Function at 0x41c6d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x38], 0
test rcx, rcx
je 0x41c713
mov rdi, rcx
mov al, byte [rcx + 0x71]
cmp al, 0xba
je 0x41c70a
cmp al, 0x76
je 0x41c71c
cmp al, 0x6d
jne 0x41c759
lea r8, [0x005ff106]
jmp 0x41c760
lea r8, str.NULL
jmp 0x41c760
test rdx, rdx
lea rsi, [0x005fadb4]
cmovne rsi, rdx
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x41c739
call qword [0x005f6090]
mov dword [rdi + 0x50], 0
cmp qword [rdi + 0x190], 0
je 0x41c7b3
mov r14, rdi
mov rcx, rdi
xor edx, edx
call fcn.00430650
jmp 0x41c7bd
lea r8, [0x00607400]
lea rdx, [0x005ff10f]
mov esi, 0x15
mov ecx, 0x15
call fcn.00408970
lea rax, [0x005fb813]
mov qword [rsp + 0x20], rax
lea rdx, [0x005fc003]
lea r8, [0x0060752f]
mov ecx, 0x15
mov r9d, 0x1f960
call fcn.00408970
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rdi
mov dword [rdi + 0x54], 0xffffffff
mov r12, qword [rsp + 0xd0]
lea r15, [rsp + 0x48]
lea rbx, [rsp + 0x38]
cmp byte [rsi], 0
je 0x41ccc3
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rsi
mov r8d, 0xffffffff
mov r9d, pe_nt_image_headers64
call fcn.0041dba0
test eax, eax
jne 0x41cd1b
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x41ca8d
xor r13d, r13d
xor ebp, ebp
xor ebx, ebx
xor r12d, r12d
mov r15, r14
nop
mov rcx, rsi
call fcn.0040cf00
mov r14d, eax
cmp qword [rsp + 0x58], 0
je 0x41ca7d
cmp r14d, 0x64
jne 0x41c860
test ebp, ebp
mov edx, ebx
jne 0x41c914
jmp 0x41c89c
cmp r14d, 0x65
sete al
setne dl
test ebp, ebp
sete cl
setne bl
xor bl, dl
jne 0x41caab
or cl, al
xor cl, 1
jne 0x41caab
mov rax, qword [r15 + 0x30]
mov rcx, rax
xor rcx, 0xfffffffffffffeff
test rcx, rax
je 0x41caab
test rsi, rsi
je 0x41c8aa
movzx edi, word [rsi + 0xc0]
jmp 0x41c8ac
xor edi, edi
mov edx, edi
shl edx, 4
mov eax, edx
not eax
and eax, 0xade0eced
and edx, 0xf1310
or edx, eax
xor edx, 0xade0ece5
mov rcx, r15
call fcn.00429840
test rax, rax
je 0x41ccb3
mov r13, rax
mov ebx, edi
test edi, edi
je 0x41c908
mov edi, ebx
xor ebp, ebp
nop word [rax + rax]
mov rcx, rsi
mov edx, ebp
call fcn.00416640
mov qword [r13 + rbp*8], rax
add rbp, 1
cmp rdi, rbp
jne 0x41c8f0
cmp r14d, 0x64
mov edx, ebx
jne 0x41ca5f
movsxd rax, edx
lea r12, [rax*8]
add r12, r13
test eax, eax
jle 0x41ca53
mov dword [rsp + 0x54], r14d
mov qword [rsp + 0x40], r13
mov rdi, r15
mov dword [rsp + 0x50], edx
mov ebp, edx
add rbp, 0xffffffffffffffff
xor r13d, r13d
xor r14d, r14d
nop word [rax + rax]
mov rcx, rsi
mov edx, r14d
call fcn.00416260
mov qword [r12 + r14*8], rax
test rax, rax
jne 0x41ca27
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x41ca27
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x41c988
call qword [0x005f6090]
mov rax, qword [rsi + 0xa0]
test rax, rax
je 0x41c9a5
movzx ecx, word [rsi + 0xc0]
cmp r14, rcx
jae 0x41c9a5
add rax, r13
jmp 0x41c9c0
mov rcx, qword [rsi]
mov dword [rcx + 0x50], 0x19
mov edx, 0x19
call fcn.00430650
lea rax, [0x005fddc8]
mov eax, dword [rax + 0x14]
mov ecx, eax
xor ecx, 0xffffffc0
and ecx, eax
movzx r15d, cx
mov rcx, qword [rsi]
mov edx, dword [rsi + 0x34]
cmp byte [rcx + 0x67], 0
setne r8b
test edx, edx
setne bl
test bl, r8b
jne 0x41c9ed
xor eax, eax
xor bl, r8b
je 0x41c9f5
call fcn.004456e0
mov rcx, qword [rsi]
mov dword [rsi + 0x34], eax
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x41ca07
call qword [0x005f60a0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov ecx, r15d
shr rax, cl
mov rcx, rax
xor rcx, 0xfffffffffffffffe
test rcx, rax
je 0x41cbca
cmp rbp, r14
je 0x41ca3e
add r14, 1
mov rsi, qword [rsp + 0x38]
add r13, 0x38
jmp 0x41c950
mov edx, dword [rsp + 0x50]
mov eax, edx
mov r15, rdi
mov r13, qword [rsp + 0x40]
mov r14d, dword [rsp + 0x54]
jmp 0x41ca55
xor eax, eax
mov eax, eax
mov qword [r12 + rax*8], 0
mov rcx, qword [rsp + 0x60]
mov ebx, edx
mov r8, r12
mov r9, r13
call qword [rsp + 0x58]
mov ebp, 1
test eax, eax
jne 0x41cc0b
cmp r14d, 0x64
jne 0x41caa1
mov rsi, qword [rsp + 0x38]
jmp 0x41c830
xor edi, edi
mov rsi, qword [rsp + 0x48]
test edi, edi
je 0x41c7cf
jmp 0x41cd1d
mov r14, r15
mov rsi, qword [rsp + 0x38]
jmp 0x41caae
mov r14, r15
mov al, byte [rsi + 0xc5]
test al, al
mov r12, qword [rsp + 0xd0]
lea r15, [rsp + 0x48]
lea rbx, [rsp + 0x38]
je 0x41cb4f
mov r12, qword [rsi]
cmp al, 2
jne 0x41cadd
mov rcx, rsi
call fcn.00445770
cmp dword [rsi + 0x30], 0
js 0x41cb04
cmp qword [r12 + 0x190], 0
jne 0x41cafc
cmp qword [rsi + 0xa8], 0
je 0x41cbad
mov rcx, rsi
call fcn.004479e0
mov rdx, qword [rsi + 0xa8]
test rdx, rdx
je 0x41cb23
mov rcx, r12
call fcn.00408130
mov qword [rsi + 0xa8], 0
mov qword [rsi + 0xa0], 0
mov edi, dword [rsi + 0x34]
mov eax, dword [r12 + 0x58]
not eax
not edi
or edi, eax
not edi
lea rbp, [0x005fb0a0]
mov r12, qword [rsp + 0xd0]
jmp 0x41cb58
xor edi, edi
lea rbp, [0x005fb0a0]
mov rcx, rsi
call fcn.00402020
mov qword [rsp + 0x38], 0
mov rsi, qword [rsp + 0x48]
add rsi, 0xffffffffffffffff
nop word cs:[rax + rax]
nop dword [rax]
movzx eax, byte [rsi + 1]
add rsi, 1
movzx eax, byte [rax + rbp]
mov ecx, eax
xor cl, 0xfe
test cl, al
jne 0x41cb80
mov rcx, r14
mov rdx, r13
call fcn.00408130
test edi, edi
je 0x41c7cf
jmp 0x41cd1d
mov eax, dword [rsi + 0x34]
mov dword [r12 + 0x50], eax
mov rdx, qword [rsi + 0xa8]
test rdx, rdx
jne 0x41cb10
jmp 0x41cb23
mov rbp, rdi
cmp byte [rdi + 0x67], 0
je 0x41cbea
mov r12, qword [rsp + 0xd0]
mov r13, qword [rsp + 0x40]
mov edi, 0x64
jmp 0x41cd2d
cmp byte [rbp + 0x68], 0
mov r12, qword [rsp + 0xd0]
mov r13, qword [rsp + 0x40]
je 0x41ccc7
mov edi, 0x64
jmp 0x41cd2d
mov rsi, qword [rsp + 0x38]
mov al, byte [rsi + 0xc5]
test al, al
mov rbp, r15
mov r12, qword [rsp + 0xd0]
je 0x41cc84
mov rbx, qword [rsi]
cmp al, 2
jne 0x41cc34
mov rcx, rsi
call fcn.00445770
cmp dword [rsi + 0x30], 0
js 0x41cc5a
cmp qword [rbx + 0x190], 0
jne 0x41cc52
cmp qword [rsi + 0xa8], 0
je 0x41ce95
mov rcx, rsi
call fcn.004479e0
mov rdx, qword [rsi + 0xa8]
test rdx, rdx
je 0x41cc79
mov rcx, rbx
call fcn.00408130
mov qword [rsi + 0xa8], 0
mov qword [rsi + 0xa0], 0
mov rcx, rsi
call fcn.00402020
mov qword [rsp + 0x38], 0
mov dword [rbp + 0x50], 4
mov edi, 4
mov rcx, rbp
mov edx, 4
call fcn.00430650
jmp 0x41cd9e
mov rbp, r15
mov r12, qword [rsp + 0xd0]
mov edi, r14d
jmp 0x41cd25
xor edi, edi
jmp 0x41cd1d
mov byte [rbp + 0x67], 1
cmp dword [rbp + 0xe4], 0
mov edi, 0x64
jle 0x41cce3
mov dword [rbp + 0x198], 1
add dword [rbp + 0x1a0], 1
mov word [rbp + 0x1a4], 0
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x41cd2d
lea rdx, [0x005fc480]
call fcn.00419aa0
mov rax, qword [rbp + 0x160]
mov dword [rax + 0x18], 7
jmp 0x41cd2d
mov edi, eax
mov rsi, qword [rsp + 0x38]
mov rbp, r14
xor r13d, r13d
test rsi, rsi
je 0x41cd9e
mov al, byte [rsi + 0xc5]
test al, al
je 0x41cd96
mov rbx, qword [rsi]
cmp al, 2
jne 0x41cd46
mov rcx, rsi
call fcn.00445770
cmp dword [rsi + 0x30], 0
js 0x41cd6c
cmp qword [rbx + 0x190], 0
jne 0x41cd64
cmp qword [rsi + 0xa8], 0
je 0x41ce7a
mov rcx, rsi
call fcn.004479e0
mov rdx, qword [rsi + 0xa8]
test rdx, rdx
je 0x41cd8b
mov rcx, rbx
call fcn.00408130
mov qword [rsi + 0xa8], 0
mov qword [rsi + 0xa0], 0
mov rcx, rsi
call fcn.00402020
mov rcx, rbp
mov rdx, r13
call fcn.00408130
cmp byte [rbp + 0x67], 0
sete al
setne dl
test edi, edi
sete cl
setne bl
xor bl, dl
jne 0x41cdde
or cl, al
xor cl, 1
jne 0x41cdde
xor esi, esi
test r12, r12
je 0x41ce62
mov qword [r12], 0
jmp 0x41ce62
mov rcx, rbp
mov edx, edi
call fcn.004456e0
mov esi, eax
test r12, r12
setne al
test esi, esi
sete cl
cmp al, cl
je 0x41cdc8
test r12, r12
je 0x41cdc8
mov rcx, rbp
call fcn.0041ceb0
test rax, rax
je 0x41ce41
mov rdi, rax
mov rcx, rax
call fcn.005f4bd8
mov rbx, rax
add rbx, 1
mov rcx, rbx
call fcn.00404550
test rax, rax
je 0x41ce41
mov r14, rax
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call fcn.005f4c20
mov qword [r12], r14
jmp 0x41ce62
mov qword [r12], 0
mov dword [rbp + 0x50], 7
mov esi, 7
mov rcx, rbp
mov edx, 7
call fcn.00430650
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x41c7a0
call qword [0x005f60a0]
jmp 0x41c7a0
mov eax, dword [rsi + 0x34]
mov dword [rbx + 0x50], eax
mov rdx, qword [rsi + 0xa8]
test rdx, rdx
jne 0x41cd78
jmp 0x41cd8b
mov eax, dword [rsi + 0x34]
mov dword [rbx + 0x50], eax
mov rdx, qword [rsi + 0xa8]
test rdx, rdx
jne 0x41cc66
jmp 0x41cc79