Function at 0x140098e00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov rsi, rdx
mov r12, rcx
mov eax, dword [0x141f3d698]
sub eax, dword [0x141f3d69c]
or eax, 0xfbcc8ab9
cmp eax, 0xa3733725
jne 0x140098e70
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
nop word [rax + rax]
mov ecx, dword [0x141f3d6a0]
or ecx, dword [0x141f3d6a4]
or ecx, 0xb92bb130
add ecx, 0xe17bd048
imul rax, rcx, 0x1f40aa01
shr rax, 0x20
sub ecx, eax
shr ecx, 1
add ecx, eax
shr ecx, 0x1e
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdx, rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov r15, rsp
cmp ecx, 0x7fd6d333
ja 0x140098e70
mov qword [rbp - 8], r8
mov qword [rbp], rdx
mov eax, dword [0x141f3d6a8]
or eax, dword [0x141f3d6ac]
or eax, 0xb0a1d422
imul rax, rax, 0x65467e8f
shr rax, 0x3e
cmp eax, 0x6f10917d
jne 0x140098f25
sub rsp, 0x20
mov rcx, r13
mov rdx, r12
mov r8, rsi
call fcn.1400965b0
add rsp, 0x20
mov ebx, 0xd22d66ef
nop word [rax + rax]
mov edi, dword [0x141f3d6b0]
imul edi, dword [0x141f3d6b4]
imul rdi, rbx
shr rdi, 0x3e
add edi, 0x582cb157
or edi, 0x1ea87c58
sub rsp, 0x20
mov rcx, r13
mov rdx, r12
mov r8, rsi
call fcn.1400965b0
add rsp, 0x20
cmp edi, 0x9fc89e24
ja 0x140098f30
mov rcx, qword [r13]
mov eax, dword [0x141f3d6b8]
xor edx, edx
div dword [0x141f3d6bc]
nop word cs:[rax + rax]
mov eax, dword [0x141f3d6c0]
and eax, dword [0x141f3d6c4]
xor eax, 0xeefdf6
add eax, 0x4c531962
and eax, 0x1db1f0fc
cmp eax, 0xd8baa95
je 0x140098f90
mov rsi, qword [r13 + 8]
movabs rbx, 0x8000000000000000
cmp rcx, rbx
jne 0x140098ffc
mov eax, 0xa5eb4e87
nop word [rax + rax]
mov ecx, dword [0x141f3d6c8]
mov edx, dword [0x141f3d6cc]
add ecx, edx
add ecx, 0x7312e4ec
imul rcx, rax
shr rcx, 0x3b
imul ecx, ecx, 0xf14ae8ef
cmp ecx, 0x53cb1102
je 0x140098fd0
jmp 0x140099027
mov r12, qword [r13 + 0x10]
mov qword [r14], rcx
mov eax, dword [0x141f3d6d0]
or eax, dword [0x141f3d6d4]
or eax, 0xf5a991ef
add eax, 0x78f21a75
or eax, 0x1805fcfd
cmp eax, 0xdb25faa0
ja 0x1400990a3
jmp 0x140099065
mov edi, 1
mov rbx, rsi
nop
mov eax, dword [0x141f3d7c0]
add eax, dword [0x141f3d7c4]
and eax, 0x9947794a
imul eax, eax, 0xcb80e28a
cmp eax, 0x6b9a2a57
je 0x140099030
mov rax, rdi
mov rdx, rbx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov edi, dword [0x141f3d6d8]
add edi, dword [0x141f3d6dc]
or edi, 0x30100
and edi, 0x10430110
mov qword [r14 + 8], rsi
mov qword [r14 + 0x10], r12
sub rsp, 0x20
mov rcx, r15
mov rdx, r14
mov r8b, 1
call fcn.14009a1f0
add rsp, 0x20
cmp edi, 0x5fbd5c56
jbe 0x1400990d0
mov qword [r14 + 8], rsi
mov qword [r14 + 0x10], r12
sub rsp, 0x20
mov rcx, r15
mov rdx, r14
mov r8b, 1
call fcn.14009a1f0
add rsp, 0x20
jmp 0x140099065
mov eax, dword [0x141f3d6e0]
mov ecx, dword [0x141f3d6e4]
add eax, ecx
add eax, 0xba76d108
imul rax, rax, 0x4de22ce9
shr rax, 0x3d
cmp eax, 0x38845641
ja 0x1400990d0
mov r12, qword [r15]
mov rsi, qword [r15 + 8]
cmp r12, rbx
mov rdi, qword [rbp - 8]
je 0x140099027
movzx r8d, byte [rdi + 0x21]
movzx ecx, byte [rdi + 0x22]
test r8b, r8b
je 0x140099190
test cl, cl
jne 0x1400991c0
nop
mov eax, dword [0x141f3d6f0]
sub eax, dword [0x141f3d6f4]
imul eax, eax, 0xb287dabe
imul rdx, rax, 0x22032501
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
cmp eax, 0x63fc0290
je 0x140099120
movzx eax, byte [rdi + 0x25]
nop word cs:[rax + rax]
mov edx, dword [0x141f3d6f8]
xor edx, dword [0x141f3d6fc]
imul rdx, rdx, 0x60595df
shr rdx, 0x3a
imul edx, edx, 0x33715b1d
cmp edx, 0xf48450da
je 0x140099160
jmp 0x1400992e0
mov eax, dword [0x141f3d6e8]
xor edx, edx
div dword [0x141f3d6ec]
xor eax, 0x202002
and eax, 0x1c2a33aa
cmp eax, 0x21e69524
ja 0x140099190
test cl, cl
je 0x140099290
nop word [rax + rax]
mov eax, dword [0x141f3d708]
imul eax, dword [0x141f3d70c]
xor eax, 0x8c3da007
imul eax, eax, 0xd3caa1a5
cmp eax, 0x8f892692
je 0x1400991c0
movzx edx, byte [rdi + 0x23]
movzx eax, byte [rdi + 0x25]
nop word [rax + rax]
test dl, dl
setne r9b
mov r10d, dword [0x141f3d710]
xor r10d, dword [0x141f3d714]
imul r11d, r10d, 0x5583cc6c
add r11d, 0x7c0c68b0
test al, al
sete r10b
cmp r11d, 0x1b250a15
ja 0x1400991f0
and r9b, r10b
je 0x1400992e0
movabs rbx, 0x5700000002
mov edi, 1
test r12, r12
je 0x140099030
mov rcx, qword [0x141f49060]
sub rsp, 0x20
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141f3d7d0]
add eax, dword [0x141f3d7d4]
and eax, 0x570b955e
imul eax, eax, 0x70d1f52
cmp eax, 0x8cbebb02
je 0x140099260
jmp 0x140099030
mov edx, dword [0x141f3d700]
imul edx, dword [0x141f3d704]
add edx, 0xcff8a8c5
or edx, 0x680875f2
and edx, 0x7c5cf7f6
movzx eax, byte [rdi + 0x23]
or al, byte [rdi + 0x24]
sete al
cmp edx, 0x9526877
je 0x140099290
cmp byte [rdi + 0x25], 0
sete dl
test al, dl
je 0x14009922a
xor eax, eax
nop word cs:[rax + rax]
mov edx, dword [0x141f3d718]
or edx, dword [0x141f3d71c]
imul edx, edx, 0x54983c4d
and edx, 0x888391
cmp edx, 0x39fa6570
ja 0x1400992e0
cmp byte [rdi + 0x24], 0
je 0x140099320
test al, al
jne 0x140099390
mov r15d, 4
jmp 0x1400993ec
mov edx, dword [0x141f3d720]
add edx, dword [0x141f3d724]
imul rdx, rdx, 0x382cdf89
shr rdx, 0x3b
imul edx, edx, 0x3329a43f
cmp edx, 0xc7697421
jb 0x140099320
movzx edx, byte [rdi + 0x23]
movzx edx, dl
lea r15d, [rdx*2 + 3]
nop word cs:[rax + rax]
mov edx, dword [0x141f3d728]
sub edx, dword [0x141f3d72c]
add edx, 0x47ba2cb3
or edx, 0xe7f3c8fb
cmp edx, 0xd18db0aa
jb 0x140099360
test al, al
je 0x1400993ec
nop word cs:[rax + rax]
mov edx, dword [0x141f3d730]
and edx, dword [0x141f3d734]
add edx, 0xb5fd3bf
imul rdx, rdx, 0x5c4b059f
shr rdx, 0x3d
or edx, 0x50f2165d
cmp edx, 0x12a436cb
jb 0x140099390
nop dword [rax + rax]
mov edx, dword [0x141f3d738]
xor edx, dword [0x141f3d73c]
imul edx, edx, 0x1f6f0436
add edx, 0x9007fe26
or edx, 0xf971fa00
cmp edx, 0x2bb1fef8
je 0x1400993c0
mov r15d, 1
cmp dword [rdi], 0
je 0x14009944f
nop word cs:[rax + rax]
mov ecx, dword [0x141f3d750]
add ecx, dword [0x141f3d754]
imul ecx, ecx, 0xa24bb143
or ecx, 0xf02be530
and ecx, 0xf6ebfd7d
cmp ecx, 0x9916a9d3
je 0x140099400
mov edx, dword [rdi + 4]
nop dword [rax]
mov ecx, dword [0x141f3d758]
sub ecx, dword [0x141f3d75c]
imul ecx, ecx, 0xd8a7c1a
cmp ecx, 0x57f1e08
je 0x140099430
jmp 0x14009959f
movzx edx, byte [rdi + 0x20]
mov r9d, 0x823bea73
nop dword [rax]
mov r10d, dword [0x141f3d740]
sub r10d, dword [str.toE6]
add r10d, 0xfd27e1c3
or r10d, 0x6e0d6e0d
imul r10, r9
shr r10, 0x3e
cmp r10d, 0xdd6acb93
je 0x140099460
nop dword [rax]
mov r9d, dword [0x141f3d748]
xor r9d, dword [0x141f3d74c]
xor r9d, 0x3016eda
imul r9d, r9d, 0x80290901
cmp r9d, 0x69a6066d
je 0x140099490
test dl, dl
je 0x140099556
xor r9d, r9d
test r8b, r8b
setne r9b
or r9d, 0xfffffffe
shl r9d, 0x1e
mov r8d, 0x80120114
nop word cs:[rax + rax]
mov r10d, dword [0x141f3d760]
or r10d, dword [0x141f3d764]
and r10d, 0xc910ca36
add r10d, 0x58203c2b
or r10d, 0x2764ae6f
test cl, cl
mov edx, r9d
cmovne edx, r8d
cmp r10d, 0x9736921a
je 0x1400994e0
nop word cs:[rax + rax]
mov ecx, dword [0x141f3d768]
mov r8d, dword [0x141f3d76c]
add ecx, r8d
add ecx, 0xd876aac8
imul r8, rcx, 0x2243ebdd
shr r8, 0x20
sub ecx, r8d
shr ecx, 1
add ecx, r8d
shr ecx, 0x1e
cmp ecx, 0xb739b1ed
jae 0x140099520
jmp 0x14009959f
test r8b, r8b
je 0x140099592
nop dword [rax + rax]
mov edx, dword [0x141f3d770]
imul edx, dword [0x141f3d774]
and edx, 0x77b6e504
xor edx, 0xf262a3a0
imul edx, edx, 0xc9db164e
cmp edx, 0xcd1dfddd
je 0x140099560
test cl, cl
jne 0x14009959a
mov edx, 0x40000000
jmp 0x14009959f
test cl, cl
je 0x14009922a
mov edx, 0x120114
mov r8d, dword [rdi + 0x18]
mov ecx, dword [rdi + 0x14]
or ecx, dword [rdi + 0x10]
mov r9, qword [rdi + 8]
or ecx, dword [rdi + 0x1c]
xor r10d, r10d
test al, al
setne r10b
shl r10d, 0x15
or r10d, ecx
sub rsp, 0x40
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r15d
mov qword [rsp + 0x30], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
add rsp, 0x40
cmp rax, 0xffffffffffffffff
je 0x140099685
movzx ecx, byte [rdi + 0x23]
mov r14, rax
nop word cs:[rax + rax]
mov r8d, dword [0x141f3d778]
add r8d, dword [0x141f3d77c]
and r8d, 0xe9dce65a
test cl, cl
setne dl
cmp r15d, 4
sete al
cmp r8d, 0x3de8e8f8
je 0x140099600
and al, dl
nop dword [rax]
mov ecx, dword [0x141f3d780]
imul ecx, dword [0x141f3d784]
xor ecx, 0x80102
or ecx, 0x17e776f0
imul ecx, ecx, 0xe539dabd
cmp ecx, 0xe4029ba0
je 0x140099630
test al, al
je 0x1400997d6
mov eax, dword [0x141f3d788]
mov ecx, dword [0x141f3d78c]
add eax, ecx
add eax, 0x822a7353
and eax, 0xdd955f99
xor eax, 0x490a1037
cmp eax, 0x96b0466c
jb 0x1400996e5
jmp 0x1400996a8
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov r14d, eax
shl r14, 0x20
or r14, 2
mov edi, 1
jmp 0x1400997d8
mov eax, dword [0x141f3d790]
sub eax, dword [0x141f3d794]
shr eax, 1
mov edi, 0x93c8b9c5
imul rdi, rax
shr rdi, 0x3d
add edi, 0x33ae05b2
or edi, 0x2fe601a5
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp edi, 0x308b0ec9
jae 0x1400996f5
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x1400996a8
mov ecx, eax
mov eax, dword [0x141f3d798]
xor edx, edx
div dword [0x141f3d79c]
nop word cs:[rax + rax]
mov eax, dword [0x141f3d7a0]
or eax, dword [0x141f3d7a4]
imul eax, eax, 0xb259b534
add eax, 0x1e3d89f0
cmp eax, 0x5c343e10
jb 0x140099710
cmp ecx, 0xb7
mov r8, qword [rbp]
jne 0x1400997d6
mov qword [r8], 0
sub rsp, 0x20
mov rcx, r14
mov edx, 6
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
add rsp, 0x20
nop word cs:[rax + rax]
mov ecx, dword [0x141f3d7a8]
or ecx, dword [0x141f3d7ac]
xor ecx, 0x22594003
add ecx, 0x8332b4e8
or ecx, 0xbc368026
cmp ecx, 0xd1386cbd
jb 0x140099770
test eax, eax
je 0x140099814
nop word [rax + rax]
mov eax, dword [0x141f3d7b8]
xor eax, dword [0x141f3d7bc]
add eax, 0xedd20458
xor eax, 0x24204082
and al, 0x25
xchg edx, eax
ret 0x2ce9
cmp eax, 0x4c633d9b
ja 0x1400997a0
xor edi, edi
mov al, 1
nop word cs:[rax + rax]
test al, al
je 0x1400997d0
jmp 0x1400997d8
xor edi, edi
test r12, r12
je 0x14009980c
mov rbx, qword [0x141f49060]
mov eax, dword [0x141f3d7c8]
xor edx, edx
div dword [0x141f3d7cc]
xor eax, 0x58eb6df7
add eax, 0x4ed8eac2
cmp eax, 0xdaeb4f7c
ja 0x1400998ab
jmp 0x14009988d
mov rbx, r14
jmp 0x140099030
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov ebx, eax
shl rbx, 0x20
or rbx, 2
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov edi, 1
test r12, r12
je 0x140099030
mov rcx, qword [0x141f49060]
sub rsp, 0x20
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov eax, dword [0x141f3d7b0]
or eax, dword [0x141f3d7b4]
imul eax, eax, 0x5b7633f5
and eax, 0x69044b2a
add eax, 0x7a0967ba
cmp eax, 0x5121ce82
jb 0x140099865
jmp 0x140099030
sub rsp, 0x20
xor r15d, r15d
mov rcx, rbx
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
test r15b, r15b
je 0x1400998c3
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add byte [rax - 0x7d], cl
invalid
and bl, ch
invalid
mov rbx, r14
jmp 0x140099030