Function at 0x14002fa60
Capabilities:
Encode data using xor

Disassembly:
mov byte [rsp + 0x10], dl
mov byte [rsp + 8], cl
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
movzx ecx, byte [0x140042a86]
xor ebx, ebx
mov r10d, dword [0x140042b40]
mov edi, 0x4b0
mov edx, dword [0x140042b3c]
test r10d, r10d
mov r9d, dword [0x140042b44]
mov ebp, ecx
setne al
xor byte [0x140042b80], al
mov eax, ebx
sete al
add byte [0x140042b66], cl
or edx, eax
lea eax, [rcx + 0x203]
or r9d, eax
lea eax, [rbx + 1]
test bl, bl
jne 0x14002fac7
mov eax, ebx
movzx r8d, byte [0x140042a63]
add edx, eax
movzx eax, byte [0x140042b67]
mov r11d, dword [0x140042b30]
and al, 0xca
movzx ecx, byte [0x140042b81]
mov r14d, dword [0x140042b78]
add cl, 0x7f
mov r15d, dword [0x140042b34]
xor cl, al
movzx eax, byte [0x140042a8c]
xor r8b, cl
or al, byte [0x140042b67]
or al, 0x59
mov dword [0x140042b3c], edx
mov byte [0x140042b64], al
test r11d, r11d
mov byte [0x140042a63], r8b
setne al
mov byte [0x140042b67], bl
or byte [0x140042b88], al
mov eax, ebx
cmp dword [0x140042b60], 1
sete al
xor r11d, 0x4a7
and dword [0x140042b84], eax
mov eax, 0xcccccccd
cmp r8b, 1
sete r8b
imul esi, dword [0x140042b28], 0xa4
mul esi
shr edx, 2
lea eax, [rdx + rdx*4]
mov edx, 0x5a6
sub esi, eax
add ebp, 0xfffffb50
nop word [rax + rax]
sub r9d, r11d
movzx ecx, r8b
test r14d, r14d
setne al
xor r10d, ebp
and cl, al
mov eax, ebx
test r15d, r15d
mov byte [0x140042a62], cl
setne al
mov dword [0x140042b38], eax
sub rdx, 1
jne 0x14002fb80
mov dword [0x140042b44], r9d
mov dword [0x140042b40], r10d
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
movsx edx, byte [0x140042a62]
mov ecx, esi
movzx r15d, byte [0x140042a87]
mov eax, dword [0x140042b58]
and r15d, edi
mov r8d, dword [0x140042b3c]
xor r15d, edx
mov r10d, dword [0x140042b34]
add eax, 0x2d0
mov ebp, dword [0x140042b7c]
add r8d, eax
movzx r14d, byte [0x140042b88]
add edx, 0x267
mov r12d, dword [0x140042b6c]
mov eax, 0x244
mov r13d, dword [0x140042b38]
xor r15d, 0xfffffeac
movzx r11d, byte [0x140042b57]
shl edx, cl
movzx ecx, byte [0x140042b83]
shl eax, cl
xor edx, eax
imul r9d, r10d, 0x6e
mov eax, r8d
mov dword [0x140042a64], edx
mov edx, 0x5be
mov dword [rsp + 0x80], r8d
mov qword [rsp + 0x90], rdx
shr r9d, 2
xor eax, 0x244
mov dword [rsp + 0x88], eax
mov eax, dword [0x140042b30]
nop
test r9d, r9d
je 0x14002fcea
test eax, eax
je 0x14002fcea
test r10d, r10d
je 0x14002fc95
mov ecx, eax
mov edx, edi
mov eax, ebx
shl edx, cl
cmp edi, 0x4e
sete al
test eax, edx
mov eax, 1
jne 0x14002fc97
mov eax, ebx
xor byte [0x140042b65], al
mov eax, 0xaaaaaaab
movzx r9d, byte [0x140042b82]
mov ecx, dword [0x140042b78]
imul r9d, edi
mov edi, dword [0x140042b4c]
add edi, 0x13
mul r9d
