Function at 0x140001070
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r14, rdx
cmp ecx, 2
jne 0x140001586
mov rcx, qword [rdx + 8]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400010b0
cmp rax, 0x20
jne 0x140001586
lea r9, [rsp + 0x50]
xor ecx, ecx
lea r8d, [rax - 8]
lea rdx, [rsp + 0x60]
call qword [sym.imp.WinHvPlatform.dll_WHvGetCapability]
test eax, eax
js 0x140001586
cmp dword [rsp + 0x60], 0
je 0x140001586
mov qword [rsp + 0x1a0], r15
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x1c0], rbx
xor r15d, r15d
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rdi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x38], 1
call qword [sym.imp.WinHvPlatform.dll_WHvCreatePartition]
test eax, eax
js 0x1400014cb
mov rcx, qword [rsp + 0x30]
lea r9d, [r15 + 4]
lea r8, [rsp + 0x38]
mov edx, 0x1fff
call qword [sym.imp.WinHvPlatform.dll_WHvSetPartitionProperty]
test eax, eax
js 0x1400014cb
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WinHvPlatform.dll_WHvSetupPartition]
test eax, eax
js 0x1400014cb
mov edx, 0x100000
lea r9d, [r15 + 4]
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x1400014cb
mov rcx, qword [rsp + 0x30]
mov r9d, 0x100000
xor r8d, r8d
mov dword [rsp + 0x20], 7
mov rdx, rax
call qword [sym.imp.WinHvPlatform.dll_WHvMapGpaRange]
test eax, eax
js 0x1400014ba
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WinHvPlatform.dll_WHvCreateVirtualProcessor]
test eax, eax
js 0x1400014ba
mov rcx, qword [rsp + 0x30]
lea r9d, [r15 + 0x12]
mov eax, 0x202
lea r8, [0x140022a30]
mov word [0x14005d920], ax
xor edx, edx
lea rax, [0x14005d810]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WinHvPlatform.dll_WHvSetVirtualProcessorRegisters]
test eax, eax
js 0x1400014ba
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 1]
mov qword [rsp + 0x40], r15
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x48], 0xffffffff
xor edx, edx
mov dword [rsp + 0x4c], 0xa09b0033
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x3c], 0x13
call qword [sym.imp.WinHvPlatform.dll_WHvSetVirtualProcessorRegisters]
test eax, eax
js 0x1400014ba
mov r8d, 0x39afe
lea rdx, [0x140022a80]
mov rcx, rsi
call fcn.140004f80
mov rcx, qword [r14 + 8]
lea rdx, [rsi + 0x39afe]
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001270
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0xe0
call fcn.140002fd0
mov rcx, qword [rsp + 0x30]
lea r8, [rbp - 0x50]
mov r9d, 0xe0
xor edx, edx
call qword [sym.imp.WinHvPlatform.dll_WHvRunVirtualProcessor]
test eax, eax
js 0x1400014ad
cmp dword [rbp - 0x50], 2
jne 0x1400014ad
mov rcx, qword [rsp + 0x30]
lea rax, [rbp - 0x80]
mov r9d, 3
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
mov qword [rsp + 0x60], 0x10
xor edx, edx
mov dword [rsp + 0x68], 2
call qword [sym.imp.WinHvPlatform.dll_WHvGetVirtualProcessorRegisters]
test eax, eax
js 0x1400014ad
test byte [rbp - 0xc], 1
jne 0x140001526
mov ecx, 0x408
call fcn.1400015d0
movdqa xmm2, xmmword [0x14001f530]
mov rdi, rax
mov ecx, 8
mov qword [rax], r15
lea rdx, [rax + 0x28]
lea eax, [rcx - 8]
movd xmm0, eax
lea rdx, [rdx + 0x40]
pshufd xmm0, xmm0, 0
lea eax, [rcx - 4]
paddd xmm0, xmm2
movd xmm1, eax
movdqu xmmword [rdx - 0x60], xmm0
lea eax, [rcx + 4]
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
movd xmm0, ecx
movdqu xmmword [rdx - 0x50], xmm1
add ecx, 0x10
movd xmm1, eax
pshufd xmm0, xmm0, 0
pshufd xmm1, xmm1, 0
paddd xmm0, xmm2
movdqu xmmword [rdx - 0x40], xmm0
lea eax, [rcx - 8]
paddd xmm1, xmm2
movdqu xmmword [rdx - 0x30], xmm1
cmp eax, 0x100
jl 0x140001320
mov rax, r15
mov r10d, r15d
mov r9, r15
nop dword [rax + rax]
mov r8d, dword [rdi + r9*4 + 8]
movzx ecx, r8b
add cl, byte [rbp + rax - 0x60]
inc rax
add cl, r10b
movzx r10d, cl
mov ecx, dword [rdi + r10*4 + 8]
lea rdx, [rdi + r10*4]
mov dword [rdi + r9*4 + 8], ecx
inc r9
cmp rax, 8
mov dword [rdx + 8], r8d
mov rcx, r15
cmovl rcx, rax
mov rax, rcx
cmp r9, 0x100
jl 0x140001390
mov rcx, qword [rbp - 0x70]
mov eax, 0x39afe
mov r9d, dword [rdi]
sub eax, ecx
mov r11d, dword [rdi + 4]
movsxd rbx, eax
lea r10, [rcx + rsi]
test eax, eax
jle 0x14000142f
inc r9b
lea r10, [r10 + 1]
movzx r9d, r9b
mov r8d, dword [rdi + r9*4 + 8]
lea rdx, [rdi + r9*4]
lea eax, [r11 + r8]
movzx r11d, al
mov ecx, dword [rdi + r11*4 + 8]
mov dword [rdx + 8], ecx
mov dword [rdi + r11*4 + 8], r8d
add r8b, cl
movzx eax, r8b
movzx ecx, byte [rdi + rax*4 + 8]
xor byte [r10 - 1], cl
sub rbx, 1
jne 0x1400013f0
mov edx, 0x408
mov dword [rdi], r9d
mov rcx, rdi
mov dword [rdi + 4], r11d
call fcn.14000160c
mov rcx, qword [rsp + 0x30]
lea rax, [rbp - 0x80]
add qword [rbp - 0x80], 2
lea r8, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x64], 1
mov qword [rbp - 0x70], 0x39afe
call qword [sym.imp.WinHvPlatform.dll_WHvSetVirtualProcessorRegisters]
test eax, eax
js 0x1400014ad
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0xe0
call fcn.140002fd0
mov rcx, qword [rsp + 0x30]
lea r8, [rbp - 0x50]
mov r9d, 0xe0
xor edx, edx
call qword [sym.imp.WinHvPlatform.dll_WHvRunVirtualProcessor]
test eax, eax
jns 0x1400012b1
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.WinHvPlatform.dll_WHvDeleteVirtualProcessor]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400014db
call qword [sym.imp.WinHvPlatform.dll_WHvDeletePartition]
lea rcx, str.Error
call fcn.1400058e8
mov eax, 1
mov rdi, qword [rsp + 0x1d8]
mov rsi, qword [rsp + 0x1d0]
mov rbx, qword [rsp + 0x1c0]
mov r15, qword [rsp + 0x1a0]
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400015b0
add rsp, 0x1a8
pop r14
pop rbp
ret
cmp dword [rbp - 0x70], 1
jne 0x14000154a
lea rcx, [0x14001f50c]
call fcn.1400058e8
mov rdx, qword [r14 + 8]
lea rcx, str.BHFlagY_s_n
call fcn.140001010
jmp 0x140001556
lea rcx, str.Ummm
call fcn.1400058e8
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.WinHvPlatform.dll_WHvDeleteVirtualProcessor]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WinHvPlatform.dll_WHvDeletePartition]
xor eax, eax
jmp 0x1400014ec
lea rcx, [0x14001f500]
call fcn.1400058e8
mov eax, 1
jmp 0x14000150c