Function at 0x1400301b0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov byte [rsp + 8], cl
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
movzx ecx, byte [0x140042b88]
xor edi, edi
movzx eax, byte [0x140042b54]
mov r9d, 0xe1
and al, r9b
mov byte [0x140042b65], cl
or byte [0x140042a87], al
mov eax, edi
cmp dword [0x140042b44], eax
mov dword [rsp + 0x24], r9d
setne al
cmp byte [0x140042b56], dil
mov dword [0x140042b60], eax
setne al
and byte [0x140042a86], al
cmp byte [0x140042b83], dil
setne al
add byte [0x140042b66], al
movzx eax, byte [0x140042a63]
xor al, 0x48
or cl, al
mov eax, dword [0x140042b3c]
add eax, 0x35f
mov byte [0x140042b88], cl
xor dword [0x140042b5c], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
movzx r12d, byte [0x140042a87]
mov r15d, edi
mov edx, dword [0x140042b38]
mov ecx, 0x82
movzx r13d, byte [0x140042b82]
inc edx
cmp dword [0x140042b40], edi
mov eax, r13d
movzx r11d, byte [0x140042b54]
mov r14d, 0x3ea
movzx r9d, byte [0x140042a86]
setne byte [0x140042b88]
imul ebx, dword [0x140042b44], 0x17
movzx edi, byte [0x140042b83]
mov r10d, dword [0x140042b48]
mov esi, dword [0x140042b6c]
mov r8d, dword [0x140042b28]
mov ebp, dword [0x140042b2c]
shr ebx, 2
cmp r12d, 0x21c
mov byte [0x140042b65], r12b
seta r15b
or eax, 0x15e
mov dword [0x140042b78], eax
nop
cmp r15d, 0x455
je 0x140030381
mov eax, edx
sub eax, ebx
xor ebx, ebx
add eax, ecx
mov ecx, ebx
mov ebx, dword [0x140042b44]
cmp eax, 0x15e
movsx eax, byte [0x140042b55]
sete cl
xor esi, 1
xor ecx, eax
xor dil, 1
movzx eax, r12b
mov dword [0x140042b4c], ecx
or al, byte [0x140042b56]
or r11b, al
movsx eax, byte [0x140042a63]
xor ebp, eax
test dword [0x140042b30], 0x38e
je 0x14003035b
test ebx, ebx
je 0x14003035b
mov ecx, dword [0x140042a88]
mov eax, 0x21c
shr eax, cl
test eax, eax
je 0x14003035b
mov eax, 1
xor ecx, ecx
jmp 0x14003035f
xor ecx, ecx
mov eax, ecx
add r9b, al
mov eax, ecx
cmp r8d, 0x38e
sete al
xor r8d, eax
mov eax, ecx
test r13b, r13b
mov ecx, 0x82
setne al
xor r10d, eax
inc edx
mov dword [0x140042b68], 1
sub r14, 1
jne 0x1400302e0
mov ecx, dword [0x140042b84]
mov dword [0x140042b38], edx
lea edx, [r14 + 0x4f]
mov dword [0x140042b28], r8d
mov r8d, dword [0x140042a64]
mov byte [0x140042b83], dil
xor edi, edi
mov byte [0x140042a86], r9b
mov dword [0x140042b48], r10d
mov byte [0x140042b54], r11b
mov dword [0x140042b6c], esi
mov dword [0x140042b2c], ebp
nop
test r8d, r8d
mov eax, edi
setne al
and ecx, eax
sub rdx, 1
jne 0x1400303e0
mov eax, edi
mov dword [0x140042b84], ecx
cmp dword [0x140042b7c], eax
setne al
mov dword [0x140042a88], eax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [0x140042b60]
mov eax, 0x39
and ecx, 1
add eax, 0xffffffff
jne 0x140030418
test byte [0x140042a64], 0xf
mov r8d, dword [0x140042b3c]
setne byte [0x140042a87]
mov dword [0x140042b60], ecx
cmp ebx, dword [0x140042b68]
jne 0x14003049f
cmp dword [0x140042b44], 0x348
mov eax, edi
mov edx, dword [0x140042b7c]
sete al
mov dword [0x140042b4c], eax
mov eax, r8d
sub eax, ebx
add eax, 0x82
jne 0x140030476
lea eax, [rdx + 0xd1]
test eax, eax
mov eax, edi
je 0x14003047b
mov eax, 1
add dword [0x140042a8c], eax
cmp ecx, 0x5b3
je 0x140030498
mov ecx, edx
mov byte [0x140042b80], dil
shl ebx, cl
test ebx, ebx
je 0x14003049f
mov byte [0x140042b80], 1
imul ecx, r8d, 0xd1
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, 0xcccccccd
mov dword [rsp + 0xa8], ecx
imul ecx, dword [0x140042b38], 0x15e
mul ecx
mov ebx, edx
shr ebx, 2
call qword [sym.imp.KERNEL32.dll_IsThreadAFiber]
movzx eax, byte [0x140042b38]
mov r9d, 0x9c
movzx ecx, byte [0x140042b65]
add al, 2
movzx esi, byte [0x140042a62]
add ecx, 2
movsx r11d, byte [0x140042b64]
sub sil, 0x71
movsx r14d, byte [0x140042b56]
mov r15d, dword [0x140042b5c]
mov r13d, dword [0x140042b2c]
mov r8d, dword [0x140042a88]
mov r10d, dword [0x140042b34]
movzx ebp, al
mov dword [rsp + 0x98], ecx
mov ecx, ebp
shl r11d, cl
mov byte [rsp + 0x90], sil
xor ecx, ecx
mov byte [0x140042b54], sil
movzx esi, byte [0x140042a63]
mov dword [rsp + 0x20], ebp
mov ebp, dword [0x140042b58]
mov byte [rsp + 0xa0], al
dec r9d
mov eax, ecx
test r15d, r15d
setne al
or r8d, r11d
or r13d, eax
mov eax, 0xcccccccd
mul ebx
mov eax, ecx
mov edi, edx
shr edi, 2
add dil, bpl
cmp dil, sil
mov dword [rsp + 0x38], edi
setl al
cmp eax, 0x455
je 0x14003059b
lea eax, [r10 + 0x6c]
mov dword [rsp + 0x24], eax
movsx ecx, dil
mov eax, 0x66666667
imul ecx, r14d
imul ecx
xor ecx, ecx
mov ebx, edx
mov r10d, ecx
sar ebx, 1
mov eax, ebx
shr eax, 0x1f
add ebx, eax
test r9d, r9d
jne 0x140030560
mov ecx, dword [rsp + 0x20]
xor r11d, r11d
movsx edx, byte [0x140042b67]
mov eax, 0x15e
movzx esi, byte [rsp + 0x90]
mov r15d, dword [0x140042b38]
sub sil, 0x5e
shl eax, cl
or eax, 0x17
movsx r9d, dil
movzx edi, byte [0x140042b81]
movzx ecx, al
mov eax, edx
mov dword [0x140042b2c], r13d
shl eax, cl
mov ecx, dword [0x140042b48]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0xa8]
mov r14d, dword [rsp + 0x2c]
shl eax, cl
mov ecx, dword [rsp + 0x98]
mov dword [rsp + 0x30], eax
mov eax, r11d
mov r12d, dword [rsp + 0x30]
mov r11d, 0x22a
shl sil, cl
test ecx, ecx
mov dword [rsp + 0x28], r9d
mov ecx, r9d
movzx r9d, byte [0x140042a87]
sete al
imul r15d, dword [rsp + 0xa8]
mov dword [rsp + 0x34], eax
mov eax, 0x66666667
mov r13d, dword [rsp + 0x34]
imul r15d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
mov edx, dword [0x140042b7c]
sub r15d, eax
movzx eax, byte [0x140042a86]
shl eax, cl
mov dword [rsp + 0x90], eax
lea eax, [r11 - 0xe]
mov ebp, dword [rsp + 0x90]
nop word [rax + rax]
mov ecx, eax
and r8d, r14d
mov eax, 0xd1
xor r9b, sil
shl eax, cl
xor r10d, ebp
xor eax, edi
xor eax, r12d
or edx, eax
mov eax, r13d
xor eax, edx
add r8d, eax
mov eax, r15d
sub r11, 1
jne 0x1400306a0
mov edi, dword [rsp + 0x38]
mov r12d, 0x82
mov ebp, dword [rsp + 0x20]
movzx r14d, byte [0x140042a86]
mov dword [0x140042b7c], edx
mov edx, dword [0x140042b68]
mov dword [0x140042a88], r8d
mov dword [rsp + 0x90], eax
cmp ebx, 0x17
jb 0x140030703
test edx, edx
je 0x14003072e
movsx ecx, byte [0x140042b67]
xor esi, esi
test ebp, ebp
mov eax, esi
sete al
or eax, ecx
je 0x140030724
lea eax, [rsi + 1]
test dword [rsp + 0xa8], r8d
jne 0x140030726
mov eax, esi
add byte [0x140042a62], al
jmp 0x140030730
xor esi, esi
mov ecx, dword [0x140042a64]
test sil, sil
je 0x140030749
mov eax, 1
test dword [rsp + 0xa8], ecx
jne 0x14003074b
mov eax, esi
mov r11d, dword [rsp + 0x98]
add r14b, al
mov byte [0x140042a86], r14b
test ecx, 0x455
jne 0x140030774
mov ecx, 0x38e
mov eax, esi
sub ecx, r11d
test r9b, cl
je 0x140030779
mov eax, 1
movzx ecx, byte [0x140042b56]
and cl, al
movzx r8d, r9b
movzx r9d, byte [0x140042b65]
sub r8d, 0x15e
mov eax, 0xffffff18
mov byte [0x140042b56], cl
sub eax, r9d
mov dword [rsp + 0x38], r8d
add dword [0x140042b30], eax
movsx eax, cl
mov dword [0x140042b44], r8d
add eax, ebx
je 0x1400307ce
sub r12d, ebp
mov ecx, edx
sar r12d, cl
mov eax, 1
test r12d, r12d
jne 0x1400307d0
mov eax, esi
add byte [0x140042b65], al
mov ecx, r11d
mov r9d, dword [rsp + 0x24]
sub ecx, edx
sub ecx, r9d
mov eax, esi
cmp dword [0x140042b3c], 0x308
sete al
cmp eax, ecx
movzx eax, byte [0x140042b88]
mov ecx, 0x2d
sete dl
sub al, dl
sub rcx, 1
jne 0x140030803
cmp dword [0x140042b48], ecx
mov byte [0x140042b88], al
je 0x14003082e
cmp byte [rsp + 0xa0], cl
je 0x14003082e
lea eax, [r15 + rbx]
xor eax, r8d
lea eax, [rcx + 1]
jne 0x140030830
mov eax, esi
or byte [0x140042b55], al
mov ecx, r9d
mov r9d, dword [0x140042b6c]
sub ebx, ebp
mov edx, dword [0x140042b38]
mov esi, r15d
mov r11d, dword [0x140042b60]
and esi, 3
mov eax, edx
add esi, r11d
sar eax, cl
movzx ecx, bl
shl eax, cl
mov ecx, r10d
sar eax, cl
add byte [0x140042a63], al
mov eax, dword [0x140042b40]
mov ecx, dword [rsp + 0x98]
or eax, 0x17
xor r9d, eax
add ecx, 0x455
mov dword [0x140042b6c], r9d
xor ebx, ebx
mov eax, 0x83
test ecx, ecx
mov r8d, ebx
setne r8b
add r8b, r14b
mov byte [0x140042b67], r8b
sub ax, 1
jne 0x140030893
movzx eax, r14b
cmp eax, ebp
jne 0x1400308c3
mov byte [0x140042b57], bl
cmp dword [rsp + 0xa8], ebx
je 0x1400308ca
mov byte [0x140042b57], 1
mov eax, dword [0x140042b78]
mov ecx, esi
mov r14d, dword [0x140042a64]
mov r12d, dword [0x140042b4c]
shr eax, cl
xor dword [0x140042b58], eax
mov eax, r14d
sub eax, r15d
mov dword [0x140042b40], eax
mov eax, ebp
imul eax, edx
cdq
and edx, 3
lea ebx, [rdx + rax]
xor edx, edx
sar ebx, 2
mov ecx, edx
cmp r12d, dword [rsp + 0x28]
mov eax, edx
setb cl
cmp r9d, 0xd1
setne al
cmp ecx, eax
jae 0x14003094d
test dil, dil
je 0x14003094d
mov ecx, dword [rsp + 0x98]
mov eax, edx
add ecx, 0x308
sar r11d, cl
cmp r15d, dword [0x140042b48]
sete al
and r11d, eax
sub r9d, r11d
mov dword [0x140042b6c], r9d
movzx edx, byte [0x140042b83]
mov eax, 0xdf
movzx r9d, byte [0x140042b64]
xor r13d, r13d
dec ax
test r9b, r9b
je 0x140030975
mov ecx, 1
cmp esi, ebx
je 0x140030978
mov ecx, r13d
sub dl, cl
test ax, ax
jne 0x140030964
movsx eax, byte [0x140042a62]
and eax, 0x308
mov byte [0x140042b83], dl
cmp dword [rsp + 0xa8], r15d
mov dword [0x140042b5c], eax
mov eax, r13d
sete al
or eax, dword [rsp + 0x38]
or r14d, eax
cmp byte [0x140042a63], r13b
mov r13d, dword [0x140042b2c]
mov dword [0x140042a64], r14d
jne 0x1400309e4
mov eax, dword [rsp + 0x98]
movsx ecx, r8b
add eax, 0xfffffc72
add ecx, 0x308
mov byte [0x140042a87], 0
test eax, ecx
je 0x1400309eb
mov byte [0x140042a87], 1
imul ebp, r12d
mov eax, 0xcccccccd
mul ebp
shr edx, 2
lea eax, [rdx + rdx*4]
sub ebp, eax
movzx r14d, bpl
mov eax, r14d
or eax, r13d
add r10d, eax
mov dword [0x140042b34], r10d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [0x140042b4c]
test ecx, ecx
jne 0x140030a33
test dword [rsp + 0x28], esi
jne 0x140030a33
mov byte [0x140042a87], cl
test dil, dil
je 0x140030a3a
mov byte [0x140042a87], 1
movzx r12d, byte [0x140042b66]
xor eax, eax
cmp dword [0x140042b5c], 0xd1
mov ebp, eax
mov r15d, dword [0x140042b48]
mov edi, 0x134
movzx r13d, byte [0x140042b55]
setne bpl
movzx edx, byte [0x140042a86]
movzx r11d, byte [0x140042b57]
mov r8d, dword [0x140042b30]
mov r9d, dword [0x140042a88]
mov r10d, dword [0x140042b84]
mov ebx, dword [0x140042b7c]
test r12b, r12b
setne al
cmp ebp, eax
je 0x140030aaa
dec r8d
add dl, 0xff
xor r9d, 1
and r10d, 1
or ecx, 1
test r15d, r15d
je 0x140030ac5
mov eax, esi
and eax, 0x38e
or eax, r14d
je 0x140030ac5
mov eax, 1
jmp 0x140030ac7
xor eax, eax
xor ebx, eax
test r13b, r13b
setne al
add r11b, al
mov eax, 0
sub rdi, 1
jne 0x140030a92
mov dword [0x140042b4c], ecx
mov byte [0x140042a86], dl
mov dword [0x140042b30], r8d
mov dword [0x140042a88], r9d
mov dword [0x140042b84], r10d
mov byte [0x140042b57], r11b
mov dword [0x140042b7c], ebx
call qword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
call fcn.14002fa60
mov eax, dword [rsp + 0x90]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret