Function at 0x10011dec4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x178
xor r14d, r14d
xor ebp, ebp
test rcx, rcx
mov rax, r9
mov r15d, 0xdc
lea r12d, [r14 + 0x14]
mov qword [rsp + 0x50], rbp
je 0x10011e732
test rdx, rdx
je 0x10011e732
test r8, r8
je 0x10011e732
test rax, rax
je 0x10011e732
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbp + 8]
mov rcx, rax
mov r8d, 0x1b4
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r15, rax
jne 0x10011df52
mov ebx, 0x80000002
jmp 0x10011e226
lea rdx, [rax + 0x60]
lea rsi, [0x100153d88]
mov rdi, r15
lea rax, [rdx + 0xa8]
mov ecx, 0x60
mov dword [rsp + 0x70], 0x123174bb
rep movsb byte [rdi], byte [rsi]
mov qword [r15], rdx
mov rsi, qword [0x100153d88]
mov qword [rsp + 0xe8], rax
lea rbp, [rax + 0x70]
mov rdi, rdx
mov edx, 8
lea rax, [rbp + 0x14]
mov ecx, 0xa8
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [r15]
mov qword [rsp + 0x50], rax
add rdi, 0x58
add rax, r12
mov rcx, rdx
mov qword [rsp + 0x120], rax
lea rsi, [rsp + 0xe8]
mov dword [rsp + 0x74], 0x86521ff8
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [r15]
mov rsi, qword [0x100153d88]
mov rdi, qword [rdi + 0x58]
mov rsi, qword [rsi + 0x58]
lea ecx, [rdx + 0x68]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r15]
mov rcx, rdx
mov rdi, qword [rax + 0x58]
xor edx, edx
lea rsi, [rsp + 0x120]
add rdi, 0x38
lea r8d, [rdx + 0x10]
mov dword [rsp + 0x78], 0x98d2438b
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r15]
mov dword [rsp + 0x7c], 0x7966ce12
mov rcx, qword [rax + 0x58]
mov dword [rsp + 0x80], 0xc5d92014
mov dword [rsp + 0xb8], ebx
mov rax, qword [rcx + 0x38]
lea rcx, [rsp + 0xbc]
mov qword [rsp + 0x40], rax
call sub.msvcrt.dll_memset
mov rdx, qword [0x100153d88]
mov rsi, qword [rdx + 0x58]
lea rdi, [rsp + 0xb8]
mov rcx, r12
mov rsi, qword [rsi + 0x38]
xor r8d, r8d
rep movsb byte [rdi], byte [rsi]
lea rsi, [rsp + 0xb8]
movabs rdi, 0xcccccccccccccccd
lea r9d, [r8 + 5]
mov rcx, r8
mov rax, rdi
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x70]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011e074
mov rdi, qword [rsp + 0x40]
lea rsi, [rsp + 0xb8]
mov rcx, r12
rep movsb byte [rdi], byte [rsi]
lea r8d, [r9 + 0x10]
lea rcx, [rsp + 0x10c]
xor edx, edx
mov qword [r15 + 8], rbp
mov dword [rsp + 0xa0], 0x123174bb
mov dword [rsp + 0xa4], 0x86521ff8
mov dword [rsp + 0xa8], 0x98d2438b
mov dword [rsp + 0xac], 0x7966ce12
mov dword [rsp + 0xb0], 0xc5d92014
mov dword [rsp + 0x108], ebx
call sub.msvcrt.dll_memset
mov rsi, qword [0x100153d90]
lea rdi, [rsp + 0x108]
mov rcx, r12
xor r8d, r8d
rep movsb byte [rdi], byte [rsi]
movabs r14, 0xcccccccccccccccd
lea rsi, [rsp + 0x108]
lea r9d, [r8 + 5]
mov rcx, r8
mov rax, r14
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0xa0]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011e130
mov rdi, rbp
mov rbp, qword [rsp + 0x50]
lea rsi, [rsp + 0x108]
mov rcx, r12
lea r8d, [r9 + 0x10]
xor edx, edx
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xd4]
mov dword [rsp + 0x58], 0x123174bb
mov qword [r15 + 0x10], rbp
mov dword [rsp + 0x5c], 0x86521ff8
mov dword [rsp + 0x60], 0x98d2438b
mov dword [rsp + 0x64], 0x7966ce12
mov dword [rsp + 0x68], 0xc5d92014
mov dword [rsp + 0xd0], ebx
call sub.msvcrt.dll_memset
mov rsi, qword [0x100153d98]
xor r8d, r8d
lea rdi, [rsp + 0xd0]
mov rcx, r12
lea r9d, [r8 + 5]
rep movsb byte [rdi], byte [rsi]
xor r14d, r14d
movabs r13, 0xcccccccccccccccd
lea rsi, [rsp + 0xd0]
mov rcx, r8
mov rax, r13
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x58]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011e1e6
mov rdi, rbp
lea rsi, [rsp + 0xd0]
mov rcx, r12
mov rbp, r15
mov qword [rsp + 0x50], r15
rep movsb byte [rdi], byte [rsi]
test ebx, ebx
js 0x10011e4b5
xor edx, edx
lea rcx, [rsp + 0xf4]
mov dword [rsp + 0x88], 0x123174bb
lea r8d, [rdx + 0x10]
mov dword [rsp + 0x8c], 0x86521ff8
mov dword [rsp + 0x90], 0x98d2438b
mov dword [rsp + 0x94], 0x7966ce12
mov dword [rsp + 0x98], 0xc5d92014
mov dword [rsp + 0xf0], 0
call sub.msvcrt.dll_memset
lea rdi, [rsp + 0xf0]
lea rsi, [0x100153310]
mov rcx, r12
movabs r13, 0xcccccccccccccccd
rep movsb byte [rdi], byte [rsi]
xor esi, esi
lea rdi, [rsp + 0xf0]
lea r8d, [rsi + 5]
mov rcx, rsi
mov rax, r13
mul rsi
add rsi, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x88]
xor dword [rdi], eax
add rdi, 4
sub r8, 1
jne 0x10011e2af
mov r13, qword [rsp + 0x1c0]
lea rdi, [rsp + 0x128]
lea rsi, [rsp + 0xf0]
lea rax, [r13 + 0x10]
mov rcx, r12
mov dword [r13], r8d
mov qword [r13 + 8], rax
rep movsb byte [rdi], byte [rsi]
mov dword [r13 + 4], 0x157c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15d, 0xdc
mov edx, 8
mov rcx, rax
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
jne 0x10011e33a
mov ebx, 0x80000002
jmp 0x10011e4bb
lea r15, [rax + 0x64]
mov rax, qword [rsp + 0x1c8]
lea rcx, [rsp + 0x140]
cmp rcx, rax
lea rsi, [r15 + 0x50]
mov qword [rsp + 0x1c0], rsi
je 0x10011e379
lea rdi, [rsp + 0x140]
mov rsi, rax
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1c0]
mov rax, qword [rbp]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov qword [rsp + 0x48], rax
je 0x10011e405
mov r9, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rsp + 0x140]
mov rcx, r12
mov edx, 5
mov qword [rsp + 0x20], r13
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1c0]
mov rcx, rax
mov r8, rsi
call fcn.100125da4
mov rdi, qword [rsp + 0x48]
mov r11d, r12d
mov rax, rdi
mov byte [rax], 0
add rax, 1
add r11d, 0xffffffff
jne 0x10011e3e4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov qword [rsp + 0x40], rax
je 0x10011e492
mov r9, qword [rsp + 0x48]
mov rdi, rax
lea rsi, [rsp + 0x154]
mov rcx, r12
mov edx, 5
mov qword [rsp + 0x20], r13
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1c0]
mov rcx, rax
lea r8, [rsi + 0x14]
call fcn.100125da4
mov rdi, qword [rsp + 0x40]
mov r11d, r12d
mov rax, rdi
mov byte [rax], 0
add rax, 1
add r11d, 0xffffffff
jne 0x10011e471
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], r13
call fcn.100121a34
test eax, eax
jne 0x10011e569
mov ebx, 0x800480d5
mov r15d, 0xdc
test rbp, rbp
mov edi, 0xffffffff
je 0x10011e517
mov rax, qword [rbp]
mov edx, r12d
mov rcx, qword [rax + 0x58]
mov rax, qword [rcx + 0x38]
mov byte [rax], 0
add rax, 1
add edx, edi
jne 0x10011e4d4
mov rax, qword [rbp + 8]
mov ecx, r12d
mov byte [rax], 0
add rax, 1
add ecx, edi
jne 0x10011e4e6
mov rax, qword [rbp + 0x10]
mov ecx, r12d
mov byte [rax], 0
add rax, 1
add ecx, edi
jne 0x10011e4f8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x128]
mov byte [rax], 0
add rax, 1
add r12d, edi
jne 0x10011e51f
test r14, r14
je 0x10011e553
mov rax, r14
mov byte [rax], 0
add rax, 1
add r15d, edi
jne 0x10011e533
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rsp + 0x1d8]
mov rdx, qword [rsp + 0x1d0]
cmp rax, rdx
je 0x10011e593
mov rdi, rax
mov rsi, rdx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1c0]
lea rdx, [r15 + 0x28]
mov r9, r13
mov r8, rbp
mov rcx, rax
call fcn.10011db7c
test eax, eax
je 0x10011e4b0
xor r9d, r9d
lea rcx, [rsp + 0x128]
mov rdx, r14
lea r8d, [r9 + 5]
mov qword [rsp + 0x20], r13
call fcn.1001264ec
mov qword [rsp + 0x38], r13
mov edx, 4
lea rax, [r14 + 0x14]
mov qword [rsp + 0x30], rbp
lea rcx, [0x10015338c]
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 0x38]
mov r9, r14
mov qword [rsp + 0x20], 5
call fcn.100124fdc
test eax, eax
je 0x10011e4b0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], r13
call fcn.100121a34
test eax, eax
je 0x10011e4b0
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov qword [rsp + 0x30], rbp
lea edx, [r8 + 4]
mov r9, r14
mov rcx, rsi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 5
call fcn.100124fdc
test eax, eax
je 0x10011e4b0
mov qword [rsp + 0x30], r13
lea r8, [r14 + 0x3c]
lea rdx, [r15 + 0x28]
mov r9d, 1
mov rcx, r15
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbp
call fcn.100121d28
test eax, eax
je 0x10011e4b0
mov r8, qword [rbp]
lea rcx, [r14 + 0x14]
mov r9, r13
mov r8, qword [r8 + 0x58]
mov rdx, r15
call fcn.100125ef4
mov rdi, qword [rsp + 0x1d8]
mov rsi, r15
mov rcx, r12
mov r9, r13
mov rdx, r15
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp]
lea rcx, [r14 + 0x28]
mov r8, qword [r8 + 0x58]
call fcn.100125ef4
mov rdi, qword [rsp + 0x1d8]
mov rsi, r15
mov rcx, r12
add rdi, r12
mov r9, r13
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp]
lea rcx, [r14 + 0x3c]
mov r8, qword [r8 + 0x58]
mov rdx, r15
call fcn.100125ef4
mov rdi, qword [rsp + 0x1d8]
mov rsi, r15
mov rcx, r12
add rdi, 0x28
mov r9, r13
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp]
lea rcx, [r14 + 0x50]
mov r8, qword [r8 + 0x58]
mov rdx, r15
call fcn.100125ef4
mov rdi, qword [rsp + 0x1d8]
mov rsi, r15
add rdi, 0x3c
mov rcx, r12
rep movsb byte [rdi], byte [rsi]
jmp 0x10011e4b5
mov ebx, 0x80070057
jmp 0x10011e4bb