Function at 0x1400024f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rdx, qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov rcx, rax
mov rdi, rax
mov esi, dword [rdx + 3]
call rdx
mov r8, rax
cmp esi, 0x600
jae 0x14000254e
mov ecx, esi
cmp qword [rsi + rdi], rax
jne 0x14000254e
mov qword [rbx + 8], rcx
add rcx, 8
mov qword [rbx + 0x10], rcx
mov r9, qword [rbx + 8]
xor esi, esi
mov ecx, esi
mov r10d, 0xc0
movabs r11, 0xffff800000000000
test r9, r9
jne 0x1400025a7
mov rax, rsi
mov edx, 0xffffffff
cmp r8, rdx
sete al
test qword [rdi], rax
je 0x1400025a7
mov rax, qword [rdi + 8]
cmp rax, r11
jbe 0x1400025a7
mov rdx, qword [rdi + 0x10]
cmp rdx, r11
jbe 0x1400025a7
xor al, dl
test al, 0xf
jne 0x1400025a7
lea rax, [rcx + 8]
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rax
mov r9, rcx
jmp 0x1400025b9
cmp qword [rbx + 0x18], rsi
jne 0x1400025b9
mov rax, cr3
cmp qword [rdi], rax
jne 0x1400025b9
mov qword [rbx + 0x18], rcx
add rcx, 8
add rdi, 8
sub r10, 1
jne 0x140002566
movaps xmm1, xmmword [0x140007390]
lea r9, [rsp + 0x30]
movzx eax, word [0x1400073e0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov r8d, esi
mov word [rsp + 0x80], ax
movaps xmm0, xmmword [0x1400073a0]
movaps xmmword [rsp + 0x30], xmm1
movaps xmm1, xmmword [0x1400073b0]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x1400073c0]
movaps xmmword [rsp + 0x50], xmm1
movaps xmm1, xmmword [str._8____]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm1
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x33
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x36
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x29
jl 0x140002622
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov r9, 0xfffffffffffffffe
mov edx, esi
mov r8, rax
sub r9, rax
lea rcx, [rax + 2]
cmp byte [rcx - 2], 0x48
jne 0x14000268e
cmp byte [rcx - 1], 0x8b
jne 0x14000268e
cmp byte [rcx], 0x81
je 0x14000269f
inc rcx
inc edx
lea rax, [r9 + rcx]
cmp rax, 0x10
jge 0x1400026ab
jmp 0x14000267d
movsxd rax, edx
mov ecx, dword [rax + r8 + 3]
mov qword [rbx + 0x48], rcx
mov eax, dword [rbx]
mov ecx, 0x4563
cmp eax, ecx
ja 0x140002811
je 0x140002795
mov ecx, 0x2800
cmp eax, ecx
ja 0x14000276e
je 0x1400026f4
sub eax, 0x1db0
je 0x140002741
sub eax, 1
je 0x140002741
sub eax, 0x63f
je 0x140002737
sub eax, 0x190
je 0x14000271d
cmp eax, 0x1cd
jne 0x140002875
mov qword [rbx + 0x28], 0x6aa
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], 0x460
mov qword [rbx + 0x30], 0x2c8
mov qword [rbx + 0x58], 0x690
jmp 0x14000286d
mov qword [rbx + 0x28], 0x67a
mov qword [rbx + 0x30], 0x2c0
mov qword [rbx + 0x40], 0x450
jmp 0x140002759
mov qword [rbx + 0x28], 0x648
jmp 0x140002725
mov qword [rbx + 0x28], 0x43c
mov qword [rbx + 0x30], 0x100
mov qword [rbx + 0x40], 0x390
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x50], 0x90
mov qword [rbx + 0x58], rsi
jmp 0x140002875
cmp eax, 0x295a
je 0x1400027f4
cmp eax, 0x3839
je 0x1400027ca
cmp eax, 0x3ad7
je 0x14000279d
cmp eax, 0x3fab
je 0x14000279d
cmp eax, 0x42ee
jne 0x140002875
mov qword [rbx + 0x20], 0x278
mov qword [rbx + 0x30], 0x2c8
mov qword [rbx + 0x28], 0x6ca
mov qword [rbx + 0x38], 0x448
mov qword [rbx + 0x40], 0x468
mov qword [rbx + 0x58], 0x6a8
jmp 0x14000286d
mov qword [rbx + 0x28], 0x6c2
mov qword [rbx + 0x30], 0x2c8
mov qword [rbx + 0x38], 0x448
mov qword [rbx + 0x40], 0x468
mov qword [rbx + 0x58], 0x698
jmp 0x14000286d
mov qword [rbx + 0x28], 0x6b2
mov qword [rbx + 0x38], 0x448
mov qword [rbx + 0x40], 0x468
jmp 0x140002708
mov ecx, 0x4a64
cmp eax, ecx
ja 0x1400028cc
je 0x14000283d
sub eax, 0x47ba
je 0x14000289a
sub eax, 1
je 0x14000289a
sub eax, 0x2a6
je 0x14000283d
sub eax, 1
je 0x14000283d
cmp eax, 1
jne 0x140002875
mov qword [rbx + 0x58], 0x4e8
mov qword [rbx + 0x20], 0x388
mov qword [rbx + 0x30], 0x3d8
mov qword [rbx + 0x28], 0x87a
mov qword [rbx + 0x40], 0x5c0
mov qword [rbx + 0x38], 0x5a0
mov qword [rbx + 0x50], 0x98
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140006890
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov qword [rbx + 0x20], 0x280
mov qword [rbx + 0x30], 0x2d0
mov qword [rbx + 0x28], 0x6fa
mov qword [rbx + 0x38], 0x448
mov qword [rbx + 0x40], 0x468
mov qword [rbx + 0x58], 0x6b8
jmp 0x14000286d
cmp eax, 0x4a65
je 0x14000283d
cmp eax, 0x55f0
je 0x1400028ec
cmp eax, 0x57b6
je 0x1400028f9
cmp eax, 0x585d
jne 0x140002875
mov qword [rbx + 0x58], 0x538
jmp 0x140002845
mov qword [rbx + 0x58], 0x538
jmp 0x14000285d