Function at 0x1800226d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov r14d, dword [rsp + 0xf8]
xor ebp, ebp
mov r10d, dword [rsp + 0xf8]
mov r13, rcx
mov rsi, qword [rsp + 0xf0]
mov rbx, r9
mov ecx, dword [rsp + 0xf8]
mov r15, r8
lea eax, [r14 + 0x7bc]
mov dword [rsp + 0x40], r10d
cmp r14d, eax
mov edi, r14d
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
jae 0x180022a8d
mov eax, dword [rsp + 0xf8]
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x58]
mov dword [rsp + 0x44], ecx
mov ecx, edi
mov dword [rsp + 0x68], eax
nop dword [rax + rax]
cmp edi, 0x10c
ja 0x1800228b3
je 0x180022896
mov eax, edi
sub eax, 0x15
je 0x18002286e
sub eax, 0x31
je 0x180022849
sub eax, 0x78
je 0x180022837
sub eax, 0x1d
je 0x1800227e3
cmp eax, 0x1c
jne 0x180022988
test rsi, rsi
je 0x1800227cd
mov rax, qword [r13 + 8]
test rax, rax
je 0x1800227cd
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 1]
call rax
mov r10d, dword [rsp + 0x40]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x48], ebp
jmp 0x180022981
mov dword [rsp + 0x68], 0xffffffff
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x48], ebp
jmp 0x180022981
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x80]
movsxd rax, dword [rsi + 0x64]
mov r10, qword [rsi + 0x10]
mov r8, qword [rsi + 0x50]
lea rdx, [rax + rax*2]
mov rdx, qword [rcx + rdx*8 - 0x18]
mov rcx, qword [rcx]
call qword [r10 + ILFree]
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x18002297c
mov rcx, qword [rsp + 0x80]
lea rax, str.Unsupported_event_type
test rcx, rcx
cmovne rax, rcx
jmp 0x180022bb0
mov eax, dword [rbx]
mov r10d, ebp
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x40], ebp
jmp 0x180022988
mov rax, qword [rsi]
mov r14, qword [rbx]
add r14, 0x28
lea r12, [rax + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x58], rax
cmp r14, r12
je case.0x180022a02.5
jmp 0x180022988
mov rax, qword [rsi + 0x10]
cmp dword [rax + 0x90], 0
je 0x180022a81
cmp dword [rsi + 0x64], 1
jl 0x180022a75
mov qword [rsp + 0x80], rbp
jmp 0x180022988
mov rax, qword [rsp + 0x58]
mov rdx, r14
mov rcx, r12
lea r8, [rax*4]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002297c
mov eax, edi
sub eax, 0x184
je 0x180022a21
sub eax, 0x39
je 0x180022a0c
sub eax, 0xc6
je 0x180022a04
cmp eax, 0xc6
jne 0x180022988
movups xmm0, xmmword [r13]
lea rbp, [rbx + 0x20]
xor r9d, r9d
xor edx, edx
lea r8d, [rax + 0x21]
movups xmmword [rbx + 0x328], xmm0
mov rcx, rbp
movups xmm1, xmmword [r13 + 0x10]
movups xmmword [rbx + 0x338], xmm1
call fcn.18008fc20
test r15, r15
je 0x18002297a
mov rax, qword [rsp + 0xd8]
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov ecx, 0x11a
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
call fcn.1800821d0
mov rcx, qword [rsp + 0xd8]
mov rdx, r15
movsxd r8, dword [rcx]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0xd8]
mov r8, rbp
mov edx, 0xf9
mov eax, dword [rcx]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
call fcn.180079510
xor ebp, ebp
mov r10d, dword [rsp + 0x40]
mov ecx, dword [rsp + 0xf8]
add edi, 0xc6
lea eax, [rcx + 0x7bc]
cmp edi, eax
jb 0x180022760
mov ecx, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x44]
mov r14d, dword [rsp + 0xf8]
lea r13d, [r14 + 0xb]
cmp r14d, r13d
jae case.0x180022a02.5
mov r15d, dword [rsp + 0xf8]
lea r12d, [r14 - 0x15]
mov rdi, qword [rsp + 0x58]
mov ebp, dword [rsp + 0xf8]
movsxd rdx, ecx
mov qword [rsp + 0x68], rdx
lea r8, [0x180000000]
cmp r12d, 0xe3
ja case.0x180022a02.10
movzx eax, byte [r8 + r12 + 0x22f38]
mov ecx, dword [r8 + rax*4 + 0x22f0c]
add rcx, r8
jmp rcx
mov qword [rbx], rsi
jmp 0x180022988
xor edx, edx
mov r8d, 0x348
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
jmp 0x18002297c
movsxd rcx, dword [rbx]
mov dword [rsp + 0x44], ecx
test byte [rsi + rcx*4], 2
jne 0x180022a62
nop
movsxd rax, dword [rbx]
mov r13d, dword [rsi + rax*4]
mov eax, r13d
sar r13d, 2
and eax, 1
xor r10d, eax
mov dword [rbx], r13d
movsxd rax, r13d
mov dword [rsp + 0x44], r13d
test byte [rsi + rax*4], 2
je 0x180022a30
mov r13, qword [rsp + 0xd0]
mov dword [rsp + 0x40], r10d
test r15, r15
je 0x180022a6a
mov dword [r15], r10d
mov eax, dword [rsp + 0x60]
mov dword [rbx], eax
jmp 0x180022981
lea rax, str.int_ChoosePixelFormat__
jmp 0x180022bb0
lea rax, str.immediate_must_be_an_integer_in_range__1__32_.
jmp 0x180022bb0
mov r9d, dword [rsp + 0xf8]
mov dword [rsp + 0x44], r9d
jmp 0x1800229ad
mov eax, dword [rbx]
mov dword [rsp + 0x50], eax
jmp case.0x180022a02.10
mov rcx, qword [rsi + 0x88]
test rcx, rcx
je 0x180022adb
movsxd rax, dword [rsi + 0x64]
mov r9, qword [rsi + 0x68]
mov r10, qword [rsi + 0x10]
lea r8, [rax + rax*2]
mov r8, qword [r9 + r8*8 - 0x18]
lea rdx, [rax + rax*2]
mov rdx, qword [r9 + rdx*8 - 0x30]
call qword [r10 + 0xd8]
mov rdx, qword [rsi + 0x10]
mov dword [rsi + 0xa8], 1
test dword [rdx + 0x168], 0x200
je 0x180022b5f
movsxd rax, dword [rsi + 0x64]
mov rcx, qword [rsi + 0x68]
sub rax, 2
lea rax, [rax + rax*2]
mov rcx, qword [rcx + rax*8]
call qword [rdx + 0x80]
mov r10, qword [rsi + 0x68]
mov r8d, 1
mov r11, qword [rsi + 0x10]
mov r9, qword [rsi + 0x88]
mov qword [rsi + 0x90], rax
movsxd rax, dword [rsi + 0x64]
lea rdx, [rax + rax*2]
mov rdx, qword [r10 + rdx*8 - 0x18]
lea rcx, [rax + rax*2]
mov rcx, qword [r10 + rcx*8 - 0x30]
call qword [r11 + 0x128]
movss dword [rsi + 0x98], xmm0
mov dword [rsi + 0x9c], 0
jmp case.0x180022a02.10
mov r9, rsi
mov dword [rsi + 0x98], 0
xor r8d, r8d
mov edx, 0x13c
xor ecx, ecx
call fcn.1800108f0
jmp case.0x180022a02.10
mov r14d, 2
cmp r14d, 2
je 0x180022bcb
cmp r14d, 0x78
jne 0x180022d22
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x180022ba6
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rsp + 0x50], r15d
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rbx + 0xa0]
mov dword [rsp + 0x60], 0xffffffff
mov r9d, 0x2f
lea rcx, [rsp + 0x60]
xor r8d, r8d
call fcn.180077620
mov rax, qword [rbx + 0x68]
lea rcx, [rsp + 0x78]
mov rdx, qword [rbx + 0x70]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov dword [rsp + 0x20], 0x1c
call fcn.18001db10
mov r15d, eax
test eax, eax
jns 0x180022c43
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rbx], rax
mov rdx, rbx
mov qword [rsp + 0x20], rax
lea ecx, [rax + 0x37]
call fcn.1800302c0
jmp 0x180022d22
mov edi, 0x2c
nop dword [rax + rax]
mov eax, edi
sub eax, 0x2c
je 0x180022cfe
sub eax, 1
je 0x180022cea
sub eax, 1
je 0x180022c9e
sub eax, 1
je 0x180022c91
cmp eax, 1
jne 0x180022d17
mov rcx, qword [rbx + 0x50]
mov rax, qword [rbx + 0x10]
mov qword [rcx], rax
mov dword [rbx + 0x80], 1
jmp 0x180022d17
mov rax, qword [rbx + 0x48]
mov qword [rax], 0
jmp 0x180022d17
mov rcx, qword [rbx + 0x58]
mov eax, dword [rsp + 0x48]
mov dword [rcx + 4], eax
movsxd r8, dword [rsp + 0x48]
mov rcx, qword [rbx + 0x58]
mov rdx, qword [rsp + 0x78]
add rcx, 8
shl r8, 2
call sub.VCRUNTIME140.dll_memcpy
mov edx, 8
lea ecx, [rdx - 7]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edx, 8
mov qword [rbx + 0x48], rax
lea ecx, [rdx - 7]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rbx + 0x50], rax
jmp 0x180022d17
mov ecx, dword [rbx + 0x200]
mov rax, qword [rbx + 0x58]
mov dword [rbx + 0x84], ecx
mov dword [rax], ecx
jmp 0x180022d17
mov eax, dword [rsp + 0x48]
mov edx, 4
add eax, 2
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rbx + 0x58], rax
inc edi
cmp edi, 0x31
jb 0x180022c50
add r14d, 0x76
cmp r14d, 0xee
jb 0x180022b86
mov r14d, dword [rsp + 0xf8]
movsxd rax, dword [rsi + 0x64]
mov rcx, qword [rsi + 0x68]
mov r9, qword [rsi + 0x10]
mov rdx, qword [rsp + 0x70]
lea r8, [rax + rax*2]
mov rcx, qword [rcx + r8*8 - 0x18]
call qword [r9 + reloc.SHELL32.dll_SHSetFolderPathW]
mov rdi, rax
jmp case.0x180022a02.10
mov r9, rsi
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov r8d, 0x13c
call fcn.18009ddd0
xor r9d, r9d
mov r8d, 0xc2
mov rdx, rsi
xor ecx, ecx
call fcn.1800429e0
mov qword [rsp + 0x50], 0
jmp case.0x180022a02.10
mov eax, dword [rsi + 0x5c]
cmp eax, dword [rsi + 0x60]
jl 0x180022dda
mov r9, qword [rsi + 0x68]
sub eax, 0xffffff80
mov dword [rsi + 0x60], eax
xor edx, edx
cdqe
mov r8d, 0xf6
lea rcx, [rax + rax*2]
shl rcx, 3
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x58]
call fcn.18006b2b0
mov qword [rsi + 0x68], rax
mov eax, dword [rsi + 0x5c]
mov rdx, qword [rsp + 0x70]
cdqe
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x68]
mov qword [rax + rcx*8], rdi
movsxd rax, dword [rsi + 0x5c]
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x68]
mov qword [rax + rcx*8 + 8], rdx
movsxd rax, dword [rsi + 0x5c]
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x68]
mov dword [rax + rcx*8 + 0x10], 2
inc dword [rsi + 0x5c]
mov eax, dword [rsi + 0x5c]
mov dword [rsi + 0x64], eax
jmp case.0x180022a02.10
cmp dword [rbx], r9d
je case.0x180022a02.10
nop dword [rax]
mov r8d, 0xd
mov eax, r8d
sub eax, 0xb
je 0x180022e72
sub eax, 1
je 0x180022e53
cmp eax, 1
jne 0x180022e74
movsxd rax, dword [rbx]
mov ebp, dword [rsi + rax*4]
sar ebp, 2
jmp 0x180022e74
movsxd rdx, dword [rbx]
lea eax, [r9*4]
mov ecx, dword [rsi + rdx*4]
and ecx, 1
xor ecx, r10d
or eax, r10d
mov r10d, ecx
mov dword [rsi + rdx*4], eax
jmp 0x180022e74
mov dword [rbx], ebp
dec r8d
cmp r8d, 0xa
ja 0x180022e36
mov dword [rsp + 0x40], r10d
cmp dword [rbx], r9d
jne 0x180022e30
jmp case.0x180022a02.10
mov r8, rsi
xor edx, edx
mov ecx, 0xd9
call fcn.18005fad0
mov rdx, rsi
mov ecx, 0x50
call fcn.18006f490
jmp case.0x180022a02.10
cmp rdx, 0xffffffffffffffff
je 0x180022eb4
mov dword [rbx + 8], 1
mov edx, 0x28
mov dword [rbx + 0x40], 1
lea ecx, [rdx - 0x27]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
movsxd rcx, dword [rbx + 0x40]
mov edx, 0x20
mov qword [rbx + 0x68], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rbx + 0x70], rax
inc r14d
inc r12d
mov dword [rsp + 0xf8], r14d
cmp r14d, r13d
jae case.0x180022a02.5
mov r9d, dword [rsp + 0x44]
mov r10d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
jmp 0x1800229da