Function at 0x1402f0410
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 8], rcx
push rsi
push r13
sub rsp, 0x48
mov rsi, qword [rsp + 0x80]
mov r13, rcx
mov qword [rax + 0x10], rbx
mov qword [rax - 0x18], rbp
mov qword [rax - 0x20], rdi
xor edi, edi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
mov eax, r9d
movsxd rbp, r8d
mov r15, rdx
test rdx, rdx
je 0x1402f0573
test al, 8
jne 0x1402f0573
mov r10, qword [rcx + 0x18]
lea eax, [rbp - 1]
mov qword [rsp + 0x80], r10
mov r9d, Ordinal_16
movsxd r8, eax
test eax, eax
js 0x1402f0498
nop dword [rax]
movzx edx, byte [r15 + r8]
lea ecx, [r9*8]
xor edx, ecx
xor r9d, edx
sub r8, 1
jns 0x1402f0480
xor edx, edx
mov eax, r9d
div dword [r10 + 0x14]
mov rax, qword [r10 + 0x20]
mov rbx, qword [rax + rdx*8]
test rbx, rbx
je 0x1402f04d0
nop
cmp ebp, dword [rbx + 0x1c]
jne 0x1402f04c8
mov r8, rbp
lea rcx, [rbx + 0x30]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1402f04f8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1402f04b0
xor r12d, r12d
mov dword [r13 + 0x3c], 0
lea r14, [r13 + 0x3c]
test rdi, rdi
je 0x1402f04eb
lea rax, [rdi + 0x10]
mov qword [rdi], rax
or dword [rsi + 8], 1
lea rbx, [rsi + 8]
jmp 0x1402f060a
mov r14d, dword [rbx + 0x18]
lea r12d, [rbp + 0x30]
sub r14d, r12d
call fcn.1403a2170
test eax, eax
jne 0x1402f0559
lea eax, [r14 + 0x1a]
movsxd rcx, eax
call fcn.14036b6d0
mov rdi, rax
test rax, rax
je 0x1402f0559
movsxd rdx, r12d
lea rcx, [rax + 0x10]
add rdx, rbx
movsxd r8, r14d
call sub.VCRUNTIME140.dll_memcpy
mov ecx, reloc.SinoSPE.dll_Ordinal_16
mov rdx, rbx
sub ecx, r12d
movsxd r8, ecx
mov rcx, qword [rsp + 0x80]
add r8, rdi
call fcn.1402e4180
lea r12d, [r14 + rax]
jmp 0x1402f04d3
lea r14, [r13 + 0x3c]
xor r12d, r12d
lea rbx, [rsi + 8]
mov dword [r14], 7
or dword [rbx], 1
jmp 0x1402f060a
mov rcx, qword [rcx + 0x18]
lea r14, [r13 + 0x3c]
mov r8d, ebp
lea r9, [rcx + 0x18]
call fcn.1402e43c0
mov rcx, qword [r13 + 0x18]
mov dword [r14], eax
mov r12, qword [rcx + 0x18]
test r12, r12
je 0x1402f05f6
movsxd rbp, dword [r12 + 0x1c]
lea r15, [r12 + 0x30]
xor r8d, r8d
mov rdx, r12
call fcn.1402e4180
mov r12d, dword [r12 + 0x18]
mov rbx, rbp
sub r12d, ebp
sub r12d, 0x30
add rbx, r15
je 0x1402f05fe
cmp dword [r14], edi
jne 0x1402f05fe
call fcn.1403a2170
test eax, eax
jne 0x1402f05e0
mov ecx, reloc.SinoSPE.dll_Ordinal_16
call fcn.14036b6d0
mov rdi, rax
test rax, rax
jne 0x1402f05e9
mov dword [r14], 7
jmp 0x1402f05fe
mov qword [rax + 8], 0
mov qword [rax], rbx
jmp 0x1402f05fe
xor r15d, r15d
xor ebp, ebp
xor r12d, r12d
mov dword [r13 + 0x30], 0
lea rbx, [rsi + 8]
test rdi, rdi
je 0x1402f0752
mov dword [rsi + 0x68], 0
test ebp, ebp
je 0x1402f0659
cmp ebp, dword [rsi + 0x6c]
jbe 0x1402f063f
mov r8d, ebp
lea rdx, [rsi + 0x60]
mov rcx, r14
call fcn.140357c70
test eax, eax
jne 0x1402f0659
mov r14, qword [rsp + 0x60]
add r14, 0x3c
movsxd rcx, dword [rsi + 0x68]
mov rdx, r15
add rcx, qword [rsi + 0x60]
mov r8d, ebp
call sub.VCRUNTIME140.dll_memcpy
add dword [rsi + 0x68], ebp
lea rbx, [rsi + 8]
mov dword [rdi + 0xc], r12d
lea rdx, [rsi + 0x70]
mov dword [rdi + 8], r12d
mov qword [rsi + 0x10], rdi
mov rcx, qword [rdi]
call fcn.14035a690
test byte [rsp + 0x78], 2
mov r13, qword [rsp + 0x60]
movzx edx, al
mov qword [rsi + 0x20], rdx
mov r9d, dword [rdi + 8]
mov dword [rsi + 0x44], r9d
je 0x1402f06a4
or dword [rsi + 8], 2
lea rbx, [rsi + 8]
mov rdx, rsi
mov rcx, r13
call fcn.1402f1a10
jmp 0x1402f0752
cmp dword [r14], 0
jne 0x1402f0752
mov rax, qword [r13]
mov ebx, edx
mov r8, qword [rsi + 0x10]
cmp dword [rax + 0x60], 1
jne 0x1402f0706
cmp r9d, dword [r8 + 0xc]
cmovge r9d, dword [r8 + 0xc]
mov byte [rsi + 0x7c], 0
mov dword [rsi + 0x78], 1
cmp edx, r9d
jge 0x1402f0747
mov rax, qword [r8]
cmp byte [rdx + rax], 0
jne 0x1402f0747
lea eax, [rdx + 1]
mov byte [rsi + 0x7c], 1
mov edx, eax
cmp eax, r9d
jge 0x1402f06fd
mov ecx, eax
mov rax, qword [r8]
cmp byte [rcx + rax], 0
jne 0x1402f06fd
inc edx
jmp 0x1402f0747
mov dword [rsi + 0x78], 0
jmp 0x1402f0747
mov rcx, rdx
inc edx
add rcx, qword [r8]
movzx r8d, byte [rcx]
mov dword [rsp + 0x80], r8d
test r8b, r8b
jns 0x1402f0737
lea rdx, [rsp + 0x80]
call fcn.14035a880
mov r8d, dword [rsp + 0x80]
lea edx, [rbx + rax]
movzx eax, r8b
and al, 1
sar r8d, 1
mov dword [rsi + 0x78], r8d
mov byte [rsi + 0x7c], al
movsxd rax, edx
lea rbx, [rsi + 8]
mov qword [rsi + 0x20], rax
test byte [rbx], 2
mov rbx, qword [rsp + 0x68]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
je 0x1402f0788
lea rax, [0x1402f1610]
mov qword [rsi + 0x30], rax
add rsp, 0x48
pop r13
pop rsi
ret
mov rax, qword [r13]
lea rcx, [0x1402f0bc0]
lea rdx, [0x1402f13c0]
cmp dword [rax + 0x60], 1
cmove rcx, rdx
mov qword [rsi + 0x30], rcx
add rsp, 0x48
pop r13
pop rsi
ret