Function at 0x1400d6380
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x141dd7e78]
and eax, dword [0x141dd7e7c]
and eax, 0xd58779bb
imul eax, eax, 0xab253581
add eax, 0x465608e2
cmp eax, 0x3683e332
jae 0x1400d63e0
mov eax, 0x10
call fcn.1400ef330
pop qword [rcx]
add byte [rax + 0x29], cl
invalid
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
nop word cs:[rax + rax]
mov ecx, dword [0x141dd7e80]
xor ecx, dword [0x141dd7e84]
and ecx, 0xff79a1e8
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r12, rsp
cmp ecx, 0x1fb54505
je 0x1400d63e0
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r15, rsp
sub rsp, 0x30
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov edx, 0x3c
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
test eax, eax
jns 0x1400d6509
mov r14d, eax
or r14d, 0x10000000
mov qword [rbx], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
add rsp, 0x20
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400d6480
mov rbx, qword [rbx]
cmp r14d, 0x90000005
je 0x1400d64b0
cmp r14d, 0xd0000004
je 0x1400d64b0
cmp r14d, 0xd0000023
jne 0x1400d6550
nop word cs:[rax + rax]
mov eax, dword [0x141dd7ea0]
sub eax, dword [0x141dd7ea4]
imul eax, eax, 0x969998ec
add eax, 0x1351bef
cmp eax, 0x9e41d1a9
jb 0x1400d64b0
nop
mov eax, dword [0x141dd7ea8]
imul eax, dword [0x141dd7eac]
or eax, 0x24908022
xor eax, 0x24808028
or eax, 0x196f67d5
cmp eax, 0x3dc24b9
je 0x1400d64d0
test rbx, rbx
je 0x1400d6509
mov rax, qword [rbx]
sub rsp, 0x20
mov rcx, rbx
call qword [rax + 0x10]
add rsp, 0x20
mov ebx, dword [r15]
mov dword [r12], ebx
mov ecx, ebx
shr ecx, 1
mov eax, dword [0x141dd7eb0]
sub eax, dword [0x141dd7eb4]
mov qword [rbp], rcx
lea r15, [rcx*2 + 2]
xor eax, 0x55a486e7
add eax, 0xbb4491d1
cmp eax, 0x44921ffb
jae 0x1400d65e8
jmp 0x1400d6614
mov eax, dword [0x141dd7e88]
imul eax, dword [0x141dd7e8c]
and eax, 0x50d33a40
imul eax, eax, 0xf0a7e144
and eax, 0x60f12200
cmp eax, 0x1de2a64
ja 0x1400d6550
test rbx, rbx
je 0x1400d680e
mov eax, dword [0x141dd7e90]
and eax, dword [0x141dd7e94]
mov rdi, qword [rbx]
imul eax, eax, 0x3cebde0
and eax, 0x11757e00
cmp eax, 0xcd15f7f5
jbe 0x1400d65b0
sub rsp, 0x20
mov rcx, rbx
call qword [rdi + 0x10]
add rsp, 0x20
nop dword [rax]
mov r14d, dword [0x141dd7e98]
xor r14d, dword [0x141dd7e9c]
or r14d, 0x30196566
add r14d, 0x822b8d0a
sub rsp, 0x20
mov rcx, rbx
call qword [rdi + 0x10]
add rsp, 0x20
cmp r14d, 0xa20dea90
jae 0x1400d65b0
jmp 0x1400d680e
mov eax, dword [0x141dd7eb8]
mov ecx, dword [0x141dd7ebc]
add eax, ecx
add eax, 0x6638a803
or eax, 0xf80def70
imul eax, eax, 0x94deb015
movzx ecx, byte [0x141ddb278]
cmp eax, 0x2bbdac13
jae 0x1400d661d
movzx eax, byte [0x141ddb278]
jmp 0x1400d65e8
mov eax, dword [0x141dd7ec0]
sub eax, dword [0x141dd7ec4]
add eax, 0xf8a7b0bb
or eax, 0xd816e4ae
xor eax, 0x9627b678
cmp eax, 0x61c1a9a1
jbe 0x1400d6660
sub rsp, 0x20
xor ecx, ecx
mov rdx, r15
call fcn.1400c0180
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd7ec8]
xor edx, edx
div dword [0x141dd7ecc]
imul r13d, eax, 0x1efb5de
xor r13d, 0x98d7c2a2
add r13d, 0x46f0d226
sub rsp, 0x20
xor ecx, ecx
mov rdx, r15
call fcn.1400c0180
add rsp, 0x20
cmp r13d, 0xda76c213
jb 0x1400d6660
mov r14, rax
test rax, rax
je 0x1400d687a
mov eax, dword [0x141dd7ee8]
imul eax, dword [0x141dd7eec]
imul eax, eax, 0x3edaf9e7
add eax, 0x8918f023
cmp eax, 0x8d9a449b
jbe 0x1400d66e9
sub rsp, 0x30
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov edx, 0x3c
mov r8, r14
mov r9d, ebx
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
xor r15d, r15d
nop dword [rax]
sub rsp, 0x30
mov qword [rsp + 0x20], r12
mov rcx, rdi
mov edx, 0x3c
mov r8, r14
mov r9d, ebx
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
test r15b, r15b
jne 0x1400d66f0
mov ecx, 0xad2012e9
nop word [rax + rax]
mov edx, dword [0x141dd7ef0]
sub edx, dword [0x141dd7ef4]
or edx, 0x3925bb35
imul rdx, rcx
shr rdx, 0x3f
or edx, 0xcddb3088
cmp edx, 0x7daf1ea9
jb 0x1400d6720
xor ecx, ecx
nop word [rax + rax]
test cl, cl
jne 0x1400d6750
test eax, eax
js 0x1400d67ca
mov rax, qword [rbp]
mov word [r14 + rax*2], 0
mov rdx, qword [r14 + 8]
sub rsp, 0x20
mov rcx, rsi
call fcn.1400d5eb0
add rsp, 0x20
mov rcx, qword [0x141ddb260]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd7f00]
mov ecx, dword [0x141dd7f04]
add eax, ecx
add eax, 0x8fe0a759
and eax, 0xf2aa795
imul eax, eax, 0x4f5a43d6
cmp eax, 0x35a71f28
je 0x1400d67a0
jmp 0x1400d6940
mov rcx, qword [0x141ddb260]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd7ef8]
or eax, dword [0x141dd7efc]
imul eax, eax, 0x5360aa1b
and eax, 0x672f6266
cmp eax, 0x65850826
je 0x1400d67f0
mov eax, dword [0x141dd7f08]
or eax, dword [0x141dd7f0c]
xor eax, 0x6a8af649
imul eax, eax, 0x2de0f2e9
cmp eax, 0xdefae38d
jne 0x1400d6840
mov qword [rsi], 0
nop word cs:[rax + rax]
mov eax, dword [0x141dd7f10]
imul eax, dword [0x141dd7f14]
add eax, 0xeaca84e1
imul rax, rax, 0x16010e75
shr rax, 0x3c
mov qword [rsi], 0
cmp eax, 0x20224fdb
je 0x1400d6840
xor eax, eax
test al, al
je 0x1400d68f6
jmp 0x1400d6924
mov eax, dword [str.h_h4e]
and eax, dword [0x141dd7ed4]
and eax, 0x10e8881
imul eax, eax, 0x3dc7fdc7
cmp eax, 0x6cb5388e
ja 0x1400d68c2
mov eax, dword [0x141dd7ed8]
xor eax, dword [0x141dd7edc]
and eax, 0xaceba6d4
imul rax, rax, 0x49384739
shr rax, 0x3a
or eax, 0xcc81a749
ud2
ud2
mov eax, dword [0x141dd7f18]
and eax, dword [0x141dd7f1c]
imul eax, eax, 0x1234c91f
or eax, 0x566daafc
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
cmp eax, 0x93d15c53
jae 0x1400d6940
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
jmp 0x1400d68f6
mov eax, dword [0x141dd7f20]
sub eax, dword [0x141dd7f24]
or eax, 0x46cfebb
add eax, 0x66c51439
or eax, 0x77fbe64c
cmp eax, 0x6c675afe
je 0x1400d6940
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret