Function at 0x140002310
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3f8
movaps xmmword [rsp + 0x3d0], xmm6
movaps xmmword [rsp + 0x3e0], xmm7
movdqa xmm0, xmmword [0x140523890]
mov r11d, 0x9c
cmp byte [0x140528ab0], 0
movaps xmmword [rsp + 0x1d0], xmm0
movdqa xmm0, xmmword [0x1405238a0]
mov word [rsp + 0x290], r11w
movaps xmmword [rsp + 0x1e0], xmm0
movdqa xmm0, xmmword [0x1405238b0]
movaps xmmword [rsp + 0x1f0], xmm0
movdqa xmm0, xmmword [0x1405238c0]
movaps xmmword [rsp + 0x200], xmm0
movdqa xmm0, xmmword [0x1405238d0]
movaps xmmword [rsp + 0x210], xmm0
movdqa xmm0, xmmword [0x1405238e0]
movaps xmmword [rsp + 0x220], xmm0
movdqa xmm0, xmmword [0x1405238f0]
movaps xmmword [rsp + 0x230], xmm0
movdqa xmm0, xmmword [0x140523900]
movaps xmmword [rsp + 0x240], xmm0
movdqa xmm0, xmmword [0x140523910]
movaps xmmword [rsp + 0x250], xmm0
movdqa xmm0, xmmword [0x140523920]
movaps xmmword [rsp + 0x260], xmm0
movdqa xmm0, xmmword [0x140523930]
movaps xmmword [rsp + 0x270], xmm0
movdqa xmm0, xmmword [0x140523940]
movaps xmmword [rsp + 0x280], xmm0
jne 0x1400024f7
movdqa xmm2, xmmword [rsp + 0x1d0]
mov r10d, 0x9c
movdqa xmm5, xmmword [rsp + 0x1e0]
lea rcx, [0x1400019a0]
movdqa xmm6, xmmword [rsp + 0x1f0]
mov byte [0x140528b82], 1
movdqa xmm7, xmmword [rsp + 0x200]
movaps xmmword [0x140528ac0], xmm2
movdqa xmm2, xmmword [rsp + 0x210]
movdqa xmm3, xmmword [rsp + 0x260]
movaps xmmword [0x140528ad0], xmm5
movdqa xmm5, xmmword [rsp + 0x220]
movaps xmmword [0x140528ae0], xmm6
movdqa xmm6, xmmword [rsp + 0x230]
movaps xmmword [0x140528af0], xmm7
movdqa xmm7, xmmword [rsp + 0x240]
movaps xmmword [0x140528b00], xmm2
movdqa xmm2, xmmword [rsp + 0x250]
movaps xmmword [0x140528b10], xmm5
movdqa xmm5, xmmword [rsp + 0x270]
movaps xmmword [0x140528b20], xmm6
movdqa xmm6, xmmword [rsp + 0x280]
mov word [0x140528b80], r10w
mov byte [0x140528ab0], 1
movaps xmmword [0x140528b30], xmm7
movaps xmmword [0x140528b40], xmm2
movaps xmmword [0x140528b50], xmm3
movaps xmmword [0x140528b60], xmm5
movaps xmmword [0x140528b70], xmm6
call fcn.140001583
cmp byte [0x140528b82], 0
lea rbx, [0x140528ac0]
je 0x14000254c
movabs r8, 0x4727c9738b41e993
xor edx, edx
nop dword [rax + rax]
mov rcx, rdx
mov rax, r8
and ecx, 7
shl rcx, 3
shr rax, cl
mov rcx, rax
movzx eax, byte [rbx + rdx*2]
ror al, 3
xor eax, ecx
movzx eax, al
mov word [rbx + rdx*2], ax
add rdx, 1
cmp rdx, 0x61
jne 0x140002518
mov byte [0x140528b82], 0
mov r8d, 0x209
mov rcx, rbx
mov word [rsp + 0x52], r8w
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov r9d, 0x49
mov qword [rsp + 0x58], rbx
movdqa xmm0, xmmword [0x140523950]
mov word [rsp + 0x1e8], r9w
add eax, eax
cmp byte [0x140528a80], 0
mov word [rsp + 0x50], ax
mov rax, qword [0x140523960]
movaps xmmword [rsp + 0x1d0], xmm0
mov qword [rsp + 0x1e0], rax
jne 0x1400025dd
movdqa xmm7, xmmword [rsp + 0x1d0]
lea rcx, [0x1400019b0]
movdqu xmm2, xmmword [rsp + 0x1da]
mov byte [0x140528aaa], 1
mov byte [0x140528a80], 1
movaps xmmword [0x140528a90], xmm7
movups xmmword [0x140528a9a], xmm2
call fcn.140001583
cmp byte [0x140528aaa], 0
je 0x140002737
movzx eax, byte [0x140528a90]
movzx r8d, byte [0x140528a94]
mov byte [0x140528aaa], 0
movzx ecx, byte [0x140528a9c]
movzx edx, byte [0x140528a98]
ror al, 3
ror r8b, 3
movzx ebx, byte [0x140528a92]
movzx r11d, byte [0x140528a96]
ror cl, 3
xor eax, 0x51
xor r8d, 0x4d
ror dl, 3
movzx eax, al
movzx r8d, r8b
xor ecx, 0xffffffeb
xor edx, 0x29
movd xmm2, eax
movzx eax, byte [0x140528aa6]
movzx ecx, cl
movzx edx, dl
movd xmm3, r8d
movd xmm1, ecx
movd xmm0, edx
ror bl, 3
movzx r8d, byte [0x140528aa4]
ror al, 3
movzx ecx, byte [0x140528aa2]
ror r11b, 3
xor eax, 0x45
xor ebx, 0xffffff83
xor r11d, 0x45
movzx edx, byte [0x140528aa0]
ror r8b, 3
movzx eax, al
ror cl, 3
movzx ebx, bl
xor r8d, 0x4d
shl rax, 0x10
xor ecx, 0xffffff83
movzx r11d, r11b
movzx r8d, r8b
ror dl, 3
movzx ecx, cl
pinsrw xmm2, ebx, 1
or rax, r8
xor edx, 0x51
movzx r10d, byte [0x140528a9a]
movzx r9d, byte [0x140528a9e]
shl rax, 0x10
movzx edx, dl
pinsrw xmm3, r11d, 1
ror r10b, 3
or rax, rcx
ror r9b, 3
punpckldq xmm2, xmm3
shl rax, 0x10
xor r10d, 0xffffff81
xor r9d, 0x5f
or rax, rdx
movzx r10d, r10b
movzx r9d, r9b
mov qword [0x140528aa0], rax
movzx eax, byte [0x140528aa8]
pinsrw xmm1, r9d, 1
pinsrw xmm0, r10d, 1
punpckldq xmm0, xmm1
movdqa xmm1, xmm2
ror al, 3
punpcklqdq xmm1, xmm0
xor eax, 0x29
movaps xmmword [0x140528a90], xmm1
movzx eax, al
mov word [0x140528aa8], ax
mov ecx, 0x209
lea rbx, [0x140528a90]
lea r12, [rsp + 0x50]
mov word [rsp + 0x62], cx
mov rcx, rbx
lea rbp, [rsp + 0xa0]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
pxor xmm0, xmm0
lea rcx, [rsp + 0x40]
mov r8, rbp
add eax, eax
mov edx, 8
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x60], ax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb8], 0x40
mov qword [rsp + 0xb0], r12
movaps xmmword [rsp + 0xc0], xmm0
call fcn.140004800
test eax, eax
js 0x140002c5f
movdqa xmm7, xmmword [0x140523980]
mov r15, qword [0x1405239a0]
xor ebx, ebx
lea rdi, [rsp + 0x3c]
movdqa xmm6, xmmword [0x140523990]
lea r13, [rsp + 0xd0]
jmp 0x1400027f3
add ebx, 1
mov qword [rsp + 0x28], rdi
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
mov r9, r13
mov dword [rsp + 0x20], 0x100
mov edx, ebx
call fcn.14000480c
cmp eax, 0x8000001a
je 0x140002c55
lea rax, [rsp + 0xe0]
lea rcx, [rsp + 0x48]
mov r8, rbp
mov edx, 1
movd xmm4, dword [rsp + 0xdc]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0xa0], 0x30
pshuflw xmm0, xmm4, 0
movd dword [rsp + 0x50], xmm0
pxor xmm0, xmm0
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xb8], 0x240
movaps xmmword [rsp + 0xc0], xmm0
call fcn.140004800
test eax, eax
js 0x1400027f0
mov qword [rsp + 0x28], rdi
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
lea rsi, [rsp + 0x1d0]
mov dword [rsp + 0x20], 0x200
mov r9, rsi
mov r8d, 1
call fcn.14000481b
test eax, eax
js 0x140002c46
mov eax, dword [rsp + 0x1d8]
add rsi, rax
cmp byte [0x140528a60], 0
jne 0x140002915
mov rax, qword [0x140523968]
mov edx, 0x3d
lea rcx, [0x1400019c0]
mov byte [0x140528a7e], 1
mov dword [0x140528a78], 0x60057
mov qword [0x140528a70], rax
mov word [0x140528a7c], dx
mov byte [0x140528a60], 1
call fcn.140001583
cmp byte [0x140528a7e], 0
je 0x1400029ce
movzx eax, byte [0x140528a76]
movzx r8d, byte [0x140528a74]
mov byte [0x140528a7e], 0
movzx ecx, byte [0x140528a72]
movzx edx, byte [0x140528a70]
ror al, 3
ror r8b, 3
ror cl, 3
xor eax, 0xffffffd3
xor r8d, 0x73
ror dl, 3
movzx eax, al
movzx r8d, r8b
xor ecx, 0xffffff9d
xor edx, 0xffffffb3
shl rax, 0x10
movzx ecx, cl
movzx edx, dl
or rax, r8
shl rax, 0x10
or rax, rcx
shl rax, 0x10
or rax, rdx
mov qword [0x140528a70], rax
movzx eax, byte [0x140528a78]
ror al, 3
xor eax, 0xffffffa3
movzx eax, al
mov word [0x140528a78], ax
movzx eax, byte [0x140528a7a]
ror al, 3
xor eax, 0xffffff81
movzx eax, al
mov word [0x140528a7a], ax
movzx eax, byte [0x140528a7c]
ror al, 3
xor eax, 0xffffffa7
movzx eax, al
mov word [0x140528a7c], ax
mov r8d, 6
lea rdx, [0x140528a70]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp
test eax, eax
je 0x140002c85
cmp byte [0x140528a48], 0
jne 0x140002a1c
mov rax, qword [0x140523970]
lea rcx, [0x1400019d0]
mov byte [0x140528a58], 1
mov byte [0x140528a48], 1
mov qword [0x140528a50], rax
call fcn.140001583
cmp byte [0x140528a58], 0
je 0x140002a8c
movzx eax, byte [0x140528a56]
movzx r8d, byte [0x140528a54]
mov byte [0x140528a58], 0
movzx ecx, byte [0x140528a52]
movzx edx, byte [0x140528a50]
ror al, 3
ror r8b, 3
ror cl, 3
xor eax, 0xffffffad
xor r8d, 0xffffffc3
ror dl, 3
movzx eax, al
movzx r8d, r8b
xor ecx, 0x43
xor edx, 0xffffffbd
shl rax, 0x10
movzx ecx, cl
movzx edx, dl
or rax, r8
shl rax, 0x10
or rax, rcx
shl rax, 0x10
or rax, rdx
mov qword [0x140528a50], rax
mov r8d, 3
lea rdx, [0x140528a50]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp
test eax, eax
je 0x140002c85
cmp byte [0x140528a30], 0
jne 0x140002ada
mov rax, qword [0x140523978]
lea rcx, [0x1400019e0]
mov byte [0x140528a40], 1
mov byte [0x140528a30], 1
mov qword [0x140528a38], rax
call fcn.140001583
cmp byte [0x140528a40], 0
je 0x140002b4a
movzx eax, byte [0x140528a3e]
movzx r8d, byte [0x140528a3c]
mov byte [0x140528a40], 0
movzx ecx, byte [0x140528a3a]
movzx edx, byte [0x140528a38]
ror al, 3
ror r8b, 3
ror cl, 3
xor eax, 0x51
xor r8d, 0xffffffcb
ror dl, 3
movzx eax, al
movzx r8d, r8b
xor ecx, 0xffffff83
xor edx, 0x19
shl rax, 0x10
movzx ecx, cl
movzx edx, dl
or rax, r8
shl rax, 0x10
or rax, rcx
shl rax, 0x10
or rax, rdx
mov qword [0x140528a38], rax
mov r8d, 3
lea rdx, [0x140528a38]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp
test eax, eax
je 0x140002c85
mov eax, 0x4f
movaps xmmword [rsp + 0x70], xmm7
cmp byte [0x1405289e8], 0
lea r14, [0x140528a00]
mov qword [rsp + 0x90], r15
mov dword [rsp + 0x98], 0xa300b1
mov word [rsp + 0x9c], ax
movaps xmmword [rsp + 0x80], xmm6
jne 0x140002beb
movdqa xmm5, xmmword [rsp + 0x70]
lea rcx, [0x1400019f0]
movdqa xmm3, xmmword [rsp + 0x80]
mov byte [0x140528a2e], 1
movdqu xmm1, xmmword [rsp + 0x8e]
mov byte [0x1405289e8], 1
movaps xmmword [0x140528a10], xmm3
movaps xmmword [0x140528a00], xmm5
movups xmmword [0x140528a1e], xmm1
call fcn.140001583
cmp byte [0x140528a2e], 0
je 0x140002c36
movabs r8, 0xf1e90753b583fb01
xor edx, edx
mov rcx, rdx
mov rax, r8
and ecx, 7
shl rcx, 3
shr rax, cl
mov rcx, rax
movzx eax, byte [r14 + rdx*2]
ror al, 3
xor eax, ecx
movzx eax, al
mov word [r14 + rdx*2], ax
add rdx, 1
cmp rdx, 0x17
jne 0x140002c00
mov byte [0x140528a2e], 0
mov rdx, r14
mov rcx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x140002c85
mov rcx, qword [rsp + 0x48]
call fcn.1400046ef
jmp 0x1400027f0
mov rcx, qword [rsp + 0x40]
call fcn.1400046ef
xor eax, eax
movaps xmm6, xmmword [rsp + 0x3d0]
movaps xmm7, xmmword [rsp + 0x3e0]
add rsp, 0x3f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
call fcn.1400046ef
mov rcx, qword [rsp + 0x40]
call fcn.1400046ef
mov eax, 1
jmp 0x140002c61