Function at 0x140001380
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140001396
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, 0x40
mov qword [rsp + 0x48], r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rbx
mov r14, rax
call fcn.140001040
test eax, eax
jne 0x140001904
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov r8d, 0x9e3779b9
mov rbp, 0xffffffffffffffff
mov r9d, r8d
mov qword [r14], rax
mov rbx, rax
mov r11, rax
mov edi, 0xfeedbeef
mov r10, rbp
nop dword [rax]
inc r10
cmp byte [rax + r10], 0
jne 0x1400013f0
cmp r10d, 0xc
jb 0x140001513
mov eax, 0xaaaaaaab
mul r10d
shr edx, 3
nop
movzx eax, byte [r11 + 6]
add r10d, 0xfffffff4
movzx ecx, byte [r11 + 7]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 4]
add r8d, eax
shl ecx, 8
movzx eax, byte [r11 + 0xa]
add r8d, ecx
movzx ecx, byte [r11 + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 8]
add edi, eax
shl ecx, 8
movzx eax, byte [r11 + 2]
add edi, ecx
movzx ecx, byte [r11 + 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11]
shl ecx, 8
add r11, 0xc
add ecx, eax
mov eax, edi
shr eax, 0xd
sub ecx, r8d
sub ecx, edi
add r9d, ecx
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, edi
shl eax, 8
xor r8d, eax
sub edi, r8d
mov eax, r8d
sub edi, r9d
shr eax, 0xd
xor edi, eax
sub r9d, r8d
sub r9d, edi
mov eax, edi
shr eax, 0xc
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, edi
shl eax, 0x10
xor r8d, eax
sub edi, r8d
mov eax, r8d
sub edi, r9d
shr eax, 5
xor edi, eax
sub r9d, r8d
sub r9d, edi
mov eax, edi
shr eax, 3
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, edi
shl eax, 0xa
xor r8d, eax
sub edi, r8d
mov eax, r8d
sub edi, r9d
shr eax, 0xf
xor edi, eax
sub rdx, 1
jne 0x140001410
mov rax, rbp
inc rax
cmp byte [rbx + rax], 0
jne 0x140001516
add edi, eax
dec r10d
cmp r10d, 0xa
ja case.default.0x140001540
lea rdx, [0x140000000]
mov ecx, dword [rdx + r10*4 + 0x191c]
add rcx, rdx
jmp rcx
movzx eax, byte [r11 + 0xa]
shl eax, 0x18
add edi, eax
movzx eax, byte [r11 + 9]
shl eax, 0x10
add edi, eax
movzx eax, byte [r11 + 8]
shl eax, 8
add edi, eax
movzx eax, byte [r11 + 7]
shl eax, 0x18
add r8d, eax
movzx eax, byte [r11 + 6]
shl eax, 0x10
add r8d, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add r8d, eax
movzx eax, byte [r11 + 4]
add r8d, eax
movzx eax, byte [r11 + 3]
shl eax, 0x18
add r9d, eax
movzx eax, byte [r11 + 2]
shl eax, 0x10
add r9d, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add r9d, eax
movzx eax, byte [r11]
add r9d, eax
sub r9d, r8d
mov qword [r14 + 0x30], rbx
sub r9d, edi
mov eax, edi
shr eax, 0xd
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, edi
shl eax, 8
xor r8d, eax
sub edi, r8d
mov eax, r8d
sub edi, r9d
shr eax, 0xd
xor edi, eax
sub r9d, r8d
sub r9d, edi
mov eax, edi
shr eax, 0xc
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, edi
shl eax, 0x10
xor r8d, eax
sub edi, r8d
mov eax, r8d
sub edi, r9d
shr eax, 5
xor edi, eax
sub r9d, r8d
mov eax, edi
sub r9d, edi
shr eax, 3
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, edi
shl eax, 0xa
xor r8d, eax
mov rax, rbp
sub edi, r8d
shr r8d, 0xf
sub edi, r9d
xor edi, r8d
mov dword [r14 + 0x3c], edi
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140001640
mov rdx, qword [0x140009788]
lea rbx, [r14 + 8]
mov qword [rsp + 0x38], rsi
xor esi, esi
mov dword [r14 + 0x38], eax
test rdx, rdx
jne 0x140001702
mov ecx, 0x40
mov qword [r14 + 0x18], rsi
mov qword [r14 + 0x10], rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx], rax
test rax, rax
je 0x1400017ae
xorps xmm0, xmm0
mov ecx, 0x200
