Function at 0x180004478
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebp, dword [rsp + 0x90]
lea r12d, [r8 - 0x17b]
mov esi, dword [rsp + 0x98]
lea r8d, [rcx - 0x2436]
mov rdi, r9
lea eax, [r8 + 0x277e]
mov r9d, 0x2e16
lea r13d, [rcx - 0xaa]
lea r15d, [rbp - 0x698]
add esi, 0xffffd55c
xor ebp, r9d
lea r14d, [rdx + 0x66e]
cmp esi, eax
je 0x1800047b0
lea eax, [rsi + 0x2f66]
cmp r14d, eax
jge 0x1800046fc
mov ecx, dword [0x1802690fc]
cmp ecx, dword [0x180269024]
jbe 0x180004516
mov rax, qword [section..data]
sub ecx, dword [rax + 0x14]
sub ecx, 0x154a9
xor dword [rax + 0x74], ecx
mov rcx, qword [section..data]
mov rax, qword [rcx + 0xc0]
mov qword [0x1802690c0], rax
mov eax, dword [rdi + 0x94]
sub eax, dword [rdi + 0x6c]
add eax, 0x6856bcac
mov dword [rcx + 0x54], eax
cmp dword [rdi + 0xec], 0xbab9
ja 0x180004562
mov eax, dword [rdi + 0xb8]
mov rcx, qword [section..data]
sub eax, 0x2db22
xor dword [rcx + 0xf8], eax
jmp 0x180004570
lea rax, [0x180091a80]
mov qword [rdi + 0xa8], rax
xor r10d, r10d
mov rax, qword [section..data]
mov ecx, dword [rax + 0xd0]
mov eax, dword [0x180269108]
add eax, 0x43ba0
add ecx, eax
mov eax, dword [0x1802690a8]
xor dword [0x180269024], ecx
add eax, 0xffe8bc8d
add dword [rdi + 0xf0], eax
mov eax, dword [rdi + 0x4c]
sub eax, dword [0x180269018]
sub eax, 0x2d5f4fc1
xor dword [0x1802690a8], eax
mov rax, qword [0x1802690b8]
mov r9d, dword [r10 + rax]
add r10, 4
mov rax, qword [section..data]
mov ecx, dword [rax + 0xf8]
xor ecx, 1
sub dword [rdi + 8], ecx
mov rcx, qword [section..data]
mov eax, dword [0x1802690fc]
sub eax, dword [0x180269100]
sub eax, 0x18c85d
xor dword [0x180269048], eax
mov eax, dword [rcx + 0xd8]
sub eax, 0x3b2b8
xor dword [rcx + 0x14], eax
mov eax, dword [rdi + 0x64]
mov rdx, qword [section..data]
xor eax, 0x57
add dword [0x18026907c], eax
mov eax, dword [0x1802690a4]
xor eax, dword [rdi + 0x14]
xor eax, 0x17151c
mov dword [0x1802690a4], eax
mov ecx, dword [rdx + 0x94]
mov eax, dword [0x1802690c8]
add eax, 0xfff16e2c
imul ecx, eax
mov dword [rdx + 0x94], ecx
movsxd rdx, dword [rdi + 0x74]
imul r9d, dword [rdi + 0x54]
mov rax, qword [section..data]
mov rcx, qword [rax + 0xb0]
mov r8d, r9d
shr r8d, 8
mov byte [rdx + rcx], r8b
inc dword [rdi + 0x74]
mov rax, qword [section..data]
movsxd rdx, dword [rdi + 0x74]
mov rcx, qword [rax + 0xb0]
mov byte [rdx + rcx], r9b
inc dword [rdi + 0x74]
mov rcx, qword [section..data]
mov eax, dword [0x180269034]
sub eax, dword [rcx + 0xec]
xor eax, 0xffda6969
add dword [0x18026907c], eax
mov eax, dword [rcx + 0xd0]
sub eax, dword [0x18026911c]
xor eax, 0xfffbc454
sub dword [0x1802690ac], eax
mov eax, 0xfffbc45f
sub eax, dword [rdi + 0xd0]
add dword [rcx + 0xf8], eax
cmp r10, 0x1be010
jl 0x180004573
mov eax, dword [0x1802690e0]
add eax, 0x45708
mov dword [0x180269064], eax
mov rax, qword [section..data]
add dword [rax + 0x54], 0xc4ec335e
jmp 0x1800047b0
mov rcx, qword [section..data]
imul eax, esi, 0x2f66
movsxd r8, r8d
mov r10d, dword [rcx + 0xf8]
mov ebx, dword [rcx + 0x3c]
mov edx, dword [rcx + 0x48]
and ebx, r14d
mov ecx, dword [0x1802690f0]
add ebx, r9d
mov r9d, dword [rdi + 0x3c]
movsxd r11, eax
or r9d, 0x2ade
movsxd rax, r12d
add r9d, ebp
xor r8, rax
imul r10d, r15d
mov eax, dword [rdi + 0x8c]
and rdx, rax
mov dword [rsp + 0x30], ebx
mov eax, r15d
mov qword [rsp + 0x28], r11
or rdx, rax
imul ecx, r13d
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov rax, qword [section..data]
mov ecx, dword [rax + 0xf0]
mov eax, 0xffffdbca
imul ecx, r12d
sub eax, ecx
add dword [rdi + 0x24], eax
mov ecx, dword [0x180269048]
mov rdx, qword [section..data]
or ecx, ebp
or dword [rdx + 0x24], ecx
mov rcx, qword [section..data]
mov edx, dword [rcx + 0xd0]
or edx, dword [0x180269024]
xor edx, r14d
add dword [0x180269098], edx
lea r11, [rsp + 0x40]
xor esi, 0x269c
mov rbx, qword [r11 + 0x30]
mov eax, esi
mov rsi, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret