Function at 0x14002a160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
mov rbp, rsp
sub rsp, 0x60
xchg rsi, rbx
mov rbx, rdx
xchg rsi, rbx
xchg r9, r15
mov r9, rcx
xchg r9, r15
xor edi, edi
mov dword [rbp + 0x30], edi
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 5]
call fcn.140028dd0
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x14002a3db
sub eax, 0x31d87417
add eax, 0x31d88417
mov dword [rbp + 0x30], eax
mov ebx, eax
mov ecx, eax
call fcn.1401102d8
xchg r14, rax
mov rax, r14
xchg r14, rax
test rax, rax
je 0x14002a200
mov r8d, ebx
xor edx, edx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x14002a209
xchg rdi, r14
mov rdi, r14
xchg r14, rdi
xchg rdi, r14
mov qword [rbp + 0x48], rdi
xchg rdi, r14
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x30]
xchg r14, r8
mov r14, r8
xchg r14, r8
mov edx, 0x4c38f846
sub edx, 0x4c38f841
xchg r14, r15
mov rcx, r14
xchg r15, r14
call fcn.140028dd0
test eax, eax
js 0x14002a3af
mov dword [rbp - 0x30], 0x7a9bf8f3
xor dword [rbp - 0x30], 0xc425464d
mov dword [rbp - 0x24], 0x664a749
add dword [rbp - 0x24], 0xf947585d
mov dword [rbp - 0x20], 0x6f406724
xor dword [rbp - 0x20], 0x90e59891
mov dword [rbp - 0x2c], 0x7ae0dd53
xor dword [rbp - 0x2c], 0xc45e63ed
mov dword [rbp - 0x1c], 0x76b20b62
add dword [rbp - 0x1c], 0x8902f44f
mov dword [rbp - 0x18], 0x445da55
xor dword [rbp - 0x18], 0xfb3525f3
mov word [rbp - 0x28], 0x648d
add word [rbp - 0x28], 0x5a31
mov dword [rbp - 0x14], 0x2dbcd4ae
add dword [rbp - 0x14], 0xd1fe2af9
mov byte [rbp - 0x26], 0x66
add byte [rbp - 0x26], 0x58
mov dword [rbp - 0x10], 0x660c39e1
sub dword [rbp - 0x10], 0x660b3a3a
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
nop dword [rax]
movzx ecx, word [rbp + rdx*2 - 0x24]
movzx eax, byte [rbp + rdx - 0x30]
add ax, cx
mov word [rbp + rdx*2 - 0x24], ax
mov byte [rbp + rdx - 0x30], 0x73
xor byte [rbp + rdx - 0x30], 0x73
inc rdx
cmp rdx, 0xb
jb 0x14002a2de
xchg rbx, r14
mov r14, rbx
xchg r14, rbx
cmp word [rbx + 0x38], 0
je 0x14002a386
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
cmp qword [rbx + 0x50], rax
je 0x14002a386
cmp word [rbx + 0x38], 0x16
jne 0x14002a386
xchg r8, rdx
mov r8, qword [rbx + 0x40]
xchg rdx, r8
lea rcx, [rbp - 0x24]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14002a386
mov eax, dword [rbx + 0x50]
mov dword [rbp + 0x40], eax
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x14002a374
mov dword [rdx], eax
sub qword [rsi + 8], 0xfffffffffffffffc
jmp 0x14002a386
lea r8, [rbp + 0x40]
xchg r9, rsi
mov rcx, r9
xchg rsi, r9
call fcn.140028970
mov eax, dword [rbx]
test eax, eax
je 0x14002a398
add rbx, rax
jmp 0x14002a310
mov byte [rbp + rdi - 0x24], 5
xor byte [rbp + rdi - 0x24], 5
inc rdi
cmp rdi, 0x16
jb 0x14002a398
mov r8d, dword [rbp + 0x30]
xor edx, edx
xchg r14, rbx
mov rcx, rbx
xchg r14, rbx
call sub.VCRUNTIME140.dll_memset
nop
test r14, r14
je 0x14002a3db
xchg rcx, r14
mov r14, rcx
xchg r14, rcx
call fcn.1401102d0
xchg r13, rbx
mov r13, qword [rsp + 0x98]
xchg rbx, r13
add rsp, 0x60
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
push rbx
push rax
push rdx
push rdx
push rbx
xchg qword [rsp + 0x28], rsi
pop rbx
pop rdx
pop rdx
pop rax
pop rbx
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret