Function at 0x1400bf470
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14, qword [rcx]
lea rdi, [r14 + 0x10]
mov rcx, qword [r14 + 0x18]
mov rbx, qword [r14 + 0x20]
test rcx, rcx
setne al
test rbx, rbx
setne bpl
and bpl, al
mov eax, dword [0x141f41fc8]
xor edx, edx
div dword [0x141f41fcc]
nop
mov eax, dword [0x141f41fd0]
sub eax, dword [0x141f41fd4]
or eax, 0xcb3e3b2a
and eax, 0xeb3efb3b
cmp eax, 0x7466646f
jb 0x1400bf4b0
test rcx, rcx
je 0x1400bf6b4
nop word cs:[rax + rax]
mov eax, dword [0x141f41fd8]
sub eax, dword [0x141f41fdc]
xor eax, 0xc81cd40f
add eax, 0x67d3d079
and eax, 0x8848c980
cmp eax, 0x5bed2345
je 0x1400bf4e0
mov r15, qword [r14 + 0x28]
nop word cs:[rax + rax]
mov eax, dword [0x141f41fe0]
sub eax, dword [0x141f41fe4]
imul eax, eax, 0x80974a72
add eax, 0x89e13b24
xor eax, 0xa4bffbe4
cmp eax, 0x8d6dbec1
ja 0x1400bf510
test rbx, rbx
je 0x1400bf6b4
mov eax, 0x9235272f
nop word cs:[rax + rax]
mov ecx, dword [0x141f41fe8]
xor ecx, dword [0x141f41fec]
imul ecx, ecx, 0xd0b43cae
add ecx, 0xe0395fe0
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xbbadb7c8
ja 0x1400bf550
mov r8, qword [r15]
mov ecx, 0xc475a377
mov eax, dword [0x141f41ff0]
xor edx, edx
div dword [0x141f41ff4]
imul rax, rcx
shr rax, 0x3e
imul eax, eax, 0xd955bfe3
cmp eax, 0xe98d3c4
ja 0x1400bf580
test r8, r8
je 0x1400bf5b0
mov rcx, rbx
call r8
nop
mov eax, dword [0x141f41ff8]
and eax, dword [0x141f41ffc]
add eax, 0xe5bc4277
or eax, 0xe132a54
imul rax, rax, 0x29b343a1
shr rax, 0x3d
cmp eax, 0xc948e95
ja 0x1400bf5b0
mov rax, qword [r15 + 8]
nop dword [rax]
mov ecx, dword [0x141f42000]
and ecx, dword [0x141f42004]
or ecx, 0x1fddebfb
cmp ecx, 0x75577662
je 0x1400bf5e0
test rax, rax
je 0x1400bf6b4
cmp qword [r15 + 0x10], 0x11
jb 0x1400bf662
nop word [rax + rax]
mov eax, dword [0x141f42008]
sub eax, dword [0x141f4200c]
imul eax, eax, 0x65f63b60
add eax, 0x4c71c7a0
xor eax, 0x7ba3ce94
cmp eax, 0x88186a22
ja 0x1400bf610
mov rbx, qword [rbx - 8]
nop word [rax + rax]
mov eax, dword [0x141f42010]
and eax, dword [0x141f42014]
and eax, 0x7174bf16
add eax, 0x97c75191
and eax, 0x6570e6b1
cmp eax, 0x562e3345
ja 0x1400bf640
mov eax, dword [0x141f42018]
xor eax, dword [0x141f4201c]
or eax, 0x4504
and eax, 0xb4406705
cmp eax, 0x2c81f4af
jne 0x1400bf691
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r15d, r15d
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rbx
call r12
test r15b, r15b
jne 0x1400bf6a0
mov eax, dword [0x141f42020]
and eax, dword [0x141f42024]
add eax, 0x708671c8
