Function at 0x1402f1fa0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r15, qword [rcx + 0x18]
mov rax, r15
inc rax
je 0x1402f281d
mov rdi, rdx
mov r14, rcx
mov r13, qword [rcx + 8]
lea r8, [r13 + 1]
mov rcx, r8
shr rcx, 3
mov r9, r8
and r9, 0xfffffffffffffff8
sub r9, rcx
cmp r13, 8
cmovb r9, r13
mov rcx, r9
shr rcx, 1
cmp rax, rcx
jbe 0x1402f201c
inc r9
cmp rax, r9
cmova r9, rax
cmp r9, 8
jae 0x1402f20aa
xor eax, eax
cmp r9, 4
setae al
lea rbp, [rax*4 + 4]
jmp 0x1402f2106
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x28], r14
test r8, r8
je 0x1402f27ef
mov rax, qword [rsp + 0x28]
mov rbp, qword [rax]
pxor xmm0, xmm0
pcmpgtb xmm0, xmmword [rbp]
por xmm0, xmmword [0x1402f96e0]
movdqa xmmword [rbp], xmm0
cmp r8, 0x11
jb 0x1402f208f
mov eax, 0x10
movdqa xmm0, xmmword [0x1402f96e0]
nop word cs:[rax + rax]
pxor xmm1, xmm1
pcmpgtb xmm1, xmmword [rbp + rax]
por xmm1, xmm0
movdqa xmmword [rbp + rax], xmm1
add rax, 0x10
jb 0x1402f208f
cmp rax, r8
jb 0x1402f2070
cmp r8, 0x10
jae 0x1402f2317
lea rcx, [rbp + 0x10]
mov rdx, rbp
call sub.VCRUNTIME140.dll_memmove
jmp 0x1402f2323
mov rax, r9
shr rax, 0x3d
jne 0x1402f281d
shl r9, 3
mov ebp, 1
cmp r9, 0xe
jb 0x1402f2106
movabs rcx, 0x2492492492492493
mov rax, r9
mul rcx
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 2
dec r9
bsr rcx, r9
not ecx
mov rbp, 0xffffffffffffffff
shr rbp, cl
inc rbp
mov rax, rbp
shr rax, 0x3c
jne 0x1402f281d
mov rsi, rbp
shl rsi, 4
lea rbx, [rbp + 0x10]
mov r12, rsi
add r12, rbx
jb 0x1402f281d
movabs rax, 0x7ffffffffffffff1
cmp r12, rax
jae 0x1402f281d
mov qword [rsp + 0x30], r8
test r12, r12
mov qword [rsp + 0x40], rdi
je 0x1402f2184
movzx eax, byte [0x1403ce430]
mov rcx, qword [0x1403cdf08]
test rcx, rcx
jne 0x1402f2167
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1402f217a
mov rcx, rax
mov qword [0x1403cdf08], rax
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x1402f2189
mov rcx, r12
call fcn.140157ae0
ud2
mov edi, 0x10
mov r12, rbp
dec rbp
mov rax, r12
shr rax, 3
and r12, 0xfffffffffffffff8
sub r12, rax
cmp rbp, 8
cmovb r12, rbp
add rdi, rsi
mov rcx, rdi
mov dl, 0xff
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
sub r12, r15
mov rbx, qword [r14]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1402f22e1
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x28], r14
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov r15, qword [rax + 8]
lea r14, [rbx - 0x10]
xor esi, esi
jmp 0x1402f222a
shr rax, 0x39
lea rcx, [rdx - 0x10]
and rcx, rbp
mov byte [rdi + rdx], al
mov byte [rcx + rdi + 0x10], al
mov rax, rbx
sub rax, r12
shl rdx, 4
neg rdx
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmmword [rdi + rdx - 0x10], xmm0
lea rax, [rsi + 1]
cmp rsi, r13
mov rsi, rax
je 0x1402f22ac
cmp byte [rbx + rsi], 0
js 0x1402f221a
mov r12, rsi
shl r12, 4
mov rax, r14
sub rax, r12
mov r8, qword [rax]
mov rcx, qword [rsp + 0x48]
mov rdx, r15
call fcn.14021e5c0
mov rcx, rax
and rcx, rbp
movdqu xmm0, xmmword [rdi + rcx]
pmovmskb edx, xmm0
test edx, edx
jne 0x1402f2287
mov r8d, 0x10
nop word cs:[rax + rax]
add rcx, r8
and rcx, rbp
movdqu xmm0, xmmword [rdi + rcx]
pmovmskb edx, xmm0
add r8, 0x10
test edx, edx
je 0x1402f2270
tzcnt edx, edx
add rdx, rcx
and rdx, rbp
cmp byte [rdi + rdx], 0
js 0x1402f21f0
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
tzcnt edx, ecx
jmp 0x1402f21f0
mov rax, qword [rsp + 0x28]
mov qword [rax], rdi
mov qword [rax + 8], rbp
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
test r13, r13
mov rax, qword [rsp + 0x30]
je 0x1402f2802
shl rax, 4
add r13, rax
cmp r13, 0xffffffffffffffef
jne 0x1402f22fd
jmp 0x1402f2802
mov qword [r14], rdi
mov qword [r14 + 8], rbp
mov qword [r14 + 0x10], r12
shl rax, 4
add r13, rax
cmp r13, 0xffffffffffffffef
je 0x1402f2802
sub rbx, rax
mov rcx, qword [0x1403cdf08]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1402f2802
movdqu xmm0, xmmword [rbp]
movdqu xmmword [rbp + r8], xmm0
lea rax, [rbp - 0x10]
mov qword [rsp + 0x60], rax
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
movabs rdx, 0x736f6d6570736575
xor rdx, rax
movabs r8, 0x646f72616e646f6d
xor r8, rcx
add rdx, r8
rol r8, 0xd
movabs r9, 0x6c7967656e657261
xor r8, rdx
rol rdx, 0x20
mov qword [rsp + 0x30], rdx
xor r9, rax
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r8
rol r8, 0x11
mov qword [rsp + 0x70], r8
xor r14d, r14d
movabs rax, 0x7465646279746573
xor rax, rcx
mov qword [rsp + 0x68], rax
jmp 0x1402f23c4
shr rcx, 0x39
lea rax, [r14 - 0x10]
and rax, r13
mov byte [rbp + r14], cl
mov byte [rax + rbp + 0x10], cl
lea rax, [r14 + 1]
cmp r14, r13
mov r14, rax
je 0x1402f27ef
cmp byte [rbp + r14], 0x80
jne 0x1402f23b4
mov rax, r14
shl rax, 4
mov rbx, rbp
sub rbx, rax
add rbx, 0xfffffffffffffff0
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov qword [rsp + 0x48], rcx
nop word [rax + rax]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
movzx ecx, byte [rax + 0x28]
mov r10, qword [rax + 0x10]
mov r8, qword [rax + 0x20]
mov r12, r8
shl r12, 8
or r12, rcx
mov r15, qword [rsp + 0x68]
xor r15, r12
mov rax, qword [rsp + 0x38]
lea rdi, [r15 + rax]
rol r15, 0x10
lea r9, [r8*8]
cmp r9, 7
mov esi, 7
cmovb rsi, r9
cmp rsi, 3
jbe 0x1402f2450
mov r11d, dword [r10]
mov eax, 4
jmp 0x1402f2455
xor r11d, r11d
xor eax, eax
xor r15, rdi
mov rcx, rax
or rcx, 1
cmp rcx, rsi
jae 0x1402f247a
movzx edx, word [r10 + rax]
lea ecx, [rax*8]
shl rdx, cl
or r11, rdx
or rax, 2
mov rcx, qword [rsp + 0x30]
lea rdx, [r15 + rcx]
rol r15, 0x15
add rdi, qword [rsp + 0x40]
cmp rax, rsi
jae 0x1402f24a1
movzx esi, byte [r10 + rax]
shl eax, 3
mov ecx, eax
shl rsi, cl
or r11, rsi
xor r15, rdx
mov rax, rdi
xor rax, qword [rsp + 0x70]
rol rdi, 0x20
xor r12, rdx
shld r11, r8, 8
test r8, r8
je 0x1402f2558
add r12, rax
rol rax, 0xd
xor rax, r12
rol r12, 0x20
xor r15, r11
add rdi, r15
rol r15, 0x10
xor r15, rdi
add r12, r15
rol r15, 0x15
add rdi, rax
rol rax, 0x11
xor rax, rdi
rol rdi, 0x20
xor r15, r12
xor r12, r11
add r9, 0xfffffffffffffff9
mov ecx, 7
and r9, 0xfffffffffffffff8
je 0x1402f2553
nop word cs:[rax + rax]
add r12, rax
rol rax, 0xd
mov rdx, qword [r10 + rcx]
xor rax, r12
rol r12, 0x20
xor r15, rdx
add rdi, r15
rol r15, 0x10
xor r15, rdi
add r12, r15
rol r15, 0x15
add rdi, rax
rol rax, 0x11
xor rax, rdi
rol rdi, 0x20
xor r15, r12
xor r12, rdx
add rcx, 8
cmp rcx, r9
jb 0x1402f2510
movzx r11d, byte [r10 + rcx]
shl r8, 0x3b
movabs rcx, 0x900000000000000
add r8, rcx
add r12, rax
rol rax, 0xd
or r8, r11
xor rax, r12
rol r12, 0x20
xor r15, r8
add rdi, r15
rol r15, 0x10
xor r15, rdi
add r12, r15
rol r15, 0x15
add rdi, rax
rol rax, 0x11
xor r15, r12
xor rax, rdi
rol rdi, 0x20
xor r12, r8
add r12, rax
rol rax, 0xd
xor rax, r12
rol r12, 0x20
xor rdi, 0xff
add rdi, r15
rol r15, 0x10
xor r15, rdi
add r12, r15
rol r15, 0x15
add rdi, rax
rol rax, 0x11
xor rax, rdi
rol rdi, 0x20
xor r15, r12
add r12, rax
rol rax, 0xd
xor rax, r12
rol r12, 0x20
add rdi, r15
rol r15, 0x10
xor r15, rdi
add r12, r15
rol r15, 0x15
add rdi, rax
rol rax, 0x11
xor rax, rdi
rol rdi, 0x20
xor r15, r12
add r12, rax
rol rax, 0xd
add rdi, r15
rol r15, 0x10
xor r15, rdi
rol r15, 0x15
xor rax, r12
add rdi, rax
rol rax, 0x11
mov rcx, rdi
rol rcx, 0x20
xor rcx, rax
xor rcx, r15
xor rcx, rdi
mov rax, rcx
and rax, r13
movdqu xmm0, xmmword [rbp + rax]
pmovmskb edx, xmm0
mov r9, rax
test edx, edx
jne 0x1402f2679
mov r8d, 0x10
mov r9, rax
nop dword [rax + rax]
add r9, r8
and r9, r13
movdqu xmm0, xmmword [rbp + r9]
pmovmskb edx, xmm0
add r8, 0x10
test edx, edx
je 0x1402f2660
tzcnt r8d, edx
add r8, r9
and r8, r13
cmp byte [rbp + r8], 0
js 0x1402f269a
movdqa xmm0, xmmword [rbp]
pmovmskb edx, xmm0
tzcnt r8d, edx
mov rdx, r14
sub rdx, rax
mov r9, r8
sub r9, rax
xor r9, rdx
and r9, r13
cmp r9, 0x10
jb 0x1402f23a0
mov rax, r8
shl rax, 4
neg rax
add rax, rbp
add rax, 0xfffffffffffffff0
movzx edx, byte [rbp + r8]
shr rcx, 0x39
lea r9, [r8 - 0x10]
and r9, r13
mov byte [rbp + r8], cl
mov byte [r9 + rbp + 0x10], cl
cmp dl, 0xff
je 0x1402f27d0
movzx ecx, byte [rbx]
movzx edx, byte [rax]
mov byte [rbx], dl
mov byte [rax], cl
movzx ecx, byte [rbx + 1]
movzx edx, byte [rax + 1]
mov byte [rbx + 1], dl
mov byte [rax + 1], cl
movzx ecx, byte [rbx + 2]
movzx edx, byte [rax + 2]
mov byte [rbx + 2], dl
mov byte [rax + 2], cl
movzx ecx, byte [rbx + 3]
movzx edx, byte [rax + 3]
mov byte [rbx + 3], dl
mov byte [rax + 3], cl
movzx ecx, byte [rbx + 4]
movzx edx, byte [rax + 4]
mov byte [rbx + 4], dl
mov byte [rax + 4], cl
movzx ecx, byte [rbx + 5]
movzx edx, byte [rax + 5]
mov byte [rbx + 5], dl
mov byte [rax + 5], cl
movzx ecx, byte [rbx + 6]
movzx edx, byte [rax + 6]
mov byte [rbx + 6], dl
mov byte [rax + 6], cl
movzx ecx, byte [rbx + 7]
movzx edx, byte [rax + 7]
mov byte [rbx + 7], dl
mov byte [rax + 7], cl
movzx ecx, byte [rbx + 8]
movzx edx, byte [rax + 8]
mov byte [rbx + 8], dl
mov byte [rax + 8], cl
movzx ecx, byte [rbx + 9]
movzx edx, byte [rax + 9]
mov byte [rbx + 9], dl
mov byte [rax + 9], cl
movzx ecx, byte [rbx + 0xa]
movzx edx, byte [rax + 0xa]
mov byte [rbx + 0xa], dl
mov byte [rax + 0xa], cl
movzx ecx, byte [rbx + 0xb]
movzx edx, byte [rax + 0xb]
mov byte [rbx + 0xb], dl
mov byte [rax + 0xb], cl
movzx ecx, byte [rbx + 0xc]
movzx edx, byte [rax + 0xc]
mov byte [rbx + 0xc], dl
mov byte [rax + 0xc], cl
movzx ecx, byte [rbx + 0xd]
movzx edx, byte [rax + 0xd]
mov byte [rbx + 0xd], dl
mov byte [rax + 0xd], cl
movzx ecx, byte [rbx + 0xe]
movzx edx, byte [rax + 0xe]
mov byte [rbx + 0xe], dl
mov byte [rax + 0xe], cl
movzx ecx, byte [rbx + 0xf]
movzx edx, byte [rax + 0xf]
mov byte [rbx + 0xf], dl
mov byte [rax + 0xf], cl
jmp 0x1402f23f0
lea rcx, [r14 - 0x10]
and rcx, r13
mov byte [rbp + r14], 0xff
mov byte [rcx + rbp + 0x10], 0xff
movdqu xmm0, xmmword [rbx]
movdqu xmmword [rax], xmm0
jmp 0x1402f23b4
mov rcx, qword [rsp + 0x50]
sub rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x10], rcx
movabs rax, 0x8000000000000001
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140157b00
ud2