Function at 0x140253dd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov qword [rbp], rcx
mov eax, dword [0x1415cef08]
mov ecx, dword [0x1415cef0c]
mov edx, ecx
and edx, eax
add eax, ecx
sub eax, edx
mov ecx, eax
xor ecx, 0xd87a7d74
and ecx, eax
mov eax, ecx
and eax, 0xfffffffc
xor eax, 0x122918dc
and ecx, 0x122918dc
or ecx, eax
shr ecx, 2
imul rax, rcx, 0x45d91a63
shr rax, 0x3c
cmp eax, 0xf6477cef
ja 0x140253e93
mov ecx, dword [0x1415cef10]
sub ecx, dword [0x1415cef14]
mov eax, ecx
or eax, 0x50c27fad
mov edx, ecx
not edx
and edx, 0xa3198040
mov r8d, eax
and r8d, 0xca45792
imul r8d, edx
and eax, 0xf35ba86d
or ecx, 0xf3dbffed
imul ecx, eax
add ecx, r8d
mov eax, ecx
not eax
or eax, 0xfa13541d
or ecx, 0x5ecabe2
and ecx, eax
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov r12, rsp
cmp ecx, 0x5c203d45
jne 0x140253ea2
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
jmp 0x140253e2e
mov eax, dword [0x1415cef18]
xor edx, edx
div dword [0x1415cef1c]
shr eax, 1
imul rax, rax, 0x45c7eb8f
shr rax, 0x3d
imul eax, eax, 0xbf81e3d0
cmp eax, 0x87f8887b
jbe 0x140253ee0
mov eax, 0x120
call fcn.14021cf50
sub rsp, rax
nop word [rax + rax]
mov ecx, dword [0x1415cef20]
sub ecx, dword [0x1415cef24]
xor ecx, 0x7f05de9d
mov eax, 0x120
call fcn.14021cf50
sub rsp, rax
mov rbx, rsp
cmp ecx, 0x63941390
je 0x140253ee0
mov qword [rbp - 8], rbx
nop
mov eax, dword [0x1415cef28]
mov ecx, dword [0x1415cef2c]
mov edx, eax
xor edx, ecx
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
xor ecx, 0x5adc6dba
add ecx, 0xaa94897c
cmp ecx, 0x25d7b7c4
jb 0x140253f10
xor r14d, r14d
mov r13d, 0x843524b3
mov edi, 2
mov r11d, 3
lea rsi, [0x1415d3940]
mov r15, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
mov ecx, dword [0x1415d3940]
nop word cs:[rax + rax]
mov eax, dword [0x1415cef30]
xor edx, edx
div dword [0x1415cef34]
imul rax, r13
shr rax, 0x3d
mov edx, eax
not edx
mov r8d, eax
and r8d, 0xfffffffe
and edx, 0x9930a341
imul edx, r8d
mov r8d, eax
and r8d, 1
or eax, 0x9930a341
imul eax, r8d
add eax, edx
cmp eax, 0x30259d7f
je 0x140253f70
nop word cs:[rax + rax]
mov eax, dword [0x1415cef38]
xor edx, edx
div dword [0x1415cef3c]
add eax, 0x9bc8fd1e
or eax, 0x3126e149
imul rax, rax, 0x394a824b
shr rax, 0x3d
cmp eax, 0x8e76249f
je 0x140253fc0
cmp ecx, 3
jge 0x1402541c0
cmp ecx, 1
jg 0x1402540ff
test ecx, ecx
js 0x1402546f0
test r14b, r14b
je 0x140254020
mov eax, ecx
lock cmpxchg dword [0x1415d3940], edi
nop word cs:[rax + rax]
mov eax, dword [0x1415cef48]
mov edx, dword [0x1415cef4c]
mov r8d, eax
and r8d, edx
xor eax, edx
lea r8d, [rax + r8*2]
mov eax, r8d
not eax
mov edx, r8d
and edx, 0xe3cc16e9
and eax, 0x1c33e916
imul eax, edx
mov edx, r8d
and edx, 0x1c33e916
or r8d, 0x1c33e916
imul r8d, edx
add r8d, eax
mov eax, r8d
and eax, 0x2f29718
xor eax, 0xf00401
and r8d, 0xf00400
or r8d, eax
or r8d, 0xfd0d68e6
mov eax, ecx
lock cmpxchg dword [0x1415d3940], edi
sete dl
cmp r8d, 0xa4f61ac1
jb 0x140254020
mov ecx, eax
nop dword [rax + rax]
mov eax, dword [0x1415cef50]
sub eax, dword [0x1415cef54]
add eax, 0x629a7f50
mov r8d, eax
and r8d, 0x52efab87
mov r9d, r8d
not r9d
and r9d, 0x11cf8828
mov r10d, eax
and r10d, 0x42202387
imul r10d, r9d
and eax, 0x10cf8800
or r8d, 0x11cf8828
imul r8d, eax
add r8d, r10d
cmp r8d, 0xd8e66c2b
je 0x1402540a0
test dl, dl
je 0x140254190
jmp 0x14025433a
mov eax, 2
lock cmpxchg dword [0x1415d3940], r11d
mov ecx, eax
sete r8b
mov eax, dword [0x1415cefb0]
xor edx, edx
div dword [0x1415cefb4]
nop word cs:[rax + rax]
mov eax, dword [0x1415cefb8]
mov edx, dword [0x1415cefbc]
mov r9d, edx
not r9d
mov r10d, eax
and r10d, r9d
or r9d, eax
not r9d
imul r9d, r10d
mov r10d, eax
and r10d, edx
or eax, edx
imul eax, r10d
add eax, r9d
add eax, 0x1ad96d45
mov edx, eax
or edx, 0x1103308
not eax
and eax, 0x44010040
and edx, 0x19983b9b
or edx, eax
cmp edx, 0xe6a3e5df
ja 0x140254130
test r8b, r8b
jne 0x1402541c9
nop word [rax + rax]
mov eax, dword [0x1415cefc0]
mov edx, eax
not edx
or edx, dword [0x1415cefc4]
add eax, edx
inc eax
imul rax, rax, 0x7895c05
shr rax, 0x3a
add eax, 0x81b0f9ed
cmp eax, 0x9dafe15e
jae 0x140254190
jmp 0x140253fc0
cmp ecx, 4
jge 0x1402546ee
mov dword [r12], 3
mov eax, dword [0x1415cefc8]
add eax, dword [0x1415cefcc]
and eax, 0x1a46c579
imul eax, eax, 0x831aedd4
mov ecx, eax
xor ecx, 0x3d59f39f
and eax, 0x42a60c60
add eax, eax
sub eax, ecx
cmp eax, 0xd9a2edd0
mov r14, r15
ja 0x14025425f
nop word cs:[rax + rax]
mov r15d, dword [0x1415cefd0]
sub r15d, dword [0x1415cefd4]
xor r15d, 0x808b000a
or r15d, 0x7d54f561
mov eax, 0xa443b3a5
imul r15, rax
shr r15, 0x3f
sub rsp, 0x20
mov r8d, 4
mov rcx, rsi
mov rdx, r12
mov r9d, 0xffffffff
call r14
add rsp, 0x20
cmp r15d, 0xe0ce7385
jbe 0x140254280
sub rsp, 0x20
mov r8d, 4
mov rcx, rsi
mov rdx, r12
mov r9d, 0xffffffff
call r14
add rsp, 0x20
jmp 0x140254210
mov ecx, dword [0x1415cefd8]
and ecx, dword [0x1415cefdc]
imul ecx, ecx, 0x8065677a
and ecx, 0x18955efe
xor ecx, 0x10145854
cmp ecx, 0xc3383aa7
ja 0x140254280
cmp eax, 1
mov r14d, 0
je 0x14025431b
mov eax, dword [0x1415cefe0]
add eax, dword [0x1415cefe4]
mov ecx, eax
and ecx, 0xe03dd7de
or eax, 0xe03dd7de
add eax, ecx
cmp eax, 0xad0f42a2
jne 0x1402542e0
sub rsp, 0x20
call sub.KERNEL32.dll_GetLastError
add rsp, 0x20
mov eax, dword [0x1415cefe8]
and eax, dword [0x1415cefec]
imul r15, rax, 0x2b153e57
shr r15, 0x3a
add r15d, 0xf30cf69f
and r15d, 0x630c329b
sub rsp, 0x20
call fcn.14021a080
add rsp, 0x20
cmp r15d, 0x2705bedd
je 0x1402542e0
mov r11d, 3
mov r15, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
nop dword [rax + rax]
test r14b, r14b
jne 0x140254330
jmp 0x140253f5e
mov rax, qword [rbp]
mov rcx, qword [rax]
mov eax, dword [0x1415cef60]
mov edx, dword [0x1415cef64]
mov r8d, eax
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, eax
imul r9d, r8d
mov r8d, eax
and r8d, edx
or eax, edx
imul eax, r8d
add eax, r9d
add eax, 0x697a04b2
mov edx, eax
and edx, 0x1f8912d6
xor eax, 0x1f8912d6
lea eax, [rax + rdx*2]
mov edx, eax
and edx, 0x721635d8
add edx, edx
sub eax, edx
cmp eax, 0x870382ca
jne 0x1402543a1
mov qword [rcx], 0
mov rdi, qword [rbp - 8]
nop word cs:[rax + rax]
mov eax, dword [0x1415cef68]
xor edx, edx
div dword [0x1415cef6c]
and eax, 0xeb917c3d
add eax, 0xafa21d3f
or eax, 0x27cb480d
mov rsi, qword [rcx]
mov qword [rcx], 0
cmp eax, 0xf3823720
ja 0x1402543b0
nop
mov eax, dword [0x1415cef70]
mov ecx, dword [0x1415cef74]
mov edx, ecx
not edx
and edx, eax
xor ecx, eax
add ecx, eax
sub ecx, edx
xor ecx, 0x257a5f63
imul rax, rcx, 0x67a55d97
shr rax, 0x20
sub ecx, eax
shr ecx, 1
add ecx, eax
shr ecx, 0x1d
cmp ecx, 0x540ba5e6
je 0x1402543e0
test rsi, rsi
je 0x14025471f
add rbx, 4
sub rsp, 0x20
mov r8d, 0x118
mov rcx, rbx
xor edx, edx
call fcn.14022b190
add rsp, 0x20
mov dword [rdi], 0x11c
sub rsp, 0x20
mov rcx, rdi
call fcn.14021c970
add rsp, 0x20
test eax, eax
js 0x1402545f0
mov eax, dword [rbx]
nop
mov ecx, dword [0x1415cef78]
mov edx, dword [0x1415cef7c]
mov r8d, ecx
not r8d
and r8d, edx
not edx
and edx, ecx
sub edx, r8d
xor edx, 0x52f6821a
add edx, 0x37600d17
not edx
or edx, 0xb622acbd
cmp edx, 0x76fe68a
jb 0x140254460
nop dword [rax + rax]
mov ecx, dword [0x1415cef80]
mov edx, dword [0x1415cef84]
mov r8d, ecx
and r8d, edx
or ecx, edx
add ecx, r8d
mov edx, ecx
or edx, 0x3001a409
and edx, 0x302bad4b
or ecx, 0xb5bbff4f
add ecx, edx
add ecx, 0x76a2ef6f
cmp ecx, 0x416011b4
jb 0x1402544a0
mov cl, 1
cmp eax, 6
ja 0x140254630
nop word cs:[rax + rax]
mov edx, dword [0x1415cef90]
mov r8d, dword [0x1415cef94]
mov ecx, edx
not ecx
mov r9d, r8d
not r9d
mov r10d, ecx
and r10d, 0xef926cc1
and edx, 0x106d933e
or edx, r10d
or ecx, r9d
and r9d, 0xef926cc1
and r8d, 0x106d933e
or r8d, r9d
xor r8d, edx
not ecx
or ecx, r8d
mov edx, ecx
not edx
or edx, 0xde3fdfe9
or ecx, 0xa3ef6ef6
and ecx, edx
add ecx, 0xf3e8300
cmp ecx, 0x68cb9718
jb 0x1402544f0
cmp eax, 6
jne 0x14025462a
nop
mov eax, dword [0x1415cef98]
mov ecx, dword [0x1415cef9c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, eax
and ecx, 0x85bf6480
or eax, 0x85bf6480
add eax, ecx
add eax, 0xd9144757
or eax, 0x3c24ceaf
cmp eax, 0xa5d0425b
ja 0x140254560
mov r8d, dword [rdi + 8]
mov eax, dword [0x1415cefa0]
xor edx, edx
div dword [0x1415cefa4]
imul eax, eax, 0xda9a9038
imul rax, rax, 0x1913fc8f
shr rax, 0x3c
lea ecx, [rax + rax]
sub eax, ecx
cmp r8d, 3
setae cl
cmp eax, 0x465ad6cb
je 0x1402545b0
jmp 0x140254630
mov eax, dword [0x1415cef88]
mov ecx, dword [0x1415cef8c]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
imul eax, eax, 0x4d7df49f
add eax, 0x41ef2ec8
mov ecx, eax
xor ecx, 0x6c5e943
or eax, 0xf93a16bc
and eax, ecx
cmp eax, 0xf66220a6
je 0x1402545f0
mov cl, 1
jmp 0x140254698
xor ecx, ecx
nop dword [rax]
mov eax, dword [0x1415cefa8]
mov edx, dword [0x1415cefac]
mov r8d, eax
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, eax
imul r9d, r8d
mov r8d, eax
and r8d, edx
or eax, edx
imul eax, r8d
add eax, r9d
mov edx, eax
not edx
or eax, 0xc4d1fdf5
and edx, 0x21020208
mov r8d, eax
and r8d, 0x1a2d0846
or r8d, edx
xor r8d, 0x10060308
and eax, 0xf5d4f4b1
or eax, r8d
add eax, 0x52408c4c
cmp eax, 0x709ee3d6
ja 0x140254630
mov byte [rsi], cl
mov eax, 4
xchg dword [0x1415d3940], eax
cmp eax, 3
jne 0x1402546c0
sub rsp, 0x20
lea rcx, [0x1415d3940]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressAll]
add rsp, 0x20
nop
mov eax, dword [0x1415cef58]
sub eax, dword [0x1415cef5c]
xor eax, 0x40b24131
and eax, 0x42ba4339
cmp eax, 0x9ab5384
je 0x1402546c0
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
je 0x1402546c0
ud2
ud2