Function at 0x1400b9e60
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r13
mov r13, r8
push r12
mov r12, r9
push rdi
mov rdi, rcx
mov ecx, 1
push rsi
mov rsi, rdx
mov edx, pe_nt_image_headers64
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
call sub.msvcrt.dll_calloc
test rax, rax
je 0x1400ba402
mov r9, rdi
lea r8, [0x1402a9444]
mov rcx, rax
mov rbx, rax
mov edx, 0x20
call fcn.1401fd9a0
mov rcx, r13
call sub.msvcrt.dll__strdup_1
mov rcx, r12
mov qword [rbx + 0x30], rax
call sub.msvcrt.dll__strdup_1
mov qword [rbx + 0x20], rsi
mov rcx, rbx
mov qword [rbx + 0x38], rax
call sub.msvcrt.dll_strlen
mov r10, rax
cmp eax, 0xb
jbe 0x1400ba3df
mov r9d, eax
mov r8, rbx
mov ecx, 0xfeedbeef
mov esi, 0x9e3779b9
mov r11d, 0x9e3779b9
nop word [rax + rax]
movzx edx, byte [r8 + 5]
movzx eax, byte [r8 + 6]
shl edx, 8
shl eax, 0x10
add edx, eax
movzx eax, byte [r8 + 4]
add edx, eax
movzx eax, byte [r8 + 7]
shl eax, 0x18
add edx, eax
movzx eax, byte [r8 + 9]
add edx, esi
movzx esi, byte [r8 + 0xa]
shl eax, 8
shl esi, 0x10
add eax, esi
movzx esi, byte [r8 + 8]
add eax, esi
movzx esi, byte [r8 + 0xb]
shl esi, 0x18
add eax, esi
movzx esi, byte [r8 + 2]
add eax, ecx
movzx ecx, byte [r8 + 1]
shl esi, 0x10
shl ecx, 8
add ecx, esi
movzx esi, byte [r8]
add ecx, esi
movzx esi, byte [r8 + 3]
shl esi, 0x18
add ecx, esi
sub ecx, edx
sub edx, eax
sub ecx, eax
add ecx, r11d
mov r11d, eax
shr r11d, 0xd
xor ecx, r11d
sub edx, ecx
sub eax, ecx
mov r11d, edx
mov edx, ecx
shl edx, 8
xor edx, r11d
sub eax, edx
mov r11d, eax
mov eax, edx
shr eax, 0xd
xor eax, r11d
sub ecx, edx
sub r9d, 0xc
add r8, 0xc
sub ecx, eax
sub edx, eax
mov r11d, ecx
mov ecx, eax
shr ecx, 0xc
xor ecx, r11d
sub edx, ecx
sub eax, ecx
mov r11d, edx
mov edx, ecx
shl edx, 0x10
xor edx, r11d
sub eax, edx
sub ecx, edx
mov r11d, eax
mov eax, edx
shr eax, 5
xor eax, r11d
mov r11d, eax
sub ecx, eax
sub edx, eax
shr r11d, 3
xor r11d, ecx
mov esi, r11d
sub edx, r11d
sub eax, r11d
shl esi, 0xa
xor esi, edx
mov ecx, esi
sub eax, esi
shr ecx, 0xf
xor ecx, eax
cmp r9d, 0xb
ja 0x1400b9f00
add ecx, r10d
cmp r9d, 0xb
ja case.0x1400ba018.0
lea rdx, [0x1402a95b4]
movsxd rax, dword [rdx + r9*4]
add rax, rdx
jmp rax
movzx eax, byte [r8 + 0xa]
shl eax, 0x18
add ecx, eax
movzx eax, byte [r8 + 9]
shl eax, 0x10
add ecx, eax
movzx eax, byte [r8 + 8]
shl eax, 8
add ecx, eax
movzx eax, byte [r8 + 7]
shl eax, 0x18
add esi, eax
movzx eax, byte [r8 + 6]
shl eax, 0x10
add esi, eax
movzx eax, byte [r8 + 5]
shl eax, 8
add esi, eax
movzx eax, byte [r8 + 4]
add esi, eax
movzx eax, byte [r8 + 3]
shl eax, 0x18
add r11d, eax
movzx eax, byte [r8 + 2]
shl eax, 0x10
add r11d, eax
movzx eax, byte [r8 + 1]
shl eax, 8
add r11d, eax
movzx eax, byte [r8]
add r11d, eax
lea eax, [rsi + rcx]
mov r8d, ecx
sub esi, ecx
mov qword [rbx + 0x70], rbx
sub r11d, eax
shr r8d, 0xd
movd xmm0, r10d
xor r8d, r11d
mov edx, r8d
sub esi, r8d
sub ecx, r8d
shl edx, 8
xor edx, esi
mov eax, edx
sub ecx, edx
sub r8d, edx
shr eax, 0xd
xor eax, ecx
mov ecx, eax
sub r8d, eax
sub edx, eax
shr ecx, 0xc
xor ecx, r8d
sub edx, ecx
sub eax, ecx
mov r8d, edx
mov edx, ecx
shl edx, 0x10
xor edx, r8d
sub eax, edx
sub ecx, edx
mov r8d, eax
mov eax, edx
shr eax, 5
xor eax, r8d
mov r8d, eax
sub ecx, eax
sub edx, eax
shr r8d, 3
xor ecx, r8d
mov esi, ecx
sub edx, ecx
sub eax, ecx
shl esi, 0xa
xor esi, edx
sub eax, esi
shr esi, 0xf
xor esi, eax
mov rax, qword [0x1403e8788]
movd xmm1, esi
punpckldq xmm0, xmm1
movq qword [rbx + 0x78], xmm0
test rax, rax
je 0x1400ba350
mov rdx, qword [rax + 0x48]
mov qword [rbx + 0x58], 0
lea r12, [rbx + 0x48]
mov qword [rbx + 0x48], rdx
mov rcx, qword [rax + 0x48]
mov rdx, qword [rcx + 0x18]
sub rdx, qword [rcx + 0x20]
mov qword [rbx + 0x50], rdx
mov rdx, qword [rax + 0x48]
mov rdx, qword [rdx + 0x18]
mov qword [rdx + 0x10], rbx
mov rdx, qword [rax + 0x48]
mov qword [rdx + 0x18], r12
mov rdi, qword [rax + 0x48]
mov edx, dword [rdi + 0x10]
add edx, 1
mov dword [rdi + 0x10], edx
mov rdx, qword [rax + 0x48]
mov eax, dword [rdx + 8]
sub eax, 1
and eax, esi
shl rax, 4
add rax, qword [rdx]
mov rdx, qword [rax]
add dword [rax + 8], 1
mov qword [rbx + 0x60], 0
mov qword [rbx + 0x68], rdx
mov rdx, qword [rax]
test rdx, rdx
je 0x1400ba199
mov qword [rdx + 0x18], r12
mov edx, dword [rax + 0xc]
mov qword [rax], r12
lea edx, [rdx + rdx*4 + 5]
add edx, edx
cmp dword [rax + 8], edx
jb 0x1400ba1b7
mov r12, qword [rbx + 0x48]
mov esi, dword [r12 + 0x34]
test esi, esi
je 0x1400ba1f0
lea rax, str.Added_command__s
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.dap_cli_server
call fcn.14005aec0
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
mov ecx, dword [r12 + 8]
mov edx, 1
shl rcx, 5
call sub.msvcrt.dll_calloc
mov rdi, rax
test rax, rax
je 0x1400ba3fa
mov edx, dword [r12 + 8]
mov eax, dword [r12 + 0x10]
mov ecx, dword [r12 + 0xc]
lea edx, [rdx + rdx - 1]
test edx, eax
setne dl
add ecx, 1
shr eax, cl
movzx edx, dl
add edx, eax
mov dword [r12 + 0x28], edx
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x2c], 0
mov r8, qword [rbx + 0x48]
mov eax, dword [r8 + 8]
test eax, eax
je 0x1400ba2f9
xor r10d, r10d
nop dword [rax]
mov edx, r10d
shl rdx, 4
add rdx, qword [r8]
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1400ba287
jmp 0x1400ba2ec
mov qword [rcx + 0x18], rdx
mov r8, qword [rbx + 0x48]
mov qword [rax], rdx
test r9, r9
je 0x1400ba2e8
mov eax, dword [r8 + 8]
mov rdx, r9
lea eax, [rax + rax - 1]
and eax, dword [rdx + 0x34]
mov r9, qword [rdx + 0x20]
shl rax, 4
add rax, rdi
mov ecx, dword [rax + 8]
add ecx, 1
mov dword [rax + 8], ecx
cmp ecx, dword [r8 + 0x28]
jbe 0x1400ba2c8
add dword [r8 + 0x2c], 1
mov r8, qword [rbx + 0x48]
mov ecx, dword [rax + 0xc]
mov r11d, dword [r8 + 0x28]
imul r11d, ecx
cmp dword [rax + 8], r11d
jbe 0x1400ba2c8
add ecx, 1
mov dword [rax + 0xc], ecx
mov qword [rdx + 0x18], 0
mov rcx, qword [rax]
mov qword [rdx + 0x20], rcx
test rcx, rcx
jne 0x1400ba270
mov qword [rax], rdx
mov r8, qword [rbx + 0x48]
test r9, r9
jne 0x1400ba280
mov eax, dword [r8 + 8]
add r10d, 1
cmp r10d, eax
jb 0x1400ba258
mov rcx, qword [r8]
call sub.msvcrt.dll_free
mov rax, qword [rbx + 0x48]
shl dword [rax + 8], 1
mov rax, qword [rbx + 0x48]
add dword [rax + 0xc], 1
mov rax, qword [rbx + 0x48]
mov qword [rax], rdi
mov rax, qword [rbx + 0x48]
mov edx, dword [rax + 0x10]
shr edx, 1
cmp dword [rax + 0x2c], edx
jbe 0x1400ba32b
mov edi, dword [rax + 0x30]
lea esi, [rdi + 1]
mov dword [rax + 0x30], esi
mov rax, qword [rbx + 0x48]
cmp dword [rax + 0x30], 1
jbe 0x1400ba1b7
mov dword [rax + 0x34], 1
jmp 0x1400ba1b7
pxor xmm0, xmm0
mov ecx, 0x40
movups xmmword [rbx + 0x50], xmm0
call sub.msvcrt.dll_malloc
mov qword [rbx + 0x48], rax
mov rdi, rax
test rax, rax
je 0x1400ba3fa
lea r12, [rbx + 0x48]
mov qword [rax + 0x10], 0
mov edx, 1
mov ecx, 0x200
mov qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
mov qword [rax + 0x38], 0
mov qword [rax + 0x18], r12
mov rax, qword [0x1402a98c0]
mov qword [rdi + 0x20], 0x48
mov qword [rdi + 8], rax
call sub.msvcrt.dll_calloc
mov dword [rdi + 0x38], 0xa0111fe1
mov qword [rdi], rax
test rax, rax
je 0x1400ba3fa
mov qword [0x1403e8788], rbx
mov rax, rbx
mov edx, 1
jmp 0x1400ba164
mov r9d, eax
mov r8, rbx
mov ecx, 0xfeedbeef
mov esi, 0x9e3779b9
mov r11d, 0x9e3779b9
jmp 0x1400ba001
or ecx, 0xffffffff
call sub.msvcrt.dll_exit
lea rax, [0x1402a9588]
mov r9d, 8
lea r8, str.dap_cli_server
mov edx, 0x217
mov qword [rsp + 0x20], rax
lea rcx, str.s_cmd_add_ex
call fcn.14005aec0
jmp 0x1400ba1db