Function at 0x180001c30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], 0xfffffffffffffffe
mov r12, rcx
cmp byte [0x180047850], 0
jne 0x180001d5e
mov rdx, qword [0x180046420]
movabs rax, 0x8140e67bb1de784a
add rax, rdx
movabs rcx, 0x8140e67bb1de7862
add rcx, rdx
xor edx, edx
lea r8, [0x18004784a]
nop dword [rax]
movzx r9d, byte [rcx + rdx]
movzx r10d, byte [rax + rdx]
mov esi, r9d
xor sil, 1
and sil, r9b
mov r11d, r10d
xor r11b, 0x89
and r11b, r10b
mov ebx, r9d
and bl, 0x16
and sil, 0xa9
mov edi, r9d
and dil, 0x40
or bl, 0x41
xor bl, dil
mov edi, r9d
and dil, 1
or dil, 0xe2
xor dil, sil
mov esi, edi
xor sil, 0xf4
and dil, bl
not bl
and bl, sil
and dil, 0x41
mov esi, r9d
xor sil, 0xa9
xor r9b, 0x56
or r9b, sil
not r9b
or r9b, dil
or r9b, bl
and r11b, 0xa9
mov ebx, r10d
and bl, 0x52
mov esi, r10d
and sil, 0x56
xor bl, 0xdb
lea edi, [r11 + 4]
xor sil, 0x24
and sil, dil
or r10b, 0x52
xor r10b, r11b
and r10b, bl
or r10b, sil
mov r11d, r9d
xor r11b, 0xd5
mov ebx, r10d
xor bl, 0xd5
xor r9b, 0x2a
and r9b, bl
xor r10b, 0x2a
and r10b, r11b
or r10b, r9b
mov byte [rdx + r8], r10b
inc rdx
cmp rdx, 6
jne 0x180001c90
mov byte [0x180047850], 1
movabs r13, 0x8140e67bb1de7696
mov rbx, qword [0x180046428]
add rbx, r13
xorps xmm0, xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm0
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x180002669
mov rdi, rax
cmp rax, 0xf
ja 0x180001dbe
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 0xf
lea rcx, [rbp - 0x40]
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbp
add rdi, 0xffffffffffffffc0
jmp 0x180001eb9
mov ecx, edi
and ecx, 0xf
mov rdx, rcx
not rdx
mov r8, rdi
xor r8, 0xf
mov rax, rdi
xor rax, 0xfffffffffffffff0
mov r9d, edi
and r9d, 1
movabs r10, 0x7e4780d6dd9c0121
xor r10, rdi
or r8, rax
and r8, r10
movabs r10, 0x420200d2d800000e
and r10, rdx
or r10, r9
movabs r9, 0x3c458004059c0120
or r9, r10
xor r9, r8
xor rcx, rax
xor rax, rdx
or rax, rcx
not rax
or rax, r9
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
lea rax, [rbp - 0x40]
cmp r15, 0xfff
jb 0x180001e8c
lea rcx, [r15 + 0x28]
mov qword [rbp + 0x68], rax
call fcn.180035cbc
mov rcx, 0xffffffffffffffd8
sub rcx, rax
mov rdx, rax
add rdx, 0x27
movabs r8, 0x200806a620eb8002
and r8, rdx
movabs r9, 0xdff7f959df147ffd
and r9, rcx
or r9, r8
movabs r14, 0xdff7f959df147fe2
xor r14, r9
and r14, rdx
mov qword [r14 - 8], rax
jmp 0x180001e9c
lea rcx, [r15 + 1]
mov qword [rbp + 0x68], rax
call fcn.180035cbc
mov r14, rax
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], r15
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
mov byte [rdi], 0
lea rdi, [rbp - 0x20]
cmp byte [0x180047857], 0
jne 0x180001f82
mov rdx, qword [0x180046420]
movabs rax, 0x8140e67bb1de787e
add rax, rdx
movabs rcx, 0x8140e67bb1de7897
add rcx, rdx
xor edx, edx
lea r8, [0x180047851]
nop word [rax + rax]
movzx r9d, byte [rcx + rdx]
movzx r10d, byte [rax + rdx]
mov ebx, r10d
not bl
mov esi, r10d
and sil, 4
mov r14d, r10d
and r14b, 0xfb
mov r11d, r9d
xor r11b, 4
and bl, 0x80
add r14b, 0x80
and r14b, r10b
mov r15d, esi
xor r15b, 0x84
or bl, r14b
or sil, 0x7b
and sil, r14b
not bl
and bl, r15b
mov r14d, r10d
xor r14b, 0xfb
xor r10b, 4
or r10b, r14b
not r10b
or r10b, sil
or r10b, bl
mov ebx, r9d
and bl, 0x68
xor r9b, 0x6c
and r9b, r11b
xor r9b, bl
xor r9b, r10b
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 6
jne 0x180001f00
mov byte [0x180047857], 1
mov r14, qword [0x180046430]
add r14, r13
xorps xmm0, xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x180002676
mov rbx, rax
cmp rax, 0xf
ja 0x180001fd2
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 0xf
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
jmp 0x1800020d3
mov ecx, ebx
and ecx, 0xf
mov rdx, rcx
not rdx
mov r8, rbx
xor r8, 0xf
mov rax, rbx
xor rax, 0xfffffffffffffff0
mov r9d, ebx
and r9d, 1
movabs r10, 0x7e4780d6dd9c0121
xor r10, rbx
or r8, rax
and r8, r10
movabs r10, 0x420200d2d800000e
and r10, rdx
or r10, r9
movabs r9, 0x3c458004059c0120
or r9, r10
xor r9, r8
xor rcx, rax
xor rax, rdx
or rax, rcx
not rax
or rax, r9
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp r15, 0xfff
jb 0x18000209c
lea rcx, [r15 + 0x28]
mov qword [rbp + 0x68], rdi
call fcn.180035cbc
mov rcx, 0xffffffffffffffd8
sub rcx, rax
mov rdx, rax
add rdx, 0x27
movabs r8, 0x200806a620eb8002
and r8, rdx
movabs r9, 0xdff7f959df147ffd
and r9, rcx
or r9, r8
movabs rdi, 0xdff7f959df147fe2
xor rdi, r9
and rdi, rdx
mov qword [rdi - 8], rax
jmp 0x1800020ac
lea rcx, [r15 + 1]
mov qword [rbp + 0x68], rdi
call fcn.180035cbc
mov rdi, rax
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], r15
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
movabs r13, 0x8140e67bb1de7696
mov byte [rbx], 0
lea r14, [rbp]
movabs rcx, 0x8140e67bb1de78b6
add rcx, qword [0x180046420]
call fcn.180031610
mov rbx, qword [0x180046438]
add rbx, r13
xorps xmm0, xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp + 0x10], xmm0
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x18000267f
mov rdi, rax
cmp rax, 0xf
ja 0x180002141
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], 0xf
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
jmp 0x180002242
mov ecx, edi
and ecx, 0xf
mov rdx, rcx
not rdx
mov r8, rdi
xor r8, 0xf
mov rax, rdi
xor rax, 0xfffffffffffffff0
mov r9d, edi
and r9d, 1
movabs r10, 0x7e4780d6dd9c0121
xor r10, rdi
or r8, rax
and r8, r10
movabs r10, 0x420200d2d800000e
and r10, rdx
or r10, r9
movabs r9, 0x3c458004059c0120
or r9, r10
xor r9, r8
xor rcx, rax
xor rax, rdx
or rax, rcx
not rax
or rax, r9
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp r15, 0xfff
jb 0x18000220b
lea rcx, [r15 + 0x28]
mov qword [rbp + 0x68], r14
call fcn.180035cbc
mov rcx, 0xffffffffffffffd8
sub rcx, rax
mov rdx, rax
add rdx, 0x27
movabs r8, 0x200806a620eb8002
and r8, rdx
movabs r9, 0xdff7f959df147ffd
and r9, rcx
or r9, r8
movabs r14, 0xdff7f959df147fe2
xor r14, r9
and r14, rdx
mov qword [r14 - 8], rax
jmp 0x18000221b
lea rcx, [r15 + 1]
mov qword [rbp + 0x68], r14
call fcn.180035cbc
mov r14, rax
mov qword [rbp], r14
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], r15
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
movabs r13, 0x8140e67bb1de7696
mov byte [rdi], 0
lea r14, [rbp + 0x20]
cmp byte [0x180047862], 0
jne 0x1800022e8
mov rax, qword [0x180046420]
movabs rcx, 0x8140e67bb1de78f3
movzx ecx, byte [rax + rcx]
movabs rdx, 0x8140e67bb1de790b
xor cl, byte [rax + rdx]
mov byte [0x18004785e], cl
movabs rcx, 0x8140e67bb1de78f4
movzx ecx, byte [rax + rcx]
movabs rdx, 0x8140e67bb1de790c
xor cl, byte [rax + rdx]
mov byte [0x18004785f], cl
movabs rcx, 0x8140e67bb1de78f5
movzx ecx, byte [rax + rcx]
movabs rdx, 0x8140e67bb1de790d
xor cl, byte [rax + rdx]
mov byte [0x180047860], cl
movabs rcx, 0x8140e67bb1de78f6
movzx ecx, byte [rax + rcx]
movabs rdx, 0x8140e67bb1de790e
xor cl, byte [rax + rdx]
mov byte [0x180047861], cl
mov byte [0x180047862], 1
mov rbx, qword [0x180046440]
add rbx, r13
xorps xmm0, xmm0
movups xmmword [r14 + 0x10], xmm0
movups xmmword [r14], xmm0
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x180002688
mov rdi, rax
cmp rax, 0xf
ja 0x180002329
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], 0xf
jmp 0x18000240f
mov ecx, edi
and ecx, 0xf
mov rdx, rcx
not rdx
mov r8, rdi
xor r8, 0xf
mov rax, rdi
xor rax, 0xfffffffffffffff0
mov r9d, edi
and r9d, 1
movabs r10, 0x7e4780d6dd9c0121
xor r10, rdi
or r8, rax
and r8, r10
movabs r10, 0x420200d2d800000e
and r10, rdx
or r10, r9
movabs r9, 0x3c458004059c0120
or r9, r10
xor r9, r8
xor rcx, rax
xor rax, rdx
or rax, rcx
not rax
or rax, r9
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp r15, 0xfff
jb 0x1800023f3
lea rcx, [r15 + 0x28]
mov qword [rbp + 0x68], r14
call fcn.180035cbc
mov rcx, 0xffffffffffffffd8
sub rcx, rax
mov rdx, rax
add rdx, 0x27
movabs r8, 0x200806a620eb8002
and r8, rdx
movabs r9, 0xdff7f959df147ffd
and r9, rcx
or r9, r8
movabs r14, 0xdff7f959df147fe2
xor r14, r9
and r14, rdx
mov qword [r14 - 8], rax
jmp 0x180002403
lea rcx, [r15 + 1]
mov qword [rbp + 0x68], r14
call fcn.180035cbc
mov r14, rax
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], r15
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
mov byte [rdi], 0
lea rax, [rbp - 0x40]
mov qword [rbp - 0x58], rax
lea rax, [rbp + 0x40]
mov qword [rbp - 0x50], rax
lea rcx, [rbp + 0x48]
lea rdx, [rbp - 0x58]
lea r8, [rbp + 0x67]
call fcn.180002960
mov edi, 0x60
movabs r14, 0xa05f51e0654154e6
movabs rbx, 0x8140e67bb1de7696
nop dword [rax]
mov rax, qword [rbp + rdi - 0x28]
cmp rax, 0x10
jb 0x1800024a1
mov rcx, qword [rbp + rdi - 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18000249c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x180002663
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.180035d00
mov qword [rbp + rdi - 0x30], 0
mov qword [rbp + rdi - 0x28], 0xf
mov byte [rbp + rdi - 0x40], 0
test rdi, rdi
mov eax, 0x30
cmove rax, rdi
mov rsi, qword [0x180046448]
add rax, rsi
mov rax, qword [rbx + rax]
add rax, r14
jmp rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea rax, [rbp - 0x40]
mov qword [rbp + 0x68], rax
call fcn.18000d970
mov qword [rbp + 0x68], rdi
call fcn.18000d970
mov qword [rbp + 0x68], r14
call fcn.18000d970
mov qword [rbp + 0x68], r14
call fcn.18000d970
int3