Function at 0x18003d2c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov qword [rsp + 0x70], rcx
mov rsi, qword [0x180277178]
movzx eax, byte [rsi]
test al, al
jne 0x18003d2f2
mov ecx, dword [0x18028e910]
test cl, 1
je 0x18003da0b
mov rax, qword [0x18028e908]
mov qword [rsp + 0x68], rax
movzx eax, byte [rsi]
test al, al
jne 0x18003d314
mov ecx, dword [0x18028e960]
test cl, 1
je 0x18003da75
mov rcx, qword [0x18028e948]
test rcx, rcx
je 0x18003dbe7
mov r14, qword [0x18028e950]
mov r15d, 0xa
lea rdi, str.gview.viewsrcdfgviewmod.rs
mov ebp, 0xff
lea rax, [rcx + 8]
mov qword [rsp + 0x40], rcx
movzx ecx, word [rcx + 0x16a]
mov qword [rsp + 0x60], rcx
lea ecx, [rcx*8]
lea r12, [rcx + rcx*2]
mov r13, 0xffffffffffffffff
nop word cs:[rax + rax]
test r12, r12
je 0x18003d3d0
lea rsi, [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rbx, r8
sub rbx, 0xa
cmovae r8, r15
neg rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
cdqe
test eax, eax
cmovne rbx, rax
xor ecx, ecx
test rbx, rbx
setne cl
cmovs ecx, ebp
add r12, 0xffffffffffffffe8
inc r13
mov rax, rsi
cmp cl, 1
je 0x18003d370
movzx eax, cl
test eax, eax
je 0x18003d3f1
jmp 0x18003d3d5
mov r13, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
sub r14, 1
jb 0x18003dbe7
mov rcx, qword [rcx + r13*8 + 0x170]
jmp 0x18003d33d
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
add rax, qword [rcx + r13*8 + 0x110]
mov qword [rsp + 0x40], 0
mov edi, 0xff
jmp 0x18003d43a
mov rax, qword [r14 + r13*8 + 0x110]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rax + rcx]
test rax, rax
je 0x18003d97d
mov qword [rsp + 0x68], rax
mov r13, qword [rax]
mov rsi, qword [0x180277178]
movzx eax, byte [rsi]
test al, al
je 0x18003d470
sub r13, qword [0x18028e9b0]
mov eax, 0xfffffffe
cmp r13, rax
jbe 0x18003d513
jmp 0x18003d5d4
mov r15d, dword [0x18028e9b8]
test r15b, 1
jne 0x18003d4f7
cmp r15d, 0xff
ja 0x18003d741
mov ecx, r15d
or ecx, 0x20000000
mov eax, r15d
lock cmpxchg dword [0x18028e9b8], ecx
lea r14, [0x18028e9b8]
jne 0x18003d741
xor ecx, ecx
call sub.kernel32.dll_GetModuleHandleW
mov qword [0x18028e9b0], rax
mov eax, r15d
or eax, 0x20000000
mov ecx, 1
lock cmpxchg dword [r14], ecx
je 0x18003d4f7
and r15d, 0xdfffffff
xor r15d, 0x20000001
mov eax, dword [r14]
nop
mov ecx, eax
xor ecx, r15d
lock cmpxchg dword [r14], ecx
jne 0x18003d4e0
cmp eax, 0x40000000
jae 0x18003d92b
mov rsi, qword [0x180277178]
sub r13, qword [0x18028e9b0]
mov eax, 0xfffffffe
cmp r13, rax
ja 0x18003d5d4
movzx eax, byte [rsi]
test al, al
jne 0x18003d529
mov ecx, dword [0x18028e988]
test cl, 1
je 0x18003d7c4
mov rax, qword [0x18028e970]
test rax, rax
je 0x18003d5d4
mov rcx, qword [0x18028e978]
movzx r8d, word [rax + 0x16a]
lea edx, [r8*8]
lea r10, [rdx + rdx*2]
mov rdx, 0xffffffffffffffff
xor r9d, r9d
nop
cmp r10, r9
je 0x18003d5a0
xor r11d, r11d
cmp qword [rax + rdx*8 + 0x10], r13
setne r11b
cmova r11d, edi
inc rdx
add r9, 0x18
cmp r11b, 1
je 0x18003d560
movzx r8d, r11b
test r8d, r8d
je 0x18003d5c0
sub rcx, 1
jae 0x18003d5a9
jmp 0x18003d5d4
mov rdx, r8
sub rcx, 1
jb 0x18003d5d4
mov rax, qword [rax + rdx*8 + 0x170]
jmp 0x18003d540
mov rcx, qword [rax + r9 + 0x50]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax + r9 + 0x58]
mov qword [rsp + 0x60], rax
movzx eax, byte [rsi]
test al, al
jne 0x18003d5ea
mov ecx, dword [0x18028e960]
test cl, 1
je 0x18003d69a
mov r14, qword [0x18028e948]
test r14, r14
je 0x18003dbdb
mov r15, qword [0x18028e950]
lea rax, [r14 + 8]
movzx r12d, word [r14 + 0x16a]
lea ecx, [r12*8]
lea rsi, [rcx + rcx*2]
mov r13, 0xffffffffffffffff
test rsi, rsi
je 0x18003d680
lea rbx, [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov rbp, r8
sub rbp, 0x10
mov eax, 0x10
cmovae r8, rax
neg rbp
lea rcx, [0x1801a4024]
call sub.VCRUNTIME140.dll_memcmp
cdqe
test eax, eax
cmovne rbp, rax
xor ecx, ecx
test rbp, rbp
setne cl
cmovs ecx, edi
add rsi, 0xffffffffffffffe8
inc r13
mov rax, rbx
cmp cl, 1
je 0x18003d620
movzx eax, cl
test eax, eax
je 0x18003d420
jmp 0x18003d683
mov r13, r12
sub r15, 1
jb 0x18003dbdb
mov r14, qword [r14 + r13*8 + 0x170]
jmp 0x18003d601
cmp ecx, 0xff
ja 0x18003d782
mov edx, ecx
or edx, 0x20000000
mov eax, ecx
lock cmpxchg dword [0x18028e960], edx
jne 0x18003d782
movd xmm0, ecx
pshufd xmm0, xmm0, 0x50
lea rax, [0x18028e960]
lea rcx, [0x18028e948]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
movq qword [rsp + 0x58], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x48]
call fcn.18018ff20
mov r8d, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rsp + 0x3c]
lock cmpxchg dword [rcx], edx
je 0x18003d5ea
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x18003d720
cmp eax, 0x40000000
jb 0x18003d5ea
xor eax, edx
mov edx, eax
jmp 0x18003d8e9
lea rcx, [rsp + 0x28]
lea rdx, [0x18028e9b8]
lea r8, [rsp + 0x27]
lea r9, [0x18028e9b0]
call fcn.1801844d0
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x18003d8f3
cmp eax, 2
je 0x18003d4f7
mov r14, qword [rsp + 0x30]
mov r15d, dword [rsp + 0x38]
jmp 0x18003d4ab
lea rcx, [rsp + 0x28]
lea rdx, [0x18028e960]
lea r8, [rsp + 0x27]
lea r9, [0x18028e948]
call fcn.1801844d0
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x18003d8b3
cmp eax, 2
je 0x18003d5ea
mov rax, qword [rsp + 0x30]
movq xmm0, qword [rsp + 0x38]
jmp 0x18003d6ce
cmp ecx, 0xff
ja 0x18003d871
mov edx, ecx
or edx, 0x20000000
mov eax, ecx
lock cmpxchg dword [0x18028e988], edx
jne 0x18003d871
movd xmm0, ecx
pshufd xmm0, xmm0, 0x50
lea rax, [0x18028e988]
lea rcx, [0x18028e970]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
movq qword [rsp + 0x58], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x48]
call fcn.180190520
mov r8d, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rsp + 0x3c]
lock cmpxchg dword [rcx], edx
je 0x18003d529
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop dword [rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x18003d850
cmp eax, 0x40000000
jb 0x18003d529
xor eax, edx
mov edx, eax
jmp 0x18003d973
lea rcx, [rsp + 0x28]
lea rdx, [0x18028e988]
lea r8, [rsp + 0x27]
lea r9, [0x18028e970]
call fcn.1801844d0
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x18003d93d
cmp eax, 2
je 0x18003d529
mov rax, qword [rsp + 0x30]
movq xmm0, qword [rsp + 0x38]
jmp 0x18003d7f8
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffff00
lock xadd dword [rcx], edx
mov eax, edx
and eax, 0x3fffff00
cmp eax, 0x100
setne al
cmp edx, 0x40000000
setb r8b
or r8b, al
jne 0x18003d5ea
add edx, 0xffffff00
call fcn.18018f9c0
jmp 0x18003d5ea
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffff00
lock xadd dword [rcx], edx
mov eax, edx
and eax, 0x3fffff00
cmp eax, 0x100
setne al
cmp edx, 0x40000000
setb r8b
or r8b, al
jne 0x18003d4f7
add edx, 0xffffff00
jmp 0x18003d933
xor eax, r15d
mov rcx, r14
mov edx, eax
call fcn.18018f9c0
jmp 0x18003d4f7
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffff00
lock xadd dword [rcx], edx
mov eax, edx
and eax, 0x3fffff00
cmp eax, 0x100
setne al
cmp edx, 0x40000000
setb r8b
or r8b, al
jne 0x18003d529
add edx, 0xffffff00
call fcn.18018f9c0
jmp 0x18003d529
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x18003d9bf
mov rdi, qword [rsp + 0x60]
test rdi, rdi
js 0x18003dbf3
je 0x18003d9d6
movzx eax, byte [0x18028ecd1]
mov r15d, 1
mov edx, 1
mov rcx, rdi
call fcn.18006a570
test rax, rax
je 0x18003dbf6
mov r14, rax
jmp 0x18003d9dc
movabs rax, 0x8000000000000000
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, rcx
jmp 0x18003d9fa
mov r14d, 1
mov rcx, r14
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x70]
mov qword [rax], rdi
mov qword [rax + 8], r14
mov qword [rax + 0x10], rdi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp ecx, 0xff
ja 0x18003dadf
mov edx, ecx
or edx, 0x20000000
mov eax, ecx
lock cmpxchg dword [0x18028e910], edx
jne 0x18003dadf
lea rax, [0x18028e910]
movd xmm0, ecx
pshufd xmm0, xmm0, 0x50
lea rcx, [0x18028e908]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
movq qword [rsp + 0x58], xmm0
lea rdi, [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.180191380
mov rcx, rdi
call fcn.180039340
jmp 0x18003d2f2
cmp ecx, 0xff
ja 0x18003db1d
mov edx, ecx
or edx, 0x20000000
mov eax, ecx
lock cmpxchg dword [0x18028e960], edx
jne 0x18003db1d
lea rax, [0x18028e960]
movd xmm0, ecx
pshufd xmm0, xmm0, 0x50
lea rcx, [0x18028e948]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
movq qword [rsp + 0x58], xmm0
lea rdi, [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.18018ff20
mov rcx, rdi
call fcn.180039340
jmp 0x18003d314
lea rdx, [0x18028e910]
lea r9, [0x18028e908]
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x27]
call fcn.1801844d0
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x18003db5b
cmp eax, 2
je 0x18003d2f2
mov rax, qword [rsp + 0x30]
movq xmm0, qword [rsp + 0x38]
jmp 0x18003da3f
lea rdx, [0x18028e960]
lea r9, [0x18028e948]
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x27]
call fcn.1801844d0
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x18003db9b
cmp eax, 2
je 0x18003d314
mov rax, qword [rsp + 0x30]
movq xmm0, qword [rsp + 0x38]
jmp 0x18003daa9
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffff00
lock xadd dword [rcx], edx
mov eax, edx
and eax, 0x3fffff00
cmp eax, 0x100
setne al
cmp edx, 0x40000000
setb r8b
or r8b, al
jne 0x18003d2f2
add edx, 0xffffff00
call fcn.18018f9c0
jmp 0x18003d2f2
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffff00
lock xadd dword [rcx], edx
mov eax, edx
and eax, 0x3fffff00
cmp eax, 0x100
setne al
cmp edx, 0x40000000
setb r8b
or r8b, al
jne 0x18003d314
add edx, 0xffffff00
call fcn.18018f9c0
jmp 0x18003d314
lea rcx, [0x1801a4038]
call fcn.18019e0f0
lea rcx, [0x1801a4008]
call fcn.18019e0f0
xor r15d, r15d
mov rcx, r15
mov rdx, rdi
call fcn.18019deb5
int3