Function at 0x1400f0ee0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
xchg r13, rsi
mov qword [rsp + 0x10], r13
xchg r13, rsi
xchg rdi, r8
mov qword [rsp + 0x18], r8
xchg rdi, r8
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x71f4205c
xor r8d, 0x17f2a420
xor r8d, 0x400f3c12
add r8d, 0x2b7dc053
sub r8d, 0x19e62d02
sub r8d, 0x37a141b7
call sub.VCRUNTIME140.dll_memset
xchg rdi, rcx
mov rdi, qword [rbx]
xchg rcx, rdi
add rcx, 0x5d8
call fcn.14007b7e0
xor ebx, ebx
mov dword [rsp + 0x32], 0x6be927be
xor dword [rsp + 0x32], 0xf76441d
sub dword [rsp + 0x32], 0x1bf32283
sub dword [rsp + 0x32], 0x1693c5a4
add dword [rsp + 0x32], 0x4d127f9e
xor dword [rsp + 0x32], 0x246a3883
xor dword [rsp + 0x32], 0x2a4b7988
add dword [rsp + 0x32], 0x85eb3ce5
mov edx, ebx
mov dword [rsp + 0x42], 0x3aadebe4
xor dword [rsp + 0x42], 0x181eb5aa
sub dword [rsp + 0x42], 0x173c4edd
add dword [rsp + 0x42], 0x37fb3aa5
add dword [rsp + 0x42], 0x32ab2021
add dword [rsp + 0x42], 0x896094f8
xchg rsi, r8
mov rsi, rax
xchg rsi, r8
mov dword [rsp + 0x46], 0x716ca76b
add dword [rsp + 0x46], 0xb882f16
sub dword [rsp + 0x46], 0x3117d657
xor dword [rsp + 0x46], 0x7833092a
sub dword [rsp + 0x46], 0xd0f4bad
xor dword [rsp + 0x46], 0x50980874
sub dword [rsp + 0x46], 0x2fb1237a
sub dword [rsp + 0x46], 0x11f5fff7
xor dword [rsp + 0x46], 0xcbec6e9c
mov dword [rsp + 0x36], 0x5c93f748
add dword [rsp + 0x36], 0x62798c8
sub dword [rsp + 0x36], 0x46a1e5c0
xor dword [rsp + 0x36], 0x533ae57f
add dword [rsp + 0x36], 0x1381f1dd
sub dword [rsp + 0x36], 0x52eaddf1
sub dword [rsp + 0x36], 0xdacd7e4
add dword [rsp + 0x36], 0xf4e96bbf
mov dword [rsp + 0x4a], 0x69d41c2d
sub dword [rsp + 0x4a], 0xc469a34
xor dword [rsp + 0x4a], 0x40c08260
add dword [rsp + 0x4a], 0x51d09e2c
sub dword [rsp + 0x4a], 0x5b4e7334
xor dword [rsp + 0x4a], 0xece5d1ec
mov dword [rsp + 0x4e], 0xc6b09ea
sub dword [rsp + 0x4e], 0x5d493e0
add dword [rsp + 0x4e], 0x45285502
xor dword [rsp + 0x4e], 0x18daed78
xor dword [rsp + 0x4e], 0x280e47ec
sub dword [rsp + 0x4e], 0x4f070c04
add dword [rsp + 0x4e], 0xd316a9d9
mov dword [rsp + 0x3a], 0x1a4f9575
add dword [rsp + 0x3a], 0x3d8c4e65
add dword [rsp + 0x3a], 0x142b809b
sub dword [rsp + 0x3a], 0x69e968f5
add dword [rsp + 0x3a], 0x301de468
xor dword [rsp + 0x3a], 0x48700358
xor dword [rsp + 0x3a], 0x65c50cc3
add dword [rsp + 0x3a], 0x1bb22cf2
add dword [rsp + 0x3a], 0xbbb5f991
mov dword [rsp + 0x52], 0x7eddba35
sub dword [rsp + 0x52], 0x68d2d733
xor dword [rsp + 0x52], 0x215064fb
xor dword [rsp + 0x52], 0x1d567583
add dword [rsp + 0x52], 0x4ff1e764
xor dword [rsp + 0x52], 0x868226a2
mov dword [rsp + 0x56], 0x28c9d9fa
xor dword [rsp + 0x56], 0x4456f0a2
add dword [rsp + 0x56], 0x19408f0
xor dword [rsp + 0x56], 0x1dc3c040
sub dword [rsp + 0x56], 0x6c9b8af
add dword [rsp + 0x56], 0x9253c626
mov word [rsp + 0x3e], 0x22fa
add word [rsp + 0x3e], 0x3470
xor word [rsp + 0x3e], 0x46c8
add word [rsp + 0x3e], 0x63fa
sub word [rsp + 0x3e], 0x2b1c
add word [rsp + 0x3e], 0xac76
mov dword [rsp + 0x5a], 0x5057797a
xor dword [rsp + 0x5a], 0x4ce3cc54
add dword [rsp + 0x5a], 0xb76eef2
xor dword [rsp + 0x5a], 0x121bcb12
sub dword [rsp + 0x5a], 0x316a4e81
xor dword [rsp + 0x5a], 0x1ef36fbe
add dword [rsp + 0x5a], 0xd1db1b3
sub dword [rsp + 0x5a], 0x5139a11
add dword [rsp + 0x5a], 0xe13098cd
mov byte [rsp + 0x40], 0x6d
xor byte [rsp + 0x40], 0x10
xor byte [rsp + 0x40], 0x43
xor byte [rsp + 0x40], 0x19
add byte [rsp + 0x40], 0x56
sub byte [rsp + 0x40], 0x75
add byte [rsp + 0x40], 0xee
mov dword [rsp + 0x5e], 0x5e5bea31
sub dword [rsp + 0x5e], 0x26f8e0f
xor dword [rsp + 0x5e], 0x57f978ee
add dword [rsp + 0x5e], 0x40bf5ee1
sub dword [rsp + 0x5e], 0x43c7065b
xor dword [rsp + 0x5e], 0x5169388a
xor dword [rsp + 0x5e], 0x7f639135
xor dword [rsp + 0x5e], 0x478dd75e
sub dword [rsp + 0x5e], 0x60890445
nop
movzx eax, word [rsp + rdx*2 + 0x42]
movzx ecx, byte [rsp + rdx + 0x32]
add cx, ax
mov word [rsp + rdx*2 + 0x42], cx
mov byte [rsp + rdx + 0x32], bl
inc rdx
cmp rdx, 0xf
jb 0x1400f1252
lea rdx, [rsp + 0x42]
lea rcx, [rsp + 0x70]
call fcn.140087040
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov byte [rsp + rax + 0x42], bl
inc rax
cmp rax, 0x1e
jb 0x1400f128b
mov dword [rsp + 0x20], 0x739e6a8d
sub dword [rsp + 0x20], 0x54f607a5
add dword [rsp + 0x20], 0x10b7d03
xor dword [rsp + 0x20], 0x3b21f0cb
add dword [rsp + 0x20], 0x5d8075f
add dword [rsp + 0x20], 0x20776350
xor dword [rsp + 0x20], 0x63472080
add dword [rsp + 0x20], 0xcd503da7
mov rax, rbx
mov dword [rsp + 0x26], 0x14b0e223
add dword [rsp + 0x26], 0x424b2258
xor dword [rsp + 0x26], 0x8bd40ee
xor dword [rsp + 0x26], 0x3007e3b0
add dword [rsp + 0x26], 0x4fb26c1
sub dword [rsp + 0x26], 0x721d9aae
add dword [rsp + 0x26], 0x3cad838f
add dword [rsp + 0x26], 0x2fec32fd
xor dword [rsp + 0x26], 0x92c1168b
mov dword [rsp + 0x2a], 0x570c47ef
xor dword [rsp + 0x2a], 0x7a2ce42d
add dword [rsp + 0x2a], 0x375aaa6f
sub dword [rsp + 0x2a], 0x36813ed8
add dword [rsp + 0x2a], 0x2e2c2bc4
xor dword [rsp + 0x2a], 0x6ac57179
add dword [rsp + 0x2a], 0xa85ff8
sub dword [rsp + 0x2a], 0x1d8507b1
xor dword [rsp + 0x2a], 0xe57f5dd7
mov byte [rsp + 0x24], 0x50
xor byte [rsp + 0x24], 0x22
sub byte [rsp + 0x24], 0xc
xor byte [rsp + 0x24], 0x4d
sub byte [rsp + 0x24], 0xd
xor byte [rsp + 0x24], 0x7b
add byte [rsp + 0x24], 0x91
mov dword [rsp + 0x2e], 0x732c4f1d
sub dword [rsp + 0x2e], 0x135a1448
sub dword [rsp + 0x2e], 0x1c8baa2b
add dword [rsp + 0x2e], 0x63e93fe
xor dword [rsp + 0x2e], 0x7183301f
xor dword [rsp + 0x2e], 0x42d3ddea
sub dword [rsp + 0x2e], 0x7ad4c9e1
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x26]
movzx edx, byte [rsp + rax + 0x20]
add dx, cx
mov word [rsp + rax*2 + 0x26], dx
mov byte [rsp + rax + 0x20], bl
inc rax
cmp rax, 5
jb 0x1400f13d4
mov r9d, 0x650c8f18
sub r9d, 0x568b0aba
add r9d, 0x5e3b4fd6
add r9d, 0xf069c2d
sub r9d, 0x3d37653a
add r9d, 0x1d8fe3fa
xor r9d, 0x6fb12965
sub r9d, 0x33aac634
lea r8, [rsp + 0x26]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop word [rax + rax]
mov byte [rsp + rbx + 0x26], 0x68
xor byte [rsp + rbx + 0x26], 0x56
sub byte [rsp + rbx + 0x26], 0xd
sub byte [rsp + rbx + 0x26], 0x27
xor byte [rsp + rbx + 0x26], 0
xor byte [rsp + rbx + 0x26], 0x4a
xor byte [rsp + rbx + 0x26], 0xb
sub byte [rsp + rbx + 0x26], 0x1c
sub byte [rsp + rbx + 0x26], 0x2f
inc rbx
cmp rbx, 0xa
jb 0x1400f1449
mov ecx, 0x100e2855
xor ecx, 0x7556497a
sub ecx, 0x2bb3e804
sub ecx, 0x28d355a0
xor ecx, 0xd1d2e78
add ecx, 0xe233f20c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3