Function at 0x140016b60
Capabilities:
Encode data using xor
Identify system language via api

Disassembly:
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
imul ecx, dword [0x140042b38], 0x11
mov edi, 0x1bf
mov eax, 0x66666667
mov dword [rsp + 0xb0], edi
mov r13d, 0x4e2
mov ebx, 0x277
mov ebp, 8
mov dword [0x140042b7c], r13d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp dword [0x140042b2c], edi
mov dword [rsp + 0xb8], ecx
movzx ecx, word [0x140042b68]
sete al
sub byte [0x140042b57], al
xor esi, esi
cmp dword [0x140042a64], 0x2e0
mov eax, esi
sete al
neg cx
or dword [0x140042b3c], eax
movzx eax, byte [0x140042b54]
add eax, 0x40f
sar eax, 0x1f
mov dword [0x140042b4c], eax
and ecx, 1
je 0x140016c4e
sub ecx, 1
je 0x140016c46
sub ecx, 1
je 0x140016c34
cmp ecx, 1
jne 0x140016c62
movsx eax, byte [0x140042b67]
movsx ebp, byte [0x140042a63]
sub eax, 0x7f9
or eax, r13d
mov dword [0x140042b7c], eax
add ebp, 3
jmp 0x140016c62
movsx edi, byte [0x140042b55]
inc edi
mov dword [rsp + 0xb0], edi
jmp 0x140016c62
mov dword [0x140042b78], esi
jmp 0x140016c62
movsx eax, byte [0x140042b88]
imul ebp, eax, 0xd8
mov byte [0x140042b66], sil
movsx eax, byte [0x140042b66]
mov r15d, dword [0x140042b60]
xor dword [0x140042b44], 1
inc r15d
imul r14d, eax, 0x40f
and r14d, 0x80000003
jge 0x140016c94
dec r14d
or r14d, 0xfffffffc
inc r14d
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
cmp dword [0x140042b40], ebx
mov eax, esi
movzx ecx, byte [0x140042a87]
mov r8d, esi
movzx r9d, byte [0x140042b80]
sete al
cmp eax, 0x426
mov ebx, r9d
mov eax, 0x51a
mov edx, 0x1db
sete r8b
sar eax, cl
mov ecx, dword [0x140042b78]
xor r8d, eax
mov eax, dword [0x140042b4c]
imul ebx, ebp
lea r11d, [rax + 3]
mov byte [rsp + 0xa8], r11b
and ebx, 3
sub ecx, r8d
sub rdx, 1
jne 0x140016cf0
mov r8d, dword [0x140042b2c]
mov edx, 0x4c2
or r8d, edi
mov dword [0x140042b78], ecx
nop
and eax, r8d
sub rdx, 1
jne 0x140016d10
mov r8d, dword [0x140042b5c]
mov eax, 0x55555556
imul r10d, r8d, 0x4cb
imul r10d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub r10d, eax
movzx eax, dil
or al, cl
mov dword [rsp + 0x38], r10d
add byte [0x140042a86], al
mov ecx, esi
movsx eax, byte [0x140042b66]
mov edi, 0x1b
mov esi, dword [0x140042b3c]
cmp eax, 0x426
movzx r10d, byte [0x140042b83]
sete cl
movzx eax, r11b
mov r11d, dword [0x140042a8c]
and esi, ecx
mov dword [rsp + 0x20], eax
mov ecx, r14d
mov dword [0x140042b3c], esi
shl esi, cl
lea ecx, [rax - 0x4e2]
shr esi, cl
mov eax, 0x66666667
mov ecx, dword [0x140042a88]
shr esi, cl
movzx ecx, byte [0x140042b54]
imul edx, ecx, 0x4cb
mov ecx, dword [rsp + 0x20]
imul edx
mov r12d, edx
sar r12d, 1
mov eax, r12d
shr eax, 0x1f
add r12d, eax
and r9d, r14d
mov dword [rsp + 0x34], r12d
mov dword [0x140042b4c], r9d
mov r9d, dword [0x140042b84]
nop word [rax + rax]
mov eax, r8d
mov edx, r8d
sar eax, 0x1f
sub r9d, esi
add r11d, eax
sar edx, cl
xor eax, eax
cmp edx, ecx
sete al
xor r10b, 1
add r8d, eax
sub rdi, 1
jne 0x140016de0
mov dword [0x140042b5c], r8d
mov dword [0x140042b84], r9d
mov byte [0x140042b83], r10b
mov dword [0x140042a8c], r11d
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp byte [0x140042a63], 0
mov edi, dword [rsp + 0xb0]
jne 0x140016e45
test edi, edi
jne 0x140016e45
xor esi, esi
mov dword [0x140042b34], esi
jmp 0x140016e51
mov dword [0x140042b34], 1
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx edx, byte [0x140042b80]
mov eax, dword [0x140042b68]
movzx ecx, byte [0x140042b54]
or eax, ebp
sar eax, 0x1f
inc ecx
sub dword [0x140042b3c], eax
movzx eax, byte [0x140042b56]
sub al, r15b
or dl, al
mov eax, dword [0x140042b84]
mov byte [0x140042b80], dl
mov dword [rsp + 0x3c], eax
test eax, eax
je 0x140016ea4
mov byte [0x140042b88], 1
test r15d, r15d
jne 0x140016eab
mov byte [0x140042b88], 0
mov r8d, dword [0x140042b28]
mov r10d, dword [0x140042b58]
lea r15d, [r8 + 0x105]
mov dword [rsp + 0x2c], r15d
test r14d, r14d
jne 0x140016ef9
cmp ecx, r10d
je 0x140016ef9
mov eax, dword [0x140042b48]
movzx r9d, byte [0x140042b81]
movzx edx, byte [0x140042a86]
mov esi, dword [rsp + 0x20]
mov r13d, dword [rsp + 0xb8]
mov dword [rsp + 0x24], eax
jmp 0x140016f8a
movzx r9d, byte [0x140042b81]
cmp r8d, 0x228
mov edx, r8d
sete al
sub ecx, r15d
and r9b, al
shr edx, cl
mov byte [0x140042b81], r9b
mov eax, 1
mov dword [rsp + 0x24], eax
mov dword [0x140042b48], eax
test edx, edx
je 0x140016f3e
test r12d, r12d
je 0x140016f3e
cmp byte [0x140042b82], 0
jne 0x140016f40
mov eax, esi
movzx ecx, byte [0x140042b44]
movzx edx, byte [0x140042a86]
mov esi, dword [rsp + 0x20]
or dl, al
cmp esi, 0x2a3
sete al
sub cl, al
mov eax, r13d
add byte [0x140042b83], cl
mov ecx, ebx
mov r13d, dword [rsp + 0xb8]
sar eax, cl
and eax, r13d
or eax, r8d
or eax, dword [0x140042b5c]
sub r8d, eax
mov dword [0x140042b28], r8d
xor r11d, r11d
mov ecx, esi
mov eax, r11d
movzx esi, r9b
cmp dword [0x140042b40], eax
movzx r12d, r15b
movsx r15d, byte [0x140042a63]
movzx r9d, byte [0x140042b66]
setne al
mov dword [rsp + 0x28], eax
neg r12b
movzx eax, byte [0x140042b56]
shl al, cl
mov ecx, dword [0x140042a8c]
sub dl, al
mov byte [0x140042a86], dl
mov eax, 0xaaaaaaab
mul ebx
mov eax, r10d
mov byte [rsp + 0xa0], r15b
sub eax, edi
shr edx, 1
add esi, edx
mov byte [0x140042a87], r12b
lea edx, [r14 + rdi]
mov edi, dword [0x140042b30]
shr edx, cl
lea r10d, [r11 + 0x57]
cmp eax, edx
mov ecx, r11d
mov r11d, dword [rsp + 0xb0]
mov eax, 0x426
sete cl
mov edx, 0x277
mov dword [rsp + 0x30], ecx
mov dword [0x140042a64], ecx
mov ecx, r13d
mov r13d, dword [0x140042b60]
shl eax, cl
cmp eax, ebx
mov eax, r15d
mov r15d, 0x4e2
sete cl
shl eax, cl
mov dword [0x140042b38], eax
sub edi, r14d
nop dword [rax]
cmp r8d, edx
jae 0x140017063
mov eax, 0xaaaaaaab
mul edx
mov ebp, edx
shr ebp, 1
add ebp, r13d
mov edx, esi
test edi, edi
je 0x14001707e
movzx eax, r12b
mov ecx, r11d
sub ecx, eax
cmp ecx, r15d
jne 0x14001707e
mov eax, 1
jmp 0x140017080
xor eax, eax
and r9b, al
sub r10, 1
jne 0x140017050
movzx r11d, byte [0x140042b83]
movzx r15d, byte [rsp + 0xa0]
mov byte [0x140042b66], r9b
mov dword [rsp + 0x48], edx
test r9b, r9b
je 0x1400170b1
cmp dword [rsp + 0x34], 1
je 0x1400170b8
cmp dword [rsp + 0x2c], 0
je 0x1400170fc
mov r8d, dword [0x140042b40]
mov eax, 0x4cb
mov ecx, dword [rsp + 0xb8]
mov r10d, dword [rsp + 0xb0]
add ecx, r10d
sar eax, cl
xor ecx, ecx
cmp r8d, eax
movzx eax, r11b
sete cl
xor ecx, eax
mov eax, dword [0x140042b58]
or r8d, ecx
mov dword [rsp + 0x38], eax
mov dword [0x140042b40], r8d
jmp 0x140017104
mov r10d, dword [rsp + 0xb0]
mov ecx, dword [rsp + 0x20]
mov eax, 0x98
shr dword [rsp + 0x24], cl
sub eax, r14d
movzx esi, byte [0x140042b57]
mov edi, 0x44f
movzx r8d, byte [0x140042b64]
mov r13d, 0x4e2
mov dword [rsp + 0xa0], eax
mov r9b, 0x11
mov eax, dword [0x140042b7c]
or eax, 0x51a
mov dword [rsp + 0x34], eax
movzx eax, r12b
mov r12d, dword [0x140042b4c]
add eax, edx
mov dword [rsp + 0x40], eax
xor edx, edx
movzx eax, r11b
mov r11d, dword [0x140042b78]
mov dword [rsp + 0x44], eax
nop dword [rax]
movsx eax, r9b
mov ecx, edx
cmp ebx, eax
movsx eax, r8b
setb cl
cmp ecx, eax
je 0x1400172ac
mov r8d, dword [rsp + 0xb8]
mov eax, 0x55555556
movzx ecx, byte [0x140042b54]
movzx r9d, r13b
imul r13d
shr r8d, cl
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dl
add al, al
add dl, al
movzx eax, byte [rsp + 0x2c]
sub r9b, dl
and al, 0x28
mov edx, dword [rsp + 0x28]
or r8b, al
or r8b, byte [0x140042a8c]
add r9b, sil
cmp dword [rsp + 0x30], 0
mov byte [0x140042b64], r8b
jne 0x1400171fd
movzx ecx, byte [0x140042b80]
mov eax, edx
sub eax, r10d
mov r10d, dword [rsp + 0xb0]
add eax, 2
shr eax, cl
xor eax, ebp
jne 0x1400171fd
xor eax, eax
jmp 0x140017202
mov eax, 1
and r11d, eax
test r9b, r9b
je 0x14001721e
mov ecx, dword [rsp + 0x38]
mov eax, r14d
sar eax, cl
test eax, eax
je 0x14001721e
mov ecx, 1
jmp 0x140017220
xor ecx, ecx
movsx eax, byte [0x140042a62]
add eax, ecx
mov ecx, dword [rsp + 0x30]
sub ecx, eax
movsx eax, byte [0x140042b56]
mov dword [rsp + 0x30], ecx
mov dword [0x140042a64], ecx
mov ecx, dword [rsp + 0xa0]
shl eax, cl
test eax, eax
je 0x14001726d
movzx ecx, byte [0x140042b54]
mov r10d, dword [rsp + 0xb0]
inc ecx
movzx eax, sil
or eax, ecx
mov byte [0x140042b81], 1
jne 0x140017274
mov byte [0x140042b81], 0
movzx ecx, byte [rsp + 0x2c]
mov eax, r12d
xor eax, 0x426
sub cl, 0x26
and edx, eax
movzx eax, byte [0x140042b67]
sar al, cl
movzx ecx, byte [0x140042b88]
or al, bl
or al, byte [0x140042b6c]
xor cl, al
mov dword [rsp + 0x28], edx
mov byte [0x140042b88], cl
jmp 0x1400172b3
movzx ecx, byte [0x140042b88]
mov ebx, dword [0x140042b30]
xor ebx, dword [rsp + 0x34]
movsx eax, cl
imul r13d, eax
mov eax, 0x55555556
mov dword [0x140042b30], ebx
imul r13d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub r13d, eax
cmp dword [rsp + 0x24], 0
jne 0x1400172f1
test r9b, r9b
jne 0x1400172f1
xor edx, edx
mov eax, edx
jmp 0x1400172f8
mov eax, 1
xor edx, edx
sub r15b, al
mov eax, dword [rsp + 0x3c]
xor eax, dword [rsp + 0x40]
cmp byte [0x140042b82], 0
mov dword [rsp + 0x3c], eax
setne al
and r15b, al
test ebx, ebx
je 0x14001732e
mov ecx, r14d
mov dword [0x140042a88], 1
mov eax, r14d
shl eax, cl
test eax, eax
jne 0x140017334
mov dword [0x140042a88], edx
movsx ebx, r9b
and ebx, 0x80000003
jge 0x140017347
dec ebx
or ebx, 0xfffffffc
inc ebx
add ebx, dword [rsp + 0x44]
sub rdi, 1
jne 0x140017170
mov r8d, dword [0x140042b40]
mov r9d, 0x123
mov ebx, dword [rsp + 0x48]
mov ecx, dword [0x140042a8c]
mov eax, dword [rsp + 0x28]
xor ecx, r13d
mov r10d, dword [0x140042b2c]
or eax, ecx
mov edx, dword [rsp + 0xb8]
test r8d, r8d
movsx edi, byte [0x140042a62]
mov ecx, r13d
mov dword [0x140042b44], eax
setne al
sub sil, al
mov dword [0x140042b78], r11d
mov eax, dword [rsp + 0x2c]
sub r10d, ebx
movzx ebx, byte [0x140042b65]
add eax, r14d
shr r10d, cl
movzx ecx, byte [rsp + 0xb0]
cmp edx, eax
sete r11b
and r11b, r8b
movzx r8d, byte [0x140042b55]
shr bl, cl
cmp byte [0x140042b56], 1
je 0x140017407
cmp dword [0x140042b5c], 0
jne 0x1400173ff
cmp ebp, edx
je 0x1400173f2
cmp byte [rsp + 0xa8], 0
jne 0x1400173ff
cmp byte [0x140042b80], 0
jne 0x1400173ff
xor eax, eax
jmp 0x140017404
mov eax, 1
or r12d, eax
cmp edi, dword [rsp + 0x20]
jne 0x140017429
test r14d, r14d
je 0x14001741d
movzx eax, byte [0x140042b54]
xor eax, ebp
jne 0x140017429
mov dword [0x140042b84], 0
jmp 0x140017433
mov dword [0x140042b84], 1
movzx edx, r10b
mov ecx, r13d
shl dl, cl
and sil, r11b
or dl, byte [0x140042b88]
and r8b, bl
xor r15b, dl
mov edx, dword [rsp + 0xb8]
sub r9, 1
jne 0x1400173d2
mov byte [0x140042b55], r8b
mov byte [0x140042b57], sil
mov byte [0x140042a63], r15b
mov dword [0x140042b4c], r12d
call fcn.140015f70
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret