Function at 0x1403d5760
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
mov esi, dword [rcx + 0xc8]
mov r12, qword [rsp + 0x190]
sar esi, 3
mov rbx, rcx
mov r15, rdx
mov rdi, r8
mov rbp, r9
test r12, r12
je 0x1403d5ae2
mov rcx, r12
call sub.msvcrt.dll_strlen
mov r14, rax
lea rax, [rax + 7]
test r15, r15
je 0x1403d5ad9
mov r8, rbp
and ebp, 7
shr r8, 3
add rax, rbp
add rdi, r8
movsxd rdx, esi
mov rcx, qword [rbx + 0xf0]
shr rax, 3
add rdx, rdi
add rax, rdx
mov rdx, qword [rbx + 0xf8]
lea r9, [rcx + rax]
cmp rdx, r9
jb 0x1403d6237
mov r13, qword [rbx + 0x100]
test rdi, rdi
jne 0x1403d5ab8
add rcx, rdi
mov qword [rbx + 0xf0], rcx
lea r9, [r13 + rcx]
test rbp, rbp
jne 0x1403d5898
test r14, r14
je 0x1403d5a0f
mov byte [r9], 0
lea rax, [r14 - 1]
lea rax, [r12 + rax + 1]
mov rcx, rbp
jmp 0x1403d583c
cmp r12, rax
je 0x1403d58d0
mov rcx, r9
movzx edx, byte [r12]
mov r8, qword [rbx + 0xf0]
add r12, 1
lea r9, [rcx + 1]
add r8, qword [rbx + 0x100]
and edx, 1
shl edx, cl
or byte [r8], dl
cmp rcx, 7
jne 0x1403d5830
mov rdx, qword [rbx + 0xf0]
mov rcx, qword [rbx + 0x100]
lea r8, [rdx + 1]
mov qword [rbx + 0xf0], r8
mov byte [rcx + rdx + 1], 0
cmp r12, rax
je 0x1403d59fc
xor r9d, r9d
jmp 0x1403d5839
mov ecx, ebp
mov eax, 1
shl eax, cl
mov ecx, eax
sub eax, 1
and al, byte [r15 + rdi]
mov byte [r9], al
lea rax, [r14 - 1]
test r14, r14
jne 0x1403d5822
mov r11, qword [rbx + 0xf0]
mov rax, qword [rbx + 0x100]
mov r9, rbp
jmp 0x1403d58f9
mov r11, qword [rbx + 0xf0]
mov rax, qword [rbx + 0x100]
mov rcx, r11
mov r13, rax
test r9, r9
je 0x1403d5a0a
mov ecx, r9d
mov edx, 1
shl edx, cl
mov ecx, edx
mov r13, rax
movsxd r8, dword [rbx + 0xc8]
xor edx, edx
lea r10, [r11 + 1]
lea rax, [r11*8]
mov qword [rbx + 0xf0], r10
or rax, r9
lea r9, [r13 + r11]
div r8
or cl, byte [r9]
mov r11d, ecx
lea rcx, [r8 - 8]
cmp rdx, rcx
jb 0x1403d59c0
lea rax, [r8 - 2]
cmp rax, rdx
jb 0x1403d59c0
lea ecx, [r11 - 0x80]
mov r12, r10
mov byte [r9], cl
mov qword [rbx + 0xf0], r12
mov rdx, qword [rbx + 0x100]
mov r8, r12
mov rcx, rbx
call fcn.1403ce7a0
mov eax, dword [rbx + 0xd0]
cmp qword [rsp + 0x198], 0
je 0x1403d5a38
lea r8d, [rax + 7]
mov rax, qword [rsp + 0x198]
mov edx, esi
mov rcx, rbx
sar r8d, 3
mov qword [rsp + 0x20], rax
mov r9d, dword [rbx + 0xd8]
sar r9d, 3
call fcn.140544c90
xor eax, eax
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [r10*8]
xor edx, edx
mov byte [r9], r11b
lea rbp, [rcx + rax]
lea rcx, [r13 + r10]
div r8
sub rbp, rdx
xor edx, edx
shr rbp, 3
mov r8, rbp
lea r12, [rbp + 1]
sub r8, r10
call sub.msvcrt.dll_memset
mov byte [r13 + rbp], pe_nt_image_headers64
jmp 0x1403d594d
mov rcx, qword [rbx + 0xf0]
mov r13, qword [rbx + 0x100]
lea r9, [r13 + rcx]
movsxd r8, dword [rbx + 0xc8]
lea rax, [rcx*8]
xor edx, edx
lea r10, [rcx + 1]
mov r11d, 1
div r8
jmp 0x1403d5929
sub eax, 1
cdq
idiv dword [rbx + 0xc8]
test eax, eax
je 0x1403d59a5
mov r13d, dword [rbx + 0xec]
mov rbp, qword [rbx + 0xe0]
mov esi, eax
cmp r13d, 0x18
je 0x1403d5aef
movsxd rax, r13d
lea rdi, [0x140615140]
movsxd rbp, ebp
lea r12, [rdi + rax*8]
nop dword [rax]
test r13d, r13d
jle 0x1403d59a5
lea rdi, [0x140615140]
nop dword [rax + rax]
mov rdx, qword [rdi]
mov rcx, rbx
add rdi, 8
and rdx, rbp
call fcn.140544480
cmp r12, rdi
jne 0x1403d5a90
sub esi, 1
jne 0x1403d5a78
jmp 0x1403d59a5
add rcx, r13
mov r8, rdi
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbx + 0xf0]
mov r13, qword [rbx + 0x100]
jmp 0x1403d57f9
xor ebp, ebp
xor edi, edi
jmp 0x1403d57c1
mov eax, 7
xor r14d, r14d
jmp 0x1403d57a8
mov dword [rsp + 0x11c], eax
nop word cs:[rax + rax]
mov rax, qword [rbx + 8]
mov rdi, qword [rbx + 0x68]
mov r14, qword [rbx + 0x88]
mov r9, qword [rbx]
mov qword [rsp + 0x88], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xd8], rdi
mov rdi, qword [rbx + 0x70]
mov qword [rsp + 0x90], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0xe0], rdi
mov rdi, qword [rbx + 0x78]
mov qword [rsp + 0x98], rax
mov rax, qword [rbx + 0x20]
mov r15, qword [rbx + 0x58]
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xa0], rax
mov rax, qword [rbx + 0x28]
mov rdi, qword [rbx + 0x80]
mov rbp, qword [rbx + 0x90]
mov qword [rsp + 0xa8], rax
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0xb0], rax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0xb8], rax
mov rax, qword [rbx + 0x40]
mov qword [rsp + 0xc0], rax
mov rax, qword [rbx + 0x48]
mov qword [rsp + 0xc8], rax
mov rax, qword [rbx + 0x50]
mov qword [rsp + 0xd0], rax
mov rax, qword [rbx + 0x60]
mov rsi, qword [rbx + 0x98]
mov r13, qword [rbx + 0xa8]
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x170], rbx
mov r12, qword [rbx + 0xa0]
mov qword [rsp + 0xf0], rsi
mov rsi, qword [rbx + 0xc0]
mov r10, qword [rbx + 0xb0]
mov r11, qword [rbx + 0xb8]
mov rbx, r9
mov r9, r13
mov qword [rsp + 0x70], rsi
lea rsi, [0x140615140]
mov r13, r14
mov r14, rax
mov qword [rsp + 0x108], rsi
nop
mov rcx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
xor rcx, rbx
mov r8, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xc0]
xor rcx, rax
mov rax, qword [rsp + 0xc8]
xor rcx, rsi
mov rsi, qword [rsp + 0xa8]
xor rcx, rdx
mov rdx, qword [rsp + 0xb0]
xor rsi, rdx
mov rdx, qword [rsp + 0xf8]
xor rsi, r8
mov r8, qword [rsp + 0xd8]
xor rsi, r15
mov r15, qword [rsp + 0xe8]
xor rsi, rax
mov rax, qword [rsp + 0xd0]
xor r15, rdi
xor rax, rdx
xor r15, r13
mov rdx, r12
xor rax, r14
xor r15, rbp
xor rdx, r9
xor rax, r8
mov r8, qword [rsp + 0xe0]
xor rdx, r10
xor rdx, r11
xor rax, r8
mov r8, qword [rsp + 0xf0]
xor r15, r8
mov r8, qword [rsp + 0x70]
xor rdx, r8
mov r8, rsi
rol r8, 1
xor r8, rdx
rol rdx, 1
xor rbx, r8
xor rdx, rax
rol rax, 1
mov qword [rsp + 0x110], rbx
mov rbx, qword [rsp + 0xe8]
xor rax, rcx
rol rcx, 1
xor rcx, r15
rol r15, 1
xor rbx, rdx
xor r15, rsi
mov rsi, rbx
mov rbx, qword [rsp + 0xa8]
rol rsi, 0x1c
xor r12, rcx
xor r9, rcx
xor rdi, rdx
xor rbx, rax
rol r12, 0x1b
mov qword [rsp + 0x40], rsi
xor r14, r15
rol rbx, 1
rol r9, 0x14
xor r11, rcx
xor r13, rdx
mov qword [rsp + 0x38], rbx
ror rdi, 9
ror r14, 0x15
xor r10, rcx
mov qword [rsp + 0x48], r9
mov rbx, qword [rsp + 0xb0]
xor rbp, rdx
rol r13, 0x19
mov qword [rsp + 0x100], r12
ror r10, 0x19
rol rbp, 0x15
mov rsi, qword [rsp + 0xd0]
mov r12, qword [rsp + 0xf8]
mov r9, qword [rsp + 0x88]
xor rbx, rax
mov qword [rsp + 0x60], rdi
xor rsi, r15
ror rbx, 0x14
xor r12, r15
xor r9, r8
ror rsi, 2
mov qword [rsp + 0xb0], rbx
rol r12, 6
ror r9, 0x1c
mov qword [rsp + 0xa8], rsi
mov rsi, r11
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x68], r14
mov rdi, qword [rsp + 0xb8]
mov r14, qword [rsp + 0x90]
mov r9, qword [rsp + 0x70]
xor rdi, rax
mov r11, qword [rsp + 0xd8]
mov r12, rdi
mov rdi, qword [rsp + 0xc0]
xor r14, r8
rol r14, 3
rol r12, 0xa
xor rdi, rax
ror rdi, 0x13
rol rsi, 8
xor rcx, r9
xor r11, r15
mov r9, qword [rsp + 0xe0]
mov rbx, r11
rol rcx, 0xe
mov r11, qword [rsp + 0x98]
rol rbx, 0xf
xor r15, r9
xor r11, r8
mov r9, qword [rsp + 0x40]
ror r15, 3
ror r11, 0x17
mov qword [rsp + 0x70], r15
mov r15, qword [rsp + 0xa0]
xor r8, r15
mov r15, qword [rsp + 0x48]
rol r8, 0x12
mov qword [rsp + 0x78], r8
mov r8, qword [rsp + 0xf0]
not r15
and r15, r14
xor rdx, r8
xor r9, r15
mov r8, qword [rsp + 0x60]
ror rdx, 8
mov qword [rsp + 0x88], r9
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x80], rdx
mov rdx, qword [rsp + 0xc8]
not r8
xor rax, rdx
mov rdx, qword [rsp + 0x58]
rol rax, 2
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x50]
not rdx
not rax
mov r15, rax
mov rax, r9
and r15, r13
xor rax, r15
mov r15, rdx
mov rdx, qword [rsp + 0x100]
and r15, r12
mov qword [rsp + 0x90], rax
xor rdx, r15
mov r15, r8
mov qword [rsp + 0x98], rdx
mov rdx, qword [rsp + 0xa8]
and r15, r10
mov r8, rdx
xor r8, r15
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0xa0], r8
mov r8, qword [rsp + 0xb0]
not r15
and r15, rbp
mov rax, r8
xor rax, r15
mov qword [rsp + 0xa8], rax
mov rax, r14
not rax
mov r15, rax
mov rax, qword [rsp + 0x48]
and r15, rdi
xor rax, r15
mov r15, r13
mov qword [rsp + 0xb0], rax
not r15
mov rax, qword [rsp + 0x50]
and r15, rsi
xor rax, r15
mov r15, r12
mov qword [rsp + 0xb8], rax
not r15
mov rax, qword [rsp + 0x58]
and r15, rbx
xor rax, r15
mov r15, r10
mov qword [rsp + 0xc0], rax
not r15
mov rax, qword [rsp + 0x60]
and r15, r11
xor rax, r15
mov r15, rbp
mov qword [rsp + 0xc8], rax
not r15
mov rax, qword [rsp + 0x68]
and r15, rcx
xor rax, r15
mov r15, rdi
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x70]
not r15
and r15, rax
xor r15, r14
mov r14, rsi
not r14
and r14, qword [rsp + 0x78]
mov qword [rsp + 0xf8], r15
xor r14, r13
mov r13, rbx
mov r15, qword [rsp + 0x110]
not r13
and r13, qword [rsp + 0x80]
xor r13, r12
mov r12, r11
not r12
and r12, qword [rsp + 0xf0]
mov qword [rsp + 0xd8], r13
xor r12, r10
mov r10, rcx
not r10
mov qword [rsp + 0xe0], r12
mov r12, r15
and r10, r15
not r12
xor r10, rbp
and r12, r8
not r8
mov qword [rsp + 0xe8], r10
mov r10, rax
xor r12, rcx
mov rax, qword [rsp + 0x100]
not r10
and r10, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
xor rdi, r10
mov r10, qword [rsp + 0x78]
not rcx
and rcx, qword [rsp + 0x48]
not r10
and r10, r9
mov r9, qword [rsp + 0x70]
xor r10, rsi
mov rsi, qword [rsp + 0xf0]
mov r13, r10
mov r10, qword [rsp + 0x80]
xor r9, rcx
mov rcx, qword [rsp + 0x38]
not r10
not rcx
and rcx, qword [rsp + 0x50]
and r10, rax
not rax
xor r10, rbx
mov rbx, qword [rsp + 0x78]
mov rbp, r10
mov r10, rsi
not r10
xor rcx, rbx
mov rbx, qword [rsp + 0x68]
and r10, rdx
not rdx
and rdx, qword [rsp + 0x60]
xor r10, r11
xor rdx, rsi
and rbx, r8
mov qword [rsp + 0xf0], r10
mov r10, rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x70], rdx
and rcx, rax
mov rax, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x108]
xor rcx, rax
mov rax, qword [rdx]
mov r11, rcx
xor rax, r15
add rdx, 8
xor rbx, rax
lea rax, [0x140615200]
mov qword [rsp + 0x108], rdx
cmp rax, rdx
jne 0x1403d5c20
mov rax, qword [rsp + 0x88]
mov rsi, r14
mov r14, r13
mov r13, r9
mov r9, rbx
mov rbx, qword [rsp + 0x170]
mov r15, qword [rsp + 0xf8]
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0x90]
mov qword [rbx + 0x58], r15
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x98]
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x18], rax
mov rax, qword [rsp + 0xa0]
mov qword [rbx + 0x80], rdi
mov qword [rbx + 0x20], rax
mov rax, qword [rsp + 0xa8]
mov qword [rbx + 0x88], r14
mov qword [rbx + 0x28], rax
mov rax, qword [rsp + 0xb0]
mov qword [rbx + 0x30], rax
mov rax, qword [rsp + 0xb8]
mov qword [rbx + 0x38], rax
mov rax, qword [rsp + 0xc0]
mov qword [rbx + 0x40], rax
mov rax, qword [rsp + 0xc8]
mov qword [rbx + 0x48], rax
mov rax, qword [rsp + 0xd0]
mov qword [rbx + 0x50], rax
mov rax, qword [rsp + 0xd8]
mov qword [rbx + 0x68], rax
mov rax, qword [rsp + 0xe0]
mov qword [rbx + 0x70], rax
mov rax, qword [rsp + 0xe8]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x90], rbp
mov rax, qword [rsp + 0xf0]
sub dword [rsp + 0x11c], 1
mov qword [rbx + 0x98], rax
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0xa0], r12
mov qword [rbx + 0xa8], r13
mov qword [rbx + 0xb0], r10
mov qword [rbx + 0xb8], r11
mov qword [rbx + 0xc0], rax
mov qword [rbx], r9
jne 0x1403d5b00
jmp 0x1403d59a5
lea rcx, [rdx + rax]
mov qword [rsp + 0x38], rdx
mov qword [rbx + 0xf8], rcx
call sub.msvcrt.dll_malloc
mov rdx, qword [rsp + 0x38]
test rax, rax
mov r13, rax
je 0x1403d6280
mov rcx, rbx
call fcn.1403d8630
mov rcx, qword [rbx + 0x100]
call sub.msvcrt.dll_free
mov qword [rbx + 0x100], r13
mov rcx, qword [rbx + 0xf0]
jmp 0x1403d57f0
mov qword [rbx + 0xf8], rdx
or eax, 0xffffffff
jmp 0x1403d59a7