Function at 0x18000da60
Capabilities:
Encode data using xor
Get file size
Resolve function by fnv-1a hash

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30f0]
mov eax, 0x31f0
call fcn.18019b750
sub rsp, rax
mov rax, qword [0x1802678f0]
xor rax, rsp
mov qword [rbp + 0x30c0], rax
xor eax, eax
lea rcx, [rbp + 0x8c0]
xor edx, edx
mov qword [rbp + 0x260], rax
mov r8d, 0x2800
mov qword [rbp + 0x268], rax
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], rax
mov byte [rbp + 0x280], al
call fcn.18019d020
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x208
call fcn.18019d020
xor edx, edx
lea rcx, [rbp + 0x4a0]
mov r8d, 0x208
call fcn.18019d020
xor edx, edx
lea rcx, [rbp + 0x6b0]
mov r8d, 0x208
call fcn.18019d020
xor r12d, r12d
mov dword [rbp - 0x80], 0xa202a21f
mov qword [rbp + 0x40], r12
mov edx, r12d
mov dword [rbp + 0x48], r12d
mov r13d, 0x5db4
mov dword [rbp - 0x7c], 0xa21ba208
mov dword [rbp - 0x78], 0xa210a207
mov dword [rbp - 0x74], 0xa216a200
mov dword [rbp - 0x70], 0xa218a208
mov dword [rbp - 0x6c], 0xa234a23f
mov dword [rbp - 0x68], 0xa236a22a
mov dword [rbp - 0x64], 0xa234a229
mov dword [rbp - 0x60], 0xa229a23a
mov dword [rbp - 0x5c], 0xa21ca202
mov dword [rbp - 0x58], 0xa218a212
mov dword [rbp - 0x54], 0xa217a212
mov dword [rbp - 0x50], 0xa202a20b
mov dword [rbp - 0x4c], 0xa206a214
mov dword [rbp - 0x48], 0xa201a218
mov dword [rbp - 0x44], 0xa213
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x80]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r13w
inc edx
xor word [rcx], ax
cmp edx, 0x1f
jb 0x18000dba0
xor eax, eax
mov word [rbp - 0x42], r12w
mov word [rsp + 0x70], ax
mov edx, r12d
mov dword [rsp + 0x58], 0xa229a20d
mov dword [rsp + 0x5c], 0xa22ea238
mov dword [rsp + 0x60], 0xa238a220
mov dword [rsp + 0x64], 0xa261a261
mov dword [rsp + 0x68], 0xa231a27a
mov dword [rsp + 0x6c], 0xa23ba23a
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x58]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r13w
inc edx
xor word [rcx], ax
cmp edx, 0xc
jb 0x18000dc00
mov rax, qword [0x1802958e0]
mov word [rsp + 0x70], r12w
test rax, rax
jne 0x18000dc45
lea rdx, [rsp + 0x58]
mov ecx, 0xfbf688c6
call fcn.18000c8d0
mov qword [0x1802958e0], rax
lea rcx, [rbp + 0x40]
mov r9d, 0x101
mov qword [rsp + 0x20], rcx
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000002
xor r8d, r8d
call rax
test eax, eax
jne 0x18000e2cd
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x18000e376
mov dword [rsp + 0x40], 0xa22ca201
mov r8d, r12d
mov dword [rsp + 0x44], 0xa227a22d
mov dword [rsp + 0x48], 0xa23fa239
mov dword [rsp + 0x4c], 0xa214a237
mov dword [rsp + 0x50], 0xa23ca221
mov dword [rsp + 0x54], 0xa232
nop dword [rax]
movsxd rax, r8d
lea rdx, [rsp + 0x40]
lea rdx, [rdx + rax*2]
movzx eax, r8w
sub ax, r13w
inc r8d
xor word [rdx], ax
cmp r8d, 0xb
jb 0x18000dcb0
lea r9, [rbp + 0x8c0]
mov word [rsp + 0x56], r12w
lea r8, [rsp + 0x40]
call fcn.18000e3b0
test eax, eax
je 0x18000e2cd
lea rax, [rbp + 0x8c0]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], r12w
jne 0x18000dd00
add rdx, rdx
lea r8, [0x18022c010]
mov r9d, 0xffffffff
lea rcx, [rbp + 0x8c0]
call fcn.18000e6d0
mov r14d, eax
mov rax, qword [0x1802958d8]
not r14d
test rax, rax
jne 0x18000dd4b
xor edx, edx
mov ecx, 0xa3fbd5fb
call fcn.18000c8d0
mov qword [0x1802958d8], rax
mov r8d, 0x104
lea rdx, [rbp + 0x290]
lea rcx, [0x180000000]
call rax
test eax, eax
je 0x18000e2cd
mov rax, qword [0x1802958e8]
test rax, rax
jne 0x18000dd88
xor edx, edx
mov ecx, 0xafcab3c4
call fcn.18000c8d0
mov qword [0x1802958e8], rax
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x290]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000e2cd
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
ja 0x18000e2a3
lea edx, [rax + 0xa]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18000e2a3
mov rax, qword [0x1802958f0]
test rax, rax
jne 0x18000de11
xor edx, edx
mov ecx, 0x54fcc943
call fcn.18000c8d0
mov qword [0x1802958f0], rax
lea r9, [rbp + 0x48]
mov qword [rsp + 0x20], r12
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call rax
test eax, eax
je 0x18000e29a
mov rax, qword [0x1802958f8]
test rax, rax
jne 0x18000de4c
xor edx, edx
mov ecx, 0xfaba0065
call fcn.18000c8d0
mov qword [0x1802958f8], rax
mov rcx, rdi
call rax
mov r9d, dword [rbp + 0x48]
mov rdi, 0xffffffffffffffff
mov r8d, r12d
test r9d, r9d
je 0x18000deb8
lea edx, [rdi + 3]
mov eax, r8d
cmp byte [rax + rbx], 0x43
jne 0x18000deae
lea eax, [rdx - 1]
cmp byte [rax + rbx], 0xeb
jne 0x18000deae
mov eax, edx
cmp byte [rax + rbx], 0x8c
jne 0x18000deae
lea eax, [rdx + 1]
cmp byte [rax + rbx], 0xbd
jne 0x18000deae
lea eax, [rdx + 2]
cmp byte [rax + rbx], 0x1d
jne 0x18000deae
lea eax, [rdx + 3]
cmp byte [rax + rbx], 0x98
jne 0x18000deae
lea eax, [rdx + 4]
cmp byte [rax + rbx], 0x3d
jne 0x18000deae
lea eax, [rdx + 5]
cmp byte [rax + rbx], 0x14
je 0x18000deb8
inc r8d
inc edx
cmp r8d, r9d
jb 0x18000de67
cmp r8d, r9d
je 0x18000e29a
lea eax, [r8 + 0x10]
cmp eax, r9d
ja 0x18000e29a
mov eax, r8d
cmp dword [rax + rbx + 8], r14d
jne 0x18000e29a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [0x180295900]
test rax, rax
jne 0x18000df04
xor edx, edx
mov ecx, 0xfc1273fe
call fcn.18000c8d0
mov qword [0x180295900], rax
mov edx, 0x104
lea rcx, [rbp + 0x4a0]
call rax
test eax, eax
je 0x18000e2cd
mov dword [rbp - 0x40], 0xa23ea269
mov r8d, r12d
mov dword [rbp - 0x3c], 0xa22ca212
mov dword [rbp - 0x38], 0xa23fa23f
mov dword [rbp - 0x34], 0xa23aa234
mov dword [rbp - 0x30], 0xa209a233
mov dword [rbp - 0x2c], 0xa22ea225
mov dword [rbp - 0x28], 0xa22da22b
mov dword [rbp - 0x24], 0xa236a23f
mov dword [rbp - 0x20], 0xa22fa22c
mov dword [rbp - 0x1c], 0xa239a231
mov dword [rbp - 0x18], 0xa20da209
mov dword [rbp - 0x14], 0xa23fa207
mov dword [rbp - 0x10], 0xa215a205
mov dword [rbp - 0xc], 0xa203a216
mov dword [rbp - 8], 0xa21da209
mov dword [rbp - 4], 0xa237a20b
mov dword [rbp], 0xa202a220
mov dword [rbp + 4], 0xa20ea20d
mov dword [rbp + 8], 0xa22da21c
mov dword [rbp + 0xc], 0xa204a206
mov dword [rbp + 0x10], 0xa244a259
mov dword [rbp + 0x14], 0xa247a246
mov dword [rbp + 0x18], 0xa254a219
mov dword [rbp + 0x1c], 0xa24ba21b
mov dword [rbp + 0x20], 0xa250a24c
mov dword [rbp + 0x24], 0xa24ea21b
mov dword [rbp + 0x28], 0xa2e5a2b4
mov dword [rbp + 0x2c], 0xa2ada2bb
mov dword [rbp + 0x30], 0xa2e8a2f0
mov dword [rbp + 0x34], 0xa2f6
nop
movsxd rax, r8d
lea rcx, [rbp - 0x40]
lea rcx, [rcx + rax*2]
movzx eax, r8w
sub ax, r13w
inc r8d
xor word [rcx], ax
cmp r8d, 0x3b
jb 0x18000dff0
lea r9, [rbp + 0x4a0]
mov word [rbp + 0x36], r12w
lea r8, [rbp - 0x40]
mov edx, 0x104
lea rcx, [rbp + 0x6b0]
call fcn.18000e890
mov rax, qword [0x1802958e8]
test rax, rax
jne 0x18000e04f
xor edx, edx
mov ecx, 0xafcab3c4
call fcn.18000c8d0
mov qword [0x1802958e8], rax
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea rcx, [rbp + 0x6b0]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call rax
mov r15, rax
cmp rax, rdi
je 0x18000e2cd
mov rax, qword [0x180295908]
test rax, rax
jne 0x18000e0a1
xor edx, edx
mov ecx, 0x44ed8118
call fcn.18000c8d0
mov qword [0x180295908], rax
xor edx, edx
mov rcx, r15
call rax
mov edi, eax
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
ja 0x18000e276
lea edx, [rax + 0xa]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18000e276
mov rax, qword [0x1802958f0]
test rax, rax
jne 0x18000e0ef
xor edx, edx
mov ecx, 0x54fcc943
call fcn.18000c8d0
mov qword [0x1802958f0], rax
lea r9, [rbp + 0x48]
mov qword [rsp + 0x20], r12
mov r8d, edi
mov rdx, rbx
mov rcx, r15
call rax
test eax, eax
je 0x18000e26d
movups xmm0, xmmword [rbx]
lea edx, [rdi - 0x1f]
mov ecx, 0x40
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x270], xmm1
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x18000e26d
lea ecx, [rdi - 0x20]
mov r12d, ecx
lea r8, [rbx + 0x20]
mov r9d, ecx
mov edx, ecx
mov rcx, rax
call fcn.180003100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x50]
call fcn.18000a170
xor eax, eax
mov rbx, r14
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x268], rax
lea eax, [rdi - 0x20]
cdq
and edx, 0xf
add eax, edx
and eax, 0xfffffff0
cmp eax, 0x10
jl 0x18000e247
movaps xmmword [rsp + 0x31e0], xmm6
lea rdi, [rbp + 0x260]
movdqa xmm6, xmmword [rbp + 0x260]
sub rdi, r14
mov esi, eax
shr rsi, 4
movaps xmmword [rsp + 0x31d0], xmm7
nop word [rax + rax]
movups xmm7, xmmword [rbx]
mov r8, rbx
lea rcx, [rbp + 0x50]
mov rdx, rbx
call fcn.18000acb0
lea rax, [rbp + 0x26f]
cmp rbx, rax
ja 0x18000e212
lea rax, [rbx + 0xf]
lea rcx, [rbp + 0x260]
cmp rax, rcx
jb 0x18000e212
mov rax, rbx
mov edx, 0x10
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18000e200
jmp 0x18000e21e
movdqu xmm0, xmmword [rbx]
pxor xmm6, xmm0
movdqu xmmword [rbx], xmm6
add rbx, 0x10
movdqa xmmword [rbp + 0x260], xmm7
sub rdi, 0x10
movaps xmm6, xmm7
sub rsi, 1
jne 0x18000e1c0
movaps xmm7, xmmword [rsp + 0x31d0]
movaps xmm6, xmmword [rsp + 0x31e0]
cmp byte [r14], 0x4d
jne 0x18000e25f
cmp byte [r14 + 1], 0x5a
jne 0x18000e25f
mov rdx, r12
mov rcx, r14
call fcn.18000c0c0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r12d, r12d
jmp 0x18000e276
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [0x1802958f8]
test rax, rax
jne 0x18000e295
xor edx, edx
mov ecx, 0xfaba0065
call fcn.18000c8d0
mov qword [0x1802958f8], rax
mov rcx, r15
jmp 0x18000e2cb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rdi, 0xffffffffffffffff
je 0x18000e2cd
mov rax, qword [0x1802958f8]
test rax, rax
jne 0x18000e2c8
xor edx, edx
mov ecx, 0xfaba0065
call fcn.18000c8d0
mov qword [0x1802958f8], rax
mov rcx, rdi
call rax
mov r8, qword [rbp + 0x40]
test r8, r8
je 0x18000e376
xor eax, eax
mov dword [rbp + 0x260], 0xa229a20d
mov word [rbp + 0x278], ax
mov edx, r12d
mov dword [rbp + 0x264], 0xa22ea238
mov dword [rbp + 0x268], 0xa238a220
mov dword [rbp + 0x26c], 0xa261a261
mov dword [rbp + 0x270], 0xa231a27a
mov dword [rbp + 0x274], 0xa23ba23a
movsxd rax, edx
lea rcx, [rbp + 0x260]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r13w
inc edx
xor word [rcx], ax
cmp edx, 0xc
jb 0x18000e322
mov rax, qword [0x180295910]
mov word [rbp + 0x278], r12w
test rax, rax
jne 0x18000e371
lea rdx, [rbp + 0x260]
mov ecx, 0x1242154a
call fcn.18000c8d0
mov r8, qword [rbp + 0x40]
mov qword [0x180295910], rax
mov rcx, r8
call rax
mov rcx, qword [rbp + 0x30c0]
xor rcx, rsp
call fcn.18019ab50
lea r11, [rsp + 0x31f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret