Function at 0x140075e40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r14, qword [rcx]
lea rdi, [r14 + 0x10]
nop word [rax + rax]
mov eax, dword [0x141dcbbe0]
xor eax, dword [0x141dcbbe4]
add eax, 0x50f09621
xor eax, 0xd6552a2b
cmp eax, 0x807dfc7
jb 0x140075e60
mov rax, qword [r14 + 0x18]
test rax, rax
setne r15b
mov rbx, qword [r14 + 0x20]
test rbx, rbx
setne r12b
test rax, rax
je 0x140075fe3
mov r13, qword [r14 + 0x28]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140075eb0
test rbx, rbx
je 0x140075fe3
mov eax, 0xe92f30bf
nop word cs:[rax + rax]
mov ecx, dword [0x141dcbbe8]
xor ecx, dword [0x141dcbbec]
xor ecx, 0x4b602f86
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xd9b23530
ja 0x140075ed0
mov rax, qword [r13]
test rax, rax
je 0x140075f00
mov rcx, rbx
call rax
cmp qword [r13 + 8], 0
je 0x140075fe3
mov rax, qword [r13 + 0x10]
nop
mov ecx, dword [0x141dcbbf0]
xor ecx, dword [0x141dcbbf4]
add ecx, 0xc8dffc8a
and ecx, 0xd668724b
imul rcx, rcx, 0x28b5d3a5
shr rcx, 0x3d
cmp ecx, 0x2804b3bd
ja 0x140075f10
cmp rax, 0x11
jb 0x140075f6e
nop word cs:[rax + rax]
mov eax, dword [0x141dcbbf8]
xor edx, edx
div dword [0x141dcbbfc]
add eax, 0xb27f6d2b
cmp eax, 0x775c7c6d
jb 0x140075f50
mov rbx, qword [rbx - 8]
mov eax, dword [0x141dcbc00]
or eax, dword [0x141dcbc04]
or eax, 0xab9537e5
add eax, 0xd8dcfa08
xor eax, 0x77565af4
cmp eax, 0x5a8d1dfa
jae 0x140075fa2
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dcbc08]
xor edx, edx
div dword [0x141dcbc0c]
mov ebp, eax
or ebp, 0xab87dc67
and ebp, 0xeb9fdd7f
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rbx
call r13
cmp ebp, 0x8b52eac
jb 0x140075fb0
and r15b, r12b
mov qword [r14 + 0x18], 0
mov eax, 0x85657c33
nop word cs:[rax + rax]
mov ecx, dword [0x141dcbc10]
xor ecx, dword [0x141dcbc14]
xor ecx, 0x53ee3e80
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x9cea722c
je 0x140076000
mov rbx, qword [rdi]
nop word cs:[rax + rax]
mov eax, dword [0x141dcbc18]
or eax, dword [0x141dcbc1c]
or eax, 0xf72c3908
imul eax, eax, 0xdbe21517
or eax, 0x487a222b
cmp eax, 0x45a9cd80
jb 0x140076030
test rbx, rbx
je 0x140076372
nop dword [rax]
mov eax, dword [0x141dcbc20]
sub eax, dword [0x141dcbc24]
add eax, 0xb1ddb31a
and eax, 0x28d01892
xor eax, 0x610702b0
cmp eax, 0x57972a53
ja 0x140076060
test r15b, r15b
je 0x140076096
xor eax, eax
test al, al
je 0x1400763e9
jmp 0x1400763f3
mov rax, 0xffffffffffffffff
lock xadd qword [rbx + 0x18], rax
nop word cs:[rax + rax]
mov ecx, dword [0x141dcbc28]
xor ecx, dword [0x141dcbc2c]
xor ecx, 0x30600028
and ecx, 0xb0708028
cmp ecx, 0x9114b439
ja 0x1400760b0
cmp rax, 1
jne 0x14007611a
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400760e0
mov rcx, qword [rbx + 0x10]
add rcx, 0x30
mov al, 1
xchg byte [rcx], al
mov edx, dword [0x141dcbc38]
xor edx, dword [0x141dcbc3c]
add edx, 0x4789978b
xor edx, 0xce75b30
cmp edx, 0x66dbb177
jb 0x1400760f0
cmp al, 0xff
jne 0x14007611a
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
mov rax, 0xffffffffffffffff
lock xadd qword [rbx], rax
nop word cs:[rax + rax]
mov ecx, dword [0x141dcbc40]
xor ecx, dword [0x141dcbc44]
or ecx, 0x712ba1d3
and ecx, 0xfbaffdff
cmp ecx, 0xdc7f3bb
je 0x140076130
cmp rax, 1
jne 0x14007622d
mov eax, dword [0x141dcbc48]
add eax, dword [0x141dcbc4c]
mov ecx, 0xa9f6d41d
imul rcx, rax
shr rcx, 0x3f
add ecx, 0x1e9aef01
cmp ecx, 0x96357726
jbe 0x140076181
mov eax, 0xf45de627
nop word cs:[rax + rax]
mov ecx, dword [0x141dcbc50]
sub ecx, dword [0x141dcbc54]
imul rcx, rax
shr rcx, 0x39
or ecx, 0x59e00100
and ecx, 0x59e00101
cmp ecx, 0xcb9f3014
ja 0x140076190
mov eax, dword [0x141dcbc58]
or eax, dword [0x141dcbc5c]
imul eax, eax, 0x7b06af5e
add eax, 0x848321c6
or eax, 0xd1f565c5
cmp eax, 0x4d6e5640
je 0x140076204
mov eax, dword [0x141dcbc60]
imul eax, dword [0x141dcbc64]
imul ebx, eax, 0x2883a564
and ebx, 0x9f5c1f10
mov rcx, rdi
call fcn.140076700
cmp ebx, 0xe239c704
jbe 0x140076210
mov rcx, rdi
call fcn.140076700
jmp 0x1400761db
mov eax, dword [0x141dcbc68]
and eax, dword [0x141dcbc6c]
add eax, 0x9007285d
xor eax, 0xaea085db
cmp eax, 0xa691eefa
ja 0x140076210
mov rax, qword [r14 + 0x18]
nop word cs:[rax + rax]
mov ecx, dword [0x141dcbc70]
imul ecx, dword [0x141dcbc74]
add ecx, 0x3a5c6017
imul rcx, rcx, 0x371ceec9
shr rcx, 0x3d
cmp ecx, 0xaccb6104
je 0x140076240
test rax, rax
je 0x140076372
mov rdi, qword [r14 + 0x20]
test rdi, rdi
je 0x140076372
mov rbx, qword [r14 + 0x28]
mov eax, dword [0x141dcbc78]
sub eax, dword [0x141dcbc7c]
cmp eax, 0x669c5a17
je 0x140076280
mov r14, qword [rbx]
test r14, r14
je 0x1400762f6
mov eax, dword [0x141dcbc80]
xor edx, edx
div dword [0x141dcbc84]
add eax, 0xf7f0d9c2
mov ecx, 0xa1236eb9
imul rcx, rax
shr rcx, 0x3e
and ecx, 1
cmp ecx, 0x9d7c7767
jne 0x1400762d0
mov rcx, rdi
call r14
nop dword [rax]
mov eax, dword [0x141dcbc88]
add eax, dword [0x141dcbc8c]
imul ebp, eax, 0x7f1bfe1a
xor ebp, 0xbfcd4569
mov rcx, rdi
call r14
cmp ebp, 0x4db69c5b
ja 0x1400762d0
mov rcx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
nop
mov edx, dword [0x141dcbc90]
add edx, dword [0x141dcbc94]
or edx, 0x82c3f279
imul rdx, rdx, 0x46e64955
shr rdx, 0x3d
cmp edx, 0x8698e19e
je 0x140076300
test rcx, rcx
je 0x140076372
nop word [rax + rax]
mov ecx, dword [0x141dcbc98]
or ecx, dword [0x141dcbc9c]
add ecx, 0x58a9cc03
or ecx, 0x980214
and ecx, 0xadba2a15
cmp ecx, 0x2ede6330
ja 0x140076330
cmp rax, 0x11
jb 0x140076360
mov rdi, qword [rdi - 8]
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsi]
cmp r8, 0xffffffffffffffff
je 0x1400763d7
mov rax, 0xffffffffffffffff
lock xadd qword [r8 + 8], rax
nop dword [rax + rax]
mov ecx, dword [0x141dcbca0]
imul ecx, dword [0x141dcbca4]
add ecx, 0xc845fd33
or ecx, 0xb5d99eec
cmp ecx, 0xffc3ea3b
ja 0x140076390
cmp rax, 1
jne 0x1400763d7
mov rcx, qword [0x141ddb260]
xor edx, edx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rbx + 0x20], 1
xor eax, eax
test al, al
je 0x140076400
mov byte [rbx + 0x20], 1
jmp 0x1400763e9
mov eax, dword [0x141dcbc30]
imul eax, dword [0x141dcbc34]
xor eax, 0x52c0450
and eax, 0x77c4650
cmp eax, 0xba8e19b0
je 0x140076400
jmp 0x140076096