and eax, 0x88bd114a
cmp eax, 0xfde7efa8
jne 0x1400bf6e0
mov qword [r14 + 0x18], 0
nop dword [rax]
mov eax, dword [0x141f42028]
sub eax, dword [0x141f4202c]
xor eax, 0x6642166f
add eax, 0x34435471
mov qword [r14 + 0x18], 0
cmp eax, 0xb17f83b0
ja 0x1400bf6e0
mov rcx, qword [r14 + 0x10]
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400bf710
test rcx, rcx
je 0x1400bfcbb
mov eax, dword [0x141f42030]
xor edx, edx
div dword [0x141f42034]
nop dword [rax + rax]
mov eax, dword [0x141f42038]
imul eax, dword [0x141f4203c]
imul eax, eax, 0x206caa4d
add eax, 0xf6699be8
imul rax, rax, 0x568dca1b
shr rax, 0x3d
cmp eax, 0xab1226eb
ja 0x1400bf730
test bpl, bpl
je 0x1400bf7b9
mov eax, dword [0x141f42040]
or eax, dword [0x141f42044]
and eax, 0xd89ca5ec
add eax, 0xb5bdcc3c
cmp eax, 0x8525b4d
jae 0x1400bf780
mov byte [rcx + 0x20], 1
mov eax, 0xaa18f8af
nop word cs:[rax + rax]
mov edx, dword [0x141f42048]
sub edx, dword [0x141f4204c]
xor edx, 0xcb97df50
imul rdx, rax
shr rdx, 0x3c
and edx, 0xfffffffc
mov byte [rcx + 0x20], 1
cmp edx, 0x1c6f51ce
jae 0x1400bf790
lock dec qword [rcx + 0x18]
jne 0x1400bf862
nop word cs:[rax + rax]
mov eax, dword [0x141f42050]
xor eax, dword [0x141f42054]
and eax, 0xa508e2d9
add eax, 0x352dc23c
or eax, 0x69538046
cmp eax, 0x20be466e
jb 0x1400bf7d0
mov rcx, qword [rcx + 0x10]
mov r8b, 1
xchg byte [rcx + 0x30], r8b
add rcx, 0x30
nop word cs:[rax + rax]
mov eax, dword [0x141f42058]
xor edx, edx
div dword [0x141f4205c]
and eax, 0xba3fc4ed
add eax, 0x33bf6aa2
cmp eax, 0x28fd9ec8
jb 0x1400bf810
cmp r8b, 0xff
jne 0x1400bf862
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
nop dword [rax + rax]
mov eax, dword [0x141f42060]
sub eax, dword [0x141f42064]
xor eax, 0xaa7e6ec8
add eax, 0x1145f8c2
or eax, 0x6356b530
cmp eax, 0xd5a66a6d
je 0x1400bf840
mov rax, qword [rdi]
xor ecx, ecx
nop word [rax + rax]
test cl, cl
jne 0x1400bf870
nop word cs:[rax + rax]
mov ecx, dword [0x141f42068]
xor ecx, dword [0x141f4206c]
add ecx, 0x32fee981
and ecx, 0x71fd8b6b
add ecx, 0x1eb408d5
cmp ecx, 0xe36524af
ja 0x1400bf880
test rax, rax
je 0x1400bf9b9
mov ecx, dword [0x141f42070]
xor ecx, dword [0x141f42074]
or ecx, 0x5554bd5b
imul ecx, ecx, 0x19ee054e
and ecx, 0x41791cd8
cmp ecx, 0xee76a2ad
jne 0x1400bf8e0
lock dec qword [rax]
nop dword [rax]
mov ecx, dword [0x141f42078]
add ecx, dword [0x141f4207c]
and ecx, 0x80026003
or ecx, 0x4d9d873c
imul edx, ecx, 0xe22a315a
lock dec qword [rax]
sete cl
cmp edx, 0x80ea62c6
ja 0x1400bf8e0
nop dword [rax]
mov eax, dword [0x141f42080]
or eax, dword [0x141f42084]
cmp eax, 0x2a42e7ad
je 0x1400bf910
test cl, cl
je 0x1400bf9b9
mov eax, dword [0x141f42088]
or eax, dword [0x141f4208c]
and eax, 0x3e5a3d63
xor eax, 0x90d32332
imul rax, rax, 0x60fcee01
shr rax, 0x3e
cmp eax, 0x9988125
je 0x1400bf976
mov eax, dword [0x141f42090]
imul eax, dword [0x141f42094]
add eax, 0x2c28ceba
xor eax, 0x4004085c
or eax, 0x8f897283
cmp eax, 0x91c9e8e3
jae 0x1400bf978
jmp 0x1400bf953
mov rcx, rdi
call fcn.14007b900
mov ecx, 0x9c118483
nop word cs:[rax + rax]
mov eax, dword [0x141f42098]
xor edx, edx
div dword [0x141f4209c]
add eax, 0xbd9f04ef
shr eax, 1
imul rax, rcx
shr rax, 0x3c
xor eax, 0x152601ef
cmp eax, 0x8ebaff0e
ja 0x1400bf990
mov rax, qword [r14 + 0x18]
nop dword [rax]
mov ecx, dword [0x141f420a0]
sub ecx, dword [0x141f420a4]
imul ecx, ecx, 0xf2c036d9
xor ecx, 0xe75313b2
add ecx, 0xa30f08b
cmp ecx, 0x32334090
jb 0x1400bf9c0
test rax, rax
je 0x1400bfcbb
mov ecx, 0x800a4027
nop word cs:[rax + rax]
mov eax, dword [0x141f420a8]
xor edx, edx
div dword [0x141f420ac]
imul rax, rcx
shr rax, 0x3f
or eax, 0x359b3562
cmp eax, 0x587bbdbe
ja 0x1400bfa00
mov rdi, qword [r14 + 0x20]
mov rbx, qword [r14 + 0x28]
nop word [rax + rax]
mov eax, dword [0x141f420b0]
or eax, dword [0x141f420b4]
or eax, 0xc4e33b0c
add eax, 0x14421e4a
cmp eax, 0x733cd25f
ja 0x1400bfa30
test rdi, rdi
je 0x1400bfcbb
mov eax, 0xc4a96fcf
nop dword [rax + rax]
mov ecx, dword [0x141f420b8]
and ecx, dword [0x141f420bc]
add ecx, 0x1d19ca69
or ecx, 0xe360580b
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x20800df1
ja 0x1400bfa60
nop dword [rax + rax]
mov eax, dword [0x141f420c0]
and eax, dword [0x141f420c4]
imul eax, eax, 0x54b11b98
add eax, 0xeed47cc8
cmp eax, 0x8d3e8ea4
ja 0x1400bfa90
mov r14, qword [rbx]
nop word cs:[rax + rax]
mov eax, dword [0x141f420c8]
sub eax, dword [0x141f420cc]
or eax, 0x7390888a
and eax, 0x7391dcca
cmp eax, 0xa9af9b87
ja 0x1400bfac0
test r14, r14
je 0x1400bfb50
mov eax, dword [0x141f420d0]
mov ecx, dword [0x141f420d4]
add eax, ecx
add eax, 0xa97f034e
and eax, 0xc0b9f20b
cmp eax, 0xfb5c1dcf
jne 0x1400bfb07
mov rcx, rdi
call r14
xor ebp, ebp
nop dword [rax]
mov rcx, rdi
call r14
test bpl, bpl
jne 0x1400bfb10
nop dword [rax + rax]
mov eax, dword [0x141f420d8]
sub eax, dword [0x141f420dc]
and eax, 0x605d8cd5
xor eax, 0xd54c0e03
imul rax, rax, 0x2bd1aa2f
shr rax, 0x3d
cmp eax, 0x78fd82f2
je 0x1400bfb20
nop dword [rax + rax]
mov eax, dword [0x141f420e0]
imul eax, dword [0x141f420e4]
xor eax, 0x4caa4b29
add eax, 0x83212bd6
or eax, 0x6c474d17
cmp eax, 0x350289cc
jb 0x1400bfb50
cmp qword [rbx + 8], 0
je 0x1400bfcbb
mov rax, qword [rbx + 0x10]
nop word cs:[rax + rax]
mov ecx, dword [0x141f420e8]
and ecx, dword [0x141f420ec]
imul ecx, ecx, 0xa3ba6e5c
imul rcx, rcx, 0x5450c75
shr rcx, 0x3a
cmp ecx, 0x459f8173
ja 0x1400bfb90
cmp rax, 0x11
jb 0x1400bfc2d
nop dword [rax + rax]
mov eax, dword [0x141f420f0]
and eax, dword [0x141f420f4]
add eax, 0x85a61540
and eax, 0x34024800
cmp eax, 0xdf2de778
je 0x1400bfbc0
nop dword [rax]
mov eax, dword [0x141f420f8]
imul eax, dword [0x141f420fc]
add eax, 0x7de8a1ad
xor eax, 0x30
and eax, 0x54001f74
cmp eax, 0xa14b82a6
ja 0x1400bfbe0
mov rdi, qword [rdi - 8]
nop word cs:[rax + rax]
mov eax, dword [0x141f42100]
and eax, dword [0x141f42104]
xor eax, 0xbd6290ab
add eax, 0x9b73138b
cmp eax, 0x8830e31b
ja 0x1400bfc10
mov eax, dword [0x141f42108]
and eax, dword [0x141f4210c]
xor eax, 0x48d10201
or eax, 0xb722ecaa
imul eax, eax, 0x3d4141a5
cmp eax, 0x545fdf7
jne 0x1400bfc62
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov r14d, dword [0x141f42110]
or r14d, dword [0x141f42114]
imul rax, r14, 0x7034a91
shr rax, 0x20
sub r14d, eax
shr r14d, 1
add r14d, eax
shr r14d, 0x1d
add r14d, 0x8edc6494
and r14d, 0x4586018
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rdi
call rbx
cmp r14d, 0x2ff7ca34
je 0x1400bfc70
mov rsi, qword [rsi]
nop
mov eax, dword [0x141f42118]
imul eax, dword [0x141f4211c]
xor eax, 0x2a91cc0
add eax, 0xa7b469d7
and eax, 0xcbd824f
cmp eax, 0xb59237de
je 0x1400bfcc0
cmp rsi, 0xffffffffffffffff
je 0x1400bfdc0
lock dec qword [rsi + 8]
jne 0x1400bfdc0
mov eax, dword [0x141f42120]
or eax, dword [0x141f42124]
add eax, 0x61b77484
mov ecx, 0x89968a2d
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x8259af6b
jne 0x1400bfd30
mov rax, qword [0x141f49060]
nop word cs:[rax + rax]
mov eax, dword [0x141f42128]
xor edx, edx
div dword [0x141f4212c]
add eax, 0x1cddd2f8
xor eax, 0x8b055118
imul eax, eax, 0xe007a55e
mov rdi, qword [0x141f49060]
cmp eax, 0xb7e32896
ja 0x1400bfd30
mov eax, dword [0x141f42130]
xor eax, dword [0x141f42134]
and eax, 0x96100ab3
cmp eax, 0xb2b3b1dd
jne 0x1400bfd82
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141f42138]
add eax, dword [0x141f4213c]
imul ebp, eax, 0x2c9c9af4
add ebp, 0x6f324870
or ebp, 0x607e4e06
mov rcx, rdi
xor edx, edx
mov r8, rsi
call rbx
cmp ebp, 0x334dcbc3
jb 0x1400bfd90
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400bfdd0
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret