Function at 0x14000ab64
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xab8
movaps xmmword [rsp + 0xaa0], xmm6
mov rdx, qword [rcx + 8]
mov qword [rsp + 0x3f8], rcx
mov r8, qword [rcx + 0x10]
lea r15, [rsp + 0x400]
mov rcx, r15
call fcn.140040610
lea rdx, str.APPDATA
lea rsi, [rsp + 0x4f0]
mov r8d, 7
mov rcx, rsi
call fcn.14017ab30
mov rax, qword [rsi]
movabs rcx, 0x8000000000000001
movabs r12, 0x8000000000000000
cmp rax, rcx
jne 0x14000ad63
mov rax, qword [rsp + 0x4f8]
movups xmm0, xmmword [rsp + 0x500]
movaps xmmword [rsp + 0x180], xmm0
cmp rax, r12
je 0x14000ade5
movaps xmm0, xmmword [rsp + 0x180]
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x168], rax
lea rax, [0x1402911da]
lea rdx, [rsp + 0x4f0]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0x77b5c687bc963496
mov qword [rdx], rax
lea rsi, [rsp + 0x4f0]
mov rdx, qword [rsi]
call fcn.1400857bf
xorps xmm0, xmm0
movaps xmmword [rsi], xmm0
mov cl, 1
xor edx, edx
lea r8, [0x14029c498]
mov r9, qword [rdx + r8]
xor r9, qword [rax + rdx]
mov qword [rsp + rdx + 0x4f0], r9
mov edx, 8
test cl, 1
mov ecx, 0
jne 0x14000ac58
mov ecx, 0x1901a708
xor ecx, dword [rax + 0x10]
lea rdx, [rsp + 0x4f0]
mov dword [rdx + 0x10], ecx
movzx eax, word [rax + 0x14]
xor eax, 0x8ef8
mov word [rdx + 0x14], ax
movaps xmm0, xmmword [rdx]
lea rax, [rsp + 0x800]
movaps xmmword [rax], xmm0
mov rcx, qword [rdx + 0xe]
mov qword [rax + 0xe], rcx
lea r8, [rsp + 0x430]
mov qword [r8], rax
mov qword [r8 + 8], 0x16
lea rcx, [rsp + 0x168]
lea rax, [rsp + 0x180]
mov qword [rax], rcx
lea rcx, [0x140006a7e]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r8
lea rcx, [0x14003906a]
mov qword [rax + 0x18], rcx
lea rbp, [0x14029be68]
mov qword [rdx], rbp
mov ecx, 2
mov qword [rdx + 8], rcx
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rcx
lea rsi, [rsp + 0xa70]
mov rcx, rsi
call fcn.14003f640
mov rbx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rsi, [rsp + 0x4f0]
mov rcx, rsi
mov qword [rsp + 0x58], rdx
call fcn.14017f2e0
cmp dword [rsi], 2
jne 0x14000ad77
mov rax, qword [rsp + 0x4f8]
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x180], 2
jmp 0x14000ad9d
cmp rax, r12
je 0x14000ade5
test rax, rax
je 0x14000ade5
mov r8, qword [rsp + 0x4f8]
jmp 0x14000add6
lea r13, [rsp + 0x180]
lea rsi, [rsp + 0x4f0]
mov ecx, 9
mov rdi, r13
rep movsq qword [rdi], qword [rsi]
cmp qword [r13], 2
jne 0x14000bc3a
lea rcx, [rsp + 0x188]
call fcn.1400747f0
test rbx, rbx
je 0x14000adc3
test rbx, rbx
je 0x14000bc53
mov rcx, qword [0x1403531b0]
xor edx, edx
mov r8, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [0x1402923f8]
lea rdx, [rsp + 0x4f0]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0x776de445ee705936
mov qword [rdx], rax
lea rsi, [rsp + 0x4f0]
mov rdx, qword [rsi]
call fcn.140085b98
movabs rcx, 0x7f4799a057464221
xor rcx, qword [rax]
mov al, byte [rax + 8]
xor al, 0xb9
lea rdx, [rsp + 0x70]
mov qword [rdx], rcx
mov byte [rdx + 8], al
mov qword [rsp + 0x430], rdx
mov qword [rsp + 0x438], 9
mov qword [rsp + 0x180], r15
lea rax, [0x140006a7e]
mov qword [rsp + 0x188], rax
lea rax, [rsp + 0x430]
mov qword [rsp + 0x190], rax
lea rax, [0x14003906a]
mov qword [rsp + 0x198], rax
mov qword [rsi], rbp
mov eax, 2
mov qword [rsi + 8], rax
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], rax
lea r15, [rsp + 0x800]
lea rsi, [rsp + 0x4f0]
mov rcx, r15
mov rdx, rsi
call fcn.14003f640
mov rcx, r15
call fcn.1400035ce
mov qword [rsi], rax
test rax, rax
je 0x14000bd40
lea rcx, [rsp + 0x4f0]
call fcn.1400747f0
lea rax, [0x14029544a]
lea rdx, [rsp + 0x4f0]
mov qword [rdx], rax
mov rcx, qword [rdx]
movabs rax, 0x4a2bed758892c2d9
mov qword [rdx], rax
lea rbp, [rsp + 0x4f0]
mov rdx, qword [rbp]
call fcn.1400853c7
xorps xmm0, xmm0
movaps xmmword [rbp], xmm0
mov cl, 1
xor edx, edx
lea r8, [0x14029c4ae]
mov r9, qword [rdx + r8]
xor r9, qword [rax + rdx]
mov qword [rsp + rdx + 0x4f0], r9
mov edx, 8
test cl, 1
mov ecx, 0
jne 0x14000bd85
mov ecx, 0x6a3abcec
xor ecx, dword [rax + 0x10]
lea rsi, [rsp + 0x4f0]
mov dword [rsi + 0x10], ecx
movzx ecx, byte [rax + 0x16]
movzx eax, word [rax + 0x14]
xor eax, 0x65df
mov word [rsi + 0x14], ax
xor cl, 0x43
mov byte [rsi + 0x16], cl
movaps xmm0, xmmword [rsi]
lea rcx, [rsp + 0x810]
movaps xmmword [rcx - 0x10], xmm0
mov rax, qword [rsi + 0xf]
mov qword [rcx - 1], rax
mov qword [rsp + 0x430], r15
mov qword [rsp + 0x438], 0x17
lea rbx, [rsp + 0x180]
lea rax, [rsp + 0x168]
mov qword [rbx], rax
lea rax, [0x140006a7e]
mov qword [rbx + 8], rax
mov ecx, 0
lea r14, [rsp + 0x430]
mov qword [rbx + 0x10], r14
lea rax, [0x14003906a]
mov qword [rbx + 0x18], rax
lea rax, [0x14029be68]
mov qword [rsi], rax
mov eax, 2
mov qword [rsi + 8], rax
mov qword [rsi + 0x20], rcx
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], rax
lea rdi, [rsp + 0xa88]
mov rcx, rdi
mov rdx, rbp
call fcn.14003f640
mov rax, qword [rdi]
mov qword [rsp + 0x140], rax
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
mov qword [rsp + 0x3f0], rdx
call fcn.140182500
xor eax, eax
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x30], 0xa
mov qword [rsi + 0x38], rax
xor r8d, r8d
mov dword [rsi + 0x48], 0x100
mov qword [rsi + 0x40], 3
add eax, dword [rax]
add byte [rax], al