Function at 0x140001e00
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov rdi, rcx
mov ecx, 0x15d200
mov rbp, rdx
call fcn.140043f30
mov r8d, 0x15d200
lea rdx, [0x140046090]
lea rsi, [rsp + 0xb0]
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_memcpy
mov r10d, 0x326c
mov qword [rsp + 0xa0], rsi
xor ecx, ecx
movabs rax, 0x677a6a6635626c4f
mov byte [rsp + 0xba], 0
movabs r8, 0xcccccccccccccccd
mov qword [rsp + 0xb0], rax
mov word [rsp + 0xb8], r10w
mov qword [rsp + 0xa8], 0xa
nop dword [rax]
mov rax, rcx
mul r8
shr rdx, 3
lea rax, [rdx + rdx*4]
mov rdx, rcx
add rax, rax
sub rdx, rax
movzx eax, byte [rsp + rdx + 0xb0]
xor byte [rbx + rcx], al
add rcx, 1
cmp rcx, 0x15d200
jne 0x140001e90
mov r14, qword [rbp]
mov rbp, qword [rbp + 8]
mov qword [rsp + 0xa0], rsi
lea r13, [rsp + 0xa0]
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x80], rbp
lea r15, [r14 + rbp]
cmp rbp, 7
ja 0x140001f30
mov r9, rbp
mov rdx, rsi
lea r12, [rsp + 0x80]
cmp r14, r15
je 0x140002398
xor eax, eax
nop
movsx cx, byte [r14 + rax]
mov word [rdx + rax*2], cx
add rax, 1
cmp rbp, rax
jne 0x140001f10
jmp 0x1400020ab
lea r12, [rsp + 0x80]
xor r8d, r8d
mov rcx, r13
mov rdx, r12
call fcn.140040230
mov r9, qword [rsp + 0x80]
mov qword [rsp + 0xa0], rax
mov rdx, rax
mov qword [rsp + 0xb0], r9
cmp r14, r15
je 0x1400020ab
lea rax, [rax + rbp*2]
lea rcx, [rbp - 1]
cmp r14, rax
jae 0x140001f7c
cmp rdx, r15
jb 0x140001f0c
cmp rcx, 0xe
jbe 0x140002413
mov r8, rbp
mov rcx, rbp
pxor xmm3, xmm3
xor eax, eax
shr r8, 4
and rcx, 0xfffffffffffffff0
nop word [rax + rax]
movdqu xmm0, xmmword [r14 + rax]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
punpckhbw xmm0, xmm1
movups xmmword [rdx + rax*2], xmm2
movups xmmword [rdx + rax*2 + 0x10], xmm0
add rax, 0x10
cmp rcx, rax
jne 0x140001fa0
mov rax, r8
lea r8, [r14 + rcx]
shl rax, 5
add rax, rdx
cmp rbp, rcx
je 0x1400020ab
sub rbp, rcx
lea r10, [rbp - 1]
cmp r10, 6
jbe 0x140002031
movq xmm0, qword [r14 + rcx]
pxor xmm1, xmm1
lea r10, [rdx + rcx*2]
mov rcx, rbp
and rcx, 0xfffffffffffffff8
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
lea rax, [rax + rcx*2]
add r8, rcx
and ebp, 7
punpcklbw xmm0, xmm1
punpcklbw xmm2, xmm1
pshufd xmm0, xmm0, 0x4e
movq qword [r10], xmm2
movq qword [r10 + 8], xmm0
je 0x1400020ab
movsx cx, byte [r8]
mov word [rax], cx
lea rcx, [r8 + 1]
cmp r15, rcx
je 0x1400020ab
movsx cx, byte [r8 + 1]
mov word [rax + 2], cx
lea rcx, [r8 + 2]
cmp r15, rcx
je 0x1400020ab
movsx cx, byte [r8 + 2]
mov word [rax + 4], cx
lea rcx, [r8 + 3]
cmp r15, rcx
je 0x1400020ab
movsx cx, byte [r8 + 3]
mov word [rax + 6], cx
lea rcx, [r8 + 4]
cmp r15, rcx
je 0x1400020ab
movsx cx, byte [r8 + 4]
mov word [rax + 8], cx
lea rcx, [r8 + 5]
cmp r15, rcx
je 0x1400020ab
movsx cx, byte [r8 + 5]
mov word [rax + 0xa], cx
lea rcx, [r8 + 6]
cmp r15, rcx
je 0x1400020ab
movsx cx, byte [r8 + 6]
mov word [rax + 0xc], cx
xor ecx, ecx
mov qword [rsp + 0xa8], r9
lea r14, [0x140046070]
mov word [rdx + r9*2], cx
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov r8, qword [rdi + 8]
mov r15, qword [rdi]
xor r9d, r9d
lea rdi, [rsp + 0x90]
mov rcx, r12
mov rbp, rax
mov qword [rsp + 0x88], 0
lea rdx, [rax + r8]
mov qword [rsp + 0x80], rdi
mov word [rsp + 0x90], r9w
mov qword [rsp + 0x58], r8
call fcn.14003fec0
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsp + 0x58]
sub rax, qword [rsp + 0x88]
cmp rax, r8
jb 0x140002464
mov rdx, r15
mov rcx, r12
call fcn.140040070
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0x88]
cmp rax, rbp
jb 0x140002470
mov r8, rbp
mov rdx, r14
mov rcx, r12
call fcn.140040070
mov rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
lea rax, [rdx + r8]
cmp r9, rdi
je 0x1400023a0
cmp qword [rsp + 0x90], rax
jae 0x1400021b1
cmp rcx, rsi
je 0x140002408
mov r10, qword [rsp + 0xb0]
cmp r10, rax
jae 0x140002330
movabs rax, 0x1fffffffffffffff
sub rax, rdx
cmp rax, r8
jb 0x14000247c
mov rdx, rcx
mov rcx, r12
call fcn.140040070
lea rbp, [rsp + 0x70]
lea rcx, [rax + 0x10]
mov qword [rsp + 0x60], rbp
mov rdx, qword [rax]
cmp rdx, rcx
je 0x1400023c0
mov qword [rsp + 0x60], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x70], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x68], rdx
xor edx, edx
mov qword [rax], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 8], 0
mov word [rax + 0x10], dx
cmp rcx, rdi
je 0x140002233
mov rax, qword [rsp + 0x90]
lea rdx, [rax + rax + 2]
call fcn.140043f20
mov rcx, qword [rsp + 0xa0]
cmp rcx, rsi
je 0x140002252
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + rax + 2]
call fcn.140043f20
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002310
mov dword [rsp + 0x30], 0x15d200
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], 0
mov rcx, rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
call fcn.140001d60
mov rcx, rsi
test eax, eax
js 0x140002320
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x1400022ed
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.140043f20
mov edx, 0x15d200
mov rcx, rbx
call fcn.140043f20
mov eax, esi
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x60]
xor esi, esi
cmp rcx, rbp
jne 0x1400022de
jmp 0x1400022ed
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x1400022d4
mov qword [rsp + 0x20], rdx
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.14003b1b0
lea rbp, [rsp + 0x70]
lea rcx, [rax + 0x10]
mov qword [rsp + 0x60], rbp
mov rdx, qword [rax]
cmp rdx, rcx
jne 0x1400021ec
mov rdx, qword [rax + 8]
mov r9, rbp
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jb 0x1400023d5
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rbp + r9], r11
cmp edx, r10d
jb 0x14000237a
lea r9, [rbp + rdx]
add rdx, rcx
jmp 0x1400023d5
xor r9d, r9d
jmp 0x1400020ab
cmp rax, 7
jbe 0x1400021b1
cmp rcx, rsi
jne 0x1400021a0
jmp 0x1400021c7
mov rdx, qword [rax + 8]
mov r9, rbp
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jae 0x140002420
xor r10d, r10d
test r8b, 4
je 0x1400023ea
mov r10d, dword [rdx]
mov dword [r9], r10d
mov r10d, 4
and r8d, 2
je 0x1400021fa
movzx edx, word [rdx + r10]
mov word [r9 + r10], dx
jmp 0x1400021fa
mov r10d, 7
jmp 0x1400021a8
mov rax, rdx
mov r8, r14
xor ecx, ecx
jmp 0x140001ff0
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rbp + r9], r11
cmp edx, r10d
jb 0x140002429
jmp 0x14000238e
mov rcx, rbx
mov edx, 0x15d200
call fcn.140043f20
mov rcx, rsi
call fcn.14001a0a0
lea rcx, [0x140046074]
call fcn.140044810
lea rcx, [0x140046074]
call fcn.140044810
lea rcx, [0x140046074]
call fcn.140044810
mov rcx, r12
mov rsi, rax
call fcn.14003b190
mov rcx, r13
call fcn.14003b190
jmp 0x14000244f