Function at 0x180029710
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x730]
sub rsp, 0x830
movaps xmmword [rsp + 0x820], xmm6
mov rax, qword [0x1800c8010]
xor rax, rsp
mov qword [rbp + 0x710], rax
mov r12, r8
mov r15, rcx
movsd xmm6, qword [0x1800ba7c0]
movaps xmm1, xmm6
movq rdx, xmm6
lea rcx, [0x1800a7d98]
call fcn.18000ba10
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14d, 1
test al, 0x10
je 0x180029c7a
mov r8d, r14d
mov rdx, r15
mov rcx, r12
call fcn.180038670
cmp eax, 0xffffffff
je 0x180029c7a
test eax, eax
je 0x180029c7d
xor esi, esi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [r15 + r8*2], si
jne 0x1800297c0
mov rdx, r15
lea rcx, [rbp - 0x40]
call fcn.18000af70
nop
lea rax, [rbp - 0x40]
mov r10, qword [rbp - 0x40]
mov r8, qword [rbp - 0x28]
cmp r8, 8
cmovae rax, r10
mov r9, qword [rbp - 0x30]
cmp word [rax + r9*2 - 2], 0x5c
jne 0x18002986f
mov edx, 0xeb20
mov word [rsp + 0x34], dx
mov eax, 0xeb0a
xor ecx, ecx
xor ax, dx
mov word [rsp + 0x36], ax
mov word [rsp + 0x38], si
lea rax, [rsp + 0x36]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], cx
jne 0x180029822
mov rax, r8
sub rax, r9
cmp rdx, rax
ja 0x180029865
lea rdi, [rdx + r9]
mov qword [rbp - 0x30], rdi
lea rbx, [rbp - 0x40]
cmp r8, 8
cmovae rbx, r10
lea r8, [rdx + rdx]
lea rcx, [rbx + r9*2]
lea rdx, [rsp + 0x36]
call fcn.180059790
mov word [rbx + rdi*2], si
jmp 0x18002991a
lea r9, [rsp + 0x36]
jmp 0x180029906
mov edx, 0x373a
mov dword [rsp + 0x40], 0x3766373a
mov dword [rsp + 0x44], 0x3711
mov rcx, rsi
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [rsp + rcx*2 + 0x42], ax
inc rcx
cmp rcx, 2
jae 0x1800298a8
movzx edx, word [rsp + 0x40]
jmp 0x180029890
mov word [rsp + 0x46], si
lea rax, [rsp + 0x42]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1800298c0
mov rax, r8
sub rax, r9
cmp rdx, rax
ja 0x180029901
lea rdi, [rdx + r9]
mov qword [rbp - 0x30], rdi
lea rbx, [rbp - 0x40]
cmp r8, 8
cmovae rbx, r10
lea r8, [rdx + rdx]
lea rcx, [rbx + r9*2]
lea rdx, [rsp + 0x42]
call fcn.180059790
mov word [rbx + rdi*2], si
jmp 0x18002991a
lea r9, [rsp + 0x42]
mov qword [rsp + 0x20], rdx
movzx r8d, byte [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.18003fbe0
movaps xmm1, xmm6
movq rdx, xmm6
lea rcx, [0x1800a7d98]
call fcn.18000ba10
movdqa xmm0, xmmword [0x1800bb7a0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1800bbd10]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x51443f4d
mov byte [rbp - 0x6c], 0
mov rax, rsi
movdqa xmm1, xmmword [0x1800bad70]
nop
movdqu xmm0, xmmword [rsp + rax + 0x70]
psubb xmm0, xmm1
movdqu xmmword [rsp + rax + 0x70], xmm0
add rax, 0x10
cmp rax, 0x20
jb 0x180029960
cmp rax, 0x24
jae 0x18002998e
add byte [rsp + rax + 0x70], 0xf4
inc rax
cmp rax, 0x24
jb 0x180029980
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x60]
call fcn.18000a950
mov rdx, rax
call fcn.18000a540
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x20]
call rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180029c3e
mov edi, 0x3daa
mov r13d, 0xe09d
mov r8, r15
mov edx, 0x270
lea rcx, [rbp + 0x230]
call fcn.18005d82c
mov edx, 0x10ec
mov word [rsp + 0x34], dx
mov eax, 0x10b0
xor ax, dx
mov word [rsp + 0x36], ax
mov word [rsp + 0x38], si
lea r8, [rsp + 0x36]
mov edx, 0x270
lea rcx, [rbp + 0x230]
call fcn.18005d894
lea r8, [rbp + 0xc]
mov edx, 0x270
lea rcx, [rbp + 0x230]
call fcn.18005d894
test byte [rbp - 0x20], 0x10
je 0x180029af5
mov word [rsp + 0x40], r13w
mov eax, 0xe0b3
xor ax, r13w
mov word [rsp + 0x42], ax
mov word [rsp + 0x44], si
lea rax, [rbp + 0xc]
lea r8, [rsp + 0x42]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180029a74
add rax, 2
test ecx, ecx
jne 0x180029a60
test edx, edx
je 0x180029b2c
mov word [rsp + 0x48], di
mov ecx, 0x3d84
movzx eax, cx
xor ax, di
mov word [rsp + 0x4a], ax
xor cx, di
mov word [rsp + 0x4c], cx
mov word [rsp + 0x4e], si
lea rax, [rbp + 0xc]
lea r8, [rsp + 0x4a]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180029ac4
add rax, 2
test ecx, ecx
jne 0x180029ab0
test edx, edx
je 0x180029b2c
mov dword [rsp + 0x20], esi
mov r9d, 0x64
mov r8, r12
lea rdx, [fcn.180038670]
lea rcx, [rbp + 0x230]
call fcn.180029710
mov r14d, eax
test eax, eax
je 0x180029bce
jmp 0x180029b18
xor r8d, r8d
lea rdx, [rbp + 0x230]
mov rcx, r12
call fcn.180038670
cmp eax, 0xffffffff
je 0x180029bce
test eax, eax
je 0x180029bcb
movaps xmm1, xmm6
movq rdx, xmm6
lea rcx, [0x1800a7d98]
call fcn.18000ba10
movdqa xmm0, xmmword [0x1800bab30]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1800bae40]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x671612
mov rcx, rsi
movzx eax, cl
add al, byte [rsp + 0x70]
xor byte [rsp + rcx + 0x71], al
inc rcx
cmp rcx, 0x22
jb 0x180029b51
mov byte [rbp - 0x6d], 0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
lea rax, [rsp + 0x71]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180029b90
lea rdx, [rsp + 0x71]
lea rcx, [rsp + 0x50]
call fcn.18000b0f0
lea rdx, [rsp + 0x50]
call fcn.18000a540
lea rdx, [rbp - 0x20]
mov rcx, rbx
call rax
test eax, eax
je 0x180029bce
test r14d, r14d
jne 0x1800299d0
jmp 0x180029bce
mov r14d, esi
movdqa xmm0, xmmword [0x1800bb230]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x2d2f2d5b
mov dword [rsp + 0x64], 0x295d2d2f
mov dword [rsp + 0x68], 0x5a292e
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rsi + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rsi + 0x52], al
add rsi, 2
cmp rsi, 0x1a
jb 0x180029c00
mov byte [rsp + 0x6b], 0
lea rdx, [rsp + 0x51]
lea rcx, [rsp + 0x70]
call fcn.18000a950
mov rdx, rax
call fcn.18000a540
mov rcx, rbx
call rax
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x180029c7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029c75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180029caf
call fcn.180055890
mov eax, r14d
mov rcx, qword [rbp + 0x710]
xor rcx, rsp
call fcn.1800555d0
mov rbx, qword [rsp + 0x878]
movaps xmm6, xmmword [rsp + 0x820]
add rsp, 0x830
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180067178
int3