Function at 0x140091740
Capabilities:
Encode data using xor
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
xchg r8, rbp
mov qword [rsp + 0x10], r8
xchg r8, rbp
xchg rsi, r11
mov qword [rsp + 0x18], r11
xchg r11, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r15
sub rsp, 0x20
xchg r9, rdi
mov r9, rcx
xchg r9, rdi
mov byte [rcx + 0x5fc], 0x2a
xor byte [rcx + 0x5fc], 0x46
sub byte [rcx + 0x5fc], 0x5c
add byte [rcx + 0x5fc], 0x48
sub byte [rcx + 0x5fc], 0x2f
add byte [rcx + 0x5fc], 0x29
add byte [rcx + 0x5fc], 8
xor byte [rcx + 0x5fc], 0x4f
sub byte [rcx + 0x5fc], 0x14
xor r15d, r15d
cmp qword [rcx + 0x5c0], r15
je 0x14009183c
mov rcx, qword [rcx + 0x5c8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x6cd7c023
sub edx, 0xf46b8d7
sub edx, 0x4dff6112
add edx, 0x2615ccdf
xor edx, 0x60c49605
sub edx, 0x43071174
xor edx, 0x737fe5c1
xor edx, 0x61233581
mov rcx, qword [rdi + 0x5c0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140091835
xor edx, edx
xchg r10, rcx
mov r10, qword [rdi + 0x5c0]
xchg rcx, r10
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rdi + 0x5c0], r15
mov edx, 0x49cadff9
xor edx, 0x60fad45
sub edx, 0x4929bf05
add edx, 0x72eef05e
sub edx, 0x16625bd7
sub edx, 0x5eb5eb35
add edx, 0x5bb79105
xor edx, 0x6029ede6
mov rcx, qword [rdi + 0x5d0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140091892
xor edx, edx
mov rcx, qword [rdi + 0x5d0]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
nop
movabs rsi, 0xffffffff26bf1ec5
xor rsi, 0x2d026277
sub rsi, 0x8a41233
add rsi, 0x6640c1b3
sub rsi, 0x6a5bdf0
sub rsi, 0x27b4c421
add rsi, 0x7fffffff
add rsi, 0x450055df
xchg rbp, rsi
mov qword [rdi + 0x5d0], rbp
xchg rbp, rsi
mov rbp, qword [rdi + 0x2f8]
mov r14, qword [rdi + 0x2f0]
cmp r14, rbp
je 0x140091955
mov rbx, qword [r14]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
xchg r13, rcx
mov r13, rax
xchg rcx, r13
call fcn.1401fcb00
mov rax, qword [rbx]
mov edx, 0x40c3aea0
xor edx, 0x63146c84
add edx, 0x34a85ad7
sub edx, 0xac15557
sub edx, 0x9af086c
xor edx, 0x440fbf39
xchg rcx, rbp
mov rbp, rbx
xchg rcx, rbp
call qword [rax]
nop
sub r14, 0x3aff0960
add r14, 0x3aff0968
cmp r14, rbp
jne 0x1400918f2
xchg rcx, r15
mov r15, qword [rdi + 0x2b8]
xchg rcx, r15
test rcx, rcx
je 0x140091970
call fcn.1401fcb00
mov rcx, qword [rdi + 0x2c0]
test rcx, rcx
je 0x140091985
call fcn.1401fcb00
mov rcx, qword [rdi + 0x2c8]
test rcx, rcx
je 0x14009199a
call fcn.1401fcb00
xchg rcx, rbp
mov rbp, qword [rdi + 0x140]
xchg rcx, rbp
test rcx, rcx
je 0x1400919b5
call fcn.1401fcb00
xchg r14, rcx
mov r14, qword [rdi + 0x2d0]
xchg r14, rcx
test rcx, rcx
je 0x1400919d0
call fcn.1401fcb00
lea rcx, [rdi + 0x5d8]
call fcn.14007adb0
lea rcx, [rdi + 0x560]
call fcn.14007adb0
lea rcx, [rdi + 0x548]
call fcn.14007adb0
xchg r10, rbx
mov r10, qword [rdi + 0x320]
xchg rbx, r10
test rbx, rbx
je 0x140091a45
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140091a45
xchg rdx, rax
mov rdx, qword [rbx]
xchg rdx, rax
xchg rbx, r9
mov rcx, r9
xchg rbx, r9
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140091a45
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
xchg r10, rbx
mov r10, qword [rdi + 0x310]
xchg rbx, r10
test rbx, rbx
je 0x140091a9c
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140091a9c
xchg rdi, rax
mov rdi, qword [rbx]
xchg rdi, rax
xchg rcx, rdx
mov rdx, rbx
xchg rcx, rdx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140091a9c
mov rax, qword [rbx]
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call qword [rax + 8]
xchg r8, rcx
mov r8, qword [rdi + 0x2f0]
xchg rcx, r8
test rcx, rcx
je 0x140091b26
mov rdx, qword [rdi + 0x300]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140091afa
nop
sub rdx, 0x689da50d
add rdx, 0x689da534
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140092225
xchg r14, r8
mov rcx, r14
xchg r8, r14
call fcn.1401fcb00
xchg r15, r13
mov qword [rdi + 0x2f0], r13
xchg r15, r13
xchg r15, r12
mov qword [rdi + 0x2f8], r12
xchg r12, r15
xchg rsi, r15
mov qword [rdi + 0x300], rsi
xchg r15, rsi
xchg rsi, rbx
mov rsi, qword [rdi + 0x2e8]
xchg rsi, rbx
test rbx, rbx
je 0x140091b79
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140091b79
mov rax, qword [rbx]
xchg r15, rbx
mov rcx, r15
xchg rbx, r15
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140091b79
mov rax, qword [rbx]
xchg rdx, rcx
mov rdx, rbx
xchg rcx, rdx
call qword [rax + 8]
xchg r12, rbx
mov r12, qword [rdi + 0x2d8]
xchg r12, rbx
test rbx, rbx
je 0x140091bce
mov rcx, rbx
call fcn.14017d3d0
mov edx, 0x165918b0
add edx, 0x1748056a
xor edx, 0x10be4865
xor edx, 0x51f0bc8d
sub edx, 0x94e3617
sub edx, 0x31734270
xor edx, 0x322e72cb
xchg rdx, rcx
mov rdx, rbx
xchg rcx, rdx
call fcn.1401fcb00
xchg rbx, r9
mov r9, qword [rdi + 0x2b0]
xchg rbx, r9
test rbx, rbx
je 0x140091c29
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.14017d3d0
mov edx, 0x3014d996
add edx, 0x12bab9ee
sub edx, 0x1aefaa83
add edx, 0x13c9c6b1
xor edx, 0xf1e9e30
add edx, 0x1cc28992
xor edx, 0x5179bbb4
xchg rbx, r12
mov rcx, r12
xchg rbx, r12
call fcn.1401fcb00
mov rbx, qword [rdi + 0x2a8]
test rbx, rbx
je 0x140091c84
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.140179d70
mov edx, 0x1817d483
add edx, 0xc296f9d
add edx, 0x41480c9b
sub edx, 0x2bf23041
add edx, 0x8b57332
add edx, 0x375225fb
xor edx, 0x6c2ca02d
sub edx, 0x15b218ea
xchg rsi, rbx
mov rcx, rsi
xchg rsi, rbx
call fcn.1401fcb00
xchg rbx, r12
mov r12, qword [rdi + 0x2a0]
xchg rbx, r12
test rbx, rbx
je 0x140091ce5
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.14017a600
mov edx, 0x485bfec4
sub edx, 0x3c78759d
add edx, 0x2ac1114b
sub edx, 0x2b0bc502
add edx, 0x5ce130c1
sub edx, 0x3a6b2839
add edx, 0x10a26e00
sub edx, 0x3eb14b50
xchg rbx, rdx
mov rcx, rdx
xchg rdx, rbx
call fcn.1401fcb00
xchg rdx, rbx
mov rdx, qword [rdi + 0x298]
xchg rbx, rdx
test rbx, rbx
je 0x140091d40
xchg r15, rcx
mov r15, rbx
xchg rcx, r15
call fcn.140179d70
mov edx, 0x42fa51ac
xor edx, 0x519c5ffb
add edx, 0x182f5ad1
sub edx, 0x107ceb1c
add edx, 0x448c6bb2
sub edx, 0x3e2d788c
xor edx, 0x21777192
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401fcb00
lea rcx, [rdi + 0x278]
call fcn.14002f850
lea rcx, [rdi + 0x258]
call fcn.14002f850
lea rcx, [rdi + 0x238]
call fcn.14002f850
lea rcx, [rdi + 0x218]
call fcn.14002f850
lea rcx, [rdi + 0x1f8]
call fcn.14002f850
lea rcx, [rdi + 0x1d8]
call fcn.14002f850
mov rbx, qword [rdi + 0x1d0]
test rbx, rbx
je 0x140091dd7
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.140183f20
mov edx, 0x76a58c0
add edx, 0x44923609
sub edx, 0x1bf1b39b
add edx, 0x26411db4
sub edx, 0x11915f0a
sub edx, 0x44ba98b0
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401fcb00
lea rcx, [rdi + 0x1b0]
call fcn.14002f850
mov rbx, qword [rdi + 0x1a8]
test rbx, rbx
je 0x140091e38
xchg rcx, rsi
mov rsi, rbx
xchg rsi, rcx
call fcn.14017d3d0
mov edx, 0x577d94eb
sub edx, 0x3e1d4265
xor edx, 0x6d61eaf5
add edx, 0x97faef1
sub edx, 0x34e352e5
add edx, 0x2b2714fd
sub edx, 0x73c528dc
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.1401fcb00
mov rbx, qword [rdi + 0x1a0]
test rbx, rbx
je 0x140091e81
mov rcx, rbx
call fcn.140183f20
mov edx, 0x66d11adc
sub edx, 0x1338989f
xor edx, 0x1da76183
sub edx, 0x7528f03
add edx, 0x21aa0909
xor edx, 0x11970f16
sub edx, 0x790051aa
mov rcx, rbx
call fcn.1401fcb00
xchg rcx, rbx
mov rcx, qword [rdi + 0x198]
xchg rcx, rbx
test rbx, rbx
je 0x140091ee2
xchg rbx, rdx
mov rcx, rdx
xchg rdx, rbx
call fcn.14017d3d0
mov edx, 0x4ae2b9b9
add edx, 0x88bc1b8
sub edx, 0x4d0cc2b1
add edx, 0x3541be46
xor edx, 0x9e594cc
xor edx, 0x1e6305c
xor edx, 0x7047d351
xor edx, 0x43e70067
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401fcb00
lea rcx, [rdi + 0x178]
call fcn.14002f850
xchg r14, rbx
mov r14, qword [rdi + 0x170]
xchg r14, rbx
test rbx, rbx
je 0x140091f3d
xchg rdx, rcx
mov rdx, rbx
xchg rdx, rcx
call fcn.140186de0
mov edx, 0x7312477e
sub edx, 0x5da9696f
sub edx, 0xd83fdde
add edx, 0x392f6f71
add edx, 0x384c4927
sub edx, 0x79609809
mov rcx, rbx
call fcn.1401fcb00
xchg rbx, r10
mov r10, qword [rdi + 0x168]
xchg r10, rbx
test rbx, rbx
je 0x140091f98
xchg r15, rbx
mov rcx, r15
xchg rbx, r15
call fcn.140187430
mov edx, 0x6b8f5f8c
sub edx, 0x8322248
xor edx, 0x462f9ceb
add edx, 0x54301b4
sub edx, 0x1f33e07f
add edx, 0x4ce8a307
sub edx, 0x586a6543
xchg r8, rbx
mov rcx, r8
xchg r8, rbx
call fcn.1401fcb00
xchg r12, rbx
mov r12, qword [rdi + 0x160]
xchg rbx, r12
test rbx, rbx
je 0x140091ff3
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.140179d70
mov edx, 0x19ee4b55
xor edx, 0x35aa79cd
sub edx, 0x1cb4ecc8
add edx, 0x4964eb92
xor edx, 0x2d496a06
sub edx, 0x22285eaf
sub edx, 0x5394fc15
xchg r10, rbx
mov rcx, r10
xchg rbx, r10
call fcn.1401fcb00
lea rcx, [rdi + 0x148]
call 0x140091290
lea rcx, [rdi + 0x110]
call fcn.14002f850
lea rcx, [rdi + 0xf0]
call fcn.14002f850
lea rcx, [rdi + 0xc8]
call fcn.14002f850
lea rcx, [rdi + 0xa8]
call fcn.14002f850
lea rcx, [rdi + 0x88]
call fcn.14002f850
mov r8, qword [rdi + 0x78]
mov r8, qword [r8 + 8]
lea rdx, [rdi + 0x78]
lea rcx, [rdi + 0x78]
call fcn.140080ea0
mov edx, 0x72814f61
add edx, 0xc147da4
sub edx, 0xb76c082
sub edx, 0x3b5ca77d
xor edx, 0x4a11a02b
xor edx, 0x7dd3c5b5
xchg rbp, rcx
mov rbp, qword [rdi + 0x78]
xchg rbp, rcx
call fcn.1401fcb00
xchg rcx, rbx
mov rcx, qword [rdi + 0x70]
xchg rcx, rbx
test rbx, rbx
je 0x1400920e0
xchg rbx, rdx
mov rcx, rdx
xchg rbx, rdx
call fcn.140188dd0
mov edx, 0x12da148d
xor edx, 0x72c1b0af
add edx, 0x405dbd4
add edx, 0x1baa99c9
sub edx, 0x25c3dec2
add edx, 0x885d55d
sub edx, 0x4843c13c
xor edx, 0x1a4a4fe6
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401fcb00
mov rbx, qword [rdi + 0x68]
test rbx, rbx
je 0x14009212c
xchg rcx, r13
mov r13, rbx
xchg rcx, r13
call fcn.140074170
mov edx, 0x3741b6dc
xor edx, 0x652b2e29
sub edx, 0x38b4eb59
add edx, 0xb78b6f4
add edx, 0x1ca69f0a
xor edx, 0x41d503ea
xchg rdx, rbx
mov rcx, rdx
xchg rbx, rdx
call fcn.1401fcb00
xchg rbx, r10
mov r10, qword [rdi + 0x60]
xchg rbx, r10
test rbx, rbx
je 0x14009217e
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401ad240
mov edx, 0x411e8bb7
add edx, 0x16464914
sub edx, 0x32391c59
add edx, 0x3d0fefa1
sub edx, 0x4967804d
xor edx, 0x18d4279e
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401fcb00
mov rbx, qword [rdi + 0x58]
test rbx, rbx
je 0x1400921ca
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400921ca
xchg r13, rax
mov r13, qword [rbx]
xchg r13, rax
xchg r15, rcx
mov r15, rbx
xchg rcx, r15
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x1400921ca
mov rax, qword [rbx]
xchg r14, rbx
mov rcx, r14
xchg r14, rbx
call qword [rax + 8]
lea rcx, [rdi + 0x30]
call fcn.140091350
lea rcx, [rdi + 0x18]
call fcn.140091350
xchg rdi, rcx
mov rdi, rcx
xchg rdi, rcx
mov rbx, qword [rsp + 0x40]
xchg rdi, rbp
mov rdi, qword [rsp + 0x48]
xchg rbp, rdi
xchg rsi, r10
mov r10, qword [rsp + 0x50]
xchg r10, rsi
add rsp, 0x20
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
jmp fcn.140091350
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3