Function at 0x18005ad10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd8
mov esi, dword [rbp + 0x87]
mov r10, r8
mov edi, dword [rbp + 0x87]
xor r8d, r8d
mov ebx, dword [rbp + 0x87]
mov r11, rcx
mov r15d, esi
mov dword [rbp - 0x61], esi
lea eax, [rsi - 0xf]
lea rcx, [0x180000000]
cmp esi, eax
jbe 0x18005ae4f
mov r13d, dword [rbp + 0x87]
mov r14, qword [rbp - 0x41]
mov r12, qword [rbp - 0x41]
lea eax, [r15 - 0xbc]
lea r8, str.getFeature
lea rdx, str.pgpSecretKeyID
cmp eax, 0x42
ja case.default.0x18005adb5
movzx eax, byte [rcx + rax + 0x5b764]
mov ecx, dword [rcx + rax*4 + 0x5b724]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
test r13d, r13d
je 0x18005ae1f
nop dword [rax]
dec r13d
mov esi, 0x120
nop dword [rax + rax]
mov eax, esi
sub eax, 0x120
je 0x18005adf3
sub eax, 1
je 0x18005ade8
cmp eax, 1
jne 0x18005ae0a
mov r14, r12
jmp 0x18005ae0a
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18005ae06
mov rax, qword [r10 + 0x18]
mov r12, qword [r14 + 8]
test rax, rax
je 0x18005ae0a
mov rcx, qword [r14 + 0x10]
call rax
mov r10, qword [rbp + 0x5f]
inc esi
cmp esi, 0x123
jb 0x18005add0
test r13d, r13d
jne 0x18005adc0
mov esi, dword [rbp + 0x87]
dec r13d
lea rcx, [0x180000000]
xor r8d, r8d
mov r10, qword [rbp + 0x5f]
lea eax, [rsi - 0xf]
mov r9, qword [rbp + 0x67]
dec r15d
mov r11, qword [rbp + 0x4f]
mov dword [rbp - 0x61], r15d
cmp r15d, eax
ja 0x18005ad7e
mov rdx, qword [rbp + 0x57]
imul eax, esi, 0x440
mov r14d, esi
mov dword [rbp - 0x41], eax
cmp esi, eax
ja case.0x18005adb5.196
mov r12, qword [rbp - 0x41]
mov r13, qword [rbp - 0x41]
mov r15, qword [rbp - 0x41]
nop
cmp r14d, 0x1b68e
ja 0x18005b463
je 0x18005b41a
cmp r14d, 0xdbae
ja 0x18005b368
je 0x18005b2cf
cmp r14d, 0xce
je 0x18005b2a9
cmp r14d, 0x3786
je 0x18005b284
cmp r14d, 0x6e3e
je 0x18005b210
cmp r14d, 0xa4f6
jne 0x18005b6f5
mov ecx, 0x100
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r13, rax
jmp 0x18005b6f5
mov rax, qword [r10]
movzx ecx, byte [rax - 1]
and ecx, 7
je case.0x18005adb5.201
sub ecx, 1
je 0x18005af02
sub ecx, 1
je 0x18005af34
sub ecx, 1
je 0x18005af51
cmp ecx, 1
je 0x18005af70
jmp case.0x18005adb5.203
mov edx, 0x44
cmp edx, 0x44
je 0x18005af1c
cmp edx, 0x7e
jne 0x18005af29
mov r15d, 0xfd
jmp case.0x18005adb5.203
mov rax, qword [rbp + 0x7f]
mov rcx, qword [r10]
movzx eax, byte [rax]
mov byte [rcx - 2], al
add edx, 0x3a
cmp edx, 0xb8
jb 0x18005af07
mov eax, 0x43
nop dword [rax]
cmp eax, 0x43
je 0x18005afa0
add eax, 0x2398
cmp eax, 0x2398
jbe 0x18005af40
mov eax, 0x61
cmp eax, 0x61
je 0x18005af89
add eax, 0x165b
cmp eax, 0x165b
jbe 0x18005af56
nop word [rax + rax]
mov rax, qword [rbp + 0x7f]
mov r15d, 0xfd
mov rcx, qword [r10]
mov rax, qword [rax]
mov qword [rcx - 0x10], rax
jmp case.0x18005adb5.203
mov rax, qword [rbp + 0x7f]
mov r15d, 0xfd
mov rcx, qword [r10]
mov eax, dword [rax]
mov dword [rcx - 8], eax
jmp case.0x18005adb5.203
mov rax, qword [rbp + 0x7f]
mov r15d, 0xfd
mov rcx, qword [r10]
movzx eax, word [rax]
mov word [rcx - 4], ax
jmp case.0x18005adb5.203
xor r8d, r8d
cmp qword [rbp + 0x8f], r8
jne 0x18005b0b9
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
lea rax, [rbp - 0x61]
mov qword [rsp + 0x30], rcx
lea rdx, [0x180077149]
mov qword [rsp + 0x28], rax
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x20], rcx
mov dword [rbp - 0x61], ecx
call fcn.18002b8a0
jmp case.0x18005adb5.203
mov edi, 1
jmp case.0x18005adb5.203
movss xmm0, dword [rbp - 0x49]
lea rcx, [rbp - 0x61]
mov r9, r10
movss dword [rbp - 0x61], xmm0
xor r8d, r8d
mov edx, 0xbc
call fcn.180022da0
jmp case.0x18005adb5.203
mov r14, qword [r10]
mov r13d, dword [r10 + 0x28]
jmp case.0x18005adb5.203
mov eax, dword [r9]
xor ecx, ecx
mov qword [rsp + 0x30], rcx
lea r9, [rbp - 0x61]
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov qword [rsp + 0x20], rcx
xor edx, edx
mov ecx, 0x119
mov dword [rbp - 0x61], eax
call fcn.18002d490
mov rbx, rax
test eax, eax
jne 0x18005b24f
jmp case.0x18005adb5.203
movss xmm0, dword [rbp - 0x59]
lea r9, [rbp - 0x61]
xor r8d, r8d
movss dword [rbp - 0x61], xmm0
mov edx, 0x104
mov dword [rbp - 0x49], 0
lea rcx, [rbp - 0x49]
call fcn.180019a80
mov dword [rbp - 0x49], eax
jmp case.0x18005adb5.203
xor r8d, r8d
mov dword [r10 + 0x28], r8d
lea rcx, [0x180000000]
jmp 0x18005ae2c
cmp qword [0x180080b38], 0
je case.0x18005adb5.203
mov esi, 0x17
lea r15d, [rsi + 1]
nop dword [rax]
cmp esi, 0x17
ja case.0x18005b100.2
lea rdx, [0x180000000]
mov eax, esi
movzx eax, byte [rdx + rax + 0x5b7b8]
mov ecx, dword [rdx + rax*4 + 0x5b7a8]
add rcx, rdx
jmp rcx
mov rcx, qword [r10]
xor edx, edx
mov r8d, 0x8000
call qword [0x180080b38]
jmp 0x18005b128
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x4000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov r10, qword [rbp + 0x5f]
dec esi
sub r15, 1
jne 0x18005b0e0
mov r15d, dword [rbp - 0x61]
mov esi, dword [rbp + 0x87]
jmp case.0x18005adb5.203
test r10, r10
jne 0x18005b192
xor ecx, ecx
lea rax, [rbp - 0x61]
mov qword [rsp + 0x58], rcx
lea rdx, [0x180077149]
mov qword [rsp + 0x50], rcx
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov dword [rbp - 0x61], ecx
call fcn.18002b8a0
mov r11, qword [rbp + 0x4f]
xor r8d, r8d
test r11, r11
jne 0x18005b0b9
xor ecx, ecx
lea rax, str.net:Enabled
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
jmp 0x18005afdf
xor ecx, ecx
mov r9d, reloc.SHELL32.dll_SHSetInstanceExplorer
mov dword [rbp - 0x61], ecx
mov r8, r10
lea rcx, [rbp - 0x61]
xor edx, edx
call fcn.180028c40
mov dword [rbp - 0x59], eax
jmp case.0x18005adb5.203
xor r8d, r8d
cmp qword [rbp + 0x6f], r8
jne 0x18005b0b9
xor ecx, ecx
lea rax, str.5_616E6W6n6
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
jmp 0x18005afdf
mov eax, dword [r9]
lea rcx, [rbp - 0x31]
mov dword [rbp - 0x59], eax
lea r9, [rbp - 0x59]
mov rax, qword [rbp + 0x6f]
mov r8d, 0xb9
mov qword [rsp + 0x20], rdx
mov rdx, qword [rax + 8]
call fcn.180038730
mov ebx, eax
test eax, eax
je 0x18005b271
mov eax, ILFindLastID
cmp eax, 0xf
je 0x18005b263
cmp eax, 0xc6
jne 0x18005b265
mov eax, edi
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edi, ebx
add eax, 0xb7
cmp eax, 0x17d
jb 0x18005b241
mov ecx, 0x100
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
jmp 0x18005b6f5
mov rax, qword [rbp + 0x77]
movsxd rax, dword [rax]
shl rax, 7
mov eax, dword [rax + rcx + 0x8219c]
mov rcx, qword [rbp + 0x7f]
cmp dword [rcx], eax
jbe 0x18005b6f5
mov eax, 0xb
jmp 0x18005b24f
mov rax, qword [rbp + 0x77]
lea r8, [rbp - 0x59]
xor r9d, r9d
xor ecx, ecx
mov eax, dword [rax]
lea edx, [r9 + 0x3a]
mov dword [rbp - 0x59], eax
call fcn.180022220
mov ebx, eax
test eax, eax
jne 0x18005b24f
jmp 0x18005b6f5
mov ecx, 0x80
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
test r15, r15
je 0x18005b2f0
test r13, r13
je 0x18005b2f0
test rax, rax
jne 0x18005b6f5
mov esi, 0x57
mov eax, esi
sub eax, 0x57
je 0x18005b348
sub eax, 1
je 0x18005b330
sub eax, 1
je 0x18005b311
cmp eax, 1
je case.0x18005adb5.196
jmp 0x18005b356
xor r9d, r9d
mov dword [rsp + 0x20], 0x43
lea r8, [rbp - 0x31]
xor edx, edx
xor ecx, ecx
call fcn.180037c30
mov edi, ILFindLastID
jmp 0x18005b356
test r13, r13
je 0x18005b33e
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r12, r12
je 0x18005b356
mov rcx, r12
jmp 0x18005b350
test r15, r15
je 0x18005b356
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc esi
cmp esi, 0x5b
jb 0x18005b2f5
mov esi, dword [rbp + 0x87]
jmp 0x18005b6f5
cmp r14d, 0x11266
je 0x18005b660
cmp r14d, 0x1491e
je 0x18005b3a8
cmp r14d, 0x17fd6
jne 0x18005b6f5
xor r9d, r9d
mov dword [rsp + 0x20], 0x43
lea r8, [rbp - 0x31]
xor edx, edx
xor ecx, ecx
call fcn.180037c30
jmp 0x18005b6f5
mov r9, qword [rbp + 0x6f]
lea r8, [rbp - 0x31]
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x51], 0x100
mov ecx, reloc.SHELL32.dll_ILAppendID
mov qword [rsp + 0x20], r13
call fcn.180005cc0
mov ebx, eax
test eax, eax
je 0x18005b6f5
mov esi, 4
nop dword [rax]
mov eax, esi
sub eax, 3
je 0x18005b6a2
cmp eax, 1
jne 0x18005b408
xor r9d, r9d
mov dword [rsp + 0x20], 0x43
lea r8, [rbp - 0x31]
xor edx, edx
xor ecx, ecx
call fcn.180037c30
dec esi
cmp esi, 2
ja 0x18005b3e0
mov esi, dword [rbp + 0x87]
jmp 0x18005b6f5
mov eax, dword [rbp - 0x51]
lea rdx, [rbp - 0x49]
mov dword [rbp - 0x59], eax
lea rcx, [rbp - 0x61]
mov rax, qword [rbp + 0x77]
mov r9, r12
mov dword [rsp + 0x28], 0x10d
mov r8, r13
mov dword [rbp - 0x49], 0x80
mov eax, dword [rax]
mov dword [rbp - 0x61], eax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
call fcn.180061fc0
mov ebx, eax
test eax, eax
jne 0x18005b6a8
jmp 0x18005b6f5
cmp r14d, 0x2916e
ja 0x18005b60e
je 0x18005b5cd
cmp r14d, 0x1ed46
je 0x18005b59f
cmp r14d, 0x223fe
je 0x18005b51a
cmp r14d, 0x25ab6
jne 0x18005b6f5
mov qword [rsp + 0x48], r8
lea rax, [rbp - 0x59]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], r8
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], r8
xor r8d, r8d
mov qword [rbp - 0x59], 0x100
mov dword [rsp + 0x20], 0x1e8
call fcn.180033a80
xor ecx, ecx
mov qword [rbp - 0x59], 0x100
mov qword [rsp + 0x48], rcx
lea rax, [rbp - 0x59]
mov qword [rsp + 0x40], r13
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x1e8
call fcn.180033a80
jmp 0x18005b6f5
mov rax, qword [rbp + 0x77]
lea rcx, [rcx + 0x821a4]
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x58], r8
mov r8d, 7
movsxd rdx, dword [rax]
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x50], r12
shl rdx, 7
add rcx, rdx
mov eax, dword [rax]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x39]
mov dword [rsp + 0x40], 5
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], eax
lea rax, [0x180000000]
mov r9d, dword [rdx + rax + 0x821e4]
mov rdx, qword [rbp + 0x8f]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rcx
mov rcx, r11
call fcn.1800302a0
mov ebx, eax
mov r14d, 0x223fe
jmp 0x18005b6f5
mov rdx, qword [rbp + 0x7f]
mov dword [rbp - 0x51], r8d
cmp dword [rdx], 0
jbe 0x18005b6f5
mov ecx, dword [rbp - 0x51]
movzx eax, byte [rcx + r10]
xor byte [rcx + r12], al
mov eax, dword [rbp - 0x51]
inc eax
mov dword [rbp - 0x51], eax
cmp eax, dword [rdx]
jb 0x18005b5b0
jmp 0x18005b6f5
mov qword [rsp + 0x48], r8
lea rax, [rbp - 0x59]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], r8
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], r8
xor r8d, r8d
mov qword [rbp - 0x59], 0x80
mov dword [rsp + 0x20], 0x1e8
call fcn.180033a80
jmp 0x18005b6f5
cmp r14d, 0x2c826
je 0x18005b6e3
cmp r14d, 0x2fede
je 0x18005b6de
cmp r14d, 0x33596
jne 0x18005b6f5
mov eax, 0x1d
nop word [rax + rax]
cmp eax, 0x1d
je 0x18005b652
cmp eax, 0x910
je case.0x18005adb5.196
jmp 0x18005b654
mov edi, ebx
add eax, 0x8f3
cmp eax, 0x11e6
jbe 0x18005b640
mov dword [rbp - 0x59], r8d
lea r9, [rbp - 0x39]
lea r8, [rbp - 0x59]
mov dword [rbp - 0x39], 0x100
mov rdx, r15
mov dword [rsp + 0x20], 0xb8
lea rcx, [rbp - 0x31]
call fcn.180036950
mov ebx, eax
test eax, eax
je 0x18005b6f5
mov esi, 0xee
cmp esi, 0xee
je 0x18005b6b0
cmp esi, 0x1b3
jne 0x18005b6c8
mov esi, dword [rbp + 0x87]
mov r14d, 0x223fe
jmp 0x18005b6f5
xor r9d, r9d
mov dword [rsp + 0x20], 0x43
lea r8, [rbp - 0x31]
xor edx, edx
xor ecx, ecx
call fcn.180037c30
add esi, 0xc5
cmp esi, 0x278
jb 0x18005b692
mov esi, dword [rbp + 0x87]
jmp 0x18005b6f5
mov rcx, r15
jmp 0x18005b6ef
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
imul eax, esi, 0x44
add r14d, eax
cmp r14d, dword [rbp - 0x41]
ja case.0x18005adb5.196
mov r10, qword [rbp + 0x5f]
lea rcx, [0x180000000]
mov r9, qword [rbp + 0x67]
xor r8d, r8d
mov r11, qword [rbp + 0x4f]
mov rdx, qword [rbp + 0x57]
jmp 0x18005ae70