Function at 0x1401a2fa4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xor ebx, ebx
mov rax, rdx
mov r15, rcx
cmp byte [rcx + 8], bl
jne 0x1401a2fe4
mov edi, 0xc004d101
mov ecx, edi
call fcn.140082a8c
jmp 0x1401a3205
test rax, rax
jne 0x1401a2ff2
mov ecx, 0x80070057
mov edi, ecx
jmp 0x1401a2fda
mov rax, qword [rcx]
mov r13d, dword [rbp + 0x68]
mov r14d, dword [rax + 0x10]
lea eax, [r13 + 1]
add eax, r14d
cmp r8d, eax
jb 0x1401a2fe9
mov r12d, r8d
mov dword [rbp + 0x48], r14d
sub r12d, r14d
dec r12d
mov dword [rbp + 0x70], r12d
lea eax, [r12 + r14]
lea ebx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1401a3041
xor ebx, ebx
jmp 0x1401a3049
mov rbx, rsi
test rsi, rsi
jne 0x1401a3050
mov edi, 0x8007000e
jmp 0x1401a2fd8
mov edx, r12d
lea rcx, [rax + r14]
add rcx, rdx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x48], rcx
lea r8, [rbp + 0x78]
mov ecx, r12d
mov r9, rsi
add rcx, r14
mov dword [rbp + 0x78], r12d
add rcx, rdx
mov rdx, rsi
add rcx, rsi
mov qword [rbp - 0x40], rcx
mov rcx, qword [r15]
call fcn.1401a2b2c
mov edi, eax
test eax, eax
jns 0x1401a3095
mov ecx, eax
jmp 0x1401a2fda
mov rax, qword [r15]
mov ebx, dword [rbp + 0x58]
mov ecx, dword [rax + 0x10]
add ecx, ecx
sub ebx, ecx
sub ebx, r13d
sub ebx, 2
je 0x1401a30ba
mov ecx, dword [rbp + 0x78]
xor edx, edx
add rcx, rsi
mov r8d, ebx
call sub.msvcrt.dll_memset
mov eax, dword [rbp + 0x78]
mov r8, r13
mov rdx, qword [rbp + 0x60]
add eax, ebx
mov dword [rbp + 0x78], eax
mov byte [rax + rsi], 1
mov eax, dword [rbp + 0x78]
inc eax
mov ecx, eax
add rcx, rsi
mov dword [rbp + 0x78], eax
call sub.msvcrt.dll_memcpy
add dword [rbp + 0x78], r13d
and dword [rbp - 0x28], 0
mov r13d, r12d
add r13, rsi
mov qword [rbp - 0x30], r13
jne 0x1401a30f7
xor eax, eax
jmp 0x1401a3107
mov rax, qword [0x1404524a8]
mov ecx, dword [rax]
lea rax, [rbp - 0x30]
add rax, rcx
and dword [rbp - 0x10], 0
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x18], rax
mov edx, r14d
movaps xmm0, xmmword [rbp - 0x18]
movdqa xmmword [rbp - 0x18], xmm0
call fcn.140193e60
mov edi, eax
test eax, eax
jns 0x1401a3139
mov ecx, eax
call fcn.140082a8c
mov rbx, rsi
jmp 0x1401a3205
mov rcx, qword [r15]
lea r8, [rbp + 0x70]
mov dword [rsp + 0x28], r12d
mov r9, r13
mov dword [rsp + 0x20], r14d
mov r14, qword [rbp - 0x48]
mov rdx, r14
call fcn.1401a2c04
mov edi, eax
test eax, eax
js 0x1401a312a
mov rbx, rsi
test r12d, r12d
je 0x1401a317f
mov rcx, rsi
mov edx, r12d
sub r14, rsi
mov al, byte [r14 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1401a3170
mov rcx, qword [r15]
lea r8, [rbp + 0x48]
mov r15, qword [rbp - 0x40]
mov r9, rsi
mov rdx, r15
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
call fcn.1401a2c04
mov edi, eax
test eax, eax
js 0x1401a308e
mov r14d, dword [rbp + 0x48]
test r14d, r14d
je 0x1401a31cc
mov rcx, r15
sub r13, r15
mov edx, r14d
mov al, byte [rcx + r13]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1401a31bd
lea eax, [r14 + r12]
cmp dword [rbp + 0x58], eax
jbe 0x1401a2fe9
mov r12, qword [rbp + 0x50]
mov r8, r14
mov rdx, r15
lea rcx, [r12 + 1]
mov byte [r12], 0
call sub.msvcrt.dll_memcpy
mov r8, qword [rbp - 0x38]
lea ecx, [r14 + 1]
add rcx, r12
mov rdx, rsi
call sub.msvcrt.dll_memcpy
mov ecx, edi
call fcn.140082b34
test rbx, rbx
je 0x1401a3225
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret