Function at 0x14008d2e0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xd540
call fcn.140127d30
sub rsp, rax
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov qword [rsp + 0xd570], rbx
mov qword [rsp + 0xd580], rbp
mov qword [rsp + 0xd588], rsi
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0xd530], rax
mov qword [rsp + 0x50], rdx
lea rcx, [rsp + 0x50]
call fcn.14005b560
mov rbx, qword [rsp + 0x50]
cmp word [rbx], 0
jne 0x14008d34e
xor eax, eax
jmp 0x14008ddcd
lea rdx, [0x14014f7a8]
lea rcx, [rsp + 0x58]
call fcn.140071240
nop
lea rdx, [0x14014f7a8]
lea rcx, [rsp + 0x60]
call fcn.140071240
nop
xor r14b, r14b
mov r13b, 8
movzx r10d, word [rbx]
test r10w, r10w
je 0x14008d54d
mov edi, 9
lea esi, [rdi + 0x24]
lea r11d, [rdi + 0x17]
nop word [rax + rax]
mov r8d, 2
mov rdx, rbx
lea rcx, [0x14014b1cc]
call fcn.14005c510
test al, al
je 0x14008d3e8
lea rcx, [rbx + 4]
movzx eax, word [rcx]
cmp di, ax
ja 0x14008d3cb
cmp ax, 0xd
jbe 0x14008d3d1
cmp r11w, ax
jne 0x14008d3e8
mov r14b, 1
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
call fcn.14005b560
jmp 0x14008d521
mov r8d, 2
mov rdx, rbx
lea rcx, [0x14014b074]
call fcn.14005c510
test al, al
je 0x14008d430
lea rcx, [rbx + 4]
movzx eax, word [rcx]
cmp di, ax
ja 0x14008d413
cmp ax, 0xd
jbe 0x14008d419
cmp r11w, ax
jne 0x14008d430
mov r13b, 2
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
call fcn.14005b560
jmp 0x14008d521
mov r8d, 2
mov rdx, rbx
lea rcx, [0x14015165c]
call fcn.14005c510
test al, al
je 0x14008d478
lea rcx, [rbx + 4]
movzx eax, word [rcx]
cmp di, ax
ja 0x14008d45b
cmp ax, 0xd
jbe 0x14008d461
cmp r11w, ax
jne 0x14008d478
mov r13b, 1
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
call fcn.14005b560
jmp 0x14008d521
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140151658]
call fcn.14005c510
test al, al
je 0x14008d4bd
lea rcx, [rbx + 4]
movzx eax, word [rcx]
cmp di, ax
ja 0x14008d4a3
cmp ax, 0xd
jbe 0x14008d4a9
cmp r11w, ax
jne 0x14008d4bd
mov r13b, 0x10
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
call fcn.14005b560
jmp 0x14008d521
mov r8d, 2
mov rdx, rbx
lea rcx, [0x140146978]
call fcn.14005c510
test al, al
je 0x14008d4eb
movzx eax, word [rbx + 4]
cmp di, ax
ja 0x14008d4e5
cmp ax, 0xd
jbe 0x14008d535
cmp r11w, ax
je 0x14008d535
cmp si, r10w
jne 0x14008d54d
cmp di, r10w
ja 0x14008d4fe
cmp r10w, 0xd
jbe 0x14008d512
cmp r11w, r10w
je 0x14008d512
add rbx, 2
mov r10w, word [rbx]
test r10w, r10w
jne 0x14008d4f1
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x50]
call fcn.14005b560
mov rbx, qword [rsp + 0x50]
mov r10w, word [rbx]
test r10w, r10w
je 0x14008d54d
jmp 0x14008d3a0
add rbx, 4
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x50]
call fcn.14005b560
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0xa0], rbx
mov r8d, 0x2c
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140066780
mov rcx, qword [rsp + 0x58]
call fcn.14002e004
mov rbp, rax
xor r15d, r15d
mov rcx, qword [rsp + 0x50]
cmp word [rcx], 0x2c
jne 0x14008d5bd
add rcx, 2
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
call fcn.14005b560
lea r8d, [r15 + 0x2c]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140066780
mov rcx, qword [rsp + 0x60]
call fcn.14002e004
mov r12, rax
jmp 0x14008d63f
mov dword [rsp + 0x68], r15d
mov r8d, 1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.140036bcc
mov rbx, rax
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x58]
call fcn.140063740
mov rbp, qword [rsp + 0x58]
mov qword [rsp + 0xa0], rbx
lea rcx, [rsp + 0xa0]
call fcn.14005b560
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.140036bcc
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.140063740
mov r12, qword [rsp + 0x60]
cmp word [r12], r15w
je 0x14008ddb3
cmp word [rbp], r15w
je 0x14008ddb3
mov esi, r15d
cmp r13b, 2
je 0x14008d6b4
nop
xor ecx, ecx
call fcn.140111624
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add edi, eax
call fcn.14005d820
mov ecx, dword [0x14019cf88]
mov esi, ecx
shl esi, 4
add edi, eax
add esi, edi
mov dword [rsp + 0x48], esi
xor ecx, esi
mov dword [0x14019cf88], ecx
mov eax, esi
and eax, 3
cmp al, 3
jne 0x14008d660
cmp byte [rsp + 0x49], r15b
je 0x14008d660
cmp byte [rsp + 0x4a], r15b
je 0x14008d660
movzx eax, byte [rsp + 0x4b]
and al, 0x88
cmp al, 0x80
jne 0x14008d660
cmp r13b, 0x10
je 0x14008da83
lea rbx, vtable.pecmd::XFILE.0
mov qword [rsp + 0xa8], rbx
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.1400673e0
mov dword [rsp + 0xd0], r15d
mov qword [rsp + 0x70], rbx
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400673e0
mov dword [rsp + 0x98], r15d
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14008d716
cmp rcx, 0xffffffffffffffff
je 0x14008d716
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edi, 7
mov r8d, edi
lea edx, [rdi - 6]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
cmove rax, r15
mov qword [rsp + 0xb0], rax
test rax, rax
jne 0x14008d7a2
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x78]
call fcn.140067440
nop
mov qword [rsp + 0xa8], rbx
lea rcx, [rsp + 0xb0]
call fcn.140067440
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
lea eax, [rdi - 6]
jmp 0x14008ddcd
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14008d7b8
cmp rcx, 0xffffffffffffffff
je 0x14008d7b8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, edi
mov edx, 0x40000001
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
cmove rax, r15
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x14008d83d
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x78]
call fcn.140067440
nop
mov qword [rsp + 0xa8], rbx
lea rcx, [rsp + 0xb0]
call fcn.140067440
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
mov eax, 1
jmp 0x14008ddcd
mov byte [rsp + 0x90], 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xe0]
call fcn.14005bc30
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xd518], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0xd520], rax
lea rbx, [0x14014d8e0]
nop dword [rax]
movzx eax, byte [rbx]
mov byte [rsp + 0x40], al
inc dword [rsp + 0x9c]
mov r8d, 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.14005e760
inc rbx
sub rdi, 1
jne 0x14008d880
mov al, 0x53
movzx eax, al
mov ecx, 0x41
cmp r13b, 8
cmove eax, ecx
mov byte [rsp + 0x40], al
inc dword [rsp + 0x9c]
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.14005e760
lea ebx, [rdi + 8]
mov eax, esi
and eax, 0xfffffff
mov dword [rsp + 0x98], eax
test esi, esi
je 0x14008d8f6
xor esi, 0x5aa59669
mov dword [rsp + 0x48], esi
cmp r13b, bl
jne 0x14008d907
xor si, bx
mov word [rsp + 0x48], si
lea rsi, [rsp + 0x48]
mov edi, 4
mov rbp, rdi
nop word [rax + rax]
movzx eax, byte [rsi]
mov byte [rsp + 0x40], al
inc ebx
mov dword [rsp + 0x9c], ebx
mov r8d, 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.14005e760
inc rsi
sub rbp, 1
je 0x14008d957
mov ebx, dword [rsp + 0x9c]
jmp 0x14008d920
mov dword [rsp + 0x9c], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov byte [rsp + 0x10da], r15b
mov byte [rsp + 0x10db], r15b
mov byte [rsp + 0x10dc], r15b
mov byte [rsp + 0x10dd], r15b
movzx esi, r15w
nop word [rax + rax]
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x48], r15d
lea r9, [rsp + 0x48]
mov r8d, 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xb0]
call fcn.14005e7c0
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x14008d9ee
cmp dword [rsp + 0x48], 1
jb 0x14008d9ee
movzx ecx, byte [rsp + 0x40]
cmp ecx, 0xffffffff
je 0x14008d9ee
movsx rax, si
mov byte [rsp + rax + 0x10da], cl
inc si
inc byte [rsp + 0x10fd]
cmp si, di
jl 0x14008d990
lea rbx, [rsp + 0x10da]
test r14b, r14b
je 0x14008da04
movzx eax, byte [rbx]
mov byte [rsp + 0x40], al
jmp 0x14008da09
mov byte [rsp + 0x40], 0
inc dword [rsp + 0x9c]
mov r8d, 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.14005e760
inc rbx
sub rdi, 1
jne 0x14008d9f6
mov dword [rsp + 0x9c], 0x10
lea rcx, [rsp + 0xe0]
call fcn.14005c010
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop
lea rbx, vtable.pecmd::XFILE.0
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x78]
call fcn.140067440
nop
mov qword [rsp + 0xa8], rbx
lea rcx, [rsp + 0xb0]
call fcn.140067440
jmp 0x14008dd9a
mov dword [rsp + 0x50], r15d
lea rsi, vtable.pecmd::XFILEU.0
mov qword [rsp + 0x70], rsi
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400673e0
mov dword [rsp + 0x98], r15d
mov qword [rsp + 0xa8], rsi
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.1400673e0
mov dword [rsp + 0xd0], r15d
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14008dadd
cmp rcx, 0xffffffffffffffff
je 0x14008dadd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edi, 7
mov r8d, edi
lea edx, [rdi - 6]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
cmove rax, r15
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x14008db63
mov qword [rsp + 0xa8], rsi
lea rcx, [rsp + 0xb0]
call fcn.140067440
nop
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x78]
call fcn.140067440
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
lea eax, [rdi - 6]
jmp 0x14008ddcd
mov ebx, 8
nop dword [rax + rax]
inc dword [rsp + 0x9c]
lea r9, [rsp + 0x48]
mov r8d, 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.14005e7c0
sub rbx, 1
jne 0x14008db70
mov rbx, r15
nop word [rax + rax]
inc dword [rsp + 0x9c]
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x48], r15d
lea r9, [rsp + 0x48]
mov r8d, 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.14005e7c0
test eax, eax
je 0x14008dbdd
cmp dword [rsp + 0x48], 1
jb 0x14008dbdd
movzx eax, byte [rsp + 0x40]
jmp 0x14008dbe0
or eax, 0xffffffff
mov byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jl 0x14008dba0
cmp dword [rsp + 0x50], 0
je 0x14008dc39
mov qword [rsp + 0xa8], rsi
lea rcx, [rsp + 0xb0]
call fcn.140067440
nop
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x78]
call fcn.140067440
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
mov eax, 1
jmp 0x14008ddcd
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14008dc52
cmp rcx, 0xffffffffffffffff
je 0x14008dc52
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, edi
mov edx, 0x40000001
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
cmove rax, r15
mov qword [rsp + 0xb0], rax
test rax, rax
jne 0x14008dcdd
mov qword [rsp + 0xa8], rsi
lea rcx, [rsp + 0xb0]
call fcn.140067440
nop
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x78]
call fcn.140067440
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
mov eax, 1
jmp 0x14008ddcd
mov byte [rsp + 0xc8], 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xe0]
call fcn.14005bc30
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0xd518], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xd520], rax
mov eax, dword [rsp + 0x98]
test eax, eax
je 0x14008dd2c
xor eax, 0x5aa59669
mov dword [rsp + 0x98], eax
mov edi, 4
inc dword [rsp + 0x9c]
lea r9, [rsp + 0x50]
mov r8d, 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.14005e7c0
sub rdi, 1
jne 0x14008dd31
lea rcx, [rsp + 0xe0]
call fcn.14005c310
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop
mov qword [rsp + 0xa8], rsi
lea rcx, [rsp + 0xb0]
call fcn.140067440
nop
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x78]
call fcn.140067440
nop
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
xor eax, eax
jmp 0x14008ddcd
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x58]
call fcn.14005b520
mov eax, 1
mov rcx, qword [rsp + 0xd530]
xor rcx, rsp
call fcn.14010bcc0
lea r11, [rsp + 0xd540]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret