Function at 0x1400d9edc
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov r12d, dword [rcx + 8]
mov eax, edx
mov ebx, edx
and eax, 2
mov r14d, edx
sar ebx, 0x10
mov dword [rsp + 0x60], eax
mov eax, edx
and edx, 0xff01
and eax, 4
and r14d, 1
mov rdi, rcx
mov byte [rsp + 0xd0], 0xff
mov dword [rsp + 0xd8], edx
mov dword [rsp + 0x38], eax
test r12d, r12d
jg 0x1400d9f36
xor eax, eax
jmp 0x1400da6e2
mov rsi, qword [rcx]
lea rcx, [rsp + 0x40]
mov edx, 0x28
mov qword [rsp + 0x30], rsi
call fcn.14005fa8c
mov rax, qword [rdi + 8]
mov rbp, qword [rsp + 0x40]
lea r15, [rsi + rax]
mov rax, qword [rdi]
movzx ecx, word [rax]
xor sil, sil
xor r13d, r13d
xor cx, bx
mov word [rbp], cx
mov rax, qword [rdi]
movzx ecx, word [rax + 2]
mov rax, qword [rsp + 0x40]
xor cx, bx
mov word [rax + 2], cx
mov rax, qword [rdi]
movzx ecx, word [rax + 4]
mov rax, qword [rsp + 0x40]
xor cx, bx
cmp r12d, 2
mov word [rax + 4], cx
jl 0x1400d9fa5
cmp byte [rbp], r13b
jne 0x1400d9fa5
cmp byte [rbp + 1], r13b
jne 0x1400d9fc0
mov rcx, qword [rsp + 0x40]
lea rdx, [0x140114e0c]
mov r8d, 2
call fcn.140057798
test eax, eax
jne 0x1400d9fd5
mov rcx, qword [rdi]
mov edx, r12d
call fcn.14005cde8
mov eax, 1
mov sil, al
jmp 0x1400d9fda
mov eax, 1
cmp byte [rbp], r13b
je 0x1400d9feb
cmp byte [rbp + 1], r13b
movzx esi, sil
cmove esi, eax
mov rcx, qword [rsp + 0x40]
lea rdx, [0x140114e08]
mov r8d, 2
call fcn.140057798
xor ecx, ecx
cmp eax, ecx
jne 0x1400da00f
mov sil, 1
lea r13d, [rcx + 2]
or dword [rsp + 0xe8], 0xffffffff
mov eax, r12d
mov dword [rsp + 0xe0], ecx
cdq
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x68], rcx
sub eax, edx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rcx
sar eax, 1
mov dword [rsp + 0x50], 0xff000000
mov dword [rsp + 0x58], eax
cmp sil, cl
jne 0x1400da077
mov rcx, qword [rsp + 0x40]
mov r13d, 3
lea rdx, [0x140114e10]
mov r8, r13
call fcn.140057798
xor ecx, ecx
cmp eax, ecx
jne 0x1400da0d7
mov eax, 0xfde9
mov dword [rsp + 0xe0], eax
sub r12d, r13d
movsxd rbp, r12d
mov eax, r12d
cdq
mov qword [rdi + 0x10], rbp
mov qword [rdi + 8], rbp
sub eax, edx
sar eax, 1
cmp r13d, ecx
mov r15d, eax
jle 0x1400da0b1
mov rcx, qword [rdi]
mov eax, r12d
movsxd rdx, r13d
add rdx, qword [rdi]
sub eax, r13d
add eax, 6
movsxd r8, eax
call fcn.14001c8b4
xor ecx, ecx
mov rax, qword [rdi]
mov r13d, dword [rsp + 0xd8]
mov byte [rax + rbp], bl
mov r14, qword [rdi]
mov ebp, dword [rsp + 0xe0]
cmp sil, cl
jne 0x1400da66b
jmp 0x1400da623
cmp r14d, ecx
mov r14, qword [rsp + 0x30]
je 0x1400da283
cmp byte [rbp], 0x40
mov rsi, r14
mov qword [rsp + 0x30], r14
mov rax, rbp
jne 0x1400da0fa
lea rax, [rbp + 1]
mov ecx, 0x3a
cmp byte [rax], cl
jne 0x1400da125
cmp byte [rax + 1], cl
jne 0x1400da125
lea rcx, [rsp + 0x30]
mov dl, bl
call fcn.1400d9668
lea rcx, [rsp + 0x30]
mov dl, bl
call fcn.1400d9694
mov rsi, qword [rsp + 0x30]
mov al, byte [rsi]
mov r13d, 1
xor al, bl
cmp al, 0x40
jne 0x1400da13b
add rsi, r13
mov qword [rsp + 0x30], rsi
movsx eax, byte [rsi]
movzx ecx, bx
mov edx, 0x23
xor eax, ecx
cmp eax, edx
jne 0x1400da179
movsx eax, byte [rsi + 1]
xor eax, ecx
cmp eax, 0x21
jne 0x1400da179
lea rcx, [rsp + 0x30]
mov dl, bl
call fcn.1400d9668
lea rcx, [rsp + 0x30]
mov dl, bl
call fcn.1400d9694
mov rsi, qword [rsp + 0x30]
mov edx, 0x23
mov al, byte [rsi]
xor al, bl
cmp al, 0x40
jne 0x1400da184
add rsi, r13
mov al, byte [rsi]
xor al, bl
cmp al, dl
jne 0x1400da281
sub r15d, esi
mov eax, 0x20
cmp r15d, eax
cmovg r15d, eax
movsxd r8, r15d
test r15d, r15d
jle 0x1400da1bf
mov rdx, rsi
mov rcx, rbp
sub rdx, rbp
mov al, byte [rdx + rcx]
xor al, bl
mov byte [rcx], al
add rcx, r13
sub r8, r13
jne 0x1400da1b0
lea rdx, [0x14010ebc8]
mov r8d, 6
mov rcx, rbp
call qword [sym.imp.SHLWAPI.DLL_StrCmpNIA]
xor ecx, ecx
cmp eax, ecx
jne 0x1400da283
mov r13d, dword [rsp + 0xd8]
or rcx, 0xffffffffffffffff
mov al, bl
mov dword [rsp + 0x38], ecx
mov r8, rcx
xor al, 0x2d
lea rdx, [rbp + 6]
lea rcx, [rsp + 0x58]
bts r13d, 9
mov byte [rsi + 1], al
mov byte [rsp + 0xd0], 1
call fcn.14006acd8
mov r11, qword [rsp + 0x58]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r11
call fcn.140064074
mov eax, dword [rsp + 0x38]
mov ebp, dword [rsp + 0xe0]
mov rcx, qword [rsp + 0x30]
test eax, eax
cmovns ebp, eax
mov dword [rsp + 0xe8], eax
movzx eax, word [rcx]
or ax, 0x20
mov edx, 0x74
cmp dx, ax
jne 0x1400da272
add rcx, 2
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
call fcn.140064074
lea rcx, [rsp + 0x58]
call fcn.140057768
jmp 0x1400da623
xor ecx, ecx
mov eax, dword [rdi]
sub eax, r14d
add r12d, eax
cmp r12d, 4
jl 0x1400da56a
cmp byte [rbp], cl
jne 0x1400da55c
cmp byte [rbp + 1], cl
je 0x1400da56a
mov rcx, qword [rdi]
mov edx, r12d
call fcn.14005cde8
mov ebp, dword [rsp + 0xe0]
mov r15d, dword [rsp + 0x58]
xor r12d, r12d
mov r13d, dword [rsp + 0xd8]
mov r14d, 0x3a
mov rcx, qword [rdi]
lea eax, [r15 + 9]
movsxd rdx, eax
lea rdx, [rdx + rdx + 2]
call fcn.14005f61c
movsxd r8, r15d
mov ecx, 7
mov qword [rdi], rax
lea rdx, [r8 + r8 + 0xe]
mov rax, qword [rdi]
dec rcx
mov word [rdx + rax], bx
sub rdx, 2
cmp rcx, r12
jge 0x1400da2f3
cmp r13d, 0x10
mov rax, qword [rdi]
mov word [rax + r8*2 + 0x10], r12w
jge 0x1400da4d9
mov rdx, qword [rdi]
or dword [rsp + 0xd8], 0xffffffff
mov esi, pe_nt_image_headers64
movzx eax, word [rdx]
mov qword [rsp + 0xe0], rdx
mov rcx, rdx
xor ax, bx
cmp si, ax
jne 0x1400da343
lea rcx, [rdx + 2]
movzx eax, word [rcx]
xor ax, bx
cmp r14w, ax
jne 0x1400da384
movzx eax, word [rcx + 2]
xor ax, bx
cmp r14w, ax
jne 0x1400da384
lea rcx, [rsp + 0xe0]
movzx edx, bx
call fcn.1400d96bc
lea rcx, [rsp + 0xe0]
movzx edx, bx
call fcn.1400d96f0
mov rdx, qword [rsp + 0xe0]
movzx eax, word [rdx]
mov rcx, rdx
xor ax, bx
cmp si, ax
jne 0x1400da396
lea rcx, [rdx + 2]
movzx eax, word [rcx]
mov r8d, 0x23
xor ax, bx
cmp r8w, ax
jne 0x1400da3e6
movzx eax, word [rcx + 2]
lea ecx, [r8 - 2]
xor ax, bx
cmp cx, ax
jne 0x1400da3e6
lea rcx, [rsp + 0xe0]
movzx edx, bx
call fcn.1400d96bc
lea rcx, [rsp + 0xe0]
movzx edx, bx
call fcn.1400d96f0
mov rdx, qword [rsp + 0xe0]
mov r8d, 0x23
movzx eax, word [rdx]
xor ax, bx
cmp si, ax
jne 0x1400da3f5
add rdx, 2
movzx eax, word [rdx]
xor ax, bx
cmp r8w, ax
jne 0x1400da4d9
mov rsi, qword [rsp + 0x40]
mov rax, rdx
mov ecx, r15d
sub rax, qword [rdi]
mov r8, r12
sar rax, 1
sub ecx, eax
mov eax, 0x20
cmp ecx, eax
cmovg ecx, eax
movsxd r9, ecx
cmp r9, r12
jle 0x1400da442
movzx eax, word [rdx + r8*2]
xor ax, bx
mov word [rsi + r8*2], ax
inc r8
cmp r8, r9
jl 0x1400da42d
mov word [rsi + r8*2], r12w
lea rdx, [0x14011b9d8]
mov rcx, rsi
mov r8d, 6
call qword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
cmp eax, r12d
jne 0x1400da4d9
lea rax, [rsi + 0xc]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0xe0], rax
call fcn.140064074
mov edx, dword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe0]
cmp edx, r12d
mov r8d, 0x74
movzx eax, word [rcx]
cmovge ebp, edx
mov dword [rsp + 0xe8], edx
or ax, 0x20
cmp r8w, ax
je 0x1400da4bb
lea eax, [r8 - 0x4a]
cmp ax, word [rcx]
jne 0x1400da4e0
add rcx, 2
lea rdx, [rsp + 0x50]
mov qword [rsp + 0xe0], rcx
lea rcx, [rsp + 0xe0]
call fcn.140064074
mov edx, dword [rsp + 0xe8]
cmp r13d, 0x1000
jge 0x1400da673
mov eax, dword [rsp + 0x50]
cmp eax, r12d
jle 0x1400da673
movzx ecx, word [0x14012c96c]
cmp eax, ecx
jne 0x1400da673
cmp edx, ecx
je 0x1400da673
mov rcx, qword [rdi]
cmp eax, 0x3b6
mov r8d, r12d
movzx r9d, bx
mov rdx, rdi
sete r8b
mov qword [rsp + 0xe0], rcx
mov qword [rdi], r12
call fcn.140070888
mov rcx, qword [rdi]
movzx edx, bx
call fcn.14001a538
lea rcx, [rsp + 0xe0]
bts r13d, 0xc
mov r15d, eax
call fcn.140057768
jmp 0x1400da2cf
cmp byte [rbp + 1], cl
jne 0x1400da56a
cmp byte [rbp + 2], cl
jne 0x1400da2b2
mov rcx, qword [rsp + 0x48]
lea esi, [r12 + r12*2]
lea eax, [rsi + 3]
movsxd rdx, eax
lea rdx, [rdx + rdx + 2]
call fcn.14005f61c
mov rdx, qword [rdi]
movzx ebp, bx
mov ecx, ebp
mov r8d, r12d
mov r9, rax
bts ecx, 0x18
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], ecx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call fcn.1400d9b18
mov r15d, eax
test eax, eax
jg 0x1400da5e8
neg dword [rsp + 0x38]
mov r9, qword [rsp + 0x48]
mov rdx, qword [rdi]
sbb eax, eax
mov r8d, r12d
mov ecx, 0xfde9
and eax, 0x40000
or eax, ebp
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
call fcn.1400d9b18
mov r15d, eax
test eax, eax
jle 0x1400da614
mov ebp, 0xfde9
jmp 0x1400da5ef
mov ebp, dword [rsp + 0xe0]
mov rax, qword [rsp + 0x48]
movsxd rcx, r15d
xor r12d, r12d
mov word [rax + rcx*2], r12w
mov rcx, qword [rdi]
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rsp + 0x48], rcx
jmp 0x1400da2c1
mov r13d, dword [rsp + 0xd8]
mov ebp, dword [rsp + 0xe0]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rdi]
lea r8d, [r12 + r12*2 + 3]
movsxd rdx, r8d
mov qword [rsp + 0x68], rax
mov qword [rdi], rcx
lea rdx, [rdx + rdx + 2]
call fcn.14005f61c
lea r8d, [r12 + r12]
movzx ecx, bx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r8d
mov rdx, r14
mov r8d, r12d
mov r9, rax
mov ecx, ebp
mov qword [rdi], rax
call fcn.1400d9b18
mov r15d, eax
xor r12d, r12d
jmp 0x1400da2c9
mov al, byte [rsp + 0xd0]
cmp al, r12b
jl 0x1400da68e
movsx rcx, al
mov rax, qword [rdi]
xor bx, 0x63
mov word [rax + rcx*2], bx
lea eax, [r15 + r15]
movsxd rcx, eax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rcx
cmp dword [rsp + 0x60], r12d
je 0x1400da6c2
mov rcx, qword [rsp + 0x40]
call fcn.1400576cc
mov rcx, qword [rsp + 0x48]
call fcn.1400576cc
mov rcx, qword [rsp + 0x68]
call fcn.1400576cc
lea rcx, [rsp + 0x68]
call fcn.140057768
lea rcx, [rsp + 0x48]
call fcn.140057768
lea rcx, [rsp + 0x40]
call fcn.140057768
mov eax, ebp
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret