Function at 0x140004440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x830]
sub rsp, 0x930
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x14017cf50], eax
jg 0x140004781
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x140004776
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x870], rax
mov r14, qword [0x14017ae30]
xor r15d, r15d
mov qword [rbp + 0x860], r15
lea rax, [rbp + 0x860]
mov qword [rsp + 0x20], rax
lea r9, str.HardwareConfig
mov r8, qword [0x14017cf18]
mov rdx, 0xffffffff80000002
call fcn.140088cb0
lea rdi, [r15 - 1]
test eax, eax
je 0x14000452a
mov rbx, qword [rbp + 0x860]
test rbx, rbx
je 0x14000452a
mov r8d, dword [rbx]
xor r8d, 0x92781293
cmp r8d, 0x20
jbe 0x140004685
lea edx, [rdi + 3]
lea rcx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x140004517
mov word [rbx + 4], r15w
mov word [rsp + 0x30], r15w
mov edx, 4
mov rcx, rbx
call fcn.1400ff054
mov qword [rbp + 0x868], r15
lea rax, [rbp + 0x868]
mov qword [rsp + 0x20], rax
lea r9, str.HardwareConfig
mov r8, qword [0x14017cf18]
mov rdx, 0xffffffff80000002
call fcn.140088cb0
test eax, eax
je 0x1400045a6
mov rbx, qword [rbp + 0x868]
test rbx, rbx
je 0x1400045a6
mov r8d, dword [rbx]
xor r8d, 0x92781293
cmp r8d, 0x20
jbe 0x1400046b2
mov edx, 2
lea rcx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x140004593
mov word [rbx + 4], r15w
mov word [rsp + 0x30], r15w
mov edx, 4
mov rcx, rbx
call fcn.1400ff054
mov word [rbp + 0x30], r15w
mov r9d, 0x3ff
lea r8, [rbp + 0x30]
mov edx, 0x173
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140004612
cmp byte [0x1401776f0], r15b
je 0x1400045e4
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], r15b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x173
mov r9d, 0x3ff
lea r8, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140004612
mov word [rbp + 0x30], r15w
lea rax, [rbp + 0x30]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x140004620
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x870]
call fcn.140005a90
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov rbx, qword [rbp + 0x870]
mov r8, rbx
xor edx, edx
call fcn.14007ef60
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000466e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x978]
add rsp, 0x930
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, 7
mov r9d, r15d
test r8d, r8d
je 0x1400046e0
lea rcx, [rbx + 4]
mov edx, r8d
mov r9d, r8d
nop dword [rax]
add eax, 7
xor word [rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x1400046a0
jmp 0x1400046e0
mov eax, 7
mov r9d, r15d
test r8d, r8d
je 0x1400046e0
lea rcx, [rbx + 4]
mov edx, r8d
mov r9d, r8d
nop dword [rax]
add eax, 7
xor word [rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x1400046d0
mov eax, r9d
mov word [rbx + rax*2 + 4], r15w
mov r9, rdi
lea r8, [rbx + 4]
mov edx, 0x80
lea rcx, [rsp + 0x30]
call fcn.140115f0c
mov edx, 4
mov rcx, rbx
call fcn.1400ff054
lea rcx, [rsp + 0x30]
call fcn.1400825c0
test al, al
je 0x1400045a6
mov word [rbp + 0x30], r15w
mov r9d, 0x3ff
lea r8, [rbp + 0x30]
lea edx, [r9 + 5]
mov rcx, r14
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x140004612
cmp byte [0x1401776f0], r15b
je 0x14000475f
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], r15b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x404
jmp 0x1400045f6
mov ecx, 0x80004005
call fcn.140002b00
int3
lea rcx, [0x14017cf50]
call fcn.1400feccc
cmp dword [0x14017cf50], 0xffffffff
jne 0x140004480
lea rcx, [0x14017cef8]
call fcn.140082660
lea rcx, [0x140136160]
call fcn.1400ff03c
nop
lea rcx, [0x14017cf50]
call fcn.1400fec60
jmp 0x140004480