Function at 0x14018eca0
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x1415a1b70]
mov ecx, dword [0x1415a1b74]
mov r9d, eax
not r9d
and r9d, ecx
not ecx
and ecx, eax
sub ecx, r9d
or ecx, 0x33d0ad11
imul eax, ecx, 0x48a78a60
cmp eax, 0xeb2de9bf
je 0x14018ed3d
mov eax, dword [0x1415a1b78]
mov ecx, dword [0x1415a1b7c]
not eax
not ecx
and ecx, eax
xor ecx, 0x684e7ac7
imul rcx, rcx, 0x1d82032f
shr rcx, 0x3c
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov rbx, rsp
cmp ecx, 0xc7e5d655
jbe 0x14018ed69
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
jmp 0x14018ece2
sub rsp, 0x20
mov rcx, r15
call fcn.140148cb0
add rsp, 0x20
mov rcx, qword [r15]
movabs r12, 0x8000000000000000
nop word cs:[rax + rax]
mov eax, dword [0x1415a1b80]
xor edx, edx
div dword [0x1415a1b84]
add eax, 0xc8afd82
mov edx, eax
xor edx, 0x8aa0404
xor eax, 0x754d9eb
mov r8d, eax
and r8d, 0xf3553378
and edx, 0xcaacc87
imul edx, r8d
mov r8d, eax
and r8d, 0xcaacc87
or eax, 0xcaacc87
imul eax, r8d
add eax, edx
cmp eax, 0x761f60fb
jb 0x14018ed90
mov rdi, qword [r15 + 8]
cmp rcx, r12
jne 0x14018edf9
mov al, 1
nop dword [rax + rax]
test al, al
je 0x14018edf0
jmp 0x14018eea2
mov rax, qword [r15 + 0x10]
mov qword [r14], rcx
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rax
sub rsp, 0x20
mov rcx, rbx
mov rdx, r14
call fcn.14018f590
add rsp, 0x20
mov r14, qword [rbx]
mov eax, dword [0x1415a1b88]
xor edx, edx
div dword [0x1415a1b8c]
nop dword [rax]
mov eax, dword [0x1415a1b90]
mov ecx, dword [0x1415a1b94]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x4a5b32da
and ecx, 0xb5a4cd25
imul ecx, edx
mov edx, eax
and edx, 0xb5a4cd25
or eax, 0xb5a4cd25
imul eax, edx
add eax, ecx
xor eax, 0xb97f19a0
imul eax, eax, 0x3c630d4
cmp eax, 0xcaf9e0a3
je 0x14018ee30
mov rdi, qword [rbx + 8]
cmp r14, r12
jne 0x14018efe0
mov rax, rdi
not rax
or rax, 3
add rax, rdi
inc rax
nop word cs:[rax + rax]
mov ecx, dword [0x1415a1bb0]
mov edx, dword [str.__x]
mov r8d, ecx
and r8d, edx
add r8d, r8d
add ecx, edx
sub ecx, r8d
mov edx, ecx
xor edx, 0x9080506
and edx, ecx
xor edx, 0x414e
or edx, 0xf2f7bab1
cmp edx, 0x90acf97c
jb 0x14018eec0
cmp rax, 2
jg 0x14018f072
cmp rax, 1
jne 0x14018f270
lea rbx, [rdi - 1]
mov eax, dword [0x1415a1bc0]
imul eax, dword [0x1415a1bc4]
imul eax, eax, 0xf6ecd84b
add eax, 0x6071709b
or eax, 0xa07a39b6
cmp eax, 0x8597d440
je 0x14018ef10
mov ecx, 0x93b72467
nop dword [rax]
mov eax, dword [0x1415a1bc8]
xor edx, edx
div dword [0x1415a1bcc]
add eax, 0x73921fc5
shr eax, 1
imul rax, rcx
shr rax, 0x3a
cmp eax, 0x885879e1
je 0x14018ef40
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov r15, qword [rdi]
test r15, r15
je 0x14018f0fc
mov eax, dword [0x1415a1bd0]
mov ecx, dword [0x1415a1bd4]
not eax
mov edx, eax
and edx, ecx
not edx
or eax, ecx
and eax, edx
mov ecx, eax
not ecx
and eax, 0x1e5471bb
mov edx, ecx
and edx, 0xe1ab8e44
imul edx, eax
mov eax, ecx
and eax, 0x1e5471bb
or ecx, 0x1e5471bb
imul ecx, eax
add ecx, edx
mov eax, ecx
and eax, 0x99cf526b
and ecx, 0x19415069
add ecx, ecx
sub eax, ecx
cmp eax, 0xd3a8f7e5
jne 0x14018f0b8
jmp 0x14018f0ec
mov eax, dword [0x1415a1b98]
add eax, dword [0x1415a1b9c]
mov ecx, eax
not ecx
or eax, 0xdb4a5ffc
or ecx, 0x24b5a003
and ecx, eax
mov eax, ecx
not eax
xor ecx, 0xbb41c55d
and ecx, eax
mov eax, ecx
xor eax, 0xd5481abb
and ecx, 0x2ab7e544
add ecx, ecx
sub ecx, eax
cmp ecx, 0xf6e09a7e
ja 0x14018efe0
mov rbx, qword [rbx + 0x10]
mov eax, dword [0x1415a1ba0]
and eax, dword [0x1415a1ba4]
mov ecx, eax
xor ecx, 0x18040c1
xor eax, 0x1e76af1c
mov edx, eax
and edx, 0xea399532
and ecx, 0x15c66acd
imul ecx, edx
mov edx, eax
and edx, 0x15c66acd
or eax, 0x15c66acd
imul eax, edx
add eax, ecx
cmp eax, 0x63d5172c
jne 0x14018f30c
jmp 0x14018f352
mov eax, 0xd674b5fd
nop word [rax + rax]
mov ecx, dword [0x1415a1bb8]
sub ecx, dword [0x1415a1bbc]
mov edx, ecx
and edx, 0x41261d0c
xor ecx, 0xc1261d0c
lea ecx, [rcx + rdx*2]
imul rcx, rax
shr rcx, 0x3d
or ecx, 0x6b226e00
cmp ecx, 0xee807169
ja 0x14018f080
jmp 0x14018f270
mov eax, dword [0x1415a1bd8]
mov r13d, dword [0x1415a1bdc]
mov ecx, r13d
not ecx
and ecx, eax
xor r13d, eax
add r13d, eax
sub r13d, ecx
sub rsp, 0x20
mov rcx, r14
call r15
add rsp, 0x20
cmp r13d, 0xf0d94507
jne 0x14018f0fc
sub rsp, 0x20
mov rcx, r14
call r15
add rsp, 0x20
jmp 0x14018f0b8
cmp qword [rdi + 8], 0
je 0x14018f17d
cmp qword [rdi + 0x10], 0x11
jb 0x14018f163
mov eax, 0xbd1fe409
nop
mov ecx, dword [0x1415a1be0]
mov edx, dword [0x1415a1be4]
add ecx, edx
add ecx, 0x1c413c38
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xa26f917f
ja 0x14018f110
mov r14, qword [r14 - 8]
nop dword [rax + rax]
mov eax, dword [0x1415a1be8]
or eax, dword [0x1415a1bec]
imul rax, rax, 0x4ce942b
shr rax, 0x3a
or eax, 0xe12f5e68
cmp eax, 0x370d0c9
jb 0x14018f140
mov rcx, qword [0x1415acb98]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov eax, dword [0x1415a1bf0]
mov ecx, dword [0x1415a1bf4]
mov edx, eax
xor edx, ecx
not edx
or eax, ecx
and eax, edx
or eax, 0xd4dd51f
add eax, 0xda251722
and eax, 0x60131ee0
cmp eax, 0x7d6b5942
jbe 0x14018f1b0
mov rax, qword [0x1415acb98]
mov eax, dword [0x1415a1bf8]
add eax, dword [0x1415a1bfc]
mov ecx, eax
or ecx, 0xc2008010
and ecx, 0xcf20d038
not eax
and eax, 0x300b0605
or eax, ecx
mov rdi, qword [0x1415acb98]
cmp eax, 0x47e018de
je 0x14018f1b0
mov eax, dword [0x1415a1c00]
add eax, dword [0x1415a1c04]
and eax, 0xef05202d
add eax, 0x54004333
and eax, 0x8301227f
cmp eax, 0xd7851ef3
jbe 0x14018f219
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x1415a1c08]
mov ecx, dword [0x1415a1c0c]
mov edx, eax
and edx, ecx
xor eax, ecx
lea r15d, [rax + rdx*2]
add r15d, 0xbcef9041
or r15d, 0x5b676ae2
add r15d, 0xa77b160e
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rbx
call r14
add rsp, 0x20
cmp r15d, 0xc02c22ed
ja 0x14018f220
nop word [rax + rax]
mov eax, dword [0x1415a1c10]
add eax, dword [0x1415a1c14]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x8069941e
and ecx, 0x7f966be1
imul ecx, edx
mov edx, eax
and edx, 0x7f966be1
or eax, 0x7f966be1
imul eax, edx
add eax, ecx
cmp eax, 0x26cec08e
je 0x14018f270
mov qword [rsi], r12
nop dword [rax]
mov eax, dword [0x1415a1c58]
add eax, dword [0x1415a1c5c]
mov ecx, eax
not ecx
and ecx, 0x5b45000a
mov edx, eax
and edx, 0xa4bafff5
imul edx, ecx
mov ecx, eax
and ecx, 0x5b45000a
or eax, 0x5b45000a
imul eax, ecx
add eax, edx
or eax, 0x3556e434
mov ecx, eax
and ecx, 0x4045ed50
add ecx, ecx
sub eax, ecx
cmp eax, 0x5caeacba
je 0x14018f2b0
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x1415a1ba8]
xor edx, edx
div dword [0x1415a1bac]
imul eax, eax, 0x4498eb06
lea ecx, [rax + 0x69fb61f1]
not ecx
or ecx, 0xca7870e9
lea r15d, [rax + rcx]
add r15d, 0x69fb61f2
sub rsp, 0x20
mov rcx, rdi
call fcn.14020d280
add rsp, 0x20
cmp r15d, 0xd58010cd
jbe 0x14018f365
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add rsp, 0x20
jmp 0x14018f30c
cmp eax, 0xffffffff
je 0x14018f37a
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbx
jmp 0x14018f2b0
mov qword [rsi], r12
mov eax, dword [0x1415a1c18]
xor edx, edx
div dword [0x1415a1c1c]
nop dword [rax + rax]
mov eax, dword [0x1415a1c20]
mov ecx, dword [0x1415a1c24]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
mov ecx, eax
xor ecx, 0x3a9bfcba
xor eax, 0x9342a30
add eax, ecx
and ecx, 0x4c502975
sub eax, ecx
or eax, 0x98e5769c
cmp eax, 0x2b296ed8
jb 0x14018f390
nop dword [rax + rax]
mov eax, dword [0x1415a1c28]
sub eax, dword [0x1415a1c2c]
add eax, 0xbae18066
mov ecx, eax
and ecx, 0x24d7402d
add ecx, ecx
sub eax, ecx
add eax, 0xa4d7402d
mov ecx, eax
and ecx, 0x90575d5c
or eax, 0x90575d5c
add eax, ecx
cmp eax, 0x9fd385fa
ja 0x14018f3d0
test r14, r14
je 0x14018f2b0
mov ecx, dword [0x1415a1c30]
mov eax, dword [0x1415a1c34]
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
and eax, 0xfafb6de4
add eax, 0x61b556c
mov ecx, eax
not ecx
and ecx, 0x54e51a4f
mov edx, eax
and edx, 0xab1ae5b0
imul edx, ecx
mov ecx, eax
and ecx, 0x54e51a4c
or eax, 0x54e51a4f
imul eax, ecx
add eax, edx
cmp eax, 0xb4b45e36
ja 0x14018f4b0
mov eax, dword [0x1415a1c38]
xor edx, edx
div dword [0x1415a1c3c]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x291d751f
and ecx, 0x56e28ae0
imul ecx, edx
mov edx, eax
and edx, 0x56e28ae0
or eax, 0x56e28ae0
imul eax, edx
add eax, ecx
not eax
or eax, 0x1f45c7c2
and eax, 0x5fd7d7e7
mov rsi, qword [0x1415acb98]
cmp eax, 0x23279ec8
jbe 0x14018f4b9
mov rax, qword [0x1415acb98]
jmp 0x14018f461
mov eax, dword [0x1415a1c40]
xor eax, dword [0x1415a1c44]
imul eax, eax, 0xdd75286f
mov ecx, eax
or ecx, 0x8c000
not eax
and eax, 0x9a15009a
and ecx, 0x450ad105
or ecx, eax
cmp ecx, 0xfdbed876
jbe 0x14018f500
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov eax, dword [0x1415a1c48]
add eax, dword [0x1415a1c4c]
mov ecx, eax
not ecx
and ecx, 0x7f02edb7
and eax, 0x80fd1248
sub eax, ecx
add eax, 0xe09619a3
imul r14, rax, 0x48096a97
shr r14, 0x3d
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rdi
call rbx
add rsp, 0x20
cmp r14d, 0x5bc0effd
ja 0x14018f510
nop dword [rax + rax]
mov eax, dword [0x1415a1c50]
add eax, dword [0x1415a1c54]
imul rax, rax, 0x6bfd46c7
shr rax, 0x3e
xor eax, 0x131c6fd
neg eax
or eax, 0xfd61d065
cmp eax, 0xcdb09c5a
jb 0x14018f560
jmp 0x14018f2b0