Function at 0x14000e000
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push r12
sub rsp, 0x220
mov rax, qword [0x140096010]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x104
xor r12d, r12d
call sub.VCRUNTIME140.dll_memset
lea ecx, [r12 + 0xc]
mov dword [rsp + 0x40], 0x10
mov qword [rsp + 0x44], 0x20
call fcn.140079860
lea r8d, [r12 + 0xc]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x40]
mov rcx, rax
lea rbx, [rax + 0xc]
mov qword [rsp + 0xa0], rbx
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [0x14009e4b4]
lea r8, [rsp + 0x90]
add rdx, qword [rsi]
mov qword [rsp + 0x98], rbx
call fcn.14000ddb0
test rax, rax
je 0x14000e57f
mov rcx, qword [0x14009e5c8]
test rcx, rcx
je 0x14000e57f
cmp dword [0x14009e5d0], r12d
je 0x14000e57f
mov r9d, 0x104
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0xb0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000e57f
mov qword [rsp + 0x248], rdi
lea rax, [rsp + 0xb0]
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x218], r14
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
mov r8, rdi
vmovups xmmword [rsp + 0x50], xmm0
vmovdqu xmmword [rsp + 0x60], xmm1
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x14000e120
mov qword [rsp + 0x250], r13
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x210], r15
call fcn.14000d930
lea rax, [rsp + 0x50]
mov r14d, 0xf
lea rbx, [rsi + 0x50]
cmp rbx, rax
je 0x14000e1b4
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000e199
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000e194
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000e517
mov rcx, r8
call fcn.140079bbc
vmovups ymm0, ymmword [rsp + 0x50]
lea r15, [rbx + 0x10]
mov rdx, r14
mov qword [r15], r12
vmovups ymmword [rbx], ymm0
mov byte [rsp + 0x50], r12b
jmp 0x14000e1bd
mov rdx, qword [rsp + 0x68]
lea r15, [rbx + 0x10]
cmp rdx, 0x10
jb 0x14000e1f8
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e1f0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e517
vzeroupper
call fcn.140079bbc
mov r10, qword [rbx + 0x18]
mov r12, rbx
mov rsi, qword [r15]
cmp r10, 0x10
jb 0x14000e20b
mov r12, qword [rbx]
cmp rsi, 1
jb 0x14000e258
lea r13, [rsi + r12]
mov r8, rsi
mov edx, 0x5f
mov rcx, r12
vzeroupper
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14000e254
nop dword [rax]
cmp byte [rax], 0x5f
je 0x14000e41a
inc rax
mov r8, r13
sub r8, rax
mov rcx, rax
mov edx, 0x5f
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14000e230
mov r10, qword [rbx + 0x18]
cmp byte [0x1400810f3], 0
vmovsd xmm0, qword [str.aRYIUUcsQQ_A]
mov eax, dword [0x1400810f0]
vmovsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x38], eax
je 0x14000e3da
vmovdqu xmm4, xmmword [0x140089240]
vmovaps xmmword [rsp + 0x200], xmm6
lea r9, [rsp + 0x38]
vmovdqu xmm6, xmmword [0x1400893b0]
vmovaps xmmword [rsp + 0x1f0], xmm7
mov eax, 5
vmovd xmm7, eax
vmovaps xmmword [rsp + 0x1e0], xmm8
mov eax, 0x1f
vpunpckldq xmm0, xmm4, xmm4
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm4, xmm4
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpaddd xmm3, xmm0, xmm4
vpsrad xmm1, xmm3, xmm7
vmovaps xmmword [rsp + 0x1d0], xmm9
lea r8d, [rax - 0x17]
vmovaps xmm9, xmmword [rsp + 0x1d0]
vmovaps xmm8, xmmword [rsp + 0x1e0]
vmovd xmm5, eax
vpsrld xmm0, xmm1, xmm5
vpaddd xmm1, xmm0, xmm1
vpmulld xmm2, xmm1, xmmword [0x140089280]
vmovd xmm0, dword [str.aRYIUUcsQQ_A]
vpsubd xmm3, xmm4, xmm2
vpshufb xmm1, xmm3, xmmword [0x140089200]
vpaddb xmm2, xmm1, xmmword [0x1400892a0]
vmovdqu xmm4, xmmword [0x140089260]
vpxor xmm1, xmm2, xmm0
vmovd dword [rsp + 0x30], xmm1
vpunpckhdq xmm1, xmm4, xmm4
vpmuldq xmm2, xmm1, xmm6
vpunpckldq xmm0, xmm4, xmm4
vpmuldq xmm3, xmm0, xmm6
vmovaps xmm6, xmmword [rsp + 0x200]
vshufps xmm0, xmm3, xmm2, 0xdd
vpaddd xmm3, xmm0, xmm4
vpsrad xmm1, xmm3, xmm7
vmovaps xmm7, xmmword [rsp + 0x1f0]
vpsrld xmm0, xmm1, xmm5
vpaddd xmm1, xmm0, xmm1
vpmulld xmm2, xmm1, xmmword [0x140089280]
vmovd xmm0, dword [rsp + 0x34]
vpsubd xmm3, xmm4, xmm2
vpshufb xmm1, xmm3, xmmword [0x140089200]
vpaddb xmm2, xmm1, xmmword [0x1400892a0]
vpxor xmm1, xmm2, xmm0
vmovd dword [rsp + 0x34], xmm1
nop dword [rax]
nop dword [rax + rax]
mov eax, 0xa0a0a0a1
lea r9, [r9 + 1]
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x36
xor byte [r9 - 1], al
cmp r8d, 0xc
jl 0x14000e3b0
lea rax, [rsp + 0x30]
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000e3e0
cmp rdi, r10
ja 0x14000e52b
cmp r10, 0x10
jb 0x14000e3fb
mov rbx, qword [rbx]
mov qword [r15], rdi
lea rdx, [rsp + 0x30]
mov r8, rdi
mov rcx, rbx
vzeroupper
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x14000e53e
sub rax, r12
cmp rax, rdi
je 0x14000e254
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x60]
test rcx, rcx
je 0x14000e254
sub rcx, rax
inc rax
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
lea r8, [rcx - 1]
vmovups xmmword [rsp + 0x70], xmm0
vmovdqu xmmword [rsp + 0x80], xmm1
cmp rsi, rax
jb 0x14000e583
sub rsi, rax
mov rcx, rbx
cmp rsi, r8
cmovb r8, rsi
cmp qword [rbx + 0x18], 0x10
jb 0x14000e479
mov rcx, qword [rbx]
lea rdx, [rcx + rax]
lea rcx, [rsp + 0x70]
call fcn.14000d930
lea rax, [rsp + 0x70]
cmp rbx, rax
je 0x14000e4df
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000e4c7
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000e4c2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000e517
mov rcx, r8
call fcn.140079bbc
vmovups ymm0, ymmword [rsp + 0x70]
mov qword [r15], 0
vmovups ymmword [rbx], ymm0
mov byte [rsp + 0x70], 0
jmp 0x14000e4e7
mov r14, qword [rsp + 0x88]
cmp r14, 0x10
jb 0x14000e53e
mov rcx, qword [rsp + 0x70]
lea rdx, [r14 + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e521
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e521
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.140079bbc
jmp 0x14000e53e
lea r9, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
vzeroupper
call fcn.14000e7d0
mov r13, qword [rsp + 0x250]
mov al, 1
mov r15, qword [rsp + 0x210]
mov rdi, qword [rsp + 0x248]
mov r14, qword [rsp + 0x218]
vzeroupper
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140079720
add rsp, 0x220
pop r12
pop rsi
pop rbx
ret
xor al, al
jmp 0x14000e560
call fcn.14000e7b0
int3