Function at 0x14001fdc0
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, byte [rdx + 1]
movzx ebx, byte [rdx]
mov r11, rcx
lea r9, [rcx + 4]
shl ebx, 8
xor ebx, eax
movzx eax, byte [rdx + 2]
shl ebx, 8
xor ebx, eax
movzx eax, byte [rdx + 3]
shl ebx, 8
xor ebx, eax
mov dword [rcx], ebx
movzx eax, byte [rdx + 5]
movzx ecx, byte [rdx + 4]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 6]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 7]
shl ecx, 8
xor ecx, eax
mov dword [r9], ecx
movzx eax, byte [rdx + 9]
movzx ecx, byte [rdx + 8]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0xa]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0xb]
shl ecx, 8
xor ecx, eax
mov dword [r11 + 8], ecx
movzx eax, byte [rdx + 0xd]
movzx ecx, byte [rdx + 0xc]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0xe]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0xf]
shl ecx, 8
xor ecx, eax
mov dword [r11 + 0xc], ecx
cmp r8d, 0x80
jne 0x14001ff6b
mov edx, ecx
mov eax, ecx
lea r10, str.ccccwwww
shr rax, 0x10
movzx ecx, al
mov eax, edx
mov r8d, dword [r10 + rcx*4]
shr rax, 8
btc r8d, 0x18
movzx ecx, al
mov eax, dword [r10 + rcx*4]
and r8d, 0xff000000
and eax, 0xff0000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r10 + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r10 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, ebx
lea rbx, str.msimg32.dll
mov dword [r11 + 0x10], r8d
xor r8d, dword [r9]
mov dword [r11 + 0x14], r8d
xor r8d, dword [r11 + 8]
mov dword [r11 + 0x18], r8d
xor r8d, dword [r11 + 0xc]
mov dword [r11 + 0x1c], r8d
lea r11, [0x1400b6684]
mov edx, dword [r9 + 0x18]
lea r9, [r9 + 0x10]
add r11, 4
mov eax, edx
shr rax, 8
movzx ecx, al
mov eax, edx
mov r8d, dword [r10 + rcx*4]
shr rax, 0x10
movzx ecx, al
and r8d, 0xff0000
mov eax, dword [r10 + rcx*4]
and eax, 0xff000000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r10 + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r10 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, dword [r9 - 4]
xor r8d, dword [r11 - 4]
mov dword [r9 + 0xc], r8d
xor r8d, dword [r9]
mov dword [r9 + 0x10], r8d
mov eax, dword [r9 + 4]
xor eax, r8d
mov dword [r9 + 0x14], eax
xor eax, dword [r9 + 8]
mov dword [r9 + 0x18], eax
cmp r11, rbx
jne 0x14001fee2
mov eax, 0xa
mov rbx, qword [rsp + 8]
ret
movzx eax, byte [rdx + 0x11]
movzx ecx, byte [rdx + 0x10]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0x12]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0x13]
shl ecx, 8
xor ecx, eax
mov dword [r11 + 0x10], ecx
movzx eax, byte [rdx + 0x15]
movzx ecx, byte [rdx + 0x14]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0x16]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0x17]
shl ecx, 8
xor ecx, eax
mov dword [r11 + 0x14], ecx
cmp r8d, 0xc0
jne 0x1400200e5
mov edx, ecx
mov eax, ecx
lea r10, str.ccccwwww
shr rax, 0x10
movzx ecx, al
mov eax, edx
mov r8d, dword [r10 + rcx*4]
shr rax, 8
movzx ecx, al
btc r8d, 0x18
mov eax, dword [r10 + rcx*4]
and r8d, 0xff000000
and eax, 0xff0000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r10 + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r10 + rax*4]
lea rax, [r11 + 0x28]
and ecx, 0xff00
xor r8d, ecx
xor r8d, ebx
lea rbx, [0x1400b66a0]
mov dword [r11 + 0x18], r8d
xor r8d, dword [r9]
mov dword [r11 + 0x1c], r8d
xor r8d, dword [r11 + 8]
mov dword [r11 + 0x20], r8d
xor r8d, dword [r11 + 0xc]
mov dword [r11 + 0x24], r8d
lea r11, [0x1400b6684]
mov edx, dword [rax - 0x18]
mov ecx, dword [rax - 0x14]
lea rax, [rax + 0x18]
xor edx, dword [rax - 0x1c]
add r11, 4
xor ecx, edx
mov dword [rax - 0x18], edx
mov dword [rax - 0x14], ecx
mov r8d, dword [rax - 0x14]
mov ecx, r8d
shr rcx, 8
movzx edx, cl
mov ecx, r8d
mov r9d, dword [r10 + rdx*4]
shr rcx, 0x10
movzx edx, cl
and r9d, 0xff0000
mov ecx, dword [r10 + rdx*4]
and ecx, 0xff000000
xor r9d, ecx
mov ecx, r8d
shr rcx, 0x18
movzx ecx, byte [r10 + rcx*4]
xor r9d, ecx
movzx ecx, r8b
mov edx, dword [r10 + rcx*4]
and edx, 0xff00
xor r9d, edx
xor r9d, dword [rax - 0x28]
xor r9d, dword [r11 - 4]
mov dword [rax - 0x10], r9d
mov ecx, dword [rax - 0x24]
xor ecx, r9d
mov dword [rax - 0xc], ecx
mov edx, dword [rax - 0x20]
xor edx, ecx
mov dword [rax - 8], edx
mov ecx, dword [rax - 0x1c]
xor ecx, edx
mov dword [rax - 4], ecx
cmp r11, rbx
jne 0x140020043
mov eax, 0xc
mov rbx, qword [rsp + 8]
ret
movzx eax, byte [rdx + 0x19]
movzx ecx, byte [rdx + 0x18]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0x1a]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0x1b]
shl ecx, 8
xor ecx, eax
mov dword [r11 + 0x18], ecx
movzx eax, byte [rdx + 0x1d]
movzx ecx, byte [rdx + 0x1c]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0x1e]
shl ecx, 8
xor ecx, eax
movzx eax, byte [rdx + 0x1f]
shl ecx, 8
xor ecx, eax
mov dword [r11 + 0x1c], ecx
cmp r8d, 0x100
jne 0x1400202c4
mov edx, ecx
mov eax, ecx
lea r10, str.ccccwwww
shr rax, 0x10
movzx ecx, al
mov eax, edx
mov r8d, dword [r10 + rcx*4]
shr rax, 8
btc r8d, 0x18
movzx ecx, al
mov eax, dword [r10 + rcx*4]
and r8d, 0xff000000
and eax, 0xff0000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r10 + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r10 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, ebx
lea rbx, [0x1400b669c]
mov dword [r11 + 0x20], r8d
xor r8d, dword [r9]
lea r9, [r11 + 0x30]
mov dword [r11 + 0x24], r8d
xor r8d, dword [r11 + 8]
mov dword [r11 + 0x28], r8d
xor r8d, dword [r11 + 0xc]
mov dword [r11 + 0x2c], r8d
lea r11, [0x1400b6684]
nop dword [rax]
mov edx, dword [r9 - 4]
lea r9, [r9 + 0x20]
add r11, 4
mov eax, edx
shr rax, 0x10
movzx ecx, al
mov eax, edx
mov r8d, dword [r10 + rcx*4]
shr rax, 8
movzx ecx, al
and r8d, 0xff0000
mov eax, dword [r10 + rcx*4]
and eax, 0xff00
xor r8d, eax
mov eax, edx
shr rax, 0x18
mov ecx, dword [r10 + rax*4]
movzx eax, dl
and ecx, 0xff000000
xor r8d, ecx
movzx ecx, byte [r10 + rax*4]
mov eax, dword [r9 - 0x3c]
xor r8d, ecx
mov ecx, dword [r9 - 0x38]
xor r8d, dword [r9 - 0x40]
xor eax, r8d
mov dword [r9 - 0x20], r8d
mov dword [r9 - 0x1c], eax
xor ecx, eax
mov eax, dword [r9 - 0x34]
xor eax, ecx
mov dword [r9 - 0x18], ecx
mov dword [r9 - 0x14], eax
mov edx, dword [r9 - 0x14]
mov eax, edx
shr rax, 8
movzx ecx, al
mov eax, edx
mov r8d, dword [r10 + rcx*4]
shr rax, 0x10
movzx ecx, al
and r8d, 0xff0000
mov eax, dword [r10 + rcx*4]
and eax, 0xff000000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r10 + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r10 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, dword [r9 - 0x30]
xor r8d, dword [r11 - 4]
mov dword [r9 - 0x10], r8d
mov eax, dword [r9 - 0x2c]
xor eax, r8d
mov dword [r9 - 0xc], eax
mov ecx, dword [r9 - 0x28]
xor ecx, eax
mov dword [r9 - 8], ecx
mov eax, dword [r9 - 0x24]
xor eax, ecx
mov dword [r9 - 4], eax
cmp r11, rbx
jne 0x1400201c0
mov eax, 0xe
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
xor eax, eax
ret