Function at 0x14000ada0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x14001f040]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov rsi, rdx
mov r14, rcx
mov qword [rbp + 0x60], rdx
xor r12d, r12d
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
lea rdi, [r12 - 1]
mov eax, dword [rcx + rax]
cmp dword [0x14001fd08], eax
jle 0x14000ae93
lea rcx, [0x14001fd08]
call fcn.14001251c
cmp dword [0x14001fd08], edi
jne 0x14000ae93
mov dword [rbp + 0x70], 0x87869c86
mov word [rbp + 0x74], 0x100
mov ecx, r12d
nop dword [rax + rax]
lea eax, [rcx - 0x38]
xor byte [rbp + rcx + 0x70], al
inc rcx
cmp rcx, 4
jb 0x14000ae30
mov byte [rbp + 0x75], 0
xorps xmm0, xmm0
movups xmmword [0x14001fd38], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x14001fd48], xmm1
lea rax, [rbp + 0x70]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x14000ae60
lea rdx, [rbp + 0x70]
lea rcx, [0x14001fd38]
call fcn.140011720
lea rcx, [0x140013f70]
call fcn.1400127bc
nop
lea rcx, [0x14001fd08]
call fcn.1400124b0
mov dword [rsp + 0x48], 0x87869c86
mov word [rsp + 0x4c], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x38]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 4
jb 0x14000aeb0
mov byte [rsp + 0x4d], 0
lea rax, [0x14001fd38]
cmp qword [0x14001fd50], 0xf
cmova rax, qword [0x14001fd38]
lea r8, [rsp + 0x48]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14000aef7
inc rax
test ecx, ecx
jne 0x14000aee4
test edx, edx
jne 0x14000b6fb
nop
call qword [r14 + 0x188]
mov ebx, eax
test eax, eax
je 0x14000af00
mov byte [rbp + 0x120], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x121], xmm0
movups xmmword [rbp + 0x131], xmm0
movups xmmword [rbp + 0x141], xmm0
mov qword [rbp + 0x151], rax
mov dword [rbp + 0x159], eax
mov word [rbp + 0x15d], ax
mov byte [rbp + 0x15f], al
mov rax, qword [r14]
mov r10, qword [rax + 0x1a8]
movdqa xmm0, xmmword [0x14001a830]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x100bd91
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x38]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0x12
jb 0x14000af70
mov byte [rsp + 0x63], 0
movdqa xmm0, xmmword [0x14001a960]
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x14001a500]
movdqu xmmword [rbp - 0x78], xmm1
movdqa xmm0, xmmword [0x14001a5a0]
movdqu xmmword [rbp - 0x68], xmm0
mov dword [rbp - 0x58], 0x1009797
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x38]
xor byte [rsp + rcx + 0x78], al
inc rcx
cmp rcx, 0x32
jb 0x14000afc0
mov byte [rbp - 0x55], 0
mov dword [rsp + 0x28], 0x40
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x78]
mov rdx, 0xffffffff80000002
mov rcx, r14
call r10
mov r15d, eax
mov rax, qword [r14 + 0x2a8]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1400
call rax
mov qword [rbp + 0x68], rax
test rax, rax
je 0x14000b29d
mov rax, qword [r14]
xor r8d, r8d
lea rdx, [rbp + 0x68]
mov rcx, r14
call qword [rax + 0xa8]
mov rbx, rax
mov rcx, qword [rbp + 0x68]
call qword [r14 + 0xe8]
mov edx, 0x800
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [rbp + 0x98], 0x400
mov dword [rbp + 0x9c], 0x400
mov r10, qword [r14 + 0x4a0]
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x98]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x9c]
lea r8, [rbp + 0x160]
mov rdx, rbx
xor ecx, ecx
call r10
test eax, eax
jne 0x14000b10e
mov dword [rsp + 0x40], 0x87869c86
mov word [rsp + 0x44], 0x100
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x38]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 4
jb 0x14000b0c0
mov byte [rsp + 0x45], 0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x40]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000b0f0
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140011720
jmp 0x14000b70a
mov rax, qword [r14 + 0x460]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x160]
call rax
test eax, eax
jne 0x14000b18e
mov dword [rsp + 0x40], 0x87869c86
mov word [rsp + 0x44], 0x100
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 0x38]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 4
jb 0x14000b140
mov byte [rsp + 0x45], 0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x40]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000b170
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140011720
jmp 0x14000b70a
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov rdx, qword [rbp + 0x60]
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x14000b1a6
lea rcx, [rsp + 0x50]
call fcn.140011720
mov rdx, qword [0x14001fd50]
cmp rdx, 0xf
jbe 0x14000b1fb
inc rdx
mov rcx, qword [0x14001fd38]
cmp rdx, 0x1000
jb 0x14000b1f6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b296
mov rcx, r8
call fcn.14001246c
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [0x14001fd38], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [0x14001fd48], xmm1
test r15d, r15d
jne 0x14000b6fb
lea rcx, [rbp + 0x120]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x14000b226
test rax, rax
je 0x14000b6fb
mov word [rsp + 0x40], 0x3a
mov byte [rsp + 0x42], 0
lea rax, [rsp + 0x40]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000b250
lea rdx, [rsp + 0x40]
lea rcx, [0x14001fd38]
call fcn.1400104f0
lea rax, [rbp + 0x120]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000b272
mov r8, rdi
lea rdx, [rbp + 0x120]
lea rcx, [0x14001fd38]
call fcn.1400104f0
jmp 0x14000b6fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0x88], xmm0
lea r14, vtable.ATL::CAccessToken.0
mov qword [rbp + 0x78], r14
movdqu xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
xor eax, eax
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rax
lea rbx, vtable.ATL::CSid.0
mov qword [rbp + 0xa0], rbx
mov byte [rbp + 0xec], al
mov dword [rbp + 0xf0], 7
call fcn.140001320
mov rcx, rax
test rax, rax
je 0x14000b743
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xf8], rax
call fcn.140001320
mov rcx, rax
test rax, rax
je 0x14000b74e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x100], rax
call fcn.140001320
mov rcx, rax
test rax, rax
je 0x14000b759
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x108], rax
call fcn.140001320
mov rcx, rax
test rax, rax
je 0x14000b738
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x60]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000b622
lea rcx, [rbp + 0x78]
mov rax, qword [rbp + 0x78]
call qword [rax + 8]
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x78]
call fcn.1400108d0
test al, al
je 0x14000b622
lea rcx, [rbp + 0xa0]
call fcn.140001690
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x30], rcx
mov r8d, 3
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140010250
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov rdx, qword [rbp - 0x30]
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x14000b430
lea rcx, [rbp - 0x50]
call fcn.140011720
mov rdx, qword [0x14001fd50]
cmp rdx, 0xf
jbe 0x14000b484
mov rcx, qword [0x14001fd38]
inc rdx
cmp rdx, 0x1000
jb 0x14000b47f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b61b
mov rcx, r8
call fcn.14001246c
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [0x14001fd38], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [0x14001fd48], xmm1
lea rax, [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
cmp rcx, rax
je 0x14000b4ad
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r15d, r15d
jne 0x14000b52d
lea rcx, [rbp + 0x120]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x14000b4c0
test rax, rax
je 0x14000b52d
mov word [rsp + 0x40], 0x3a
mov byte [rsp + 0x42], 0
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x14000b4e2
lea rdx, [rsp + 0x40]
lea rcx, [0x14001fd38]
call fcn.1400104f0
lea rax, [rbp + 0x120]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000b510
lea rdx, [rbp + 0x120]
lea rcx, [0x14001fd38]
call fcn.1400104f0
lea rdx, [0x14001fd38]
mov rcx, rsi
call fcn.14000fcb0
nop
mov qword [rbp + 0xa0], rbx
mov rdx, qword [rbp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b564
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b584
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b5a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0xf8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000b5c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov qword [rbp + 0x78], r14
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x80]
test rdx, rdx
je 0x14000b5f3
test rcx, rcx
je 0x14000b5ec
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rbp + 0x80]
mov qword [rbp + 0x88], r12
test rcx, rcx
je 0x14000b605
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x80], r12
mov edx, 8
mov rcx, qword [rbp + 0x90]
call fcn.14001246c
jmp 0x14000b70a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov qword [rbp + 0xa0], rbx
mov rdx, qword [rbp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b649
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b669
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b689
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0xf8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000b6a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov qword [rbp + 0x78], r14
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x80]
test rdx, rdx
je 0x14000b6d8
test rcx, rcx
je 0x14000b6d1
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rbp + 0x80]
mov qword [rbp + 0x88], r12
test rcx, rcx
je 0x14000b6ea
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x80], r12
mov edx, 8
mov rcx, qword [rbp + 0x90]
call fcn.14001246c
lea rdx, [0x14001fd38]
mov rcx, rsi
call fcn.14000fcb0
mov rax, rsi
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.1400122d0
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400011d0
nop
mov ecx, 0x80004005
call fcn.1400011d0
nop
mov ecx, 0x80004005
call fcn.1400011d0
nop
mov ecx, 0x80004005
call fcn.1400011d0
int3