Function at 0x1400231a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14004f068]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor r13d, r13d
mov ebx, edx
mov esi, 0x2000
mov qword [r8], r13
mov ecx, esi
mov r12, r8
lea edx, [r13 + 0x10]
call qword [sym.imp.msvcrt.dll__aligned_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140023205
lea esi, [rax + 8]
jmp 0x1400234af
mov r8, rsi
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
mov ebp, 1
mov dword [rdi], 0x66676572
and ebx, ebp
mov dword [rdi + 4], ebp
mov dword [rdi + 8], ebp
lea rcx, [rdi + 0x1004]
mov dword [rdi + 0x14], ebp
mov r8d, 0xffc
lea r15d, [rbp + 1]
lea eax, [rbx + 5]
mov dword [rdi + 0x18], eax
mov eax, dword [rdi + 0x90]
cmovne eax, r15d
mov dword [rdi + 0x20], ebp
xor edx, edx
mov dword [rdi + 0x90], eax
mov dword [rdi + 0x2c], ebp
call sub.msvcrt.dll_memset
mov qword [rdi + 0x1000], 0x6e696268
lea r14d, [rbp + 0x1f]
mov dword [rdi + 0x1008], 0x1000
lea rcx, [rsp + 0x20]
mov qword [rdi + 0x1014], r13
mov dword [rdi + 0x24], r14d
mov dword [rdi + 0x1024], 0x6b6e
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
mov eax, dword [rsp + 0x20]
lea esi, [rbp + 7]
mov dword [rdi + 0x1028], eax
lea r9, [0x140034020]
mov eax, dword [rsp + 0x24]
lea rcx, [rsp + 0x28]
mov qword [rdi + 0x1038], r13
mov r8, rdi
mov dword [rdi + 0x102c], eax
mov edx, esi
or eax, 0xffffffff
mov byte [rdi + 0x1030], r13b
mov dword [rdi + 0x1040], eax
mov dword [rdi + 0x1044], eax
mov dword [rdi + 0x1050], eax
mov dword [rdi + 0x106c], r13d
mov dword [rdi + 0x1034], eax
mov dword [rdi + 0x1048], r13d
mov dword [rdi + 0x104c], eax
mov dword [rdi + 0x1054], eax
mov qword [rdi + 0x105c], r13
mov word [rdi + 0x1058], r13w
mov dword [rdi + 0x1064], r13d
call fcn.140025acc
movzx ebx, ax
lea rcx, [rdi + 0x1070]
mov r8d, ebx
lea rdx, [rsp + 0x28]
call sub.msvcrt.dll_memcpy
movzx eax, word [rdi + 0x1026]
cmp bx, si
jae 0x14002334a
or ax, r14w
jmp 0x140023352
mov ecx, 0xffdf
and ax, cx
mov word [rdi + 0x1026], ax
lea r14d, [rbx + 0x4f]
mov word [rdi + 0x106c], bx
mov eax, dword [rdi + 0x14]
sub eax, ebp
shl eax, 0xc
add eax, dword [rdi + 0x18]
cmp eax, r15d
sbb ecx, ecx
and ecx, esi
add ecx, esi
add r14d, ecx
neg ecx
and r14d, ecx
mov eax, r14d
mov ebp, r14d
neg eax
mov dword [rdi + 0x1020], eax
mov ecx, dword [rdi + 0x24]
add ecx, r14d
mov dword [rdi + 0x1050], ecx
call fcn.140026488
mov r15, rax
test rax, rax
je 0x14002349b
mov rcx, rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetSecurityDescriptorLength]
nop dword [rax + rax]
lea rcx, [r14 + 0x1038]
mov dword [rdi + r14 + 0x1030], 1
mov ebx, eax
add rcx, rdi
mov eax, 0x6b73
mov r8d, ebx
mov rdx, r15
mov word [rdi + r14 + 0x1024], ax
call sub.msvcrt.dll_memcpy
mov dword [rdi + r14 + 0x1034], ebx
lea edx, [rbx + 0x17]
mov ecx, dword [rdi + 0x24]
mov r8d, 1
add ecx, r14d
mov dword [rdi + r14 + 0x102c], ecx
mov dword [rdi + r14 + 0x1028], ecx
mov ecx, 0xfe0
mov eax, dword [rdi + 0x14]
sub eax, r8d
shl eax, 0xc
add eax, dword [rdi + 0x18]
cmp eax, 2
sbb eax, eax
and eax, esi
add eax, esi
add edx, eax
neg eax
and edx, eax
sub ecx, edx
mov eax, edx
neg eax
sub ecx, r14d
mov dword [rdi + r14 + 0x1020], eax
mov eax, edx
lea edx, [r8 + 0x7e]
add rax, rbp
mov dword [rax + rdi + 0x1020], ecx
mov eax, r13d
mov dword [rdi + 0x28], 0x1000
mov rcx, rdi
xor eax, dword [rcx]
lea rcx, [rcx + 4]
sub rdx, r8
jne 0x140023460
cmp eax, 0xffffffff
mov ecx, 0xfffffffe
mov esi, r13d
cmove eax, ecx
test eax, eax
cmove eax, r8d
mov dword [rdi + 0x1fc], eax
mov qword [r12], rdi
mov rdi, r13
mov rcx, r15
call qword [sym.imp.msvcrt.dll__aligned_free]
nop dword [rax + rax]
test rdi, rdi
je 0x1400234af
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__aligned_free]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140030000
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret