Function at 0x140199590
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
mov eax, dword [0x1415a29f8]
add eax, dword [0x1415a29fc]
shr eax, 4
imul rax, rax, 0x8a684c9
shr rax, 0x35
or eax, 0xa1192718
cmp eax, 0xe5e569db
ja 0x1401995a0
test rsi, rsi
js 0x1401995dc
jne 0x1401995e2
movabs rax, 0x600000002
jmp 0x1401996f0
cmp rsi, 0xffffffffffffffff
je 0x140199615
mov eax, dword [0x1415a2a18]
or eax, dword [0x1415a2a1c]
add eax, 0xae9bbfc3
mov ecx, eax
not ecx
or eax, 0x10befec4
or ecx, 0xef41013b
and ecx, eax
cmp ecx, 0x6951ec97
jne 0x140199b29
jmp 0x140199bb5
mov eax, dword [0x1415a2a00]
imul eax, dword [0x1415a2a04]
mov ecx, eax
not ecx
or ecx, 0xf3b22ad6
or eax, 0xc4dd529
and eax, ecx
add eax, 0x45d9a4ea
mov ecx, eax
and ecx, 0x39675ff1
add ecx, ecx
sub eax, ecx
add eax, 0x39675ff1
cmp eax, 0x45cad8c2
jae 0x140199655
call sub.KERNEL32.dll_GetLastError
mov esi, 0xcc975e63
nop word [rax + rax]
mov edi, dword [0x1415a2a08]
mov eax, dword [0x1415a2a0c]
mov ecx, edi
not ecx
and ecx, eax
mov edx, eax
not edx
and edx, edi
imul edx, ecx
mov ecx, edi
and ecx, eax
or edi, eax
imul edi, ecx
add edi, edx
mov eax, edi
not eax
or eax, 0x5948110b
or edi, 0xa6b7eef4
and edi, eax
imul rdi, rsi
shr rdi, 0x3e
mov eax, edi
and eax, 0xfffffffe
or edi, 0xe42979aa
add edi, eax
call sub.KERNEL32.dll_GetLastError
cmp edi, 0x69dc199f
jb 0x140199660
shl rax, 0x20
nop dword [rax]
mov ecx, dword [0x1415a2a10]
or ecx, dword [0x1415a2a14]
and ecx, 0x35b05e39
imul ecx, ecx, 0xaab2cf32
imul rcx, rcx, 0x712490d7
shr rcx, 0x3e
cmp ecx, 0x7abb8a05
ja 0x1401996c0
or rax, 2
nop
mov ecx, dword [0x1415a2a58]
mov edx, dword [0x1415a2a5c]
mov r8d, ecx
xor r8d, edx
not r8d
and r8d, edx
add r8d, r8d
sub edx, r8d
add edx, ecx
mov ecx, edx
xor ecx, 0x60eaccb7
add ecx, edx
and edx, 0x9f153348
sub ecx, edx
add ecx, 0xaaf4537
mov edx, ecx
not edx
and edx, 0x6774efb5
and ecx, 0x988b104a
sub ecx, edx
cmp ecx, 0x9f2e2ba1
ja 0x1401996f0
mov ecx, eax
and ecx, 3
cmp rcx, 2
jg 0x140199a50
xor edi, edi
mov edx, 0
cmp ecx, 1
jne 0x140199d7d
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
nop dword [rax]
mov ecx, dword [0x1415a2a68]
add ecx, dword [0x1415a2a6c]
mov edx, ecx
xor edx, 0x10000813
and edx, 0x79440997
xor ecx, 0xeb7e81e4
lea ecx, [rcx + rdx*2]
add ecx, 0xcdaf54c0
cmp ecx, 0xa9301139
ja 0x140199770
mov rbx, qword [rax + 7]
mov rax, qword [rbx]
nop dword [rax + rax]
mov ecx, dword [0x1415a2a70]
mov edx, dword [0x1415a2a74]
mov r8d, ecx
xor r8d, edx
not edx
and edx, ecx
add edx, edx
sub edx, r8d
imul ecx, edx, 0xec28092e
add ecx, 0x9c2cd0cf
xor ecx, 0x98859210
cmp ecx, 0xe8340a95
ja 0x1401997b0
test rax, rax
je 0x1401997f0
mov rcx, rdi
call rax
nop
mov eax, dword [0x1415a2a78]
and eax, dword [0x1415a2a7c]
mov ecx, eax
and ecx, 0x1a68ff49
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x1a68ff49
mov ecx, eax
or ecx, 0x2e0285d
and ecx, 0x76e4285d
or eax, 0xf7f6bbdd
add eax, ecx
cmp eax, 0x44750e27
ja 0x1401997f0
mov rax, qword [rbx + 8]
nop
mov ecx, dword [0x1415a2a80]
add ecx, dword [0x1415a2a84]
imul ecx, ecx, 0x7e91f188
cmp ecx, 0x949f9353
je 0x140199830
test rax, rax
je 0x140199a05
mov rax, qword [rbx + 0x10]
nop word [rax + rax]
mov ecx, dword [0x1415a2a88]
mov edx, dword [0x1415a2a8c]
mov r8d, edx
not r8d
mov r9d, ecx
and r9d, r8d
or r8d, ecx
not r8d
imul r8d, r9d
mov r9d, ecx
and r9d, edx
or ecx, edx
imul ecx, r9d
add ecx, r8d
add ecx, 0xe746fa1c
mov edx, ecx
not edx
mov r8d, ecx
and r8d, 0xa5d6d276
and edx, 0x5a292d89
imul edx, r8d
mov r8d, ecx
and r8d, 0x5a292d89
or ecx, 0x5a292d89
imul ecx, r8d
add ecx, edx
imul ecx, ecx, 0xa6447928
cmp ecx, 0xf6b58fd1
je 0x140199860
mov ecx, 0xac459057
nop dword [rax + rax]
mov edx, dword [0x1415a2a90]
sub edx, dword [0x1415a2a94]
add edx, 0xa4d0b48
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0x63f67a9a
ja 0x1401998e0
cmp rax, 0x11
jb 0x1401999a6
nop dword [rax]
mov eax, dword [0x1415a2a98]
mov ecx, dword [0x1415a2a9c]
mov edx, eax
xor edx, ecx
not edx
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0x7cf2c9be
add eax, ecx
and ecx, 0x830d3641
sub eax, ecx
mov ecx, eax
xor ecx, 0x80008380
or eax, 0x44351422
and eax, ecx
and eax, 0xc43597a2
cmp eax, 0x12cfbae1
je 0x140199910
mov eax, dword [0x1415a2aa0]
xor edx, edx
div dword [0x1415a2aa4]
nop word cs:[rax + rax]
mov eax, dword [0x1415a2aa8]
mov ecx, dword [0x1415a2aac]
mov edx, eax
or edx, ecx
not eax
not ecx
and ecx, eax
not ecx
and ecx, edx
or ecx, 0x90353f3d
imul eax, ecx, 0xebe70a4f
add eax, 0x5f9067db
cmp eax, 0x9ed90709
ja 0x140199970
mov rdi, qword [rdi - 8]
mov eax, dword [0x1415a2ab0]
mov ecx, dword [0x1415a2ab4]
not eax
not ecx
and ecx, eax
not ecx
or ecx, 0x7249e9d9
mov eax, ecx
and eax, 0x43f8aad
xor ecx, 0x43f8aad
lea eax, [rcx + rax*2]
or eax, 0xa57224ce
cmp eax, 0x92b3426c
jae 0x1401999ee
mov rcx, qword [0x1415acb98]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rcx, qword [0x1415acb98]
xor edx, edx
mov r8, rdi
call fcn.14020ae70
test bl, bl
jne 0x1401999f0
mov eax, dword [0x1415a2ab8]
xor edx, edx
div dword [0x1415a2abc]
mov ecx, eax
not ecx
or ecx, 0x6b50a8c5
add eax, ecx
inc eax
mov ecx, eax
or ecx, 0x1004191c
not eax
and eax, 0x42490440
and ecx, 0x9c84d91f
sub ecx, eax
cmp ecx, 0xf128a3e8
jbe 0x140199a89
jmp 0x140199ab8
mov eax, dword [0x1415a2a60]
imul eax, dword [0x1415a2a64]
add eax, 0xa50678c
or eax, 0x68ad93c6
add eax, 0x2cc87a94
cmp eax, 0xbf6b7630
ja 0x140199a50
xor edi, edi
mov al, 1
nop word [rax + rax]
test al, al
je 0x140199a80
jmp 0x140199b22
mov eax, dword [0x1415a2ac0]
xor eax, dword [0x1415a2ac4]
and eax, 0xd249f947
add eax, 0xeef23292
imul rax, rax, 0x43a96871
shr rax, 0x3c
mov rbx, qword [0x1415acb98]
cmp eax, 0x141e3c09
jne 0x140199ac1
mov rax, qword [0x1415acb98]
jmp 0x140199a89
mov eax, dword [0x1415a2ac8]
mov ecx, dword [0x1415a2acc]
mov edx, eax
xor edx, ecx
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
and ecx, 0xd4bb9b3c
add ecx, 0x3ae955af
mov eax, ecx
and eax, 0x707470c8
add eax, eax
sub ecx, eax
cmp ecx, 0x7c7cb62e
jne 0x140199b06
mov rcx, rbx
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
nop dword [rax + rax]
mov rcx, rbx
xor edx, edx
mov r8, rsi
call fcn.14020ae70
test dil, dil
jne 0x140199b10
xor edx, edx
jmp 0x140199d7d
mov eax, dword [0x1415a2a20]
imul eax, dword [0x1415a2a24]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x9c7d5a34
and ecx, 0x6382a5cb
imul ecx, edx
mov edx, eax
and edx, 0x6382a5cb
or eax, 0x6382a5cb
imul eax, edx
add eax, ecx
mov edi, eax
not edi
or eax, 0x4e6e82e1
or edi, 0xb1917d1e
and edi, eax
xor edi, 0xe7d3d9d
mov qword [rsp + 0x38], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call fcn.14020d340
cmp edi, 0x2188682f
jne 0x140199c00
mov qword [rsp + 0x38], 0
call fcn.14020d440
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x140199b29
mov ecx, dword [0x1415a2a2c]
mov edx, ecx
xor edx, edx
not edx
and edx, dword [0x1415a2a28]
xor edx, ecx
add edx, 0xa5d03934
or edx, 0x50931ca8
mov ecx, edx
and ecx, 0x220288f5
add ecx, ecx
neg ecx
add ecx, edx
add ecx, 0xa20288f5
cmp ecx, 0xf40cb9b7
jb 0x140199c00
test eax, eax
je 0x140199d08
nop word cs:[rax + rax]
mov eax, dword [0x1415a2a30]
mov ecx, dword [0x1415a2a34]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
add eax, 0x91ebb4b
xor eax, 0x1444785d
cmp eax, 0xc610211d
je 0x140199c50
mov rdx, qword [rsp + 0x38]
nop word cs:[rax + rax]
mov eax, dword [0x1415a2a38]
or eax, dword [0x1415a2a3c]
add eax, 0x1d34e7ca
or eax, 0x4349bd4a
and eax, 0x73d9fd6b
cmp eax, 0x1cc3f78c
jb 0x140199ca0
xor edi, edi
nop word cs:[rax + rax]
mov eax, dword [0x1415a2a40]
mov ecx, dword [0x1415a2a44]
not ecx
add eax, ecx
add eax, 0x9f3b4000
mov ecx, eax
not ecx
or eax, 0x4418110
or ecx, 0x921852e2
and ecx, eax
not ecx
or ecx, 0x69a62c0d
cmp ecx, 0x1adde786
jbe 0x140199cd0
jmp 0x140199d7d
mov eax, dword [0x1415a2a48]
xor eax, dword [0x1415a2a4c]
mov ecx, eax
xor ecx, 0x9b1ba92e
or eax, 0x64e456d1
and eax, ecx
add eax, 0xacd8332e
cmp eax, 0xb1e824c4
ja 0x140199d67
mov eax, dword [0x1415a2a50]
add eax, dword [0x1415a2a54]
mov ecx, eax
and ecx, 0xd2c592c2
and eax, 0x458200
mov esi, ecx
xor esi, 0xd3aa30eb
add esi, ecx
sub esi, eax
add esi, 0x83841e3b
call fcn.14020b260
cmp esi, 0x2c87d8dc
jae 0x140199d6e
call sub.KERNEL32.dll_GetLastError
jmp 0x140199d2f
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret