Function at 0x1400b2370
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov eax, dword [0x141dd43f0]
add eax, dword [0x141dd43f4]
and eax, 0x90108e
or eax, 0xc60f8d10
xor eax, 0x977aa3b9
cmp eax, 0xd464ff42
ja 0x1400b2402
mov eax, dword [0x141dd43f8]
imul eax, dword [0x141dd43fc]
imul ecx, eax, 0x842a29c6
add ecx, 0x787572b0
and ecx, 0x7bc29a36
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov r12, rsp
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov rbx, rsp
cmp ecx, 0xb665ea08
jbe 0x1400b242b
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
jmp 0x1400b23ab
xor eax, eax
nop dword [rax]
test al, al
jne 0x1400b2430
mov eax, dword [0x141dd4400]
imul eax, dword [0x141dd4404]
and eax, 0x2f6ebe7d
xor eax, 0xce8fbbd4
cmp eax, 0x4d3b334d
jae 0x1400b2470
sub rsp, 0x20
mov rcx, r12
mov rdx, r14
mov r8, rdi
call fcn.140091760
add rsp, 0x20
nop dword [rax + rax]
mov eax, dword [0x141dd4408]
imul eax, dword [0x141dd440c]
or eax, 0xa523b770
shr eax, 4
imul r13, rax, 0x114e5615
shr r13, 0x37
or r13d, 0x52d33014
sub rsp, 0x20
mov rcx, r12
mov rdx, r14
mov r8, rdi
call fcn.140091760
add rsp, 0x20
cmp r13d, 0x8ffb39c
jb 0x1400b2470
mov rax, qword [r12]
mov rdi, qword [r12 + 8]
movabs r13, 0x8000000000000000
cmp rax, r13
jne 0x1400b24ea
nop
mov eax, dword [0x141dd4410]
add eax, dword [0x141dd4414]
xor eax, 0x83e88534
cmp eax, 0x3c8c0e6f
jb 0x1400b24d0
jmp 0x1400b2520
mov rcx, qword [r12 + 0x10]
mov qword [r15], rax
mov qword [r15 + 8], rdi
mov qword [r15 + 0x10], rcx
sub rsp, 0x20
mov rcx, rbx
mov rdx, r15
call fcn.1400b2980
add rsp, 0x20
mov r14, qword [rbx]
mov rdi, qword [rbx + 8]
cmp r14, r13
jne 0x1400b2735
nop dword [rax]
mov eax, dword [0x141dd4430]
add eax, dword [0x141dd4434]
or eax, 0xe8bc4ec1
cmp eax, 0xf30d256c
je 0x1400b2520
mov eax, edi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400b26e0
test rax, rax
je 0x1400b26e0
cmp eax, 1
jne 0x1400b2819
lea rbx, [rdi - 1]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400b2570
mov r14, qword [rdi - 1]
nop dword [rax + rax]
mov eax, dword [0x141dd4440]
xor eax, dword [0x141dd4444]
imul eax, eax, 0x8c01a218
add eax, 0xa32c4c30
cmp eax, 0x35b4687b
ja 0x1400b2580
mov rdi, qword [rdi + 7]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4448]
xor edx, edx
div dword [0x141dd444c]
imul eax, eax, 0x70f1b689
add eax, 0x5bfdf626
xor eax, 0x7af188a9
cmp eax, 0xf22bb5fd
ja 0x1400b25b0
mov rax, qword [rdi]
test rax, rax
je 0x1400b261a
sub rsp, 0x20
mov rcx, r14
call rax
add rsp, 0x20
nop word [rax + rax]
mov eax, dword [0x141dd4450]
imul eax, dword [str.vMq]
or eax, 0x260655ce
imul rax, rax, 0x328d3f35
shr rax, 0x3d
imul eax, eax, 0xed15be8
cmp eax, 0xd3a473bf
je 0x1400b25f0
mov rcx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
nop word cs:[rax + rax]
mov edx, dword [0x141dd4458]
and edx, dword [0x141dd445c]
add edx, 0x60fb7fd4
imul rdx, rdx, 0x47a9a1e5
shr rdx, 0x3d
cmp edx, 0xe2b4fcab
ja 0x1400b2630
test rcx, rcx
je 0x1400b26c2
nop word [rax + rax]
mov ecx, dword [0x141dd4460]
xor ecx, dword [0x141dd4464]
or ecx, 0x8d65c1f4
cmp ecx, 0x6662951e
je 0x1400b2660
cmp rax, 0x11
jb 0x1400b26a8
mov r14, qword [r14 - 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4468]
xor eax, dword [0x141dd446c]
xor eax, 0x23d90b9f
cmp eax, 0x11dcae8f
jb 0x1400b2690
mov rcx, qword [0x141ddc4e0]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rcx, qword [0x141ddc4e0]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141dd4470]
add eax, dword [0x141dd4474]
imul eax, eax, 0x49a9dd8d
or eax, 0x8fce3d38
imul eax, eax, 0x70b2d84e
cmp eax, 0x36425922
jb 0x1400b26e0
mov eax, dword [0x141dd4478]
sub eax, dword [0x141dd447c]
imul rax, rax, 0x7790f131
shr rax, 0x3e
add eax, 0x46ee2f7
xor eax, 0x11a7f288
cmp eax, 0xdca42657
jbe 0x1400b290e
jmp 0x1400b293f
mov eax, dword [str._a9_aviDz]
add eax, dword [0x141dd441c]
and eax, 0x7d34e19b
add eax, 0x7fb3a862
or eax, 0x96a8ee0e
cmp eax, 0xa8a26890
jbe 0x1400b2768
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add rsp, 0x20
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
mov eax, dword [0x141dd4420]
xor eax, dword [0x141dd4424]
or eax, 0xefb02080
imul r13d, eax, 0xef95a70b
add r13d, 0x3edde314
mov r15, qword [rbx + 0x10]
sub rsp, 0x20
mov rcx, rdi
call r12
add rsp, 0x20
cmp r13d, 0xc064ad4b
ja 0x1400b2770
nop word [rax + rax]
mov ecx, dword [0x141dd4428]
xor ecx, dword [0x141dd442c]
and ecx, 0x6a7397a3
imul rcx, rcx, 0x5f44150f
shr rcx, 0x3d
cmp ecx, 0x3d0537b1
ja 0x1400b27b0
cmp eax, 0xffffffff
movabs rax, 0x8000000000000000
je 0x1400b2840
mov eax, dword [0x141dd4488]
imul eax, dword [0x141dd448c]
xor eax, 0x2084880
and eax, 0x9af86cb0
mov ecx, 0xc878877b
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x5df2242b
jbe 0x1400b28df
jmp 0x1400b28ff
mov eax, dword [0x141dd4438]
xor edx, edx
div dword [0x141dd443c]
xor eax, 0x8011a281
or eax, 0x7ea2057e
imul eax, eax, 0xc1eea8bf
cmp eax, 0x14c0c984
jb 0x1400b2819
ud2
mov qword [rsi], rax
test r14, r14
je 0x1400b2950
mov eax, dword [0x141dd4498]
sub eax, dword [0x141dd449c]
imul eax, eax, 0x5ad7e1e7
xor eax, 0x91b52a21
add eax, 0xfff5ac0d
cmp eax, 0xcee07868
jbe 0x1400b2880
mov rax, qword [0x141ddc4e0]
nop word cs:[rax + rax]
mov eax, dword [0x141dd44a0]
xor eax, dword [0x141dd44a4]
xor eax, 0x1378d613
add eax, 0xfc250bf1
and eax, 0x3a0a45d6
mov rcx, qword [0x141ddc4e0]
cmp eax, 0xf2a4d3ad
ja 0x1400b2880
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141dd44a8]
or eax, dword [0x141dd44ac]
add eax, 0x120d6773
or eax, 0x620709a0
cmp eax, 0x616f5129
je 0x1400b28c0
jmp 0x1400b2950
mov eax, dword [0x141dd4490]
and eax, dword [0x141dd4494]
add eax, 0xf81662a
xor eax, 0x6999333d
mov qword [rsi], r14
cmp eax, 0xd0b1cf7b
jbe 0x1400b2904
mov qword [rsi], r14
jmp 0x1400b28df
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x1400b2950
mov eax, dword [0x141dd4480]
add eax, dword [0x141dd4484]
imul eax, eax, 0x6044e4e4
add eax, 0x9749973f
shr eax, 1
mov ecx, 0x94321fe9
imul rcx, rax
shr rcx, 0x3d
mov qword [rsi], r13
cmp ecx, 0xc4449d17
jne 0x1400b2950
mov qword [rsi], r13
jmp 0x1400b290e
mov eax, dword [0x141dd44b0]
and eax, dword [str._fI]
add eax, 0x6798f245
and eax, 0x4c1de0a7
cmp eax, 0xb191da57
ja 0x1400b2950
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret