Function at 0x14006de4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1080
call fcn.1400d8110
sub rsp, rax
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x1070], rax
xor r13d, r13d
mov sil, cl
cmp byte [0x140176a90], r13b
je 0x14006de9b
cmp dl, r13b
je 0x14006e30c
mov ecx, 0x4f8
call fcn.140076080
mov r14d, 1
cmp word [rax], 0x23
mov rdi, rax
jne 0x14006df17
cmp word [rax + 2], 0x23
jne 0x14006df17
mov ebx, 0x1000
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8, rbx
call fcn.1400c7170
lea rcx, [rdi + 4]
lea rdx, [rsp + 0x70]
mov r8, rbx
call fcn.140087f80
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
lea rdx, [rsp + 0x70]
repne scasb al, byte [rdi]
lea rdi, str.8g30w1_5r7_2ta
not rcx
sub rcx, r14
mov r8, rcx
mov rcx, rdi
call fcn.14006d9b0
cmp al, r13b
jne 0x14006df70
mov r8d, 0x480
jmp 0x14006df66
cmp dword [0x1400fefb4], r13d
je 0x14006df70
mov r8, r13
mov rcx, r13
lea rdi, str.8g30w1_5r7_2ta
mov r9d, 0x480
xor byte [r8 + rdi], cl
movabs rax, 0xaaaaaaaaaaaaaaab
add r8, r14
mul rcx
shr rdx, 1
lea rcx, [rdx + rcx + 3]
and ecx, 0xffffff
cmp r8, r9
jb 0x14006df33
cmp dword [0x1400fefb4], r13d
je 0x14006df70
mov r8, r9
xor edx, edx
mov rcx, rdi
call fcn.1400c7170
mov cl, byte [0x1401088b0]
cmp cl, r13b
jne 0x14006df90
mov eax, dword [0x14014897c]
cmp eax, 0x28
jg 0x14006df8b
cmp eax, r13d
jge 0x14006df90
mov bl, r14b
jmp 0x14006df93
mov bl, r13b
cmp sil, r13b
je 0x14006e2d7
cmp byte [0x1400ff320], r13b
je 0x14006e30c
mov byte [0x1400ff0cb], r13b
mov byte [0x1400ff1cf], r13b
mov byte [0x1400ff41f], r13b
cmp bl, r13b
jne 0x14006dfdb
mov al, byte [0x1400fefb0]
and al, 0x80
neg al
sbb eax, eax
and eax, dword [0x1400fefb8]
mov dword [0x1400fefb8], eax
mov dil, r13b
mov r15d, 0x100
lea rbp, [0x1400ff320]
lea rsi, [0x1400e3ae8]
cmp dword [0x1400fefc8], r13d
jbe 0x14006e04f
cmp cl, r13b
jne 0x14006e04f
lea rdx, str.RemShown
xor r8d, r8d
mov rcx, rsi
call fcn.14006d3c4
cmp eax, dword [0x1400fefc8]
jae 0x14006e049
lea r8d, [rax + 1]
lea rdx, str.RemShown
mov rcx, rsi
call fcn.14006d35c
mov dil, r14b
cmp byte [0x1400fefcc], r13b
je 0x14006e0fe
lea rdx, [0x1400fefcc]
jmp 0x14006e0f3
mov cl, byte [0x1401088b0]
cmp dword [0x1400ff0cc], r13d
jbe 0x14006e0a5
cmp bl, r13b
je 0x14006e0a5
lea rdx, str.ExpRemShown
xor r8d, r8d
mov rcx, rsi
call fcn.14006d3c4
cmp eax, dword [0x1400ff0cc]
jae 0x14006e09f
lea r8d, [rax + 1]
lea rdx, str.ExpRemShown
mov rcx, rsi
call fcn.14006d35c
mov dil, r14b
cmp byte [0x1400ff0d0], r13b
je 0x14006e0fe
lea rdx, [0x1400ff0d0]
jmp 0x14006e0f3
mov cl, byte [0x1401088b0]
cmp dword [0x1400ff1d0], r13d
jbe 0x14006e0fe
cmp cl, r13b
je 0x14006e0fe
lea rdx, str.RegRemShown
xor r8d, r8d
mov rcx, rsi
call fcn.14006d3c4
cmp eax, dword [0x1400ff1d0]
jae 0x14006e0fe
lea r8d, [rax + 1]
lea rdx, str.RegRemShown
mov rcx, rsi
call fcn.14006d35c
mov dil, r14b
cmp byte [0x1400ff1d4], r13b
je 0x14006e0fe
lea rdx, [0x1400ff1d4]
mov r8, r15
mov rcx, rbp
call fcn.140080570
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov eax, edx
shr eax, 6
cmp byte [0x1401088b0], r13b
je 0x14006e134
mov ecx, dword [0x1400fefc4]
cmp ecx, r13d
jbe 0x14006e169
xor edx, edx
div ecx
cmp edx, r13d
jne 0x14006e169
mov dil, r14b
jmp 0x14006e169
cmp bl, r13b
jne 0x14006e14f
mov ecx, dword [0x1400fefbc]
cmp ecx, r13d
jbe 0x14006e169
xor edx, edx
div ecx
cmp edx, r13d
jne 0x14006e169
jmp 0x14006e172
mov ecx, dword [0x1400fefc0]
cmp ecx, r13d
jbe 0x14006e169
xor edx, edx
movzx edi, dil
div ecx
cmp edx, r13d
cmove edi, r14d
cmp dil, r13b
je 0x14006e30c
test byte [0x1400fefb0], 2
mov esi, 0x16c80000
mov eax, 0x16cc0000
cmove esi, eax
test byte [0x1400fefb0], 8
jne 0x14006e195
or esi, 0x30000
mov edi, 0x80000000
mov ebx, edi
mov ebp, edi
mov r12d, edi
cmp dword [0x1400ff2d8], r13d
je 0x14006e243
cmp dword [0x1400ff2d4], r13d
je 0x14006e243
mov ecx, 0x21
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 4
mov edi, eax
lea ebx, [rdi + rdi]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
add ebx, eax
mov eax, dword [0x1400fefb0]
add ebx, dword [0x1400ff2d8]
test al, 0x40
jne 0x14006e1ee
bt eax, 8
jb 0x14006e1f1
add ebx, 0x1e
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [0x1400ff2d4]
xor edx, edx
lea edi, [rcx + rax*2]
lea r8, [rsp + 0x60]
lea ecx, [rdx + 0x30]
xor r9d, r9d
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [rsp + 0x68]
cmp edi, eax
mov ebp, eax
cmovl ebp, edi
sub eax, ebp
cdq
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [rsp + 0x6c]
cmp ebx, eax
mov r12d, eax
cmovl r12d, ebx
sub eax, r12d
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
lea rcx, [0x1400ff320]
mov rdx, r15
call fcn.14006d744
mov rcx, qword [0x140134b80]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], ebp
lea r8, [0x1400e4698]
lea rdx, str.RarReminder
mov r9d, esi
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExW]
test byte [0x1400fefb0], r14b
je 0x14006e2c5
mov dword [rsp + 0x30], 3
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov rcx, rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp qword [0x140149a28], r13
je 0x14006e30c
mov byte [0x140176a90], r14b
jmp 0x14006e30c
cmp bl, r13b
je 0x14006e30c
mov byte [0x140176a90], r14b
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, qword [0x140134b88]
lea r9, [0x1400b24d8]
lea rdx, str.REMINDER
mov r8, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.1400c6350
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret