Function at 0x1400bb150
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x60], r8
mov r15, rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x58], 0
mov edi, 0x200
mov eax, 2
mov qword [rsp + 0x38], rax
mov r14, qword [sym.imp.KERNEL32.dll_SetLastError]
mov r13, qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12, [rsp + 0x48]
xor eax, eax
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x78], rax
xor ebp, ebp
nop word cs:[rax + rax]
cmp rdi, 0x201
jae 0x1400bb200
mov qword [rsp + 0x40], rbp
mov eax, 0x200
mov qword [rsp + 0x70], rax
lea rbp, [rsp + 0x98]
mov rbx, rdi
jmp 0x1400bb28e
mov eax, dword [0x141dd46c8]
xor edx, edx
div dword [0x141dd46cc]
and eax, 0xa27ea5e6
xor eax, 0x8bd39d75
add eax, 0xce631aea
cmp eax, 0xa7d77db1
ja 0x1400bb200
sub rdi, rbp
mov eax, dword [0x141dd46d0]
xor edx, edx
div dword [0x141dd46d4]
xor eax, 0xedf25ab4
mov ecx, 0xa9f3f3d5
imul rax, rcx
shr rax, 0x3e
cmp eax, 0x796cc8c9
ja 0x1400bb227
mov rax, qword [rsp + 0x78]
sub rax, rbp
cmp rdi, rax
ja 0x1400bb4ef
mov rax, qword [rsp + 0x30]
mov ecx, 0xffffffff
cmp rax, rcx
mov ebx, 0xffffffff
cmovb rbx, rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rbx
mov rbp, qword [rsp + 0x38]
mov qword [rsp + 0x40], rbx
mov eax, dword [0x141dd46f8]
add eax, dword [0x141dd46fc]
or eax, 0x86028401
and eax, 0x86139d81
mov ecx, 0xbbe57811
imul rax, rcx
shr rax, 0x3b
cmp eax, 0xe301e17c
jbe 0x1400bb2d0
xor ecx, ecx
call r14
mov rcx, r15
mov edx, ebx
mov r8, rbp
xor r9d, r9d
call r13
nop dword [rax + rax]
mov eax, dword [0x141dd4700]
xor edx, edx
div dword [0x141dd4704]
mov edi, eax
xor edi, 0x3ebbb127
xor ecx, ecx
call r14
mov rcx, r15
mov edx, ebx
mov r8, rbp
xor r9d, r9d
call r13
cmp edi, 0x31e547f5
jb 0x1400bb2d0
mov r12d, eax
test eax, eax
jne 0x1400bb340
call rsi
mov ecx, dword [0x141dd4708]
imul ecx, dword [0x141dd470c]
add ecx, 0x6dbb1b99
or ecx, 0x7142e225
and ecx, 0x71cae2b5
cmp ecx, 0x8293259c
ja 0x1400bb30a
test eax, eax
jne 0x1400bb93b
nop dword [rax]
mov eax, dword [0x141dd4748]
or eax, dword [0x141dd474c]
and eax, 0x502811cb
imul eax, eax, 0xdc269290
xor eax, 0x68df0c47
cmp eax, 0x6b427b15
ja 0x1400bb340
mov edi, r12d
nop word cs:[rax + rax]
mov eax, dword [0x141dd4750]
imul eax, dword [0x141dd4754]
or eax, 0x6ffff7b7
imul eax, eax, 0xa7f4595f
cmp eax, 0x6a65898b
je 0x1400bb370
cmp rbx, rdi
jne 0x1400bb490
mov eax, dword [0x141dd4760]
sub eax, dword [0x141dd4764]
add eax, 0xe6956551
xor eax, 0xdf391401
cmp eax, 0x165ea41d
jae 0x1400bb3b7
call rsi
lea r12, [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
nop word cs:[rax + rax]
mov edi, dword [0x141dd4768]
add edi, dword [0x141dd476c]
xor edi, 0x410854c0
and edi, 0x4728f5d8
xor edi, 0xb88edf49
call rsi
cmp edi, 0x40e4432a
jb 0x1400bb3d0
nop dword [rax + rax]
mov ecx, dword [0x141dd4770]
and ecx, dword [0x141dd4774]
imul rcx, rcx, 0x35583a0f
shr rcx, 0x3b
cmp ecx, 0x5abda949
je 0x1400bb400
cmp eax, 0x7a
jne 0x1400bbcbb
nop dword [rax + rax]
mov eax, dword [0x141dd4778]
add eax, dword [0x141dd477c]
imul eax, eax, 0x497a762c
add eax, 0xe1e827ac
cmp eax, 0x340abbb4
jb 0x1400bb430
lea rcx, [rbx + rbx]
mov eax, dword [0x141dd4780]
xor edx, edx
div dword [0x141dd4784]
imul eax, eax, 0x27cdad4b
cmp rbx, 0x7fffffff
mov rdi, rcx
mov edx, 0xffffffff
cmova rdi, rdx
cmp eax, 0x9a37c1b9
je 0x1400bb452
jmp 0x1400bb4c0
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400bb4a0
cmp rbx, rdi
jae 0x1400bb5f0
lea r12, [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
nop word [rax + rax]
mov eax, dword [0x141dd4788]
xor edx, edx
div dword [0x141dd478c]
imul rax, rax, 0x47ee81b
shr rax, 0x38
or eax, 0xb82c2082
and eax, 0xb82c2083
cmp eax, 0xf16bd024
ja 0x1400bb4c0
jmp 0x1400bb1d0
mov eax, dword [0x141dd46d8]
xor edx, edx
div dword [0x141dd46dc]
or eax, 0x2008481
and eax, 0x7fc18c91
add eax, 0x5b15b404
cmp eax, 0xe9b633b8
ja 0x1400bb5c3
mov eax, dword [0x141dd46e0]
imul eax, dword [0x141dd46e4]
imul ebx, eax, 0x971ddcb0
add ebx, 0xff507b90
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rcx, r12
mov rdx, rbp
mov r8, rdi
call fcn.1400fe010
cmp ebx, 0xfd4057ce
ja 0x1400bb5c3
nop word cs:[rax + rax]
mov eax, dword [0x141dd46e8]
imul eax, dword [0x141dd46ec]
or eax, 0xdc30bed0
add eax, 0x7c108217
imul rax, rax, 0x6e0ae889
shr rax, 0x3c
cmp eax, 0x17e77189
je 0x1400bb560
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
nop dword [rax]
mov eax, dword [0x141dd46f0]
xor eax, dword [0x141dd46f4]
and eax, 0x905abd21
imul eax, eax, 0x1c093ce2
cmp eax, 0xdd1d4fab
je 0x1400bb5a0
jmp 0x1400bb25f
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rcx, r12
mov rdx, rbp
mov r8, rdi
call fcn.1400fe010
jmp 0x1400bb517
mov eax, dword [0x141dd4790]
imul eax, dword [0x141dd4794]
imul rax, rax, 0x2ff1e0bd
shr rax, 0x3d
or eax, 0xaebc5f42
imul eax, eax, 0xa95f6865
cmp eax, 0x6ccb3873
je 0x1400bb5f0
cmp qword [rsp + 0x70], rdi
jb 0x1400bbcbb
mov rax, qword [rsp + 0x60]
mov rsi, qword [rax]
mov r13, qword [rax + 8]
mov r14, qword [rax + 0x10]
lea rax, [r14 - 1]
nop dword [rax]
mov ecx, dword [0x141dd4798]
imul ecx, dword [0x141dd479c]
imul ecx, ecx, 0x49978d2d
xor ecx, 0x23644500
and ecx, 0x2f646574
cmp ecx, 0x85221ddb
je 0x1400bb640
nop word [rax + rax]
mov ecx, dword [0x141dd47a0]
sub ecx, dword [0x141dd47a4]
or ecx, 0x69ffffe7
xor ecx, 0x39afd6e2
cmp ecx, 0x3d52bbb1
jb 0x1400bb670
cmp rax, 4
jb 0x1400bb9f4
nop word [rax + rax]
mov eax, dword [str.Upqm]
sub eax, dword [0x141dd47ac]
imul eax, eax, 0x3312a412
cmp eax, 0x6984f27f
je 0x1400bb6a0
test r14, r14
je 0x1400bba16
lea rax, [r14 - 5]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd47c0]
mov edx, dword [0x141dd47c4]
add ecx, edx
add ecx, 0x5dbdf59c
or ecx, 0x17b7f6c2
add ecx, 0x2ce6882d
cmp ecx, 0x24c676bb
jb 0x1400bb6d0
nop dword [rax + rax]
mov ecx, dword [0x141dd47c8]
xor ecx, dword [0x141dd47cc]
add ecx, 0xc07d6f36
and ecx, 0x97b611f6
cmp ecx, 0x5fdbd306
je 0x1400bb700
cmp rax, rdi
jne 0x1400bb77c
lea rdx, [r13 + 8]
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400bb730
lea rbx, [rdi + rdi]
mov rcx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
mov ecx, 0x9436e5a3
nop dword [rax + rax]
mov edx, dword [0x141dd47d0]
and edx, dword [0x141dd47d4]
imul edx, edx, 0x9a597d78
shr edx, 1
imul rdx, rcx
shr rdx, 0x3d
cmp edx, 0x7289a92f
je 0x1400bb750
test eax, eax
je 0x1400bb840
mov r12, rsi
mov r15, r13
mov rdi, r14
mov rax, qword [rsp + 0x68]
mov qword [rax], r12
mov qword [rax + 8], r15
mov qword [rax + 0x10], rdi
cmp qword [rsp + 0x30], 0
je 0x1400bb7e0
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x141ddb260]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4828]
imul eax, dword [0x141dd482c]
add eax, 0x86366673
or eax, 0xe4427051
cmp eax, 0x26abccbf
je 0x1400bb7c0
nop
mov eax, dword [0x141dd4830]
imul eax, dword [0x141dd4834]
xor eax, 0x9008462a
and eax, 0x900846ff
imul eax, eax, 0x36202b80
cmp eax, 0x5f0d6d76
ja 0x1400bb7e0
nop word cs:[rax + rax]
mov eax, dword [0x141dd4838]
imul eax, dword [0x141dd483c]
xor eax, 0x6040509
or eax, 0x804a92d4
cmp eax, 0x66a9739e
je 0x1400bb810
jmp 0x1400bbb80
mov eax, dword [0x141dd47e0]
xor eax, dword [0x141dd47e4]
imul eax, eax, 0xcd0b32c
cmp eax, 0x1acbc434
je 0x1400bb840
nop dword [rax]
mov eax, dword [0x141dd47e8]
imul eax, dword [str.F]
and eax, 0xad988ad0
imul eax, eax, 0x3f4bbf5f
cmp eax, 0x33f52759
je 0x1400bb860
test r12d, r12d
je 0x1400bb971
mov eax, dword [0x141dd47f0]
xor eax, dword [0x141dd47f4]
imul eax, eax, 0x8f508cda
add eax, 0x6a808b70
or eax, 0xfb4798d3
cmp eax, 0xa31e6999
jne 0x1400bb8c0
movzx eax, byte [0x141ddb278]
xor ecx, ecx
mov rdx, rbx
call fcn.1400c0180
nop dword [rax]
mov eax, dword [0x141dd47f8]
or eax, dword [0x141dd47fc]
imul r14, rax, 0x5d9937cd
shr r14, 0x3d
or r14d, 0x1302c128
movzx eax, byte [0x141ddb278]
xor ecx, ecx
mov rdx, rbx
call fcn.1400c0180
cmp r14d, 0x4241a4c4
ja 0x1400bb8c0
mov r15, rax
xor eax, eax
nop dword [rax]
test al, al
jne 0x1400bb900
test r15, r15
jne 0x1400bb977
mov eax, dword [0x141dd4800]
or eax, dword [0x141dd4804]
imul eax, eax, 0x553f9df2
add eax, 0xdc34a6b6
or eax, 0x35d8738d
cmp eax, 0x274e0f2f
jae 0x1400bb92e
ud2
xor eax, eax
ud2
mov eax, dword [0x141dd4710]
or eax, dword [0x141dd4714]
movabs rsi, 0x8000000000000000
xor eax, 0xabd02a03
imul eax, eax, 0x628e6bba
cmp eax, 0x6ad3b1c
mov rbx, qword [rsp + 0x68]
jae 0x1400bba25
jmp 0x1400bba65
mov r15d, 2
mov rcx, r15
mov rdx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], rdi
lea rcx, [rsp + 0x80]
call fcn.1400dac30
mov r15, qword [rsp + 0x88]
mov word [r15 + rdi*2], 0
inc rdi
mov r12, qword [rsp + 0x80]
test rsi, rsi
je 0x1400bb785
mov eax, dword [0x141dd4808]
imul eax, dword [0x141dd480c]
add eax, 0x4610aac0
and eax, 0x200c184f
cmp eax, 0x4616039a
jbe 0x1400bbbdf
jmp 0x1400bbc09
mov eax, dword [0x141dd47b0]
xor eax, dword [0x141dd47b4]
imul eax, eax, 0x89a64527
cmp eax, 0x679220d4
jne 0x1400bbbb8
jmp 0x1400bbbdb
xor eax, eax
test al, al
je 0x1400bbc90
jmp 0x1400bbcb7
mov eax, dword [0x141dd4718]
imul eax, dword [0x141dd471c]
xor eax, 0x5efd7134
imul eax, eax, 0x9054a8d2
imul rdi, rax, 0x2deffe5b
shr rdi, 0x3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbx + 8], rax
mov qword [rbx], rsi
cmp edi, 0x94dddd96
jbe 0x1400bba7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbx + 8], rax
mov qword [rbx], rsi
jmp 0x1400bba25
cmp qword [rsp + 0x30], 0
mov rsi, qword [rsp + 0x60]
je 0x1400bbb10
mov eax, dword [0x141dd4720]
imul eax, dword [0x141dd4724]
and eax, 0x9e1b6a10
cmp eax, 0xe97a295e
je 0x1400bbad9
mov eax, dword [0x141dd4728]
xor eax, dword [0x141dd472c]
imul eax, eax, 0xd2eb31c
add eax, 0xfffe6610
mov edx, 0xe653db1b
imul rdx, rax
shr rdx, 0x3e
mov rcx, qword [0x141ddb260]
cmp edx, 0x3f92ea59
jne 0x1400bbae2
mov rax, qword [0x141ddb260]
jmp 0x1400bbaa6
xor edx, edx
mov r8, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, dword [0x141dd4730]
or eax, dword [0x141dd4734]
cmp eax, 0x4044b134
je 0x1400bbaf0
nop word cs:[rax + rax]
mov eax, dword [0x141dd4738]
and eax, dword [0x141dd473c]
xor eax, 0xd0740141
add eax, 0x65ec2765
cmp eax, 0x3b2c7113
jb 0x1400bbb10
cmp qword [rsi], 0
je 0x1400bbb80
nop word cs:[rax + rax]
mov eax, dword [0x141dd4740]
and eax, dword [0x141dd4744]
and eax, 0x1e2ae7c9
imul eax, eax, 0x33a132e7
cmp eax, 0x909df900
je 0x1400bbb40
mov r8, qword [rsi + 8]
mov rcx, qword [0x141ddb260]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4758]
xor edx, edx
div dword [0x141dd475c]
and eax, 0x55d92e7b
xor eax, 0x59542224
add eax, 0x538dfe1c
cmp eax, 0xe5bf505a
ja 0x1400bbb80
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x141dd47b8]
add eax, dword [0x141dd47bc]
xor eax, 0xfc09402
or eax, 0xe0126bdd
ud2
ud2
mov eax, dword [0x141dd4810]
imul eax, dword [0x141dd4814]
or eax, 0x10402082
xor eax, 0x22008
or eax, 0xefa4d575
mov rbx, qword [0x141ddb260]
cmp eax, 0xbc10b754
jae 0x1400bbc12
mov rax, qword [0x141ddb260]
jmp 0x1400bbbdf
mov eax, dword [0x141dd4818]
xor edx, edx
div dword [0x141dd481c]
shr eax, 1
mov ecx, 0x90027aef
imul rcx, rax
shr rcx, 0x3d
or ecx, 0x41a8fd6c
xor ecx, 0xccd62191
cmp ecx, 0x3f4fe876
jb 0x1400bbc71
mov esi, dword [0x141dd4820]
xor esi, dword [0x141dd4824]
and esi, 0x3a57bb8d
add esi, 0xa5c6979f
mov rcx, rbx
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, 0xe9530e2f
jbe 0x1400bbc81
mov rcx, rbx
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400bbc43
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
jmp 0x1400bb785
mov eax, dword [0x141dd47d8]
mov ecx, dword [0x141dd47dc]
add eax, ecx
add eax, 0x6ec268c9
imul rax, rax, 0x2484d5e3
shr rax, 0x3d
ud2
ud2
ud2