Function at 0x14005af30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
test rcx, rcx
je 0x14005b374
mov rbx, rcx
call sub.msvcrt.dll_strlen
test rax, rax
je 0x14005af76
xor ecx, ecx
xor edx, edx
nop word [rax + rax]
add rdx, rbx
cmp byte [rdx], 0x5c
jne 0x14005af6b
mov byte [rdx], 0x2f
lea edx, [rcx + 1]
mov rcx, rdx
cmp rdx, rax
jb 0x14005af60
mov edx, 0x2f
mov rcx, rbx
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14005aff0
lea rsi, str..dcert
mov rcx, rbx
mov rdx, rsi
call sub.msvcrt.dll_strstr
test rax, rax
je 0x14005b2b0
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x1400ffdf7]
call fcn.140068710
mov r13, rax
mov rcx, r13
call fcn.14005acd0
mov rcx, r13
mov r12, rax
call sub.msvcrt.dll_free
test r12, r12
je 0x14005b280
add rsp, 0x48
mov rax, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r11, qword [0x1402241a8]
mov r8, rax
mov esi, eax
test r11, r11
je 0x14005b2d0
mov r9, rbx
cmp eax, 0xb
jbe 0x14005b37c
mov r10d, eax
mov ebp, 0x9e3779b9
mov edi, 0x9e3779b9
mov ecx, 0xfeedbeef
nop dword [rax + rax]
movzx edx, byte [r9 + 5]
movzx eax, byte [r9 + 6]
shl edx, 8
shl eax, 0x10
add edx, eax
movzx eax, byte [r9 + 4]
add edx, eax
movzx eax, byte [r9 + 7]
shl eax, 0x18
add edx, eax
movzx eax, byte [r9 + 9]
add edx, ebp
movzx ebp, byte [r9 + 0xa]
shl eax, 8
shl ebp, 0x10
add eax, ebp
movzx ebp, byte [r9 + 8]
add eax, ebp
movzx ebp, byte [r9 + 0xb]
shl ebp, 0x18
add eax, ebp
movzx ebp, byte [r9 + 2]
add eax, ecx
movzx ecx, byte [r9 + 1]
shl ebp, 0x10
shl ecx, 8
add ecx, ebp
movzx ebp, byte [r9]
add ecx, ebp
movzx ebp, byte [r9 + 3]
shl ebp, 0x18
add ecx, ebp
sub ecx, edx
sub edx, eax
sub ecx, eax
add ecx, edi
mov edi, eax
shr edi, 0xd
xor ecx, edi
mov edi, edx
mov edx, ecx
sub edi, ecx
sub eax, ecx
shl edx, 8
xor edx, edi
sub eax, edx
mov edi, eax
mov eax, edx
shr eax, 0xd
xor eax, edi
sub ecx, edx
sub r10d, 0xc
add r9, 0xc
mov edi, ecx
mov ecx, eax
sub edx, eax
sub edi, eax
shr ecx, 0xc
xor ecx, edi
mov edi, edx
mov edx, ecx
sub edi, ecx
sub eax, ecx
shl edx, 0x10
xor edx, edi
sub eax, edx
sub ecx, edx
mov edi, eax
mov eax, edx
shr eax, 5
xor eax, edi
mov edi, eax
sub ecx, eax
sub edx, eax
shr edi, 3
xor edi, ecx
mov ebp, edi
sub edx, edi
sub eax, edi
shl ebp, 0xa
xor ebp, edx
mov ecx, ebp
sub eax, ebp
shr ecx, 0xf
xor ecx, eax
cmp r10d, 0xb
ja 0x14005b030
add ecx, r8d
cmp r10d, 0xb
ja case.0x14005b134.0
lea rdx, [0x1400ffe24]
movsxd rax, dword [rdx + r10*4]
add rax, rdx
jmp rax
movzx eax, byte [r9 + 0xa]
shl eax, 0x18
add ecx, eax
movzx eax, byte [r9 + 9]
shl eax, 0x10
add ecx, eax
movzx eax, byte [r9 + 8]
shl eax, 8
add ecx, eax
movzx eax, byte [r9 + 7]
shl eax, 0x18
add ebp, eax
movzx eax, byte [r9 + 6]
shl eax, 0x10
add ebp, eax
movzx eax, byte [r9 + 5]
shl eax, 8
add ebp, eax
movzx eax, byte [r9 + 4]
add ebp, eax
movzx eax, byte [r9 + 3]
shl eax, 0x18
add edi, eax
movzx eax, byte [r9 + 2]
shl eax, 0x10
add edi, eax
movzx eax, byte [r9 + 1]
shl eax, 8
add edi, eax
movzx eax, byte [r9]
add edi, eax
lea eax, [rcx + rbp]
mov r9d, ecx
sub ebp, ecx
sub edi, eax
shr r9d, 0xd
xor r9d, edi
mov edx, r9d
sub ebp, r9d
sub ecx, r9d
shl edx, 8
xor edx, ebp
mov eax, edx
sub ecx, edx
sub r9d, edx
shr eax, 0xd
xor eax, ecx
mov ecx, eax
sub r9d, eax
sub edx, eax
shr ecx, 0xc
xor ecx, r9d
sub edx, ecx
sub eax, ecx
mov r9d, edx
mov edx, ecx
shl edx, 0x10
xor edx, r9d
sub eax, edx
sub ecx, edx
mov r9d, eax
mov eax, edx
shr eax, 5
xor eax, r9d
mov r9d, eax
sub ecx, eax
sub edx, eax
shr r9d, 3
xor ecx, r9d
mov ebp, ecx
sub edx, ecx
sub eax, ecx
shl ebp, 0xa
xor ebp, edx
mov rdx, qword [r11 + 0x30]
sub eax, ebp
shr ebp, 0xf
xor ebp, eax
mov eax, dword [rdx + 8]
sub eax, 1
and eax, ebp
shl rax, 4
add rax, qword [rdx]
mov rdi, qword [rax]
test rdi, rdi
je 0x14005b2d0
mov rax, qword [rdx + 0x20]
mov r13d, r8d
mov r12, rax
sub rdi, rax
neg r12
jmp 0x14005b254
mov rdi, qword [rdi + 0x50]
test rdi, rdi
je 0x14005b2d0
add rdi, r12
cmp dword [rdi + 0x64], ebp
jne 0x14005b248
cmp dword [rdi + 0x60], esi
jne 0x14005b248
mov rcx, qword [rdi + 0x58]
mov r8, r13
mov rdx, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14005b248
mov r12, qword [rdi + 0x28]
test r12, r12
jne 0x14005afd4
nop
lea rax, [0x1400ffe0f]
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.dap_cert
xor r12d, r12d
call fcn.140052ca0
jmp 0x14005afd4
xor r9d, r9d
mov r8, rsi
lea rcx, [0x1400ffdf7]
mov rdx, rbx
call fcn.140068710
mov r13, rax
jmp 0x14005afb8
xor eax, eax
lea r9, [rsp + 0x3e]
lea r8, str.ca_folders
mov word [rsp + 0x3e], ax
mov rax, qword [0x14021c450]
lea rdx, str.resources
mov rcx, qword [rax]
call fcn.14005ef20
cmp word [rsp + 0x3e], 0
mov rsi, rax
je 0x14005b280
xor r15d, r15d
lea rbp, str..dcert
lea rdi, [0x1400ffdf7]
lea r14, [0x1400ffe0d]
movzx eax, r15w
mov r9, rbx
mov r8, r14
mov rcx, rdi
mov rdx, qword [rsi + rax*8]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], 0
call fcn.140068710
mov rcx, rax
mov r13, rax
call fcn.14005acd0
mov rcx, r13
mov r12, rax
call sub.msvcrt.dll_free
test r12, r12
jne 0x14005afd4
add r15d, 1
cmp word [rsp + 0x3e], r15w
ja 0x14005b320
jmp 0x14005b280
xor r12d, r12d
jmp 0x14005afd4
mov r10d, eax
mov ebp, 0x9e3779b9
mov edi, 0x9e3779b9
mov ecx, 0xfeedbeef
jmp 0x14005b11d