Function at 0x140001160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x2b0
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x190]
mov rax, 0xffffffffffffffff
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400011a5
lea rax, [rsp + rax + 0x18f]
lea rcx, [rsp + 0x190]
cmp rax, rcx
jbe 0x1400011da
cmp byte [rax], 0x5c
je 0x1400011da
dec rax
lea rcx, [rsp + 0x190]
cmp rax, rcx
ja 0x1400011c5
mov byte [rax + 1], 0
movzx ecx, byte [str.QcANUB]
movzx eax, byte [0x140022a52]
xor byte [0x140022a42], al
movzx eax, byte [0x140022a53]
xor byte [str._f4c_xse_], al
movzx eax, byte [0x140022a54]
xor byte [0x140022a44], al
movzx eax, byte [0x140022a55]
xor byte [0x140022a45], al
movzx eax, byte [0x140022a56]
xor byte [0x140022a46], al
movzx eax, byte [0x140022a57]
xor byte [0x140022a47], al
movzx eax, byte [0x140022a58]
xor byte [0x140022a48], al
movzx eax, byte [0x140022a59]
xor byte [0x140022a49], al
movzx eax, byte [0x140022a5a]
xor byte [0x140022a4a], al
movzx edx, byte [0x140022a50]
xor byte [0x140022a41], cl
xor byte [0x140022a4d], cl
movzx eax, byte [0x140022a5b]
xor byte [0x140022a4b], al
xor byte [0x140022a40], dl
xor byte [0x140022a4c], dl
xor r14d, r14d
mov ecx, r14d
nop dword [rax]
movzx eax, byte [rsp + rcx + 0x190]
mov byte [rsp + rcx + 0x80], al
lea rcx, [rcx + 1]
test al, al
jne 0x140001290
lea rcx, [rsp + 0x80]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x1400012b2
lea rbx, [0x140022a40]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400012d0
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140006898
test eax, eax
je 0x140001348
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x5c3a43
dec rdx
nop dword [rax + rax]
cmp byte [rdx + 1], r14b
lea rdx, [rdx + 1]
jne 0x140001310
xor r8d, r8d
nop dword [rax]
movzx eax, byte [rbx + r8]
mov byte [rdx + r8], al
lea r8, [r8 + 1]
test al, al
jne 0x140001320
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140006898
test eax, eax
jne 0x140001547
lea rdx, [0x14001f410]
mov qword [rsp + 0x2d0], rdi
lea rcx, [rsp + 0x80]
call fcn.140006450
mov rdi, rax
test rax, rax
je 0x140001552
mov qword [rsp + 0x2c0], rbp
lea rcx, [rsp + 0x68]
mov r8, rax
mov qword [rsp + 0x2c8], rsi
mov edx, 0xa
mov ebx, r14d
call fcn.140006b10
test rax, rax
je 0x1400013c3
nop word [rax + rax]
lea rcx, [rsp + 0x68]
call fcn.14000a044
mov r8, rdi
lea rcx, [rsp + 0x68]
mov edx, 0xa
inc ebx
call fcn.140006b10
test rax, rax
jne 0x1400013a0
mov rcx, rdi
call fcn.1400065e8
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor edx, edx
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 0xa]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
movsxd rbp, ebx
mov rsi, rax
test ebx, ebx
jle 0x14000140b
mov r9, rbp
mov r8, rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rsi, rax
lea rdx, [0x14001f410]
lea rcx, [rsp + 0x80]
call fcn.140006450
mov rdi, rax
test rax, rax
je 0x14000155d
mov r8, rax
lea rcx, [rsp + 0x68]
mov edx, 0xa
call fcn.140006b10
test rax, rax
je 0x140001471
mov rbx, rsi
lea rcx, [rsp + 0x68]
call fcn.14000a044
cvttsd2si eax, xmm0
mov r8, rdi
lea rcx, [rsp + 0x68]
mov edx, 0xa
lea rbx, [rbx + 1]
mov byte [rbx - 1], al
call fcn.140006b10
test rax, rax
jne 0x140001445
mov rcx, rdi
call fcn.1400065e8
mov r9d, r14d
test rbp, rbp
jle 0x1400014c8
mov r8, rsi
lea r10, [0x140022a50]
nop dword [rax + rax]
mov eax, 0x2aaaaaab
imul r9d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
inc r9d
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
movzx eax, byte [rcx + r10]
xor byte [r8], al
inc r8
mov rax, r8
sub rax, rsi
cmp rax, rbp
jl 0x140001490
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50], r14
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], r14
mov r9, rax
mov qword [rsp + 0x40], r14
lea rax, [0x140001150]
mov qword [rsp + 0x38], r14
xor r8d, r8d
mov dword [rsp + 0x30], r14d
mov edx, 0x1fffff
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.140001990
mov rsi, qword [rsp + 0x2c8]
mov rbp, qword [rsp + 0x2c0]
mov rdi, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400023c0
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2b0
pop r14
ret
mov ecx, 0xffffffff
call fcn.140006388
int3
mov ecx, 0xffffffff
call fcn.140006388
int3
mov ecx, 0xffffffff
call fcn.140006388
int3