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
mov rax, qword [rbx]
mov qword [rax + 0x18], rbx
mov rax, qword [rbx]
mov dword [rax + 8], 0x20
mov rax, qword [rbx]
mov dword [rax + 0xc], 5
mov rax, qword [rbx]
mov qword [rax + 0x20], 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rbx]
mov qword [rcx], rax
mov rax, qword [rbx]
mov dword [rax + 0x38], 0xa0111fe1
mov rax, qword [rbx]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400017ae
xor edx, edx
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
mov rdx, r14
mov qword [0x140009788], rdx
jmp 0x140001731
mov rax, qword [rdx + 8]
mov qword [rbx], rax
mov qword [r14 + 0x18], rsi
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 0x18]
sub rcx, qword [rax + 0x20]
mov qword [r14 + 0x10], rcx
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 0x18]
mov qword [rcx + 0x10], r14
mov rax, qword [rdx + 8]
mov qword [rax + 0x18], rbx
mov rax, qword [rdx + 8]
inc dword [rax + 0x10]
mov rcx, qword [rdx + 8]
mov eax, edi
mov edx, dword [rcx + 8]
dec edx
and rdx, rax
shl rdx, 4
add rdx, qword [rcx]
mov rax, qword [rdx]
inc dword [rdx + 8]
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x20], rsi
mov rax, qword [rdx]
test rax, rax
je 0x140001767
mov qword [rax + 0x18], rbx
mov eax, dword [rdx + 0xc]
inc eax
mov qword [rdx], rbx
lea ecx, [rax + rax*4]
add ecx, ecx
cmp dword [rdx + 8], ecx
jb 0x1400018e5
mov rax, qword [rbx]
cmp dword [rax + 0x34], 0
jne 0x1400018e5
mov edx, dword [rax + 8]
mov eax, 2
shl rdx, 4
mul rdx
cmovb rax, rbp
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400017b7
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [rbx]
xor edx, edx
mov rcx, rdi
mov r8d, dword [rax + 8]
shl r8, 5
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx]
mov r11d, esi
mov eax, dword [r9 + 8]
mov ecx, dword [r9 + 0xc]
mov r8d, dword [r9 + 0x10]
inc ecx
shr r8d, cl
lea eax, [rax*2 - 1]
test dword [r9 + 0x10], eax
mov eax, esi
setne al
add r8d, eax
mov dword [r9 + 0x28], r8d
mov rax, qword [rbx]
mov dword [rax + 0x2c], esi
mov rax, qword [rbx]
cmp dword [rax + 8], 0
jbe 0x1400018a0
nop dword [rax]
mov rax, qword [rax]
mov ecx, r11d
add rcx, rcx
mov r8, qword [rax + rcx*8]
test r8, r8
je 0x140001890
mov rax, qword [rbx]
mov r10, qword [r8 + 0x20]
mov ecx, dword [rax + 8]
lea eax, [rcx*2 - 1]
mov ecx, dword [r8 + 0x34]
and rax, rcx
shl rax, 4
add rax, rdi
mov ecx, dword [rax + 8]
inc ecx
mov dword [rax + 8], ecx
mov rdx, qword [rbx]
cmp ecx, dword [rdx + 0x28]
jbe 0x14000186e
inc dword [rdx + 0x2c]
mov rcx, qword [rbx]
mov r9d, dword [rax + 0xc]
mov edx, r9d
imul edx, dword [rcx + 0x28]
cmp dword [rax + 8], edx
jbe 0x14000186e
lea ecx, [r9 + 1]
mov dword [rax + 0xc], ecx
mov qword [r8 + 0x18], rsi
mov rcx, qword [rax]
mov qword [r8 + 0x20], rcx
mov rcx, qword [rax]
test rcx, rcx
je 0x140001885
mov qword [rcx + 0x18], r8
mov qword [rax], r8
mov r8, r10
test r10, r10
jne 0x140001822
mov rax, qword [rbx]
inc r11d
cmp r11d, dword [rax + 8]
jb 0x140001810
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbx]
mov eax, dword [rcx + 8]
add eax, eax
mov dword [rcx + 8], eax
mov rax, qword [rbx]
inc dword [rax + 0xc]
mov rax, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov eax, dword [rcx + 0x10]
shr eax, 1
cmp dword [rcx + 0x2c], eax
jbe 0x1400018d2
mov esi, dword [rcx + 0x30]
inc esi
mov dword [rcx + 0x30], esi
mov rcx, qword [rbx]
cmp dword [rcx + 0x30], 1
jbe 0x1400018e5
mov dword [rcx + 0x34], 1
mov rsi, qword [rsp + 0x38]
mov eax, 1
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rbx
ret
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rbx
ret