Function at 0x14018c2d8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xb0
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r15, r9
mov r12, r8
mov r14, rdx
xor edi, edi
mov dword [rbp + 0x5f], edi
xor esi, esi
movsxd r13, ecx
lea r8d, [rdi + 1]
test ecx, ecx
je 0x14018c8ab
mov dword [rbp - 0x71], 0x58
mov eax, dword [rbp - 0x71]
xor al, 0x2d
mov byte [rbp - 0x6d], al
mov eax, dword [rbp - 0x71]
add al, r8b
xor al, 0x76
mov byte [rbp - 0x6c], al
xor eax, eax
mov byte [rbp - 0x6b], al
mov al, byte [rbp - 0x6d]
xor edx, edx
mov al, byte [rbp + rdx - 0x6d]
mov ecx, dword [rbp - 0x71]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x6d], cl
add rdx, r8
cmp rdx, 2
jb 0x14018c348
mov byte [rbp - 0x6b], 0
lea rdx, [rbp - 0x6d]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
mov ebx, eax
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [rbp - 0x6d]
call qword [sym.imp.VCRUNTIME140.dll_memset]
test ebx, ebx
jne 0x14018c3a2
mov ebx, 1
mov byte [0x1402c61ab], bl
mov byte [0x1402cccc1], bl
mov byte [r12], bl
jmp 0x14018c762
mov dword [rbp - 0x41], 0x11
mov byte [rbp - 0x3d], 0x3c
xor eax, eax
mov byte [rbp - 0x3c], al
mov al, byte [rbp - 0x3d]
mov al, byte [rbp - 0x3d]
mov ecx, dword [rbp - 0x41]
xor cl, al
mov byte [rbp - 0x3d], cl
mov byte [rbp - 0x3c], 0
lea rdx, [rbp - 0x3d]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
mov ebx, eax
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rbp - 0x3d]
call qword [sym.imp.VCRUNTIME140.dll_memset]
test ebx, ebx
jne 0x14018c3f8
mov ebx, 1
mov byte [0x1402c61ae], bl
jmp 0x14018c762
mov dword [rbp - 0x61], 8
mov byte [rbp - 0x5d], 0x25
mov byte [rbp - 0x5c], 0x79
xor eax, eax
mov byte [rbp - 0x5b], al
mov al, byte [rbp - 0x5d]
xor edx, edx
lea r8d, [rdx + 1]
mov al, byte [rbp + rdx - 0x5d]
mov ecx, dword [rbp - 0x61]
xor cl, al
mov byte [rbp + rdx - 0x5d], cl
add rdx, r8
cmp rdx, 2
jb 0x14018c415
mov byte [rbp - 0x5b], 0
lea rdx, [rbp - 0x5d]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
mov ebx, eax
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [rbp - 0x5d]
call qword [sym.imp.VCRUNTIME140.dll_memset]
test ebx, ebx
jne 0x14018c46c
mov ebx, 1
mov byte [0x1402c61a2], bl
mov byte [0x1402cccc0], bl
mov byte [r15], bl
jmp 0x14018c762
mov byte [rbp + 0x5f], 0x38
mov byte [rbp + 0x60], 0x71
mov byte [rbp + 0x61], 0
mov al, byte [rbp + 0x5f]
mov r15d, 1
or edi, r15d
xor ecx, ecx
mov al, byte [rbp + rcx + 0x5f]
sub al, 0xb
mov byte [rbp + rcx + 0x5f], al
add rcx, r15
cmp rcx, 2
jb 0x14018c486
lea rdx, [rbp + 0x5f]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
test eax, eax
jne 0x14018c4c4
lea rbx, [rsi + 1]
cmp rbx, r13
jae 0x14018c4c4
mov rcx, qword [r14 + rsi*8 + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
cmp rax, r15
je 0x14018c4cb
xor r15b, r15b
lea rbx, [rsi + 1]
and edi, 0xfffffffe
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [rbp + 0x5f]
call qword [sym.imp.VCRUNTIME140.dll_memset]
test r15b, r15b
je 0x14018c4f8
mov rax, qword [r14 + rsi*8 + 8]
mov cl, byte [rax]
mov rax, qword [rbp + 0x7f]
mov byte [rax], cl
mov rsi, rbx
jmp 0x14018c759
mov dword [rbp - 0x59], 0x46
mov byte [rbp - 0x55], 0x6b
mov byte [rbp - 0x54], 0x20
xor eax, eax
mov byte [rbp - 0x53], al
mov al, byte [rbp - 0x55]
xor edx, edx
lea r15d, [rdx + 1]
mov al, byte [rbp + rdx - 0x55]
mov ecx, dword [rbp - 0x59]
xor cl, al
mov byte [rbp + rdx - 0x55], cl
add rdx, r15
cmp rdx, 2
jb 0x14018c515
mov byte [rbp - 0x53], 0
lea rdx, [rbp - 0x55]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
test eax, eax
jne 0x14018c556
cmp rbx, r13
jae 0x14018c556
mov rcx, qword [r14 + rsi*8 + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
cmp rax, r15
ja 0x14018c559
xor r15b, r15b
and edi, 0xfffffffd
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [rbp - 0x55]
call qword [sym.imp.VCRUNTIME140.dll_memset]
test r15b, r15b
je 0x14018c57d
mov rax, qword [rbp + 0x7f]
mov byte [rax], 0x78
jmp 0x14018c4f0
mov dword [rbp - 0x69], 0x67
mov eax, dword [rbp - 0x69]
xor al, 0x2d
mov byte [rbp - 0x65], al
mov eax, dword [rbp - 0x69]
mov r15d, 1
add al, r15b
xor al, 0x6c
mov byte [rbp - 0x64], al
xor eax, eax
mov byte [rbp - 0x63], al
mov al, byte [rbp - 0x65]
xor edx, edx
mov al, byte [rbp + rdx - 0x65]
mov ecx, dword [rbp - 0x69]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x65], cl
add rdx, r15
cmp rdx, 2
jb 0x14018c5a7
mov byte [rbp - 0x63], 0
lea rdx, [rbp - 0x65]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
test eax, eax
jne 0x14018c5ef
cmp rbx, r13
jae 0x14018c5ef
mov rcx, qword [r14 + rsi*8 + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
test rax, rax
je 0x14018c5ef
mov bl, r15b
jmp 0x14018c5f1
xor bl, bl
and edi, 0xfffffffb
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [rbp - 0x65]
call qword [sym.imp.VCRUNTIME140.dll_memset]
test bl, bl
je 0x14018c759
mov r9, qword [r14 + rsi*8 + 8]
and qword [rbp - 0x29], 0
and qword [rbp - 0x19], 0
mov qword [rbp - 0x11], 0xf
mov byte [rbp - 0x29], 0
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [r9 + rbx], 0
jne 0x14018c62b
lea rcx, [rbp - 0x29]
cmp rbx, 0xf
ja 0x14018c656
mov qword [rbp - 0x19], rbx
mov r8, rbx
mov rdx, r9
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp + rbx - 0x29], 0
jmp 0x14018c65f
mov rdx, rbx
call fcn.1400ada10
nop
lea rcx, [rbp - 0x29]
mov r15, qword [rbp - 0x29]
mov r12, qword [rbp - 0x11]
cmp r12, 0x10
cmovae rcx, r15
mov rbx, qword [rbp - 0x19]
mov r8, rbx
mov eax, 1
cmp rbx, rax
cmova r8, rax
lea rdx, [0x140291614]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14018c6b0
lea r8d, [rax + 1]
cmp rbx, r8
jae 0x14018c6a4
or eax, 0xffffffff
jmp 0x14018c6ac
xor eax, eax
cmp rbx, r8
seta al
test eax, eax
je 0x14018c701
lea r8, [rbp - 0x29]
cmp r12, 0x10
cmovae r8, r15
add r8, rbx
lea rdx, [rbp - 0x29]
cmp r12, 0x10
cmovae rdx, r15
lea rcx, [rbp - 9]
call fcn.1400c42a4
lea r8, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae r8, qword [rbp - 9]
mov edx, 0x104
lea r9d, [rdx - 1]
lea rcx, [0x1402ccd00]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rcx, [rbp - 9]
call fcn.1400ac668
xor ecx, ecx
call fcn.1401742f0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14018c744
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018c73f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018c8c9
call fcn.14027b384
and qword [rbp - 0x19], 0
mov qword [rbp - 0x11], 0xf
mov byte [rbp - 0x29], 0
mov r12, qword [rbp + 0x6f]
mov ebx, 1
mov r15, qword [rbp + 0x77]
mov dword [rbp - 0x49], 0xf
mov byte [rbp - 0x45], 0x22
mov byte [rbp - 0x44], 0x67
xor eax, eax
mov byte [rbp - 0x43], al
mov al, byte [rbp - 0x45]
or edi, 8
xor edx, edx
mov al, byte [rbp + rdx - 0x45]
mov ecx, dword [rbp - 0x49]
xor cl, al
mov byte [rbp + rdx - 0x45], cl
add rdx, rbx
cmp rdx, 2
jb 0x14018c77e
mov byte [rbp - 0x43], 0
lea rdx, [rbp - 0x45]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
test eax, eax
je 0x14018c850
mov dword [rbp - 0x39], 0xe
mov byte [rbp - 0x35], 0x23
mov byte [rbp - 0x34], 0x23
mov byte [rbp - 0x33], 0x66
mov byte [rbp - 0x32], 0x6b
mov byte [rbp - 0x31], 0x62
mov byte [rbp - 0x30], 0x7e
xor eax, eax
mov byte [rbp - 0x2f], al
mov al, byte [rbp - 0x35]
or edi, 0x10
xor edx, edx
mov al, byte [rbp + rdx - 0x35]
mov ecx, dword [rbp - 0x39]
xor cl, al
mov byte [rbp + rdx - 0x35], cl
add rdx, rbx
cmp rdx, 6
jb 0x14018c7da
mov byte [rbp - 0x2f], 0
lea rdx, [rbp - 0x35]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
test eax, eax
je 0x14018c850
mov dword [rbp - 0x51], 0x15
mov byte [rbp - 0x4d], 0x3a
mov byte [rbp - 0x4c], 0x2a
xor eax, eax
mov byte [rbp - 0x4b], al
mov al, byte [rbp - 0x4d]
or edi, 0x20
xor edx, edx
mov al, byte [rbp + rdx - 0x4d]
mov ecx, dword [rbp - 0x51]
xor cl, al
mov byte [rbp + rdx - 0x4d], cl
add rdx, rbx
cmp rdx, 2
jb 0x14018c822
mov byte [rbp - 0x4b], 0
lea rdx, [rbp - 0x4d]
mov rcx, qword [r14 + rsi*8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
test eax, eax
je 0x14018c850
xor bl, bl
test dil, 0x20
je 0x14018c869
and edi, 0xffffffdf
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [rbp - 0x4d]
call qword [sym.imp.VCRUNTIME140.dll_memset]
test dil, 0x10
je 0x14018c882
and edi, 0xffffffef
xor edx, edx
lea r8d, [rdx + 7]
lea rcx, [rbp - 0x35]
call qword [sym.imp.VCRUNTIME140.dll_memset]
and edi, 0xfffffff7
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [rbp - 0x45]
call qword [sym.imp.VCRUNTIME140.dll_memset]
test bl, bl
jne 0x14018c8d0
mov r8d, 1
add rsi, r8
cmp rsi, r13
jb 0x14018c324
mov al, r8b
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140176b28
xor al, al
jmp 0x14018c8ae