Function at 0x140079b04
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xd5b0
call fcn.1400f6fb0
sub rsp, rax
mov rdi, rcx
lea rcx, [rsp + 0xd5f8]
call fcn.140052130
mov rax, qword [rsp + 0xd5f8]
xor r12d, r12d
cmp word [rax], r12w
jne 0x140079b53
xor eax, eax
jmp 0x14007a828
lea rdx, [0x1400f9548]
lea rcx, [rsp + 0x50]
call fcn.140064d14
lea rdx, [0x1400f9548]
lea rcx, [rsp + 0x58]
call fcn.140064d14
mov r11, qword [rsp + 0xd5f8]
mov r13d, 0x20
lea ebp, [r13 - 0x1e]
mov byte [rsp + 0x44], r12b
mov r15b, r13b
mov byte [rsp + 0xd608], r12b
mov byte [rsp + 0x46], r12b
mov dword [rsp + 0x40], 0xff000000
lea esi, [rbp - 1]
lea r14d, [r13 - 0x1c]
cmp word [r11], r12w
je 0x140079e6c
lea ebx, [rbp + 7]
lea rdx, [rsp + 0xd5f8]
lea rcx, [0x1400fd0c8]
mov r8d, ebp
call fcn.14005c928
cmp al, r12b
je 0x140079bde
mov byte [rsp + 0x44], sil
jmp 0x140079e5a
lea rdx, [rsp + 0xd5f8]
lea rcx, [0x1400fcd7c]
mov r8d, ebp
call fcn.14005c928
cmp al, r12b
je 0x140079c02
mov r15b, bpl
jmp 0x140079e5a
lea rdx, [rsp + 0xd5f8]
lea rcx, [0x140103754]
mov r8d, r14d
call fcn.14005c928
cmp al, r12b
je 0x140079c26
mov r15b, pe_nt_image_headers64
jmp 0x140079e5a
lea rdx, [rsp + 0xd5f8]
lea rcx, [0x140103750]
mov r8d, ebp
call fcn.14005c928
cmp al, r12b
je 0x140079c4a
mov r15b, sil
jmp 0x140079e5a
lea rdx, [rsp + 0xd5f8]
lea rcx, [0x1400ff424]
mov r8d, ebp
call fcn.14005c928
mov r11, qword [rsp + 0xd5f8]
cmp al, r12b
je 0x140079c76
mov r15b, 0x10
jmp 0x140079e62
lea rcx, [0x14010374c]
mov r8d, 3
mov rdx, r11
call fcn.140053674
cmp al, r12b
je 0x140079cfe
lea rcx, [rsp + 0xd5f8]
add r11, 6
mov r15b, 0x10
mov qword [rsp + 0xd5f8], r11
call fcn.140052130
mov r11, qword [rsp + 0xd5f8]
cmp word [r11], r12w
je 0x140079e6c
mov word [r11], r12w
mov r11, qword [rsp + 0xd5f8]
add r11, rbp
mov qword [rsp + 0xd5f8], r11
movzx eax, word [r11]
cmp ax, r12w
je 0x140079e6c
cmp bx, ax
ja 0x140079cf2
cmp ax, 0xd
jbe 0x140079e62
cmp r13w, ax
je 0x140079e62
jmp 0x140079cca
lea rdx, [rsp + 0xd5f8]
lea rcx, [0x140103744]
mov r8d, r14d
call fcn.14005c928
cmp al, r12b
je 0x140079d2f
add qword [rsp + 0xd5f8], r14
mov byte [rsp + 0xd608], sil
jmp 0x140079e4d
mov r11, qword [rsp + 0xd5f8]
lea rcx, [0x14010373c]
mov r8d, r14d
mov rdx, r11
call fcn.140053674
cmp al, r12b
je 0x140079db8
add r11, 8
mov qword [rsp + 0xd5f8], r11
cmp bx, word [r11]
ja 0x140079d67
cmp word [r11], 0xd
jbe 0x140079d6d
cmp r13w, word [r11]
jne 0x140079d7a
mov dword [rsp + 0x40], 5
jmp 0x140079e62
mov eax, 0x3a
cmp ax, word [r11]
jne 0x140079e62
add r11, rbp
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xd5f8]
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0xd5f8], r11
call fcn.140068da0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x40], eax
jmp 0x140079e5a
lea rdx, [rsp + 0xd5f8]
lea rcx, [0x140103734]
mov r8d, 5
call fcn.14005c928
cmp al, r12b
je 0x140079dde
mov byte [rsp + 0x46], sil
jmp 0x140079e5a
lea rdx, [rsp + 0xd5f8]
lea rcx, [0x1400fa0bc]
mov r8d, ebp
call fcn.14005c928
mov r11, qword [rsp + 0xd5f8]
cmp al, r12b
jne 0x140079e6c
lea rcx, [0x1400fa940]
mov r8d, esi
mov rdx, r11
call fcn.140053618
cmp al, r12b
jne 0x140079e6c
movzx eax, word [r11]
mov ecx, 0x2d
cmp cx, ax
jne 0x140079e6c
cmp bx, ax
ja 0x140079e32
cmp ax, 0xd
jbe 0x140079e4d
cmp r13w, ax
je 0x140079e4d
add r11, rbp
mov qword [rsp + 0xd5f8], r11
mov ax, word [r11]
cmp ax, r12w
jne 0x140079e27
lea rcx, [rsp + 0xd5f8]
call fcn.140052130
mov r11, qword [rsp + 0xd5f8]
cmp word [r11], r12w
jne 0x140079bb8
mov eax, 0x22
mov qword [rsp + 0x120], r11
lea ebx, [rax + 0xa]
cmp ax, word [r11]
jne 0x140079ec8
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xd5f8]
mov r9d, ebx
mov rcx, rdi
mov word [rsp + 0x20], r12w
call fcn.14004ba2c
mov r13, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xd5f8]
mov r9d, ebx
mov rcx, rdi
mov word [rsp + 0x20], r12w
call fcn.14004ba2c
jmp 0x140079f7f
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xd5f8]
mov r8d, ebx
call fcn.14005dc90
mov rax, qword [rsp + 0xd5f8]
mov r13, qword [rsp + 0x50]
cmp word [rax], bx
jne 0x140079f1e
add rax, rbp
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xd5f8]
mov r8d, ebx
mov qword [rsp + 0xd5f8], rax
call fcn.14005dc90
mov rcx, qword [rsp + 0x58]
call fcn.140019d38
mov rbp, rax
jmp 0x140079f84
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x120]
mov r8d, esi
mov qword [rsp + 0x68], r12
call fcn.1400256a8
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x120]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x60], rax
call fcn.14005a3b8
mov r13, qword [rsp + 0x50]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
xor r8d, r8d
call fcn.1400256a8
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.14005a3b8
mov rbp, qword [rsp + 0x58]
mov qword [rsp + 0x70], rbp
cmp word [rbp], r12w
je 0x14007a80d
cmp word [r13], r12w
je 0x14007a80d
lea rcx, [0x140103730]
mov rdx, r13
call qword [sym.imp.KERNEL32.DLL_lstrcmpW]
cmp eax, r12d
sete byte [rsp + 0x45]
mov edx, r12d
cmp r15b, 2
je 0x14007a021
xor ecx, ecx
call fcn.1400e2330
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
add edi, eax
call fcn.140054c4c
mov ecx, dword [0x140118f48]
add edi, eax
mov edx, ecx
shl edx, 4
add edx, edi
xor ecx, edx
mov eax, edx
mov dword [rsp + 0x48], edx
and eax, 3
mov dword [0x140118f48], ecx
cmp al, 3
jne 0x140079fc0
mov al, byte [rsp + 0x49]
test al, 0xf0
je 0x140079fc0
test al, 0xf
je 0x140079fc0
mov al, byte [rsp + 0x4a]
test al, 0xf0
je 0x140079fc0
test al, 0xf
je 0x140079fc0
mov al, byte [rsp + 0x4b]
test al, 0xf
je 0x140079fc0
and al, 0x88
cmp al, 0x80
jne 0x140079fc0
cmp r15b, 0x10
je 0x14007a59a
mov ebx, edx
and ebx, 0xfffffff
cmp edx, r12d
je 0x14007a03e
xor edx, 0x5aa59669
mov dword [rsp + 0x48], edx
mov ax, r12w
cmp r15b, 0x20
jne 0x14007a051
mov eax, 0x14
cmp r15b, 0x40
jne 0x14007a05c
mov eax, 0x18
xor dx, ax
mov word [rsp + 0x48], dx
cmp ax, r12w
je 0x14007a074
cmp dx, r12w
je 0x140079fb7
lea rdi, [0x140102650]
lea rcx, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x78], rdi
call fcn.14005e994
lea rcx, [rsp + 0xb8]
xor edx, edx
mov dword [rsp + 0xa8], r12d
mov qword [rsp + 0xb0], rdi
call fcn.14005e994
mov eax, 0x26
mov ebp, r12d
cmp ax, word [r13]
mov dword [rsp + 0xe0], ebx
lea r12d, [rax - 0x1f]
sete r14b
xor edi, edi
cmp r14b, dil
je 0x14007a155
mov rcx, qword [rsp + 0xd5f0]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rdi
call fcn.140016e9c
mov r13, rax
cmp rax, rdi
je 0x14007a2f2
mov rbp, qword [rax + 0x18]
lea rcx, [rsp + 0x88]
shr rbp, 1
lea eax, [rbp + 0xc]
lea ebx, [rbp + rbp]
movsxd rdx, eax
call fcn.14005a250
mov rdi, qword [rsp + 0x88]
mov rdx, qword [r13 + 8]
movsxd rbx, ebx
mov rcx, rdi
mov r8, rbx
call fcn.14001b7a8
lea rcx, [rbx + rdi]
lea r8d, [r12 + 3]
xor edx, edx
call fcn.1400dd9e0
movsxd r11, ebp
add r11, r11
mov qword [rsp + 0x98], r11
jmp 0x14007a16b
cmp byte [rsp + 0x45], dil
je 0x14007a170
mov rax, qword [0x1401152d0]
mov qword [rsp + 0x80], rax
xor r13d, r13d
jmp 0x14007a1df
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0x80]
mov r9d, r12d
mov r8d, esi
mov rdx, r13
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
call fcn.1400037e4
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov r8, qword [rsp + 0x80]
lea rdx, [0x1401036f8]
lea rcx, [0x140117fa0]
xor r13d, r13d
mov r9, rax
mov dword [rsp + 0x20], r13d
call fcn.1400172b0
cmp qword [rsp + 0x80], r13
je 0x14007a2f9
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0xb8]
mov r9d, r12d
mov r8d, 0x40000001
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], r13
call fcn.1400037e4
cmp qword [rsp + 0xb8], r13
je 0x14007a2f9
lea rcx, [rsp + 0x160]
xor r8d, r8d
xor edx, edx
mov byte [rsp + 0xd8], sil
call fcn.140052c4c
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0xd5a0], rax
mov al, 0x53
mov qword [rsp + 0xd598], rcx
cmp r15b, 0x20
jne 0x14007a266
mov dil, 0x61
jmp 0x14007a275
movzx edi, al
cmp r15b, 0x40
mov eax, 0x4d
cmove edi, eax
lea rcx, [rsp + 0x60]
call fcn.14005a150
mov ebx, dword [rsp + 0x40]
cmp ebx, r13d
jge 0x14007a292
cmp dil, 0x53
je 0x14007a38d
cmp byte [rsp + 0xd608], r13b
jne 0x14007a38d
cmp r14b, r13b
jne 0x14007a2e3
movsx r8d, byte [rsp + 0x46]
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x88]
call fcn.14005eb48
mov rcx, qword [rsp + 0x80]
mov ebp, eax
cmp rcx, r13
je 0x14007a2db
cmp rcx, 0xffffffffffffffff
je 0x14007a2db
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp + 0x80], r13
cmp ebp, r13d
jg 0x14007a327
lea rcx, [rsp + 0x60]
call fcn.140052160
mov rsi, 0xffffffff80070057
lea rbx, [0x140102650]
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0xb0], rbx
call fcn.14005e9f0
mov qword [rsp + 0x78], rbx
lea rcx, [rsp + 0x80]
jmp 0x14007a714
cmp r14b, r13b
jne 0x14007a35b
cmp ebp, esi
jle 0x14007a35b
mov rcx, qword [rsp + 0x88]
lea rdx, [rcx + 2]
cmp word [rdx], 0x7f
ja 0x14007a363
cmp r15b, 0x20
je 0x14007a34e
cmp r15b, 0x40
jne 0x14007a363
movsxd r8, ebp
add r8, r8
call fcn.14001b760
dec ebp
mov rcx, qword [rsp + 0x88]
cmp ebx, r13d
mov eax, 5
cmovl ebx, eax
cmp r14b, r13b
jne 0x14007a37f
mov r8d, ebx
mov edx, ebp
call fcn.140069610
mov ebp, eax
movsxd rax, ebp
add rax, rax
mov qword [rsp + 0x98], rax
lea rbx, [0x140101240]
mov al, byte [rbx]
add dword [rsp + 0xe4], esi
lea rdx, [rsp + 0xd608]
lea rcx, [rsp + 0xb8]
mov r8d, esi
mov byte [rsp + 0xd608], al
call fcn.140055cbc
add rbx, rsi
sub r12, rsi
jne 0x14007a394
add dword [rsp + 0xe4], esi
lea rdx, [rsp + 0xd608]
lea rcx, [rsp + 0xb8]
mov r8d, esi
mov byte [rsp + 0xd608], dil
call fcn.140055cbc
lea ebp, [r12 + 4]
lea rbx, [rsp + 0x48]
lea ecx, [rbp + 4]
mov rdi, rbp
mov al, byte [rbx]
add ecx, esi
lea rdx, [rsp + 0xd608]
mov dword [rsp + 0xe4], ecx
lea rcx, [rsp + 0xb8]
mov r8d, esi
mov byte [rsp + 0xd608], al
call fcn.140055cbc
add rbx, rsi
sub rdi, rsi
je 0x14007a436
mov ecx, dword [rsp + 0xe4]
jmp 0x14007a3fb
mov dword [rsp + 0xe4], 0xc
mov byte [rsp + 0x115a], r13b
mov byte [rsp + 0x115b], r13b
mov byte [rsp + 0x115c], r13b
mov byte [rsp + 0x115d], r13b
movzx edi, r13w
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0xd608]
lea rcx, [rsp + 0x80]
mov r8d, esi
mov byte [rsp + 0xd608], r13b
mov dword [rsp + 0x40], r13d
call fcn.140055d14
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp ebx, r13d
je 0x14007a4ac
cmp dword [rsp + 0x40], esi
jb 0x14007a4ac
movzx ecx, byte [rsp + 0xd608]
jmp 0x14007a4af
or ecx, 0xffffffff
cmp ecx, 0xffffffff
je 0x14007a4cf
movsx rax, di
add di, si
mov byte [rsp + rax + 0x115a], cl
add byte [rsp + 0x117d], sil
cmp di, bp
jl 0x14007a465
mov dil, byte [rsp + 0x44]
lea rbx, [rsp + 0x115a]
cmp dil, r13b
je 0x14007a4ec
mov al, byte [rbx]
mov byte [rsp + 0xd608], al
jmp 0x14007a4f4
mov byte [rsp + 0xd608], r13b
add dword [rsp + 0xe4], esi
lea rdx, [rsp + 0xd608]
lea rcx, [rsp + 0xb8]
mov r8d, esi
call fcn.140055cbc
add rbx, rsi
sub rbp, rsi
jne 0x14007a4dc
xor ecx, ecx
mov dword [rsp + 0xe4], 0x10
call qword [sym.imp.KERNEL32.DLL_SetLastError]
lea rcx, [rsp + 0x160]
call fcn.140052f40
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov r11, qword [rsp + 0x80]
cmp byte [rsp + 0x45], r13b
cmovne r11, r13
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x80], r11
call fcn.140052160
lea rbx, [0x140102650]
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0xb0], rbx
