Function at 0x1403d7ba0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r14, qword [rsp + 0x110]
mov rax, qword [rsp + 0x118]
mov rbp, qword [rsp + 0x130]
mov r12, rcx
mov qword [rsp + 0x70], rax
lea rax, [0x140615280]
mov rdi, r9
movsxd rbx, dword [r12 + 0xc8]
mov qword [rsp + 0x78], rdx
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x120]
shr rbx, 3
test r14, r14
cmove r14, rax
test rbp, rbp
cmove rbp, rax
mov rax, r9
or rax, rdx
or rax, rcx
or rax, r8
jne 0x1403d7c24
cmp byte [r14], 0
je 0x1403d8040
mov rax, rdi
and edi, 7
shr rax, 3
mov qword [rsp + 0x60], rdi
add rax, r8
mov qword [rsp + 0x58], rax
mov rax, rdx
and edx, 7
shr rax, 3
mov qword [rsp + 0x68], rdx
mov rdx, qword [r12 + 0x100]
add rax, rcx
mov qword [rsp + 0x50], rax
test rbx, rbx
je 0x1403d8340
mov rsi, rbx
xor r13d, r13d
nop dword [rax]
add r13, 1
shr rsi, 8
jne 0x1403d7c70
test r13, r13
mov eax, 1
cmove r13, rax
mov byte [rdx], r13b
mov r15d, r13d
cmp rbx, 1
je 0x1403d82a0
mov esi, 1
lea eax, [r15*8 - 8]
mov qword [rsp + 0x80], r14
xor r15d, r15d
mov r14, r13
mov qword [rsp + 0x88], rbp
mov r13d, eax
mov rbp, rdx
jmp 0x1403d7cd4
sub r13d, 8
cmp r15, r14
je 0x1403d7d10
mov rsi, rdi
mov rax, rbx
mov ecx, r13d
lea rdi, [rsi + 1]
add r15, 1
shr rax, cl
mov byte [rbp + rsi], al
cmp rbx, rdi
jne 0x1403d7cc8
mov r8, rbx
mov rdx, rbp
mov rcx, r12
sub r13d, 8
call fcn.1403d40b0
cmp r15, r14
je 0x1403d8320
xor edi, edi
jmp 0x1403d7cd1
mov r14, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsi, 2
mov rcx, r14
call sub.msvcrt.dll_strlen
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
lea r9, [rcx + rdx*8]
mov rdx, qword [r12 + 0x100]
add r9, rax
je 0x1403d8360
mov rax, r9
xor r13d, r13d
nop dword [rax]
add r13, 1
shr rax, 8
jne 0x1403d7d58
mov eax, 1
test r13, r13
cmove r13, rax
mov eax, r13d
mov r15d, r13d
mov byte [rdx + rdi], al
cmp rbx, rsi
je 0x1403d82c8
mov qword [rsp + 0x80], r14
lea edi, [r15*8 - 8]
mov r14, r13
xor r15d, r15d
mov qword [rsp + 0x88], rbp
mov r13, rdx
mov rbp, r9
jmp 0x1403d7dbb
sub edi, 8
cmp r15, r14
je 0x1403d7df8
mov rsi, rax
mov rdx, rbp
mov ecx, edi
lea rax, [rsi + 1]
add r15, 1
shr rdx, cl
mov byte [r13 + rsi], dl
cmp rbx, rax
jne 0x1403d7db0
mov r8, rbx
mov rdx, r13
mov rcx, r12
sub edi, 8
call fcn.1403d40b0
cmp r15, r14
je 0x1403d8300
xor eax, eax
jmp 0x1403d7db8
mov r14, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r8, rax
mov rax, qword [rsp + 0x60]
lea r13, [rsp + 0x98]
mov r9, qword [rsp + 0x58]
mov rcx, r12
mov rdx, qword [r12 + 0x100]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], r13
mov r8, qword [rsp + 0x78]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1403d79f0
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x98]
mov r15, rax
mov rax, qword [rsp + 0x68]
lea rsi, [rax + rcx*8]
mov rcx, rbp
test rdi, rdi
jne 0x1403d7f28
call sub.msvcrt.dll_strlen
mov r14, rax
mov rax, qword [r12 + 0x100]
add r14, rsi
je 0x1403d8414
mov rdx, r14
xor esi, esi
nop
add rsi, 1
shr rdx, 8
jne 0x1403d7e90
test rsi, rsi
mov edx, 1
cmove rsi, rdx
mov ecx, esi
mov edi, esi
lea rdx, [r15 + 1]
mov byte [rax + r15], cl
cmp rbx, rdx
je 0x1403d83b8
mov qword [rsp + 0x58], rbp
lea r15d, [rdi*8 - 8]
mov rbp, rsi
xor edi, edi
mov rsi, rax
jmp 0x1403d7ee8
sub r15d, 8
cmp rdi, rbp
je 0x1403d8238
mov rdx, r9
mov rax, r14
mov ecx, r15d
lea r9, [rdx + 1]
add rdi, 1
shr rax, cl
mov byte [rsi + rdx], al
cmp rbx, r9
jne 0x1403d7ed8
mov r8, rbx
mov rdx, rsi
mov rcx, r12
sub r15d, 8
call fcn.1403d40b0
cmp rdi, rbp
je 0x1403d83f6
xor r9d, r9d
jmp 0x1403d7ee5
call sub.msvcrt.dll_strlen
mov rdx, qword [r12 + 0x100]
add rax, rsi
mov r11, rax
je 0x1403d8428
xor r14d, r14d
nop dword [rax]
add r14, 1
shr rax, 8
jne 0x1403d7f48
mov eax, 1
test r14, r14
cmove r14, rax
mov rcx, r14
movzx eax, r14b
mov esi, r14d
movzx ecx, ch
mov r13, rcx
mov ecx, edi
lea r8, [r15 + 1]
mov r10d, edi
shl rax, cl
or byte [rdx + r15], al
cmp rbx, r8
je 0x1403d8380
lea rax, [rdx + r8]
lea r9d, [rsi*8 - 8]
mov byte [rax], r13b
mov rax, r14
xor r15d, r15d
mov qword [rsp + 0x78], rdi
mov r14d, r9d
mov rdi, r11
mov r9, rax
mov qword [rsp + 0x58], r12
mov r12d, r10d
mov qword [rsp + 0x80], rbp
mov rbp, rbx
mov rbx, rdx
mov rdx, r8
jmp 0x1403d7fe4
shr si, 8
sub r14d, 8
mov byte [rbx + rdx + 1], sil
mov r13d, esi
cmp r15, r9
je 0x1403d8060
mov rdx, rax
mov ecx, r14d
mov rsi, rdi
lea rax, [rdx + 1]
add r15, 1
shr rsi, cl
mov ecx, r12d
movzx esi, sil
shl rsi, cl
or r13d, esi
mov byte [rbx + rdx], r13b
cmp rbp, rax
jne 0x1403d7fc8
mov rcx, qword [rsp + 0x58]
mov r8, rbp
mov rdx, rbx
mov qword [rsp + 0x60], r9
shr si, 8
sub r14d, 8
call fcn.1403d40b0
mov r9, qword [rsp + 0x60]
mov byte [rbx], sil
mov r13d, esi
cmp r15, r9
je 0x1403d83d7
xor eax, eax
jmp 0x1403d7fe1
cmp byte [rbp], 0
jne 0x1403d7c24
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, rbp
mov r10d, r12d
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov r15, qword [r12 + 0x100]
test rcx, rcx
je 0x1403d80d0
mov rsi, qword [rsp + 0x70]
movzx edx, byte [r15 + rax]
mov r13, rsi
lea r14, [rcx + rsi]
nop dword [rax + rax]
movzx esi, byte [r13]
mov ecx, r10d
shl esi, cl
or edx, esi
mov byte [r15 + rax], dl
add rax, 1
cmp rbx, rax
je 0x1403d8200
shr si, 8
add r13, 1
mov byte [r15 + rax], sil
mov edx, esi
cmp r14, r13
jne 0x1403d80a0
mov r11, qword [rsp + 0x68]
test r11, r11
je 0x1403d81e0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x50]
add rdi, r11
movzx esi, byte [rcx + rdx]
mov ecx, r10d
lea rdx, [r15 + rax]
shl esi, cl
or byte [rdx], sil
cmp rdi, 7
jbe 0x1403d8119
add rax, 1
cmp rbx, rax
je 0x1403d8440
lea rdx, [r15 + rax]
mov ecx, esi
and edi, 7
mov byte [rdx], ch
test rdi, rdi
jne 0x1403d81e0
mov byte [rdx], 0
movzx edx, byte [rbp]
test dl, dl
je 0x1403d8403
mov esi, 1
mov rcx, rdi
jmp 0x1403d814c
movzx edx, byte [rbp + 1]
add rbp, 1
test dl, dl
je 0x1403d8185
cmp dl, 0x31
jne 0x1403d8159
mov edx, esi
shl edx, cl
or byte [r15 + rax], dl
add rcx, 1
cmp rcx, 8
jne 0x1403d8140
add rax, 1
cmp rbx, rax
je 0x1403d8288
lea rdx, [r15 + rax]
add rbp, 1
mov byte [rdx], 0
xor ecx, ecx
movzx edx, byte [rbp]
test dl, dl
jne 0x1403d814c
mov qword [rsp + 0x98], rcx
mov rdi, rcx
test rdi, rdi
je 0x1403d8199
add rax, 1
test rax, rax
je 0x1403d804a
mov rcx, qword [r12 + 0x100]
mov r8, rbx
xor edx, edx
sub r8, rax
add rcx, rax
call sub.msvcrt.dll_memset
mov rdx, qword [r12 + 0x100]
mov r8, rbx
mov rcx, r12
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1403d40b0
movzx edx, byte [rbp]
test dl, dl
jne 0x1403d8131
mov qword [rsp + 0x98], rdi
jmp 0x1403d8195
mov rdx, r15
mov r8, rbx
mov rcx, r12
add r13, 1
shr si, 8
mov dword [rsp + 0x58], r10d
call fcn.1403d40b0
xor eax, eax
cmp r13, r14
mov byte [r15], sil
mov r10d, dword [rsp + 0x58]
mov edx, esi
jne 0x1403d80a0
jmp 0x1403d80d0
mov rbp, qword [rsp + 0x58]
mov r8, r9
mov rax, qword [rsp + 0x68]
mov rdx, qword [r12 + 0x100]
mov qword [rsp + 0x30], r8
mov rcx, r12
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x70]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1403d79f0
mov rdi, qword [rsp + 0x98]
jmp 0x1403d8190
mov rdx, r15
mov r8, rbx
mov rcx, r12
call fcn.1403d40b0
mov rdx, r15
xor eax, eax
jmp 0x1403d8174
mov r8d, 1
mov rcx, r12
mov qword [rsp + 0x80], rdx
call fcn.1403d40b0
mov rdx, qword [rsp + 0x80]
jmp 0x1403d7c9b
mov r8, rbx
mov rcx, r12
mov qword [rsp + 0x88], r9
xor esi, esi
mov qword [rsp + 0x80], rdx
call fcn.1403d40b0
mov r9, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
jmp 0x1403d7d80
mov r14, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
xor r8d, r8d
jmp 0x1403d7e0b
mov r14, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov esi, 1
xor edi, edi
jmp 0x1403d7d24
mov byte [rdx], 1
mov r15d, 1
mov esi, 1
mov r13d, 1
jmp 0x1403d7c9b
mov r15d, 1
mov eax, 1
mov r13d, 1
jmp 0x1403d7d74
mov r8, rbx
mov rcx, r12
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x58], rdx
mov dword [rsp + 0x78], edi
call fcn.1403d40b0
mov rdx, qword [rsp + 0x58]
mov r10d, dword [rsp + 0x78]
xor r8d, r8d
mov r11, qword [rsp + 0x60]
mov rax, rdx
jmp 0x1403d7f8b
mov rdx, rax
mov r8, rbx
mov rcx, r12
mov qword [rsp + 0x58], rax
call fcn.1403d40b0
mov rax, qword [rsp + 0x58]
xor edx, edx
jmp 0x1403d7ebb
mov rbx, rbp
mov r10d, r12d
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x80]
xor eax, eax
jmp 0x1403d8078
mov rbp, qword [rsp + 0x58]
xor r8d, r8d
jmp 0x1403d8240
mov qword [rsp + 0x98], 0
jmp 0x1403d8199
mov edi, 1
mov ecx, 1
mov esi, 1
jmp 0x1403d7eaa
mov esi, 1
xor r13d, r13d
mov eax, 1
mov r14d, 1
jmp 0x1403d7f6e
mov rdx, r15
mov r8, rbx
mov rcx, r12
call fcn.1403d40b0
mov rdx, r15
xor eax, eax
jmp 0x1403d8112