Function at 0x18002cc80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1800a1030]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r13, rax
xor r14d, r14d
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], r14b
mov ecx, 0x110
call fcn.180069dac
mov rbx, rax
mov qword [rbp - 0x28], pe_nt_image_headers64
mov qword [rbp - 0x20], 0x10f
lea edx, [r14 + 0x20]
mov r8d, pe_nt_image_headers64
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + 0x100], r14b
mov qword [rbp - 0x38], rbx
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
mov r8d, pe_nt_image_headers64
mov rcx, r13
call qword [sym.imp.USER32.dll_GetClassNameA]
lea rax, [rbp - 0x38]
mov rcx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
cmp qword [rbp - 0x20], 0x10
jb 0x18002cd52
lea r15, [rcx + r8]
mov rsi, rcx
lea rbx, [rcx + r8]
mov rdi, r15
jmp 0x18002cd64
lea rdi, [rax + r8]
mov r15, rdi
lea rbx, [rbp - 0x38]
add rbx, r8
lea rsi, [rbp - 0x38]
cmp rsi, rbx
je 0x18002cdca
nop dword [rax]
movsx ecx, byte [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
je 0x18002cd85
inc rsi
cmp rsi, rbx
jne 0x18002cd70
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x38]
cmp rsi, rbx
je 0x18002cdca
lea r14, [rsi + 1]
cmp r14, rbx
je 0x18002cdc7
nop dword [rax + rax]
movsx ecx, byte [r14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
je 0x18002cdb7
movzx eax, byte [r14]
mov byte [rsi], al
inc rsi
inc r14
cmp r14, rbx
jne 0x18002cda0
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x38]
xor r14d, r14d
lea rax, [rbp - 0x38]
mov rdx, rsi
cmp qword [rbp - 0x20], 0x10
jb 0x18002cddd
sub rdx, rcx
jmp 0x18002cde7
sub rdx, rax
mov r15, rdi
lea rcx, [rbp - 0x38]
mov rax, r8
sub r15, rsi
sub rax, rdx
cmp rax, r15
cmovb r15, rax
add rcx, rdx
sub r8, r15
mov qword [rbp - 0x28], r8
sub r8, rdx
inc r8
lea rdx, [rcx + r15]
call sub.VCRUNTIME140.dll_memmove
cmp qword [rbp - 0x20], 0x10
setae r8b
mov dword [rbp - 0x48], 0x57
mov eax, dword [rbp - 0x48]
xor al, 0x44
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x48]
inc al
xor al, 0x61
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x48]
add al, 2
xor al, 0x79
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x48]
add al, 3
xor al, 0x5a
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
movzx eax, byte [rbp - 0x44]
mov rdx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rdx - 0x44]
mov ecx, dword [rbp - 0x48]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x44], cl
inc rdx
cmp rdx, 4
jb 0x18002ce60
mov byte [rbp - 0x40], 0
lea rcx, [rbp - 0x44]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18002ce90
lea rcx, [rbp - 0x38]
test r8b, r8b
cmovne rcx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
cmp r8, rax
jne 0x18002cf74
lea rdx, [rbp - 0x44]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18002cf74
lea rdx, [rbp - 0x18]
mov rcx, r13
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
cmp eax, dword [rbp - 0x14]
je 0x18002cf6c
test ecx, ecx
je 0x18002cf6c
mov qword [r12], r13
mov byte [r12 + 8], 1
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x18002cf2f
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002cf2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002cfb0
call fcn.180069990
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rax, r12
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180069970
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov byte [r12 + 8], 0
jmp 0x18002cef4
mov byte [r12 + 8], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x18002cf2f
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002cf2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002cf2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3