Function at 0x10011e744
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x168
xor r15d, r15d
xor r12d, r12d
test rcx, rcx
mov rax, r8
mov rsi, rdx
mov r13, rcx
lea ebx, [r15 + 0x14]
mov qword [rsp + 0x48], r12
mov r14d, 0xb4
je 0x10011ef3d
test rdx, rdx
je 0x10011ef3d
test rax, rax
je 0x10011ef3d
test r9, r9
je 0x10011ef3d
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbx - 0xc]
mov rcx, rax
mov r8d, 0x1b4
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
jne 0x10011e7d9
mov ebp, 0x80000002
jmp 0x10011eabe
lea rdx, [rax + 0x60]
lea rsi, [0x100153d88]
mov rdi, r14
lea rax, [rdx + 0xa8]
mov ecx, 0x60
mov dword [rsp + 0x80], 0x123174bb
rep movsb byte [rdi], byte [rsi]
mov qword [r14], rdx
mov rsi, qword [0x100153d88]
mov qword [rsp + 0xe0], rax
add rax, 0x70
mov rdi, rdx
mov edx, 8
lea r12, [rax + 0x14]
mov qword [rsp + 0x40], rax
lea rax, [r12 + 0x14]
mov ecx, 0xa8
mov dword [rsp + 0x84], 0x86521ff8
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [r14]
mov qword [rsp + 0xe8], rax
add rdi, 0x58
mov rcx, rdx
lea rsi, [rsp + 0xe0]
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [r14]
mov rsi, qword [0x100153d88]
mov rdi, qword [rdi + 0x58]
mov rsi, qword [rsi + 0x58]
lea ecx, [rdx + 0x68]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r14]
mov rcx, rdx
mov rdi, qword [rax + 0x58]
xor edx, edx
lea rsi, [rsp + 0xe8]
add rdi, 0x38
lea r8d, [rdx + 0x10]
mov dword [rsp + 0x88], 0x98d2438b
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r14]
mov dword [rsp + 0x8c], 0x7966ce12
mov rcx, qword [rax + 0x58]
mov dword [rsp + 0x90], 0xc5d92014
mov dword [rsp + 0x98], ebp
mov rax, qword [rcx + 0x38]
lea rcx, [rsp + 0x9c]
mov qword [rsp + 0x48], rax
call sub.msvcrt.dll_memset
mov rdx, qword [0x100153d88]
mov rsi, qword [rdx + 0x58]
lea rdi, [rsp + 0x98]
mov rcx, rbx
mov rsi, qword [rsi + 0x38]
xor r8d, r8d
movabs r15, 0xcccccccccccccccd
rep movsb byte [rdi], byte [rsi]
lea rsi, [rsp + 0x98]
lea r9d, [r8 + 5]
mov rcx, r8
mov rax, r15
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x80]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011e909
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
lea rsi, [rsp + 0x98]
mov rcx, rbx
lea r8d, [r9 + 0x10]
xor edx, edx
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xb4]
mov dword [rsp + 0x50], 0x123174bb
mov qword [r14 + 8], rax
mov dword [rsp + 0x54], 0x86521ff8
mov dword [rsp + 0x58], 0x98d2438b
mov dword [rsp + 0x5c], 0x7966ce12
mov dword [rsp + 0x60], 0xc5d92014
mov dword [rsp + 0xb0], ebp
call sub.msvcrt.dll_memset
mov rsi, qword [0x100153d90]
xor r8d, r8d
lea rdi, [rsp + 0xb0]
mov rcx, rbx
lea r9d, [r8 + 5]
rep movsb byte [rdi], byte [rsi]
lea rsi, [rsp + 0xb0]
movabs rdi, 0xcccccccccccccccd
xor r15d, r15d
mov rcx, r8
mov rax, rdi
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x50]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011e9c1
mov rdi, qword [rsp + 0x40]
lea rsi, [rsp + 0xb0]
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
lea r8d, [r9 + 0x10]
lea rcx, [rsp + 0xcc]
xor edx, edx
mov qword [r14 + 0x10], r12
mov dword [rsp + 0x68], 0x123174bb
mov dword [rsp + 0x6c], 0x86521ff8
mov dword [rsp + 0x70], 0x98d2438b
mov dword [rsp + 0x74], 0x7966ce12
mov dword [rsp + 0x78], 0xc5d92014
mov dword [rsp + 0xc8], ebp
call sub.msvcrt.dll_memset
mov rsi, qword [0x100153d98]
lea rdi, [rsp + 0xc8]
mov rcx, rbx
xor r8d, r8d
rep movsb byte [rdi], byte [rsi]
movabs r13, 0xcccccccccccccccd
lea rsi, [rsp + 0xc8]
lea r9d, [r8 + 5]
mov rcx, r8
mov rax, r13
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x68]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011ea6e
mov r13, qword [rsp + 0x1b0]
mov rdi, r12
lea rsi, [rsp + 0xc8]
mov rcx, rbx
mov r12, r14
mov qword [rsp + 0x48], r14
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1b8]
test ebp, ebp
js 0x10011eda8
lea rax, [r13 + 0x10]
mov dword [r13], 0
mov dword [r13 + 4], 0x157c
mov qword [r13 + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0xb4
mov r8, r14
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r15, rax
jne 0x10011eb0d
mov ebp, 0x80000002
jmp 0x10011edae
add rax, 0x3c
lea rcx, [rsp + 0xf0]
cmp rcx, rsi
mov qword [rsp + 0x1b0], rax
je 0x10011eb33
lea rdi, [rsp + 0xf0]
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
lea rsi, [rsp + 0xf0]
mov rdi, r15
mov rcx, rbx
mov edx, ebx
lea rax, [rsp + 0xf0]
rep movsb byte [rdi], byte [rsi]
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011eb4d
mov rsi, qword [rsp + 0x1c0]
lea rax, [rsp + 0x110]
cmp rax, rsi
je 0x10011eb7b
lea rdi, [rsp + 0x110]
lea ecx, [rdx + 0x50]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r12]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
je 0x10011ebf7
mov r9, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rsp + 0x110]
mov rcx, rbx
lea r8, [r15 + 0x14]
mov edx, 5
rep movsb byte [rdi], byte [rsi]
mov rcx, rax
mov qword [rsp + 0x20], r13
call fcn.100125da4
mov edx, ebx
mov rax, r14
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011ebd7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [r12]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
je 0x10011ec73
mov r9, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rsp + 0x124]
mov rcx, rbx
lea r8, [r15 + 0x28]
mov edx, 5
rep movsb byte [rdi], byte [rsi]
mov rcx, rax
mov qword [rsp + 0x20], r13
call fcn.100125da4
mov edx, ebx
mov rax, r14
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011ec53
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [r12]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
je 0x10011ecf8
mov r9, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rsp + 0x138]
mov rcx, rbx
mov edx, 5
mov qword [rsp + 0x20], r13
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1b0]
mov rcx, rax
mov r8, rsi
call fcn.100125da4
mov edx, ebx
mov rax, r14
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011ecd6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10011ed00
mov rsi, qword [rsp + 0x1b0]
mov rax, qword [r12]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
je 0x10011ed84
mov r9, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rsp + 0x14c]
mov rcx, rbx
mov edx, 5
mov qword [rsp + 0x20], r13
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1b0]
mov rcx, rax
lea r8, [rsi + 0x14]
call fcn.100125da4
mov edx, ebx
mov rax, r14
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011ed64
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [r15 + 0x14]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], r13
call fcn.100121a34
test eax, eax
jne 0x10011ee49
mov ebp, 0x800480d5
mov r14d, 0xb4
test r12, r12
je 0x10011ee05
mov rax, qword [r12]
mov edx, ebx
mov rcx, qword [rax + 0x58]
mov rax, qword [rcx + 0x38]
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011edc1
mov rax, qword [r12 + 8]
mov ecx, ebx
mov byte [rax], 0
add rax, 1
add ecx, 0xffffffff
jne 0x10011edd4
mov rax, qword [r12 + 0x10]
mov byte [rax], 0
add rax, 1
add ebx, 0xffffffff
jne 0x10011ede5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x10011ee33
test r15, r15
je 0x10011ee33
mov rax, r15
mov byte [rax], 0
add rax, 1
add r14d, 0xffffffff
jne 0x10011ee12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebp
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov qword [rsp + 0x30], r12
lea r14, [rsi + 0x28]
lea rcx, [r15 + 0x14]
lea edx, [r8 + 4]
mov r9, r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 5
call fcn.1001245e8
test eax, eax
je 0x10011eda3
mov qword [rsp + 0x30], r13
lea rdi, [r14 + 0x28]
mov r9d, 0xffffffff
mov rdx, r14
mov rcx, rsi
mov r8, rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r12
call fcn.100121d28
test eax, eax
je 0x10011eda3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
je 0x10011eda3
mov r8, qword [r12]
lea rsi, [rax + 0x14]
mov r9, r13
mov r8, qword [r8 + 0x58]
mov rdx, rsi
mov rcx, rdi
call fcn.100125ef4
mov rdi, r14
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [rsp + 0x1c8]
cmp rdi, r14
je 0x10011ef10
mov rsi, r14
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, r14
mov ecx, 0x28
mov byte [rax], 0
add rax, 1
add ecx, 0xffffffff
jne 0x10011ef18
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10011eda8
mov ebp, 0x80070057
jmp 0x10011edae