Function at 0x1400029f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov rdi, rcx
mov ecx, 0x15d200
mov rbp, rdx
call fcn.140126110
mov r8d, 0x15d200
lea rdx, [0x14012b150]
lea rsi, [rsp + 0xb0]
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_memcpy
mov r10d, 0x346e
mov qword [rsp + 0xa0], rsi
xor ecx, ecx
movabs rax, 0x437a677238716547
mov byte [rsp + 0xba], 0
movabs r8, 0xcccccccccccccccd
mov qword [rsp + 0xb0], rax
mov word [rsp + 0xb8], r10w
mov qword [rsp + 0xa8], 0xa
nop dword [rax]
mov rax, rcx
mul r8
shr rdx, 3
lea rax, [rdx + rdx*4]
mov rdx, rcx
add rax, rax
sub rdx, rax
movzx eax, byte [rsp + rdx + 0xb0]
xor byte [rbx + rcx], al
add rcx, 1
cmp rcx, 0x15d200
jne 0x140002a80
mov r14, qword [rbp]
mov rbp, qword [rbp + 8]
mov qword [rsp + 0xa0], rsi
lea r13, [rsp + 0xa0]
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x80], rbp
lea r15, [r14 + rbp]
cmp rbp, 7
ja 0x140002b20
mov r9, rbp
mov rdx, rsi
lea r12, [rsp + 0x80]
cmp r14, r15
je 0x140002f88
xor eax, eax
nop
movsx cx, byte [r14 + rax]
mov word [rdx + rax*2], cx
add rax, 1
cmp rbp, rax
jne 0x140002b00
jmp 0x140002c9b
lea r12, [rsp + 0x80]
xor r8d, r8d
mov rcx, r13
mov rdx, r12
call fcn.140111bc0
mov r9, qword [rsp + 0x80]
mov qword [rsp + 0xa0], rax
mov rdx, rax
mov qword [rsp + 0xb0], r9
cmp r14, r15
je 0x140002c9b
lea rax, [rax + rbp*2]
lea rcx, [rbp - 1]
cmp r14, rax
jae 0x140002b6c
cmp rdx, r15
jb 0x140002afc
cmp rcx, 0xe
jbe 0x140003003
mov r8, rbp
mov rcx, rbp
pxor xmm3, xmm3
xor eax, eax
shr r8, 4
and rcx, 0xfffffffffffffff0
nop word [rax + rax]
movdqu xmm0, xmmword [r14 + rax]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
punpckhbw xmm0, xmm1
movups xmmword [rdx + rax*2], xmm2
movups xmmword [rdx + rax*2 + 0x10], xmm0
add rax, 0x10
cmp rcx, rax
jne 0x140002b90
mov rax, r8
lea r8, [r14 + rcx]
shl rax, 5
add rax, rdx
cmp rbp, rcx
je 0x140002c9b
sub rbp, rcx
lea r10, [rbp - 1]
cmp r10, 6
jbe 0x140002c21
movq xmm0, qword [r14 + rcx]
pxor xmm1, xmm1
lea r10, [rdx + rcx*2]
mov rcx, rbp
and rcx, 0xfffffffffffffff8
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
lea rax, [rax + rcx*2]
add r8, rcx
and ebp, 7
punpcklbw xmm0, xmm1
punpcklbw xmm2, xmm1
pshufd xmm0, xmm0, 0x4e
movq qword [r10], xmm2
movq qword [r10 + 8], xmm0
je 0x140002c9b
movsx cx, byte [r8]
mov word [rax], cx
lea rcx, [r8 + 1]
cmp r15, rcx
je 0x140002c9b
movsx cx, byte [r8 + 1]
mov word [rax + 2], cx
lea rcx, [r8 + 2]
cmp r15, rcx
je 0x140002c9b
movsx cx, byte [r8 + 2]
mov word [rax + 4], cx
lea rcx, [r8 + 3]
cmp r15, rcx
je 0x140002c9b
movsx cx, byte [r8 + 3]
mov word [rax + 6], cx
lea rcx, [r8 + 4]
cmp r15, rcx
je 0x140002c9b
movsx cx, byte [r8 + 4]
mov word [rax + 8], cx
lea rcx, [r8 + 5]
cmp r15, rcx
je 0x140002c9b
movsx cx, byte [r8 + 5]
mov word [rax + 0xa], cx
lea rcx, [r8 + 6]
cmp r15, rcx
je 0x140002c9b
movsx cx, byte [r8 + 6]
mov word [rax + 0xc], cx
xor ecx, ecx
mov qword [rsp + 0xa8], r9
lea r14, [0x14012b130]
mov word [rdx + r9*2], cx
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov r8, qword [rdi + 8]
mov r15, qword [rdi]
xor r9d, r9d
lea rdi, [rsp + 0x90]
mov rcx, r12
mov rbp, rax
mov qword [rsp + 0x88], 0
lea rdx, [rax + r8]
mov qword [rsp + 0x80], rdi
mov word [rsp + 0x90], r9w
mov qword [rsp + 0x58], r8
call fcn.140111850
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsp + 0x58]
sub rax, qword [rsp + 0x88]
cmp rax, r8
jb 0x140003054
mov rdx, r15
mov rcx, r12
call fcn.140111a00
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0x88]
cmp rax, rbp
jb 0x140003060
mov r8, rbp
mov rdx, r14
mov rcx, r12
call fcn.140111a00
mov rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
lea rax, [rdx + r8]
cmp r9, rdi
je 0x140002f90
cmp qword [rsp + 0x90], rax
jae 0x140002da1
cmp rcx, rsi
je 0x140002ff8
mov r10, qword [rsp + 0xb0]
cmp r10, rax
jae 0x140002f20
movabs rax, 0x1fffffffffffffff
sub rax, rdx
cmp rax, r8
jb 0x14000306c
mov rdx, rcx
mov rcx, r12
call fcn.140111a00
lea rbp, [rsp + 0x70]
lea rcx, [rax + 0x10]
mov qword [rsp + 0x60], rbp
mov rdx, qword [rax]
cmp rdx, rcx
je 0x140002fb0
mov qword [rsp + 0x60], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x70], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x68], rdx
xor edx, edx
mov qword [rax], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 8], 0
mov word [rax + 0x10], dx
cmp rcx, rdi
je 0x140002e23
mov rax, qword [rsp + 0x90]
lea rdx, [rax + rax + 2]
call fcn.1401260d0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rsi
je 0x140002e42
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + rax + 2]
call fcn.1401260d0
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002f00
mov dword [rsp + 0x30], 0x15d200
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], 0
mov rcx, rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
call fcn.140002950
mov rcx, rsi
test eax, eax
js 0x140002f10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x140002edd
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.1401260d0
mov edx, 0x15d200
mov rcx, rbx
call fcn.1401260d0
mov eax, esi
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x60]
xor esi, esi
cmp rcx, rbp
jne 0x140002ece
jmp 0x140002edd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x140002ec4
mov qword [rsp + 0x20], rdx
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.14010c710
lea rbp, [rsp + 0x70]
lea rcx, [rax + 0x10]
mov qword [rsp + 0x60], rbp
mov rdx, qword [rax]
cmp rdx, rcx
jne 0x140002ddc
mov rdx, qword [rax + 8]
mov r9, rbp
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jb 0x140002fc5
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rbp + r9], r11
cmp edx, r10d
jb 0x140002f6a
lea r9, [rbp + rdx]
add rdx, rcx
jmp 0x140002fc5
xor r9d, r9d
jmp 0x140002c9b
cmp rax, 7
jbe 0x140002da1
cmp rcx, rsi
jne 0x140002d90
jmp 0x140002db7
mov rdx, qword [rax + 8]
mov r9, rbp
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jae 0x140003010
xor r10d, r10d
test r8b, 4
je 0x140002fda
mov r10d, dword [rdx]
mov dword [r9], r10d
mov r10d, 4
and r8d, 2
je 0x140002dea
movzx edx, word [rdx + r10]
mov word [r9 + r10], dx
jmp 0x140002dea
mov r10d, 7
jmp 0x140002d98
mov rax, rdx
mov r8, r14
xor ecx, ecx
jmp 0x140002be0
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rbp + r9], r11
cmp edx, r10d
jb 0x140003019
jmp 0x140002f7e
mov rcx, rbx
mov edx, 0x15d200
call fcn.1401260d0
mov rcx, rsi
call fcn.14001ae30
lea rcx, [0x14012b134]
call fcn.1401273d0
lea rcx, [0x14012b134]
call fcn.1401273d0
lea rcx, [0x14012b134]
call fcn.1401273d0
mov rcx, r12
mov rsi, rax
call fcn.14010c6f0
mov rcx, r13
call fcn.14010c6f0
jmp 0x14000303f