Function at 0x180005b10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xe8
mov rax, qword [0x1800791a8]
xor rax, rsp
mov qword [rbp - 9], rax
mov rsi, qword [rbp + 0x7f]
xor ebx, ebx
mov r11, qword [rbp + 0x6f]
mov rdi, qword [rbp + 0x77]
mov r10, qword [rbp - 0x79]
mov r15, qword [rbp - 0x79]
mov r12, qword [rbp - 0x79]
mov qword [rbp - 0x31], rdx
mov rdx, rcx
mov qword [rbp - 0x59], rcx
mov ecx, dword [rbp + 0x8f]
mov r13d, ecx
imul eax, ecx, 0x666
mov qword [rbp - 0x21], r9
mov qword [rbp - 0x29], r8
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x51], r11
mov dword [rsp + 0x60], eax
mov r8d, dword [rsp + 0x60]
mov r9d, dword [rsp + 0x60]
mov r14d, dword [rsp + 0x60]
mov dword [rsp + 0x5c], r8d
mov dword [rsp + 0x58], r9d
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x69], r10
cmp ecx, eax
ja 0x1800060d6
mov rcx, qword [rbp - 0x79]
mov eax, dword [rsp + 0x60]
mov qword [rbp - 0x71], rcx
mov dword [rsp + 0x50], eax
nop dword [rax + rax]
cmp r13d, 0x807a
ja 0x180005e07
je 0x180005d9d
cmp r13d, 0x3594
ja 0x180005d0d
je 0x180005ccb
mov eax, r13d
sub eax, 0x6c
je 0x180005cb2
sub eax, 0x16
je 0x180005c4f
cmp eax, 0xa5
jne 0x180006095
mov r8d, 1
lea rdx, [0x18006f092]
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 2
mov byte [rbp - 0x10], bl
lea rdx, [0x18006f169]
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 3
lea rdx, [0x18006f20f]
lea rcx, [rbp - 0xe]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18000607b
test rdi, rdi
jne 0x180005c79
lea rax, str.BaseTableOffset
mov dword [rbp - 0x61], ebx
lea r9, [rbp - 0x61]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r8d, [rdi + 0x33]
lea rcx, [0x18006d014]
call fcn.18002d470
mov rax, qword [rbp - 0x29]
test rax, rax
jne 0x180005cab
xor edx, edx
mov dword [rbp - 0x61], ebx
lea rax, str.XapFilename
lea r9, [rbp - 0x61]
mov qword [rsp + 0x20], rax
lea rcx, [0x18006d014]
lea r8d, [rdx + 0x33]
call fcn.18002d470
mov rax, qword [rbp - 0x29]
mov dword [rax], ebx
jmp 0x18000607b
mov edx, 0x60038
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rbp - 0x79], rax
jmp 0x18000607b
mov rsi, qword [rbp - 0x79]
test rsi, rsi
je 0x1800060ba
mov dword [rsp + 0x40], 0x78
mov r9, rsi
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.18000efd0
mov rsi, qword [rbp - 0x41]
jmp 0x18000607b
cmp r13d, 0x407e
je 0x180005d3b
cmp r13d, 0x6abc
jne 0x180006095
mov rsi, qword [rbp - 0x79]
mov qword [rbp - 0x49], rsi
mov qword [rsi + 0x60018], rdi
mov rsi, qword [rbp - 0x41]
jmp 0x180006095
mov eax, dword [r11]
lea rdx, [rbp - 0x61]
mov r8d, 0x6b
mov dword [rbp - 0x61], eax
xor ecx, ecx
call fcn.180056ff0
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x1800060c2
mov r11, qword [rbp - 0x51]
lea rax, [0x180000000]
mov r8d, ebx
movsxd rcx, dword [r11]
shl rcx, 7
mov r9d, dword [rcx + rax + 0x7a8ec]
mov rax, qword [rbp - 0x31]
mov dword [rsp + 0x58], r9d
mov ecx, dword [rax]
test cl, 7
setne r8b
shr ecx, 3
add r8d, ecx
mov dword [rsp + 0x5c], r8d
jmp 0x180006089
mov eax, dword [rdx]
cmp eax, r8d
ja 0x1800060ca
add eax, 2
add eax, r9d
cmp r8d, eax
jb 0x1800060ca
mov rax, qword [rbp + 0x87]
cmp dword [rax], r8d
jne 0x1800060ca
mov ecx, r8d
mov edi, r8d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, edi
mov r15, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, edi
mov r12, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
mov qword [rbp - 0x71], rax
mov rdi, qword [rbp - 0x39]
mov r8d, dword [rsp + 0x5c]
mov r9d, dword [rsp + 0x58]
mov r11, qword [rbp - 0x51]
jmp 0x18000608d
cmp r13d, 0x10072
ja 0x180005fea
je 0x180005f3a
cmp r13d, 0x9259
je 0x180005e64
cmp r13d, 0x9fe4
je case.0x180006113.118
cmp r13d, 0xc076
jne 0x180006095
mov ecx, r8d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rbp - 0x71]
mov r10, rax
mov r8d, dword [rsp + 0x5c]
mov r9d, dword [rsp + 0x58]
mov r11, qword [rbp - 0x51]
mov qword [rbp - 0x69], rax
jmp 0x180006091
mov byte [rbp - 0xb], bl
lea rax, [rbp - 0x11]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], bl
jne 0x180005e72
mov rcx, qword [rdi + 0x18]
mov rdx, qword [rdi + 0x10]
mov rax, rcx
sub rax, rdx
cmp rsi, rax
ja 0x180005ebd
lea rax, [rdx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rcx, 0x10
jb 0x180005ea1
mov rax, qword [rdi]
lea rdi, [rax + rdx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rbp - 0x11]
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], bl
mov rdi, qword [rbp - 0x39]
jmp 0x180005ed4
lea r9, [rbp - 0x11]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180003980
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x180005f12
lea rax, [rcx + 2]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180005efc
mov rax, qword [rdi]
mov rsi, qword [rbp - 0x41]
mov edx, 0x3436
mov word [rax + rcx], dx
mov byte [rax + rcx + 2], bl
jmp 0x18000607b
xor r8d, r8d
mov qword [rsp + 0x20], 2
lea r9, [0x18006f084]
mov rcx, rdi
lea edx, [r8 + 2]
call fcn.180003980
mov rsi, qword [rbp - 0x41]
jmp 0x18000607b
test r15, r15
je 0x180005f52
test r12, r12
je 0x180005f52
test rcx, rcx
je 0x180005f52
test r10, r10
jne 0x180006095
mov edi, 0xa8
cmp edi, 0xa8
je 0x180005fb3
cmp edi, 0x6cf0
je 0x180005fac
cmp edi, 0xd938
jne 0x180005fcf
mov r10, qword [rbp - 0x69]
test r10, r10
je 0x180005f81
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rbp - 0x49], 0xd
mov rax, qword [rbp - 0x49]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.180068d70
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test rcx, rcx
je 0x180005fcf
jmp 0x180005fc9
test r15, r15
je 0x180005fc1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r12, r12
je 0x180005fcf
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x71]
add edi, 0x6c48
cmp edi, 0x144d8
jbe 0x180005f57
jmp 0x180005df0
cmp r13d, 0x1406e
je 0x180006053
cmp r13d, 0x1806a
jne 0x180006095
mov edx, r14d
mov rcx, r10
add rdx, rsi
mov r8d, r9d
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp - 0x31]
mov edx, 0xff
mov r8d, dword [rsp + 0x5c]
mov r9d, dword [rsp + 0x58]
add r14d, r9d
lea eax, [r8*8]
sub eax, dword [rcx]
lea ecx, [rax + 1]
sar edx, cl
not edx
test byte [rsi], dl
je 0x180006085
mov r13, qword [rbp - 0x71]
mov edx, 7
mov dword [rsp + 0x50], edx
mov esi, 0x7b
jmp 0x1800062d6
mov rax, qword [rbp + 0x87]
mov eax, dword [rax]
dec eax
cmp byte [rax + rsi], 0xbc
jne 0x18000603c
mov r14d, r8d
mov rdx, rsi
sub r14d, r9d
mov rcx, r15
dec r14d
mov r8d, r14d
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x5c]
mov r9d, dword [rsp + 0x58]
mov r11, qword [rbp - 0x51]
mov rcx, qword [rbp - 0x71]
mov r10, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x59]
imul eax, dword [rbp + 0x8f], 0x7e
add r13d, eax
cmp r13d, dword [rsp + 0x60]
jbe 0x180005bc0
mov edx, dword [rsp + 0x50]
mov r13, qword [rbp - 0x71]
mov ecx, dword [rbp + 0x8f]
jmp 0x1800060e2
mov rax, rbx
jmp 0x180005f8c
mov dword [rbp - 0x49], eax
jmp case.0x180006113.118
mov dword [rbp - 0x49], 0x16
jmp case.0x180006113.118
mov edx, dword [rsp + 0x60]
mov r13, qword [rbp - 0x79]
mov dword [rsp + 0x50], edx
mov esi, ecx
lea eax, [rcx - 0xd]
cmp esi, eax
jbe case.0x180006113.118
lea eax, [rsi - 0x76]
cmp eax, 0xc
ja case.default.0x180006113
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x6468]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov eax, dword [r11]
lea rdx, [rbp - 0x61]
mov edi, r8d
mov dword [rsp + 0x50], eax
sub edi, r9d
mov dword [rsp + 0x60], r9d
lea rax, [rsp + 0x60]
dec edi
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
mov r9, r10
mov dword [rbp - 0x61], edi
mov r8, r12
mov dword [rsp + 0x20], 0x42
call fcn.18004aff0
mov dword [rsp + 0x50], eax
mov edx, eax
test eax, eax
jne case.0x180006113.123
mov edx, ebx
test edi, edi
je 0x18000645e
cmp edi, 0x40
jb 0x180006205
lea eax, [rdi - 1]
lea r8, [rax + r15]
add rax, r12
cmp r15, rax
ja 0x180006187
cmp r8, r12
jae 0x180006205
mov r9d, edi
and r9d, 0xffffffc0
mov r8d, 0x20
mov eax, edx
add edx, 0x40
movdqu xmm0, xmmword [rax + r15]
movdqu xmm1, xmmword [rax + r12]
pxor xmm1, xmm0
movdqu xmmword [rax + r15], xmm1
lea eax, [r8 - 0x10]
movdqu xmm0, xmmword [rax + r15]
movdqu xmm1, xmmword [rax + r12]
pxor xmm1, xmm0
movdqu xmmword [rax + r15], xmm1
mov eax, r8d
movdqu xmm0, xmmword [rax + r15]
movdqu xmm1, xmmword [rax + r12]
pxor xmm1, xmm0
movdqu xmmword [rax + r15], xmm1
lea eax, [r8 + 0x10]
add r8d, 0x40
movdqu xmm0, xmmword [rax + r15]
movdqu xmm1, xmmword [rax + r12]
pxor xmm1, xmm0
movdqu xmmword [rax + r15], xmm1
cmp edx, r9d
jb 0x180006194
cmp edx, edi
jae 0x1800062d2
mov eax, edx
mov r8, r12
add rax, r15
sub r8, r15
sub edi, edx
mov edx, edi
nop dword [rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180006220
jmp 0x1800062d2
movsxd rax, dword [r11]
mov rcx, qword [rbp - 0x59]
shl rax, 7
mov edx, r14d
add rdx, r15
mov r8d, dword [rcx]
lea r9, [0x180000000]
lea rcx, [rbp - 0x19]
call qword [rax + r9 + 0x7a940]
mov dword [rsp + 0x50], eax
mov edx, eax
test eax, eax
jne case.0x180006113.123
jmp 0x1800062d6
movsxd rax, dword [r11]
lea rcx, [rbp - 0x19]
shl rax, 7
lea r9, [0x180000000]
mov r8d, 8
mov rdx, r12
call qword [rax + r9 + 0x7a940]
mov dword [rsp + 0x50], eax
mov edx, eax
test eax, eax
jne case.0x180006113.123
mov rax, qword [rbp - 0x51]
mov rdx, rdi
mov rcx, qword [rbp - 0x21]
movsxd rax, dword [rax]
shl rax, 7
jmp 0x180006247
mov dword [rbp - 0x49], edx
jmp 0x1800062d6
mov eax, r8d
mov r9d, 0x99
mov qword [rbp - 0x79], rax
mov r8, r10
lea rdx, [rbp - 0x79]
xor ecx, ecx
call fcn.180015650
mov edx, dword [rsp + 0x50]
mov ecx, dword [rbp + 0x8f]
mov rdi, qword [rbp - 0x39]
dec esi
mov r8d, dword [rsp + 0x5c]
mov r10, qword [rbp - 0x69]
mov r9d, dword [rsp + 0x58]
mov r11, qword [rbp - 0x51]
jmp 0x1800060e4
mov edx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x1800062d6
mov rax, qword [rbp - 0x31]
lea ecx, [r8*8]
mov r14d, ebx
sub ecx, dword [rax]
mov eax, 0xff
inc ecx
sar eax, cl
mov ecx, r8d
and byte [r15], al
mov rax, qword [rbp - 0x59]
sub ecx, dword [rax]
sub ecx, r9d
sub ecx, 2
je 0x180006341
mov rax, r15
cmp byte [rax], bl
jne 0x18000634e
inc r14d
inc rax
cmp r14d, ecx
jb 0x180006332
mov eax, r14d
inc r14d
cmp byte [rax + r15], 1
je 0x18000635f
mov edx, 7
mov dword [rsp + 0x50], edx
lea esi, [rdx + 0x74]
jmp 0x1800062d6
movsxd rax, dword [r11]
lea rcx, [rbp - 0x19]
shl rax, 7
lea rdx, [0x180000000]
call qword [rax + rdx + 0x7a938]
jmp 0x18000625d
mov qword [rbp - 0x79], 8
mov r9d, 0x99
mov r8, r12
jmp 0x1800062c7
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800062d2
mov edi, r8d
lea rdx, [rbp - 0x79]
mov r8, r15
mov qword [rbp - 0x79], rdi
mov r9d, 0x99
xor ecx, ecx
call fcn.180015650
mov r9d, 0x99
mov qword [rbp - 0x79], rdi
mov r8, r12
lea rdx, [rbp - 0x79]
xor ecx, ecx
call fcn.180015650
mov r9d, 0x99
mov qword [rbp - 0x79], rdi
mov r8, r13
jmp 0x1800062c7
movsxd rax, dword [r11]
lea rcx, [rbp - 0x19]
shl rax, 7
lea r8, [0x180000000]
mov rdx, r12
call qword [rax + r8 + 0x7a948]
mov dword [rsp + 0x50], eax
mov edx, eax
test eax, eax
jne case.0x180006113.123
mov r8d, dword [rsp + 0x58]
mov rcx, r12
mov rdx, qword [rbp - 0x69]
call sub.VCRUNTIME140.dll_memcmp
mov edx, dword [rsp + 0x50]
mov ecx, dword [rbp + 0x8f]
test eax, eax
jne case.default.0x180006113
mov rax, qword [rbp - 0x29]
mov dword [rax], 1
jmp case.default.0x180006113
mov edx, eax
jmp 0x1800062d6