Function at 0x140004da0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push r13
sub rsp, 0x48
mov r13, rcx
mov rdx, 0xffffffffffffffff
mov ecx, 0x202000
call qword [sym.imp.ntoskrnl.exe_MmAllocateContiguousMemory]
mov qword [r13 + 0x18], rax
mov rsi, rax
test rax, rax
jne 0x140004def
mov r9d, 0xfe
lea r8, [0x14000b5c0]
lea rdx, [0x14000b5e0]
lea ecx, [rax + 1]
call fcn.140007cc0
xor al, al
add rsp, 0x48
pop r13
pop rsi
ret
mov qword [rsp + 0x70], rbx
xor eax, eax
mov qword [rsp + 0x40], rbp
lea rbx, [rsi + 0x1000]
mov qword [rsp + 0x38], rdi
mov ecx, 0x202000
mov qword [rsp + 0x30], r12
mov rdi, rsi
rep stosb byte [rdi], al
mov rcx, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
lea r14, [rsi + 0x2000]
movabs rbp, 0xfffffffff000
and rax, 0xfffffffffffff000
mov qword [rsp + 0x60], r14
xor rax, qword [rsi]
mov rdi, rbx
and rax, rbp
mov ecx, 0x200
xor rax, qword [rsi]
or rax, 7
mov qword [rsi], rax
mov eax, 7
rep stosq qword [rdi], rax
mov rdi, r14
mov esi, 0x200
nop dword [rax]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
add rdi, 0x1000
lea rbx, [rbx + 8]
and rax, 0xfffffffffffff000
xor rax, qword [rbx - 8]
and rax, rbp
xor qword [rbx - 8], rax
sub rsi, 1
jne 0x140004e70
mov eax, 0x87
mov rdi, r14
mov ecx, 0x40000
xor r12d, r12d
rep stosq qword [rdi], rax
movabs rax, 0xffffffe00000
nop dword [rax + rax]
xor ebp, ebp
mov r15d, r12d
nop word [rax + rax]
movsxd rbx, r15d
xor edx, edx
mov r9, rbx
shl rbx, 0x15
shl r9, 0x15
xor r9, qword [r14]
and r9, rax
xor r9, qword [r14]
lea rdi, [rbx + 0x1fffff]
mov qword [r14], r9
mov rax, qword [0x14000f2c8]
mov r8d, dword [rax + 0x970]
test r8d, r8d
je 0x14000501c
add rax, 0x10
nop
mov rcx, qword [rax + 8]
cmp rbx, rcx
ja 0x140004f1e
cmp rdi, rcx
ja 0x140004f81
mov rcx, qword [rax]
cmp rbx, rcx
jae 0x140004f2b
cmp rdi, rcx
jae 0x140004f81
inc edx
add rax, 0x18
cmp edx, r8d
jb 0x140004f10
mov rcx, qword [0x14000f2c8]
xor edx, edx
lea rax, [rcx + 0x18]
movzx ecx, byte [rcx + 0x974]
nop word [rax + rax]
cmp rbx, qword [rax - 8]
jb 0x140004f71
cmp rdi, qword [rax]
ja 0x140004f71
cmp byte [rax + 9], 1
movzx ecx, byte [rax + 8]
je 0x140005023
test cl, cl
je 0x140005023
inc edx
add rax, 0x18
cmp edx, r8d
jb 0x140004f50
jmp 0x140005023
mov rax, qword [0x14000f2c8]
lea rcx, [rsp + 0x68]
xor esi, esi
mov rdx, qword [rax + 8]
mov rdi, qword [rdx + 8]
add rdx, 0x14
call fcn.140008900
mov rax, qword [0x14000f2c8]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx + 8]
mov rcx, qword [rdi]
cmp rdx, rcx
je 0x140004fde
cmp dword [rcx - 8], 3
jne 0x140004fc3
cmp byte [rcx + 0x10], sil
je 0x140004fd0
mov rax, qword [rcx]
mov rcx, rax
cmp rdx, rax
jne 0x140004fb7
jmp 0x140004fde
cmp byte [rcx + 0x11], 0
mov rsi, qword [rcx - 0x18]
mov byte [rcx + 0x10], 1
jne 0x140004ff1
mov edx, 1
mov ecx, 0x2000
lea r8d, [rdx + 2]
call fcn.140008780
lea rcx, [rsp + 0x68]
call fcn.140008960
test rsi, rsi
je 0x1400050a4
mov r8, rbx
mov rdx, rsi
mov rcx, r13
call fcn.1400057c0
test al, al
je 0x1400050c2
jmp 0x140005036
movzx ecx, byte [rax + 0x974]
movzx eax, cl
shl rax, 3
xor rax, r9
and eax, 0x38
xor rax, r9
mov qword [r14], rax
inc r15d
inc rbp
add r14, 8
movabs rax, 0xffffffe00000
cmp rbp, 0x200
jl 0x140004ed0
mov r14, qword [rsp + 0x60]
add r12d, 0x200
add r14, 0x1000
mov qword [rsp + 0x60], r14
cmp r12d, 0x40000
jl 0x140004ec0
mov al, 1
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x20]
add rsp, 0x48
pop r13
pop rsi
ret
mov r9d, 0xea
lea r8, [0x14000b570]
lea rdx, [0x14000b590]
mov ecx, 1
call fcn.140007cc0
xor al, al
jmp 0x14000507e