shr edx, 1
lea eax, [rdx + rdx*2]
sub r9d, eax
mov eax, ebx
shl eax, cl
add r12d, eax
test r13d, r13d
jne 0x14002fcda
mov eax, ebx
test edi, edi
je 0x14002fcdf
mov eax, 1
mov rdx, qword [rsp + 0x90]
sub r14b, al
test r10d, r10d
movzx r8d, r15b
setne al
and r11b, al
movzx eax, r15b
test edi, edi
sete cl
xor r13d, dword [rsp + 0x88]
and al, 0xea
shl r8b, cl
xor byte [0x140042b83], al
mov ecx, dword [0x140042b4c]
movzx eax, r11b
cmp eax, 0x267
je 0x14002fd2a
mov eax, ebx
test ecx, ecx
je 0x14002fd2f
mov eax, 1
and r10d, eax
test esi, r10d
jne 0x14002fd46
test esi, esi
je 0x14002fd42
lea eax, [rbp + 0x4e]
test eax, eax
jne 0x14002fd46
mov eax, ebx
jmp 0x14002fd4b
mov eax, 1
or r8b, al
mov eax, dword [0x140042b30]
sub rdx, 1
mov qword [rsp + 0x90], rdx
jne 0x14002fc70
movsx eax, byte [0x140042b55]
mov byte [0x140042b57], r11b
imul r11d, eax, 0x267
mov dword [0x140042b34], r10d
mov byte [0x140042b88], r14b
mov dword [0x140042b6c], r12d
mov dword [rsp + 0x28], r13d
and r11d, 0x80000003
mov dword [rsp + 0x90], r11d
jge 0x14002fdb8
dec r11d
or r11d, 0xfffffffc
inc r11d
mov dword [rsp + 0x90], r11d
movsx r10d, byte [0x140042b56]
lea eax, [rcx - 0x3b5]
mov r15d, dword [0x140042b40]
sub esi, r9d
movzx ecx, sil
mov r14d, r11d
shr eax, cl
lea r11d, [r9 + 0x25b]
and eax, r12d
mov ecx, edi
mov dword [rsp + 0x98], eax
mov r12d, 0x32d
mov dword [0x140042b4c], eax
movsx eax, byte [0x140042b64]
imul esi, eax, 0x244
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ebx
sub esi, eax
mov eax, r15d
shr eax, cl
mov ecx, r10d
mov r10d, dword [0x140042b5c]
cmp eax, 0xfffffff5
mov eax, 0x77
mov dword [rsp + 0x24], esi
movzx esi, byte [0x140042b64]
sete dl
shl eax, cl
mov ecx, ebx
cmp edx, eax
mov eax, dword [0x140042a88]
sete cl
and r14d, 0x25b
add eax, ecx
mov dword [rsp + 0x88], eax
mov eax, r13d
sar eax, 0x1f
mov r13d, eax
nop word [rax + rax]
inc ebp
movzx edx, r10b
test r14d, r14d
setne cl
or r15d, r13d
lea eax, [rcx + rbp]
or r8b, al
test r11d, r11d
setne al
or dl, al
test sil, sil
setne al
add dl, al
mov byte [0x140042a87], dl
sub r12, 1
jne 0x14002fe70
mov r11d, dword [rsp + 0x90]
mov r10d, dword [0x140042b34]
mov esi, dword [rsp + 0x24]
movzx r14d, byte [0x140042b88]
mov r13d, dword [rsp + 0x28]
mov byte [0x140042b67], r8b
mov dword [0x140042b40], r15d
test r11d, r11d
je 0x14002fee1
cmp byte [0x140042b55], bl
lea eax, [r12 + 1]
jne 0x14002fee3
mov eax, ebx
cmp eax, 0xa4
mov ecx, ebx
movsx eax, r14b
setg cl
cmp eax, ecx
je 0x14002fefc
xor byte [0x140042b64], 1
mov eax, dword [rsp + 0x98]
mov r12d, dword [0x140042a8c]
and eax, 0xfffffff5
xor dword [0x140042b5c], eax
test r12d, r12d
jns 0x14002ff21
movzx eax, sil
or eax, r9d
jne 0x14002ff28
mov eax, ebx
test r10d, r10d
je 0x14002ff2d
mov eax, 1
or dword [rsp + 0x88], eax
mov ecx, r9d
movzx eax, dl
shl eax, cl
cmp eax, 0xfffffff5
je 0x14002ff51
movzx eax, byte [0x140042b81]
xor eax, edi
mov eax, 1
jne 0x14002ff53
mov eax, ebx
movzx r10d, byte [0x140042a86]
or r13d, eax
mov dword [0x140042b38], r13d
test r10b, r10b
je 0x14002ff7d
mov eax, 0xa4
mov dword [0x140042b7c], 1
cmp eax, edi
jne 0x14002ff83
mov dword [0x140042b7c], ebx
cmp byte [0x140042b56], 0x77
mov eax, ebx
mov ecx, ebx
mov edx, ebx
setg al
cmp eax, 0xa4
movzx eax, byte [0x140042b54]
setl cl
cmp ecx, r9d
seta dl
cmp eax, edx
je 0x14002ffc2
lea ecx, [rbp - 0xa4]
movzx eax, r12b
shl al, cl
or r14b, al
mov byte [0x140042b88], r14b
mov ecx, dword [0x140042b3c]
mov r8d, ebx
mov r14d, dword [rsp + 0x88]
mov eax, 0xcccccccd
imul ecx, edi
movzx r11d, sil
mov dword [rsp + 0x90], r11d
movzx r10d, r10b
mov byte [0x140042b66], bl
mul ecx
movzx eax, byte [0x140042b83]
mov ecx, ebx
shr edx, 2
sub edx, 0x3b5
cmp edx, r11d
sete r8b
cmp eax, r8d
mov eax, 0xaaaaaaab
sete cl
or dword [0x140042b84], ecx
mov ecx, dword [rsp + 0x98]
imul ecx, ebp
mul ecx
imul ecx, r14d, 0xa4
mov eax, 0xcccccccd
mov r8d, edx
shr r8d, 1
mul ecx
mov eax, dword [rsp + 0x80]
shr edx, 2
movsx ecx, dl
shr r8d, cl
mov r13d, ecx
imul r13d, r15d
movzx r15d, byte [0x140042b60]
shl r10d, cl
mov ecx, ebx
mov byte [0x140042a62], r15b
and r13d, 3
cmp r10d, r8d
mov r8d, dword [0x140042b28]
sete cl
xor eax, ecx
mov dword [rsp + 0x80], eax
mov dword [0x140042b58], eax
mov eax, 0xcccccccd
mul r11d
shr edx, 2
lea eax, [rdx + rdx*4]
mov edx, 0xcc
sub r11d, eax
movsx eax, byte [0x140042b56]
add r11d, eax
dec dx
test r8d, r8d
jne 0x1400300be
mov eax, r11d
mov ecx, ebp
sar eax, cl
or eax, r9d
mov eax, ebx
je 0x1400300c3
mov eax, 1
and r10d, eax
test dx, dx
jne 0x1400300a8
movzx edx, byte [0x140042b82]
cmp r9d, r11d
mov ebp, dword [rsp + 0x90]
mov r8d, ebx
sete r8b
movsx eax, r15b
xor r8d, dword [0x140042b2c]
sub edx, eax
movsx eax, byte [0x140042b64]
xor r8d, r10d
sub edx, 3
mov dword [0x140042b48], r10d
cmp ebp, eax
mov dword [0x140042b2c], r8d
mov ecx, ebx
sete cl
and edx, ecx
add r14d, edx
cmp dword [0x140042b5c], edi
mov dword [0x140042a88], r14d
jbe 0x140030153
cmp edi, dword [0x140042b68]
je 0x140030153
lea eax, [r13 - 0xb]
and al, r8b
mov r8d, dword [rsp + 0x80]
test r8d, r8d
mov byte [0x140042a63], al
sete bl
xor r12d, ebx
mov dword [0x140042a8c], r12d
sub sil, 0xb
lea ecx, [r14 - 0x19]
xor sil, 0x77
and sil, byte [0x140042b30]
movzx edx, sil
and edx, 0x77
mov byte [0x140042b81], sil
and edx, ecx
and edx, r13d
mov dword [0x140042b68], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call fcn.14002ef20
mov eax, ebp
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret