Function at 0x180007570
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rdx], r14
mov qword [rbp + 0x48], r14
mov rax, qword [rcx]
lea r8, [rbp - 0x30]
lea rdx, [0x180074820]
mov rax, qword [rax + 0x28]
call qword [case.0x18004bf34.0]
mov ebx, eax
test eax, eax
js 0x1800075dd
cmp r14w, word [rbp - 0x30]
je 0x1800075cf
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x30]
call qword [sym.imp.PROPSYS.dll_PropVariantToUInt64]
nop dword [rax + rax]
mov ebx, eax
jmp 0x1800075d4
mov ebx, 0x80070490
lea rcx, [rbp - 0x30]
call sub.ole32.dll_PropVariantClear
lea r12, str.pcshell_shell_appresolver_appsfolder_appsfolder.cpp
test ebx, ebx
jns 0x1800076e9
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
or r15, 0xffffffffffffffff
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x30], r14
mov rax, qword [rdi]
lea r8, [rbp - 0x18]
lea rdx, [0x1800748c8]
mov rcx, rdi
mov rax, qword [rax + 0x28]
call qword [case.0x18004bf34.0]
mov ebx, eax
test eax, eax
js 0x180007640
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x30]
call fcn.18005f0c0
mov ebx, eax
mov rcx, qword [rbp + 0x38]
test ebx, ebx
jns 0x18000765c
mov r9d, ebx
mov r8, r12
mov edx, 0x3fb
call fcn.18000a128
test ebx, ebx
js 0x1800076c0
mov r8, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
cmp rax, r15
jne 0x180007684
test r8, r8
je 0x18000767d
mov rax, r15
inc rax
cmp word [r8 + rax*2], r14w
jne 0x180007671
jmp 0x180007680
mov rax, r14
mov qword [rbp - 0x28], rax
lea ecx, [rax + rax]
movabs rdx, 0xd7a9059d7284495b
test ecx, ecx
je 0x1800076bc
mov r9d, ecx
imul rcx, rdx, 0x820
mov rax, rdx
shr rax, 2
add rcx, rax
movzx eax, byte [r8]
add rcx, rax
xor rdx, rcx
inc r8
sub r9, 1
jne 0x180007698
mov qword [rbp + 0x48], rdx
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1800076d9
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
test ebx, ebx
js 0x180007848
lea r8, [rbp + 0x40]
lea rdx, [0x18006d668]
mov rcx, rdi
call fcn.18005f114
mov rcx, qword [rbp + 0x38]
test eax, eax
jns 0x180007718
mov r9d, eax
mov r8, r12
mov edx, 0x406
call fcn.18000a128
mov dword [rbp + 0x40], r14d
test ebx, ebx
js 0x180007848
mov rcx, qword [rbp + 0x48]
lea r8, [rbp + 0x40]
mov r9d, 4
imul rdx, rcx, 0x820
mov rax, rcx
shr rax, 2
add rdx, rax
movzx eax, byte [r8]
add rdx, rax
xor rcx, rdx
inc r8
sub r9, 1
jne 0x18000772e
mov qword [rbp + 0x48], rcx
lea rdx, [rbp + 0x48]
call fcn.18001b7ac
mov ebx, eax
mov rcx, qword [rbp + 0x38]
test eax, eax
jns 0x180007779
mov r9d, eax
mov r8, r12
mov edx, 0x410
call fcn.18000a128
test ebx, ebx
js 0x180007848
cmp dword [rbp + 0x40], r14d
jne 0x180007797
lea r8, [rbp + 0x48]
mov rdx, qword [rbp + 0x48]
mov rcx, rdi
call fcn.1800073dc
mov qword [rbp + 0x50], r14
lea rcx, [rbp + 0x50]
call fcn.180009204
mov rdx, rax
lea rcx, [0x18006e990]
call qword [sym.imp.PROPSYS.dll_PSCreateMemoryPropertyStore]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rbp + 0x38]
test eax, eax
jns 0x1800077d4
mov r9d, eax
mov r8, r12
mov edx, 0x41a
call fcn.18000a128
test ebx, ebx
js 0x18000782e
mov eax, Ordinal_24
mov word [rbp - 0x30], ax
mov rax, qword [rbp + 0x48]
mov qword [rbp - 0x28], rax
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx]
lea r8, [rbp - 0x30]
lea rdx, [0x180074820]
mov rax, qword [rax + 0x30]
call qword [case.0x18004bf34.0]
mov ebx, eax
mov rcx, qword [rbp + 0x38]
test eax, eax
jns 0x18000781f
mov r9d, eax
mov r8, r12
mov edx, 0x41d
call fcn.18000a128
test ebx, ebx
js 0x18000782e
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x50], r14
mov qword [rsi], rax
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x180007848
mov qword [rbp + 0x50], r14
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x18004bf34.0]
mov eax, ebx
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret