Function at 0x140001e80
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov edi, 0x4b37
mov r12, rcx
mov ecx, 0x15d200
mov r14, rdx
mov r15d, r8d
mov r13, r9
lea rsi, [rsp + 0xe0]
call fcn.140127f90
mov r8d, 0x15d200
lea rdx, [0x14012e0c0]
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0xd0], rsi
xor ecx, ecx
movabs rax, 0x4276424d30395565
mov qword [rsp + 0xe0], rax
movabs r8, 0xcccccccccccccccd
mov word [rsp + 0xe8], di
mov qword [rsp + 0xd8], 0xa
mov byte [rsp + 0xea], 0
mov rax, rcx
mul r8
shr rdx, 3
lea rax, [rdx + rdx*4]
mov rdx, rcx
add rax, rax
sub rdx, rax
movzx eax, byte [rsp + rdx + 0xe0]
xor byte [rbx + rcx], al
add rcx, 1
cmp rcx, 0x15d200
jne 0x140001f10
mov rdx, qword [r13]
mov r8, qword [r13 + 8]
xor r11d, r11d
lea rbp, [rsp + 0x70]
mov rcx, qword [0x140292a50]
lea rdi, [rsp + 0x80]
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], rdi
mov word [rsp + 0x80], r11w
call fcn.140120570
mov r9, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov rcx, qword [r9 + rax + 0xf0]
test rcx, rcx
je 0x140002828
mov rax, qword [rcx]
mov qword [rsp + 0x58], r9
lea rbp, [rsp + 0x70]
mov edx, 0xa
call qword [rax + 0x50]
mov r9, qword [rsp + 0x58]
mov word [rsp + 0xb0], ax
mov rdx, qword [r9]
mov rdx, qword [rdx - 0x18]
cmp qword [r9 + rdx + 0x10], 0
je 0x1400020d0
lea rdx, [rsp + 0xb0]
mov r8d, 1
mov rcx, r9
call fcn.140120570
test r15b, r15b
je 0x1400020e9
lea rbp, [rsp + 0x70]
mov rdx, r13
mov rcx, rbp
call fcn.140112e20
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
lea rbp, [rsp + 0x70]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002178
lea rax, [rsp + 0xd0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], 0
mov rcx, rsi
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x15d200
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.140001de0
mov rcx, rsi
test eax, eax
js 0x140002160
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
mov rcx, qword [rsp + 0x70]
cmp rcx, rdi
je 0x1400020a8
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call fcn.140127f50
mov edx, 0x15d200
mov rcx, rbx
call fcn.140127f50
mov eax, esi
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx edx, ax
mov rcx, r9
lea rbp, [rsp + 0x70]
call fcn.1400eaec0
test r15b, r15b
jne 0x140001fe9
mov r13, qword [r14 + 8]
mov r15, qword [r14]
lea rdx, [rsp + 0xc0]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], rdx
lea r14, [r15 + r13]
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xd0], r13
cmp r13, 7
ja 0x140002190
mov r8, r13
cmp r15, r14
je 0x1400026ec
xor eax, eax
nop
movsx cx, byte [r15 + rax]
mov word [rdx + rax*2], cx
add rax, 1
cmp r13, rax
jne 0x140002140
jmp 0x14000230c
lea rbp, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x14000208c
mov rcx, qword [rsp + 0x70]
xor esi, esi
cmp rcx, rdi
jne 0x140002096
jmp 0x1400020a8
mov rcx, rax
lea rdx, [rsp + 0xd0]
xor r8d, r8d
lea rbp, [rsp + 0x70]
call fcn.140112f50
mov r8, qword [rsp + 0xd0]
mov qword [rsp + 0xb0], rax
mov rdx, rax
mov qword [rsp + 0xc0], r8
cmp r15, r14
je 0x14000230c
lea rax, [rax + r13*2]
lea rcx, [r13 - 1]
cmp r15, rax
jae 0x1400021e2
cmp rdx, r14
jb 0x14000213c
cmp rcx, 0xe
jbe 0x140002710
mov r9, r13
mov rcx, r13
pxor xmm3, xmm3
xor eax, eax
shr r9, 4
and rcx, 0xfffffffffffffff0
movdqu xmm0, xmmword [r15 + rax]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
punpckhbw xmm0, xmm1
movups xmmword [rdx + rax*2], xmm2
movups xmmword [rdx + rax*2 + 0x10], xmm0
add rax, 0x10
cmp rcx, rax
jne 0x140002200
mov rax, r9
lea r9, [r15 + rcx]
shl rax, 5
add rax, rdx
cmp r13, rcx
je 0x14000230c
sub r13, rcx
lea r10, [r13 - 1]
cmp r10, 6
jbe 0x140002292
movq xmm0, qword [r15 + rcx]
pxor xmm1, xmm1
lea r10, [rdx + rcx*2]
mov rcx, r13
and rcx, 0xfffffffffffffff8
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
lea rax, [rax + rcx*2]
add r9, rcx
and r13d, 7
punpcklbw xmm0, xmm1
punpcklbw xmm2, xmm1
pshufd xmm0, xmm0, 0x4e
movq qword [r10], xmm2
movq qword [r10 + 8], xmm0
je 0x14000230c
movsx cx, byte [r9]
mov word [rax], cx
lea rcx, [r9 + 1]
cmp r14, rcx
je 0x14000230c
movsx cx, byte [r9 + 1]
mov word [rax + 2], cx
lea rcx, [r9 + 2]
cmp r14, rcx
je 0x14000230c
movsx cx, byte [r9 + 2]
mov word [rax + 4], cx
lea rcx, [r9 + 3]
cmp r14, rcx
je 0x14000230c
movsx cx, byte [r9 + 3]
mov word [rax + 6], cx
lea rcx, [r9 + 4]
cmp r14, rcx
je 0x14000230c
movsx cx, byte [r9 + 4]
mov word [rax + 8], cx
lea rcx, [r9 + 5]
cmp r14, rcx
je 0x14000230c
movsx cx, byte [r9 + 5]
mov word [rax + 0xa], cx
lea rcx, [r9 + 6]
cmp r14, rcx
je 0x14000230c
movsx cx, byte [r9 + 6]
mov word [rax + 0xc], cx
xor r9d, r9d
mov qword [rsp + 0xb8], r8
lea r14, [0x14012e0a2]
lea r13, [rsp + 0xa0]
mov word [rdx + r8*2], r9w
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov r8, qword [r12 + 8]
xor r10d, r10d
mov r15, qword [r12]
lea r12, [rsp + 0x90]
mov rbp, rax
mov qword [rsp + 0x90], r13
lea rdx, [rax + r8]
mov rcx, r12
mov qword [rsp + 0x98], 0
mov word [rsp + 0xa0], r10w
mov qword [rsp + 0x60], r8
call fcn.140112be0
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsp + 0x60]
sub rax, qword [rsp + 0x98]
cmp rax, r8
jb 0x1400027de
mov rdx, r15
mov rcx, r12
call fcn.140112d90
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0x98]
cmp rax, rbp
jb 0x1400027d2
mov r8, rbp
mov rdx, r14
mov rcx, r12
call fcn.140112d90
mov rdx, qword [rsp + 0x98]
mov r8, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
lea rax, [rdx + r8]
cmp r9, r13
je 0x140002681
cmp qword [rsp + 0xa0], rax
jae 0x140002422
mov r11, qword [rsp + 0x58]
cmp rcx, r11
je 0x140002705
mov r10, qword [rsp + 0xc0]
cmp r10, rax
jae 0x140002560
movabs rax, 0x1fffffffffffffff
sub rax, rdx
cmp rax, r8
jb 0x1400027c6
mov rdx, rcx
mov rcx, r12
call fcn.140112d90
mov qword [rsp + 0xd0], rsi
mov rdx, qword [rax]
lea rcx, [rax + 0x10]
cmp rdx, rcx
je 0x14000269e
mov qword [rsp + 0xd0], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0xe0], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0xd8], rdx
mov qword [rax], rcx
xor ecx, ecx
mov word [rax + 0x10], cx
mov rcx, qword [rsp + 0x70]
mov qword [rax + 8], 0
mov r8, rcx
cmp rcx, rdi
je 0x140002654
mov rdx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xd8]
cmp rdx, rsi
je 0x1400025ea
movq xmm0, rax
mov qword [rsp + 0x70], rdx
mov rax, qword [rsp + 0x80]
movhps xmm0, qword [rsp + 0xe0]
movups xmmword [rsp + 0x78], xmm0
test rcx, rcx
je 0x140002512
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xd8], 0
xor eax, eax
mov word [rcx], ax
cmp rcx, rsi
je 0x140002512
mov rax, qword [rsp + 0xe0]
lea rdx, [rax + rax + 2]
call fcn.140127f50
mov rcx, qword [rsp + 0x90]
cmp rcx, r13
je 0x140002531
mov rax, qword [rsp + 0xa0]
lea rdx, [rax + rax + 2]
call fcn.140127f50
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x58]
cmp rcx, rax
je 0x140001ff9
mov rax, qword [rsp + 0xc0]
lea rdx, [rax + rax + 2]
call fcn.140127f50
jmp 0x140001ff9
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call fcn.14010daa0
mov qword [rsp + 0xd0], rsi
mov rdx, qword [rax]
lea rcx, [rax + 0x10]
cmp rdx, rcx
jne 0x14000245b
mov rdx, qword [rax + 8]
mov r9, rsi
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jb 0x1400025c4
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rsi + r9], r11
cmp edx, r10d
jb 0x1400025aa
lea r9, [rsi + rdx]
add rdx, rcx
xor r10d, r10d
test r8b, 4
jne 0x1400026f4
and r8d, 2
je 0x14000246f
movzx edx, word [rdx + r10]
mov word [r9 + r10], dx
jmp 0x14000246f
test rax, rax
je 0x1400026e4
cmp rax, 1
je 0x1400026d8
lea rcx, [rax + rax]
cmp ecx, 8
jae 0x14000271d
test cl, 4
jne 0x140002770
test ecx, ecx
je 0x140002640
movzx eax, byte [rsp + 0xe0]
mov byte [r8], al
test cl, 2
jne 0x14000279f
mov r8, qword [rsp + 0x70]
mov rax, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xd0]
mov rcx, rdx
xor edx, edx
mov qword [rsp + 0x78], rax
mov word [r8 + rax*2], dx
jmp 0x1400024ea
mov rdx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xd8]
cmp rdx, rsi
je 0x1400025ea
movdqu xmm0, xmmword [rsp + 0xd8]
mov qword [rsp + 0x70], rdx
movups xmmword [rsp + 0x78], xmm0
jmp 0x140002512
cmp rax, 7
jbe 0x140002422
mov r11, qword [rsp + 0x58]
cmp rcx, r11
jne 0x140002411
jmp 0x140002438
mov rdx, qword [rax + 8]
mov r9, rsi
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jb 0x1400025c4
mov r10d, r8d
xor edx, edx
and r10d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r11, qword [rcx + r9]
mov qword [rsi + r9], r11
cmp edx, r10d
jb 0x1400026c0
jmp 0x1400025bd
movzx edx, word [rsp + 0xe0]
mov word [r8], dx
mov rcx, rsi
jmp 0x140002643
xor r8d, r8d
jmp 0x14000230c
mov r10d, dword [rdx]
mov dword [r9], r10d
mov r10d, 4
jmp 0x1400025d1
mov r10d, 7
jmp 0x140002419
mov r9, r15
mov rax, rdx
xor ecx, ecx
jmp 0x140002250
mov rax, qword [rsp + 0xe0]
mov r9, rsi
mov qword [r8], rax
mov eax, ecx
mov rdx, qword [rsi + rax - 8]
mov qword [r8 + rax - 8], rdx
lea rdx, [r8 + 8]
and rdx, 0xfffffffffffffff8
sub r8, rdx
add ecx, r8d
sub r9, r8
and ecx, 0xfffffff8
cmp ecx, 8
jb 0x14000262b
and ecx, 0xfffffff8
xor eax, eax
mov r8d, eax
add eax, 8
mov r10, qword [r9 + r8]
mov qword [rdx + r8], r10
cmp eax, ecx
jb 0x140002759
jmp 0x14000262b
mov eax, dword [rsp + 0xe0]
mov ecx, ecx
mov dword [r8], eax
mov eax, dword [rsi + rcx - 4]
mov dword [r8 + rcx - 4], eax
mov r8, qword [rsp + 0x70]
mov rax, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xd0]
jmp 0x140002640
mov ecx, ecx
movzx eax, word [rsi + rcx - 2]
mov word [r8 + rcx - 2], ax
mov r8, qword [rsp + 0x70]
mov rax, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xd0]
jmp 0x140002640
lea rcx, [0x14012e0a6]
call fcn.1401290c0
lea rcx, [0x14012e0a6]
call fcn.1401290c0
lea rcx, [0x14012e0a6]
call fcn.1401290c0
mov rcx, r12
mov rsi, rax
lea rbp, [rsp + 0x70]
call fcn.14010da80
mov rcx, qword [rsp + 0x68]
call fcn.14010da80
mov rcx, rbp
call fcn.14010da80
mov rcx, rbx
mov edx, 0x15d200
call fcn.140127f50
mov rcx, rsi
call fcn.14001ae80
jmp 0x1400027ea
call fcn.140128f50
nop
nop