Function at 0x14007a030
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 0x10], rsi
xchg rbx, rsi
push rbp
nop
push 0x746431d6
mov qword [rsp], rsi
nop
push 0x1d3ad4a6
mov qword [rsp], rdi
nop
push 0x72c51372
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
mov rbp, rsp
sub rsp, 0x60
xchg r15, rdx
mov rsi, r15
xchg r15, rdx
xchg r11, r15
mov r11, rcx
xchg r11, r15
xor edi, edi
mov dword [rbp + 0x30], edi
lea rax, [rbp + 0x30]
xchg r15, rax
mov qword [rsp + 0x20], r15
xchg r15, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 5]
call fcn.140078310
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x14007a492
add eax, 0x1000
mov dword [rbp + 0x30], eax
mov ebx, eax
mov ecx, eax
call fcn.1401fc80c
mov r14, rax
test rax, rax
je 0x14007a0dd
mov r8d, ebx
xor edx, edx
xchg rcx, r15
mov r15, rax
xchg r15, rcx
call sub.VCRUNTIME140.dll_memset
jmp 0x14007a0e6
xchg rdi, rbx
mov r14, rbx
xchg rdi, rbx
mov qword [rbp + 0x48], r14
lea rax, [rbp + 0x30]
xchg r9, rax
mov qword [rsp + 0x20], r9
xchg r9, rax
mov r9d, dword [rbp + 0x30]
xchg r9, r8
mov r9, r14
xchg r8, r9
mov edx, 0x6fe9e25b
sub edx, 0x278abf25
xor edx, 0x6f7e11ef
add edx, 0x78fbe11
add edx, 0x2c23e60e
add edx, 0x9ef624a
xor edx, 0x6f5b1f76
add edx, 0x5d6f63e5
xor edx, 0x690e8a1c
xchg rcx, r15
mov r15, rcx
xchg r15, rcx
call fcn.140078310
test eax, eax
js 0x14007a46c
mov dword [rbp - 0x30], 0x286cd4f8
add dword [rbp - 0x30], 0x936d0c3
xor dword [rbp - 0x30], 0x62c352e2
xor dword [rbp - 0x30], 0xca72a7f
sub dword [rbp - 0x30], 0x118024b6
add dword [rbp - 0x30], 0xa8af3e86
mov dword [rbp - 0x24], 0xd8f6820
xor dword [rbp - 0x24], 0x26d0821e
xor dword [rbp - 0x24], 0x1d734468
xor dword [rbp - 0x24], 0x560597b6
xor dword [rbp - 0x24], 0x77366e54
xor dword [rbp - 0x24], 0x640bc8aa
sub dword [rbp - 0x24], 0x1d92581e
sub dword [rbp - 0x24], 0x1cbd4aff
add dword [rbp - 0x24], 0xc6af036d
mov dword [rbp - 0x20], 0x224bb392
sub dword [rbp - 0x20], 0x217656e4
xor dword [rbp - 0x20], 0x71c95452
xor dword [rbp - 0x20], 0x76d2b8a3
xor dword [rbp - 0x20], 0x73e9bf3a
sub dword [rbp - 0x20], 0x187691e2
add dword [rbp - 0x20], 0x19481ccd
xor dword [rbp - 0x20], 0x495d48f5
add dword [rbp - 0x20], 0xc1c82cd8
mov dword [rbp - 0x2c], 0x5ce3f8a6
add dword [rbp - 0x2c], 0x2166142b
sub dword [rbp - 0x2c], 0x79149751
add dword [rbp - 0x2c], 0x51c30715
xor dword [rbp - 0x2c], 0x1f559d4b
xor dword [rbp - 0x2c], 0x4cbbea00
xor dword [rbp - 0x2c], 0x4dd89356
xor dword [rbp - 0x2c], 0xbe386e7e
mov dword [rbp - 0x1c], 0x209bd878
add dword [rbp - 0x1c], 0x2031a405
xor dword [rbp - 0x1c], 0x96a984f
add dword [rbp - 0x1c], 0x32de517f
xor dword [rbp - 0x1c], 0x5f3ec549
xor dword [rbp - 0x1c], 0x51af0874
sub dword [rbp - 0x1c], 0x480fc073
xor dword [rbp - 0x1c], 0x38109e52
add dword [rbp - 0x1c], 0xed64592e
mov dword [rbp - 0x18], 0x22942d9b
xor dword [rbp - 0x18], 0x5efda2ad
xor dword [rbp - 0x18], 0x3e5db871
xor dword [rbp - 0x18], 0x6558fb98
sub dword [rbp - 0x18], 0x18fd6804
xor dword [rbp - 0x18], 0x6dc42f94
add dword [rbp - 0x18], 0x9b8db41f
mov word [rbp - 0x28], 0x266a
add word [rbp - 0x28], 0x17e5
add word [rbp - 0x28], 0x3a78
xor word [rbp - 0x28], 0x16d3
add word [rbp - 0x28], 0x20f
sub word [rbp - 0x28], 0x2e51
sub word [rbp - 0x28], 0x3c0f
add word [rbp - 0x28], 0x112f
xor word [rbp - 0x28], 0xe004
mov dword [rbp - 0x14], 0x51a837d6
sub dword [rbp - 0x14], 0x3638c7b0
add dword [rbp - 0x14], 0x60c988a5
xor dword [rbp - 0x14], 0x2beae69c
sub dword [rbp - 0x14], 0x2a873a6d
sub dword [rbp - 0x14], 0x1d35cd45
add dword [rbp - 0x14], 0xef6de8ca
mov byte [rbp - 0x26], 0x1f
add byte [rbp - 0x26], 0x59
add byte [rbp - 0x26], 2
sub byte [rbp - 0x26], 0x26
xor byte [rbp - 0x26], 0x1c
xor byte [rbp - 0x26], 0x3f
sub byte [rbp - 0x26], 0x2f
xor byte [rbp - 0x26], 0xbe
mov dword [rbp - 0x10], 0x254131cd
add dword [rbp - 0x10], 0x2639c41e
xor dword [rbp - 0x10], 0x2676e380
sub dword [rbp - 0x10], 0xa18e3e6
xor dword [rbp - 0x10], 0x21c05e26
sub dword [rbp - 0x10], 0x316326f2
add dword [rbp - 0x10], 0x588addf9
sub dword [rbp - 0x10], 0x613eab05
sub dword [rbp - 0x10], 0x91b7936
mov rdx, rdi
nop dword [rax]
movzx eax, word [rbp + rdx*2 - 0x24]
movzx ecx, byte [rbp + rdx - 0x30]
add cx, ax
mov word [rbp + rdx*2 - 0x24], cx
mov byte [rbp + rdx - 0x30], 0x68
xor byte [rbp + rdx - 0x30], 0x29
add byte [rbp + rdx - 0x30], 0x14
sub byte [rbp + rdx - 0x30], 0x33
xor byte [rbp + rdx - 0x30], 0x76
sub byte [rbp + rdx - 0x30], 0x54
inc rdx
cmp rdx, 0xb
jb 0x14007a36f
xchg rdi, rbx
mov rdi, r14
xchg rdi, rbx
cmp word [rbx + 0x38], 0
je 0x14007a425
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
cmp qword [rbx + 0x50], rax
je 0x14007a425
cmp word [rbx + 0x38], 0x16
jne 0x14007a425
mov rdx, qword [rbx + 0x40]
lea rcx, [rbp - 0x24]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14007a425
mov eax, dword [rbx + 0x50]
mov dword [rbp + 0x40], eax
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x14007a413
mov dword [rdx], eax
sub qword [rsi + 8], 0xfffffffffffffffc
jmp 0x14007a425
lea r8, [rbp + 0x40]
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call fcn.140077e30
mov eax, dword [rbx]
test eax, eax
je 0x14007a437
add rbx, rax
jmp 0x14007a3b5
mov byte [rbp + rdi - 0x24], 0x67
sub byte [rbp + rdi - 0x24], 0x2d
xor byte [rbp + rdi - 0x24], 0x5e
sub byte [rbp + rdi - 0x24], 2
sub byte [rbp + rdi - 0x24], 0x5b
add byte [rbp + rdi - 0x24], 0x68
sub byte [rbp + rdi - 0x24], 0x18
sub byte [rbp + rdi - 0x24], 0x57
inc rdi
cmp rdi, 0x16
jb 0x14007a437
mov r8d, dword [rbp + 0x30]
xor edx, edx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
nop
test r14, r14
je 0x14007a492
xchg r14, r13
mov rcx, r13
xchg r13, r14
call fcn.1401fc804
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
push rcx
push rax
xchg qword [rsp + 0x10], r15
pop rax
pop rcx
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
push rdx
push rdx
push rbx
push rcx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
xchg qword [rsp], rsi
add rsp, 8
push rbx
push rdx
push rbx
push rax
push rbx
push rcx
push rcx
xchg qword [rsp + 0x38], rbp
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]