Function at 0x1400d8a90
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov rcx, rdx
mov edx, 0x3c
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryInformationProcess
mov ebx, eax
nop
mov eax, dword [0x141ddb4d8]
or eax, dword [0x141ddb4dc]
imul eax, eax, 0xab942562
add eax, 0xbfa8857a
or eax, 0xe69e0efd
cmp eax, 0xa7e797d4
jb 0x1400d8ac0
test ebx, ebx
jns 0x1400d8c3e
or ebx, 0x10000000
mov eax, dword [0x141ddb4e0]
imul eax, dword [0x141ddb4e4]
add eax, 0xc799d8d1
xor eax, 0x1e6ffc37
imul rax, rax, 0x4a58c409
shr rax, 0x3d
cmp eax, 0x41e0bc33
ja 0x1400d8b56
mov ebp, dword [0x141ddb4e8]
or ebp, dword [0x141ddb4ec]
xor ebp, 0x5b33b4c2
or ebp, 0x24c84b38
add ebp, 0xbb0a7482
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
cmp ebp, 0x7a2d040c
jbe 0x1400d8b6e
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
jmp 0x1400d8b1a
mov rcx, qword [rsp + 0x30]
nop word cs:[rax + rax]
mov eax, dword [0x141ddb4f0]
imul eax, dword [0x141ddb4f4]
imul eax, eax, 0xb3109f9d
add eax, 0x2ffcbad1
cmp eax, 0x5f3c629b
jb 0x1400d8b80
cmp ebx, 0x90000005
je 0x1400d8bc0
cmp ebx, 0xd0000004
je 0x1400d8bc0
cmp ebx, 0xd0000023
jne 0x1400d8d10
nop dword [rax + rax]
mov eax, dword [0x141ddb508]
sub eax, dword [0x141ddb50c]
xor eax, 0x82b1218
add eax, 0xb086333
cmp eax, 0x418ce36e
jb 0x1400d8bc0
test rcx, rcx
je 0x1400d8c3e
mov r8d, 0xd1501ecf
nop dword [rax + rax]
mov eax, dword [0x141ddb510]
xor edx, edx
div dword [0x141ddb514]
imul rax, r8
shr rax, 0x3b
or eax, 0xcc4af0ca
and eax, 0xcc4af0ce
cmp eax, 0x84b86f3a
jb 0x1400d8bf0
mov rax, qword [rcx]
call qword [rax + 0x10]
nop dword [rax]
mov eax, dword [0x141ddb518]
xor eax, dword [0x141ddb51c]
imul eax, eax, 0xf1304278
and eax, 0xc0840880
cmp eax, 0xce054c0b
ja 0x1400d8c20
mov eax, dword [0x141ddb520]
and eax, dword [0x141ddb524]
xor eax, 0x18840132
and eax, 0x1ba43133
xor eax, 0xee4ab50
cmp eax, 0xa0211c94
jbe 0x1400d8c70
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x30], eax
movzx eax, byte [0x141dde6f8]
nop
mov eax, dword [0x141ddb528]
imul eax, dword [0x141ddb52c]
shr eax, 1
imul rax, rax, 0x2333176f
shr rax, 0x3c
add eax, 0xe04f2ca5
mov ebp, dword [rsp + 0x3c]
mov dword [rsp + 0x30], ebp
movzx ecx, byte [0x141dde6f8]
cmp eax, 0xb1013a78
jb 0x1400d8c70
mov r14d, ebp
shr r14d, 1
lea rdx, [r14*2 + 2]
xor ecx, ecx
call fcn.1400c29b0
mov rbx, rax
nop dword [rax]
mov eax, dword [0x141ddb530]
and eax, dword [0x141ddb534]
imul eax, eax, 0x14eb8cdd
and eax, 0xbb13d72d
cmp eax, 0x7726802f
ja 0x1400d8cc0
test rbx, rbx
je 0x1400d8d62
mov eax, dword [0x141ddb538]
xor eax, dword [0x141ddb53c]
add eax, 0x5ccadadc
imul rax, rax, 0x787d65dd
shr rax, 0x3d
xor eax, 0x18cad74b
cmp eax, 0x95f701f3
jbe 0x1400d8d64
jmp 0x1400d8d87
mov eax, dword [0x141ddb4f8]
xor edx, edx
div dword [0x141ddb4fc]
xor eax, 0x874901c2
and eax, 0xf76b1dcf
add eax, 0x125fac97
cmp eax, 0x5ecf100e
jb 0x1400d8d10
test rcx, rcx
je 0x1400d8e44
mov rax, qword [rcx]
mov edx, dword [0x141ddb500]
xor edx, dword [0x141ddb504]
imul edx, edx, 0x5885b472
cmp edx, 0x64e3348e
je 0x1400d8d40
call qword [rax + 0x10]
jmp 0x1400d8e44
ud2
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov edx, 0x3c
mov r8, rbx
mov r9d, ebp
call sub.ntdll.dll_NtQueryInformationProcess
xor ecx, ecx
test cl, cl
je 0x1400d8da6
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov edx, 0x3c
mov r8, rbx
mov r9d, ebp
call sub.ntdll.dll_NtQueryInformationProcess
jmp 0x1400d8d64
test eax, eax
js 0x1400d8ddd
mov eax, dword [0x141ddb550]
mov ecx, dword [0x141ddb554]
add eax, ecx
add eax, 0x1f70e3ca
imul rax, rax, 0x4a10e33
shr rax, 0x37
xor eax, 0x1aa7516e
cmp eax, 0x190d2a4a
jae 0x1400d8ea0
jmp 0x1400d8ec6
mov rdi, qword [0x141dde6e0]
mov eax, dword [0x141ddb540]
or eax, dword [0x141ddb544]
and eax, 0x8010b0f0
add eax, 0x31a530a3
cmp eax, 0x934b06c
jb 0x1400d8e34
mov eax, dword [0x141ddb548]
and eax, dword [0x141ddb54c]
and eax, 0x373d3a46
imul ebp, eax, 0x716ec5b0
or ebp, 0xd3bc2d57
mov rcx, rdi
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0x1b42745d
jae 0x1400d8e44
mov rcx, rdi
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400d8e01
mov eax, dword [0x141ddb570]
xor eax, dword [0x141ddb574]
imul rax, rax, 0x18d0f8d
shr rax, 0x37
add eax, 0x5b755dda
and eax, 0xa511c5c
cmp eax, 0x930a2add
jbe 0x1400d8e7b
mov qword [rsi], 0
mov qword [rsi + 8], 8
xor eax, eax
nop dword [rax]
mov qword [rsi], 0
mov qword [rsi + 8], 8
test al, al
jne 0x1400d8e80
mov qword [rsi + 0x10], 0
jmp 0x1400d8f70
mov eax, dword [0x141ddb558]
xor edx, edx
div dword [0x141ddb55c]
add eax, 0x65301313
xor eax, 0x2daccff8
mov word [rbx + r14*2], 0
cmp eax, 0xe3474b88
jbe 0x1400d8ecf
mov word [rbx + r14*2], 0
jmp 0x1400d8ea0
mov rdi, qword [rbx + 8]
mov eax, dword [0x141ddb560]
or eax, dword [0x141ddb564]
xor eax, 0xddb10fc2
mov ecx, 0x81715587
imul rcx, rax
shr rcx, 0x3c
add ecx, 0x29f8034a
cmp ecx, 0xbce63bc4
jbe 0x1400d8f1c
mov rcx, rsi
mov rdx, rdi
call fcn.1400d87b0
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov ebp, dword [0x141ddb568]
and ebp, dword [0x141ddb56c]
add ebp, 0x3fc8d9c6
xor ebp, 0xf511df3a
mov rcx, rsi
mov rdx, rdi
call fcn.1400d87b0
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, rbx
call r14
cmp ebp, 0x37ed2fe2
jbe 0x1400d8f30
nop word [rax + rax]