call fcn.14005e9f0
mov qword [rsp + 0x78], rbx
lea rcx, [rsp + 0x80]
jmp 0x14007a7ef
lea r15, [0x140102670]
lea rcx, [rsp + 0xf0]
xor edx, edx
mov qword [rsp + 0xe8], r15
mov dword [rsp + 0x48], r12d
call fcn.14005e994
lea rcx, [rsp + 0x130]
xor edx, edx
mov dword [rsp + 0x118], r12d
mov qword [rsp + 0x128], r15
call fcn.14005e994
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], 0x80
mov dword [rsp + 0x158], r12d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r12
mov r12d, 7
lea rcx, [rsp + 0xf0]
mov r8d, esi
mov rdx, r13
mov r9d, r12d
call fcn.1400037e4
xor edi, edi
cmp qword [rsp + 0xf0], rdi
je 0x14007a6ef
lea ebx, [rdi + 8]
add dword [rsp + 0x11c], esi
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0xd608]
lea rcx, [rsp + 0xf0]
mov r8d, esi
call fcn.140055d14
sub rbx, rsi
jne 0x14007a62d
mov rbx, rdi
add dword [rsp + 0x11c], esi
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0xd608]
lea rcx, [rsp + 0xf0]
mov r8d, esi
mov byte [rsp + 0xd608], dil
mov dword [rsp + 0x40], edi
call fcn.140055d14
cmp eax, edi
je 0x14007a69d
cmp dword [rsp + 0x40], esi
jb 0x14007a69d
movzx eax, byte [rsp + 0xd608]
jmp 0x14007a6a0
or eax, 0xffffffff
mov byte [rsp + rbx + 0x48], al
add rbx, rsi
cmp rbx, r14
jl 0x14007a659
lea rcx, [rsp + 0x130]
cmp dword [rsp + 0x48], edi
jne 0x14007a6f7
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x80
mov r9d, r12d
mov r8d, 0x40000001
mov rdx, rbp
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rdi
call fcn.1400037e4
cmp qword [rsp + 0x130], rdi
jne 0x14007a735
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x128], r15
call fcn.14005e9f0
mov qword [rsp + 0xe8], r15
lea rcx, [rsp + 0xf0]
call fcn.14005e9f0
lea rcx, [rsp + 0x58]
call fcn.140052160
lea rcx, [rsp + 0x50]
call fcn.140052160
mov rax, rsi
jmp 0x14007a828
lea rcx, [rsp + 0x160]
xor r8d, r8d
xor edx, edx
mov byte [rsp + 0x150], sil
call fcn.140052c4c
lea rax, [rsp + 0x128]
mov qword [rsp + 0xd5a0], rax
mov eax, dword [rsp + 0x118]
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0xd598], rcx
cmp eax, edi
je 0x14007a786
xor eax, 0x5aa59669
mov dword [rsp + 0x118], eax
add dword [rsp + 0x11c], esi
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0xd608]
lea rcx, [rsp + 0xf0]
mov r8d, esi
call fcn.140055d14
sub r14, rsi
jne 0x14007a786
lea rcx, [rsp + 0x160]
call fcn.140053214
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x128], r15
call fcn.14005e9f0
mov qword [rsp + 0xe8], r15
lea rcx, [rsp + 0xf0]
call fcn.14005e9f0
lea rcx, [rsp + 0x58]
call fcn.140052160
lea rcx, [rsp + 0x50]
call fcn.140052160
jmp 0x140079b4c
lea rcx, [rsp + 0x58]
call fcn.140052160
lea rcx, [rsp + 0x50]
call fcn.140052160
mov rax, 0xffffffff80070057
mov rbx, qword [rsp + 0xd600]
add rsp, 0xd5b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret