb 0x180043aa0
mov dword [rsp + 0x60], edi
test edi, edi
jne 0x180043edb
jmp 0x180043ae1
cmp r8d, 0x117
je 0x180043ee3
cmp r8d, reloc.SHELL32.dll_SHChangeNotification_Unlock
jne 0x180043ea8
mov esi, dword [rbp - 0x18]
mov r14d, 0x26
mov edi, dword [rbp - 0x30]
mov dword [r10], esi
cmp r14d, 0x26
je 0x180043c14
cmp r14d, 0xf24
jne 0x180043c2b
mov edx, ebx
test edi, edi
jle 0x180043baf
mov r8, qword [rbp - 0x70]
mov rcx, rdi
mov edx, edi
nop dword [rax]
mov eax, dword [r12]
add r12, 4
sub eax, r13d
sub eax, dword [r8]
add r8, 4
mov r13d, eax
and eax, 0xfffffff
mov dword [r15], eax
add r15, 4
shr r13d, 0x1f
sub rcx, 1
jne 0x180043b80
mov qword [rbp - 0x70], r8
cmp edx, esi
jge 0x180043be4
mov ecx, esi
sub ecx, edx
nop word [rax + rax]
mov eax, dword [r12]
add r12, 4
sub eax, r13d
mov r13d, eax
and eax, 0xfffffff
mov dword [r15], eax
add r15, 4
shr r13d, 0x1f
sub rcx, 1
jne 0x180043bc0
mov ecx, dword [r10]
mov eax, dword [rbp - 0x28]
cmp ecx, eax
jge 0x180043c2b
sub eax, ecx
xor edx, edx
mov r8d, eax
mov rcx, r15
shl r8, 2
mov esi, eax
call sub.VCRUNTIME140.dll_memset
mov r10, qword [rbp - 0x58]
lea r15, [r15 + rsi*4]
mov esi, dword [rbp - 0x18]
mov r11, qword [rbp - 0x10]
jmp 0x180043c2b
mov rax, qword [rbp - 8]
mov r13d, ebx
mov r12, qword [r11 + 0x10]
mov r15, qword [r10 + 0x10]
mov rax, qword [rax + 0x10]
mov qword [rbp - 0x70], rax
add r14d, 0xefe
cmp r14d, 0x1dfc
jbe 0x180043b53
mov edi, dword [rbp - 0x38]
xor r9d, r9d
mov qword [rsp + 0x50], rbx
mov r8, r10
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x40], rbx
mov ecx, 0xe9
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.180032550
mov r14d, dword [rbp - 0x34]
mov dword [rbp - 0x50], ebx
jmp 0x180043ae1
cmp r8d, 0xf9b
ja 0x180043e30
je 0x180043d76
cmp r8d, 0x497
je 0x180043d14
cmp r8d, 0x843
je 0x180043ce4
cmp r8d, 0xbef
jne 0x180043ea8
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rsi
mov qword [rbp - 0x40], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r10, qword [rbp - 0x58]
mov r9, rax
mov r8d, dword [rbp - 0x80]
mov esi, dword [rsp + 0x6c]
mov qword [rsp + 0x70], rax
jmp 0x180043ea4
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rsi
mov qword [rbp - 0x20], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, dword [rbp - 0x80]
mov r10, qword [rbp - 0x58]
mov r9, qword [rsp + 0x70]
mov esi, dword [rsp + 0x6c]
mov qword [rbp - 0x78], rax
jmp 0x180043ea8
mov rax, qword [rbp - 0x48]
lea rcx, [0x180000000]
mov esi, ebx
movsxd rax, dword [rax]
shl rax, 7
mov ecx, dword [rax + rcx + 0xed60c]
mov rax, qword [rbp]
mov dword [rsp + 0x68], ecx
mov eax, dword [rax]
test al, 7
setne sil
shr eax, 3
add esi, eax
mov rax, qword [rbp + 8]
mov dword [rsp + 0x6c], esi
mov eax, dword [rax]
cmp eax, esi
ja 0x180043d6a
add eax, 2
add eax, ecx
cmp esi, eax
jb 0x180043d6a
mov rax, qword [rbp + 0xb0]
cmp dword [rax], esi
je 0x180043ea4
mov dword [rbp - 0x50], 0x16
jmp 0x1800442ff
test rcx, rcx
je 0x180043d8e
test rax, rax
je 0x180043d8e
test rdx, rdx
je 0x180043d8e
test r9, r9
jne 0x180043ea8
mov esi, 5
cmp esi, 5
je 0x180043df4
cmp esi, 0x27b
je 0x180043dae
cmp esi, 0x4f1
je 0x1800442ff
jmp 0x180043e10
test rax, rax
je 0x180043dc5
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x180043dd8
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9, qword [rsp + 0x70]
test r9, r9
je 0x180043deb
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9, qword [rsp + 0x70]
mov dword [rbp - 0x50], 0xd
jmp 0x180043e04
test rcx, rcx
je 0x180043e10
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x20]
add esi, 0x276
cmp esi, 0x762
jbe 0x180043d93
mov r8d, dword [rbp - 0x80]
mov r10, qword [rbp - 0x58]
mov esi, dword [rsp + 0x6c]
jmp 0x180043ea8
cmp r8d, 0x1347
je 0x180043e8c
cmp r8d, 0x16f3
jne 0x180043ea8
mov r8d, esi
mov edx, r14d
sub r8d, dword [rsp + 0x68]
add rdx, r10
dec r8d
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rsp + 0x68]
mov eax, esi
sub eax, ecx
mov r8d, ecx
mov rcx, qword [rsp + 0x70]
dec eax
add r14d, eax
mov edx, r14d
add rdx, qword [rbp - 0x58]
mov dword [rbp - 0x34], r14d
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rbp - 0x80]
mov r10, qword [rbp - 0x58]
mov r9, qword [rsp + 0x70]
jmp 0x180043ea4
mov rax, qword [rbp + 0xb0]
mov eax, dword [rax]
dec eax
cmp byte [rax + r10], 0xbc
jne 0x180043ef8
mov r14d, ebx
mov dword [rbp - 0x34], ebx
mov rax, qword [rbp - 0x78]
mov ecx, dword [rbp + 0xa8]
mov r11, qword [rbp - 0x10]
lea r8d, [r8 + rcx*4]
mov dword [rbp - 0x80], r8d
cmp r8d, dword [rsp + 0x78]
ja 0x180043f2d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x40]
jmp 0x180043960
mov dword [rbp - 0x50], eax
jmp 0x1800442ff
mov edi, 0xb
mov dword [rbp - 0x50], edi
jmp 0x1800442ff
test r11, r11
jne 0x180043ef0
mov rax, rbx
jmp 0x180044303
mov rax, qword [r11]
jmp 0x180044303
mov r15, qword [rbp - 0x20]
mov dword [rsp + 0x60], 7
jmp 0x1800442a6
mov r8d, dword [rsp + 0x78]
mov r13, qword [rbp - 0x68]
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x68], r8d
mov qword [rbp - 0x40], r13
mov dword [rsp + 0x6c], eax
mov qword [rbp - 0x78], r12
mov dword [rsp + 0x60], edx
jmp 0x180043f42
mov r15, qword [rbp - 0x20]
mov r12, qword [rbp - 0x78]
mov r13, qword [rbp - 0x40]
mov r8d, dword [rsp + 0x68]
mov rdi, qword [rbp - 8]
mov esi, ecx
lea eax, [rcx + 0xd]
cmp esi, eax
jae 0x1800442ff
lea eax, [rsi - 0xeb]
cmp eax, 0xc
ja case.default.0x180043f6f
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x44324]
add rcx, rdx
jmp rcx
mov rax, qword [rbp - 0x48]
lea rcx, [rbp + 0x10]
mov rdx, r12
lea r9, [0x180000000]
movsxd rax, dword [rax]
shl rax, 7
call qword [rax + r9 + 0xed668]
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x1800442a6
jmp 0x1800442c4
mov rax, qword [rbp - 0x48]
lea rcx, [rbp + 0x10]
movsxd rax, dword [rax]
shl rax, 7
call qword [rax + rdx + 0xed658]
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x1800442a6
mov qword [rbp - 0x70], 8
mov rdx, r12
jmp 0x1800442b6
mov eax, r14d
inc r14d
cmp byte [rax + r15], 1
je 0x1800442ce
mov dword [rsp + 0x60], 7
jmp 0x1800442a6
mov rdx, r9
mov rcx, r12
call sub.VCRUNTIME140.dll_memcmp
mov r9, qword [rsp + 0x70]
mov ecx, dword [rbp + 0xa8]
mov r8d, dword [rsp + 0x68]
test eax, eax
jne case.default.0x180043f6f
mov rax, qword [rbp - 0x68]
mov dword [rax], 1
jmp case.default.0x180043f6f
mov rax, qword [rbp - 0x48]
mov rdx, r11
mov r8d, dword [rdi]
movsxd rax, dword [rax]
shl rax, 7
lea rcx, [rbp + 0x10]
lea r9, [0x180000000]
call qword [rax + r9 + 0xed660]
jmp 0x180043f92
mov rax, qword [rbp - 0x48]
lea rdx, [rbp - 0x30]
mov edi, dword [rsp + 0x6c]
mov ecx, 0x84
sub edi, r8d
mov dword [rbp - 0x30], r8d
dec edi
mov r8, r12
mov eax, dword [rax]
mov dword [rbp - 0x28], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
lea r9, [rbp - 0x28]
mov dword [rsp + 0x78], edi
call fcn.180056b30
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x1800442a6
mov r8d, ebx
test edi, edi
je 0x180044171
cmp edi, 0x40
jb 0x18004413f
lea eax, [rdi - 1]
lea rdx, [rax + r15]
add rax, r12
cmp r15, rax
ja 0x1800440c0
cmp rdx, r12
jae 0x18004413f
mov r9d, edi
and r9d, 0xffffffc0
mov edx, 0x20
nop dword [rax]
mov eax, r8d
add r8d, 0x40
movdqu xmm0, xmmword [rax + r15]
movdqu xmm1, xmmword [rax + r12]
pxor xmm1, xmm0
movdqu xmmword [rax + r15], xmm1
lea eax, [rdx - 0x10]
movdqu xmm0, xmmword [rax + r15]
movdqu xmm1, xmmword [rax + r12]
pxor xmm1, xmm0
movdqu xmmword [rax + r15], xmm1
mov eax, edx
movdqu xmm0, xmmword [rax + r15]
movdqu xmm1, xmmword [rax + r12]
pxor xmm1, xmm0
movdqu xmmword [rax + r15], xmm1
lea eax, [rdx + 0x10]
add edx, 0x40
movdqu xmm0, xmmword [rax + r15]
movdqu xmm1, xmmword [rax + r12]
pxor xmm1, xmm0
movdqu xmmword [rax + r15], xmm1
cmp r8d, r9d
jb 0x1800440d0
cmp r8d, edi
jae 0x180044171
mov eax, r8d
mov r9, r12
add rax, r15
sub r9, r15
sub edi, r8d
mov edx, edi
nop word [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180044160
mov rax, qword [rbp]
mov r14d, ebx
mov edx, dword [rsp + 0x6c]
mov r8d, dword [rsp + 0x68]
lea ecx, [rdx*8]
sub ecx, dword [rax]
mov eax, 0xff
inc ecx
sar eax, cl
mov ecx, edx
and byte [r15], al
mov rax, qword [rbp + 8]
sub ecx, dword [rax]
sub ecx, r8d
sub ecx, 2
je 0x1800442c9
mov rax, r15
nop dword [rax]
cmp byte [rax], bl
jne 0x180043fe6
inc r14d
inc rax
cmp r14d, ecx
jb 0x1800441b0
jmp 0x1800442c9
mov eax, dword [rsp + 0x6c]
mov edx, 0xff
mov rcx, qword [rbp]
add r14d, r8d
lea eax, [rax*8]
sub eax, dword [rcx]
lea ecx, [rax + 1]
sar edx, cl
not edx
test byte [r10], dl
je 0x1800442ce
mov dword [rsp + 0x60], 7
jmp 0x1800442a6
mov edi, dword [rsp + 0x6c]
lea r8, [rbp - 0x70]
mov rdx, r12
mov qword [rbp - 0x70], rdi
mov ecx, 0x127
call fcn.18005f5d0
lea r8, [rbp - 0x70]
mov qword [rbp - 0x70], rdi
mov rdx, r13
mov ecx, 0x127
call fcn.18005f5d0
mov rdx, qword [rsp + 0x70]
mov qword [rbp - 0x70], rdi
jmp 0x1800442b6
mov dword [rsp + 0x60], ebx
jmp 0x1800442a6
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp + 8]
mov edx, r14d
movsxd rax, dword [rax]
mov r8d, dword [rcx]
shl rax, 7
add rdx, r15
jmp 0x180044036
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800442c4
mov rax, qword [rbp - 0x48]
lea rcx, [rbp + 0x10]
mov r8d, 8
lea r9, [0x180000000]
mov rdx, r12
movsxd rax, dword [rax]
shl rax, 7
call qword [rax + r9 + 0xed660]
mov dword [rsp + 0x60], eax
test eax, eax
je 0x1800442c4
mov eax, dword [rsp + 0x6c]
mov esi, SHTestTokenMembership
mov qword [rbp - 0x70], rax
mov rdx, r15
lea r8, [rbp - 0x70]
mov ecx, 0x127
call fcn.18005f5d0
mov r8d, dword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov ecx, dword [rbp + 0xa8]
mov r12, qword [rbp - 0x78]
inc esi
mov r10, qword [rbp - 0x58]
mov r13, qword [rbp - 0x40]
mov r11, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
jmp 0x180043f44
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, dword [rsp + 0x60]
mov dword [rbp - 0x50], edx
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1800602e0
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret