Function at 0x140002420
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x140072090]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ecx, ecx
call fcn.14002d6e4
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul eax, ebx
mov ecx, eax
call fcn.14002d99c
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x14005f7a8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400024d1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Running
call fcn.140007540
mov rcx, rax
call fcn.140007820
lea rax, [rbp - 1]
jmp 0x140002952
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x14007b270], xmm0
movups xmmword [0x14007b280], xmm0
movups xmmword [0x14007b290], xmm0
movups xmmword [0x14007b2a0], xmm0
movups xmmword [0x14007b2b0], xmm0
movups xmmword [0x14007b2c0], xmm0
mov dword [0x14007b2d0], eax
call fcn.14002d970
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
add r8d, 0xa
mov rbx, rbp
movsxd rdi, r8d
test r8d, r8d
jle 0x140002580
movabs r14, 0x4ec4ec4ec4ec4ec5
lea rsi, [0x140000000]
nop dword [rax]
call fcn.14002d970
movsxd rcx, eax
mov rax, r14
mul rcx
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [rcx + rsi + 0x683c8]
mov byte [rbx + rsi + 0x7b270], al
inc rbx
cmp rbx, rdi
jl 0x140002550
lea rcx, [rsp + 0x60]
call fcn.140002140
nop
cmp qword [rsp + 0x70], 0
jne 0x14000259f
lea rdx, [0x14005f7c0]
jmp 0x1400028fd
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.14002dda4
lea r10, [0x14007b2e0]
cmp byte [0x1400839e7], 0
je 0x140002764
cmp dword [0x140072098], 2
jl 0x14000272c
movdqa xmm5, xmmword [0x140069630]
mov edx, ebp
movdqa xmm4, xmmword [0x140069680]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [0x140069650]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rsp + 0x40], xmm0
mov rcx, r10
mov r8d, dword [rsp + 0x40]
nop dword [rax]
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140069660]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rdx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140069660]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
pxor xmm2, xmm0
movd dword [rcx + 4], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x8708
jl 0x140002620
jmp 0x140002764
mov r9, r10
mov ecx, ebp
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul r8d, eax, 0x39
movzx eax, cl
sub al, r8b
add al, 0x30
xor byte [r9], al
inc ecx
lea r9, [r9 + 1]
cmp ecx, 0x8708
jl 0x140002731
mov rdx, r10
lea rcx, [rsp + 0x60]
call fcn.14000c050
test al, al
jne 0x140002781
lea rdx, str.Failed_To_CreateFileFromMemory__Log_it_to_SandFoxy_
jmp 0x1400028fd
lea rcx, [rsp + 0x60]
call fcn.14000b990
test al, al
jne 0x1400027be
lea rdx, str.Failed_To_RegisterAndStart__Log_it_to_SandFoxy_
call fcn.140007540
mov rcx, rax
call fcn.140007820
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.14002dda4
jmp 0x14000290a
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [0x14005f7a8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400028ee
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rbp
mov r8d, 0xc
lea rdx, [0x14005f868]
lea rcx, [rsp + 0x40]
call fcn.140008f30
nop
lea rcx, [rsp + 0x40]
call fcn.14000c290
mov qword [0x14007b2d8], rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140002877
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000286b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002995
call fcn.140023b00
mov rax, qword [0x14007b2d8]
test rax, rax
jne 0x14000289a
lea rdx, str.Failed_To_Find_Kernel_Module__Log_it_to_SandFoxy_
call fcn.140007540
mov rcx, rax
call fcn.140007820
mov rcx, rbx
call fcn.140002fa0
jmp 0x14000290a
mov rcx, rbx
call fcn.140004160
test al, al
jne 0x1400028af
lea rdx, str.Failed_To_ClearPiDDBCacheTable__Log_it_to_SandFoxy_
jmp 0x140002883
mov rcx, rbx
call fcn.140004a10
test al, al
jne 0x1400028c4
lea rdx, str.Failed_To_ClearKernelHashBucketList__Log_it_to_SandFoxy_
jmp 0x140002883
mov rcx, rbx
call fcn.140003c00
test al, al
jne 0x1400028d9
lea rdx, str.Failed_To_ClearMmUnloadedDrivers__Log_it_to_SandFoxy_
jmp 0x140002883
mov rcx, rbx
call fcn.1400029a0
test al, al
jne 0x140002911
lea rdx, str.Failed_To_ClearWdFilterDriverList__Log_it_to_SandFoxy_
jmp 0x140002883
mov rcx, rbx
call fcn.140002fa0
lea rdx, str.Idk_how_i_can_call_it_but_just_log_it_to_SandFoxy_
call fcn.140007540
mov rcx, rax
call fcn.140007820
mov rbx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000294f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000294a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000298f
call fcn.140023b00
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140023ae0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r14
ret
call fcn.14002f57c
nop
call fcn.14002f57c
nop
int3