Function at 0x170c8
Capabilities:
Encode data using xor
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x70
mov rax, qword [0x00013200]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, rcx
mov cl, byte [rcx + 0x427]
mov rsi, r8
mov r13b, dl
call fcn.000120a0
mov r15d, 1
mov byte [r12 + 0x411], al
cmp al, r15b
je 0x17152
lea rcx, [0x00018650]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
xor r11d, r11d
lea rcx, [r12 + 0xc]
xor edx, edx
mov r8d, 0x200
mov word [0x00013224], r11w
mov word [0x00013228], ax
mov dword [0x0001322c], eax
mov dword [0x00013220], eax
call fcn.000126a0
lea rbx, [0x00015a60]
cmp r13b, 9
jne 0x17a59
movzx edx, byte [rsi]
lea rcx, [0x00018680]
call sub.ntoskrnl.exe_DbgPrint
movzx r11d, byte [rsi]
cmp r11d, 0xc
jg 0x1776b
je 0x176f7
sub r11d, r15d
mov ecx, 4
je 0x1765e
sub r11d, ecx
je 0x175f6
sub r11d, r15d
je 0x17542
sub r11d, 2
je 0x174da
sub r11d, r15d
je 0x17261
cmp r11d, 2
jne 0x17a74
xor edi, edi
mov byte [0x00015a60], 0x5a
mov byte [0x00015a64], dil
mov byte [0x00015a63], dil
mov byte [0x00015a62], dil
mov byte [0x00015a61], dil
mov al, byte [rsi + 1]
xor al, byte [0x0001322c]
mov byte [0x00015a65], al
mov al, byte [rsi + 1]
xor al, byte [0x0001322d]
mov byte [0x00015a66], al
mov al, byte [rsi + 1]
xor al, byte [0x0001322e]
mov byte [0x00015a67], al
mov al, byte [rsi + 1]
xor al, byte [0x0001322f]
mov byte [0x00015a68], al
lea rdx, [0x00010000]
mov rax, qword [rsi + 9]
mov qword [rdx + 0x5a69], rax
mov eax, dword [rsi + 0x11]
mov dword [rdx + 0x5a71], eax
movzx eax, word [rsi + 0x15]
mov word [rdx + 0x5a75], ax
lea rcx, [0x00015a60]
call fcn.00010a44
mov byte [0x00015a77], al
jmp 0x17a74
xor edi, edi
xor eax, eax
mov qword [rsp + 0x49], rax
mov dword [rsp + 0x51], eax
mov byte [rsp + 0x48], dil
mov rcx, rdi
mov al, byte [rcx + rsi + 2]
xor al, byte [rsi + 1]
mov byte [rsp + rcx + 0x48], al
add rcx, r15
cmp rcx, 0xb
jl 0x17276
movzx eax, byte [rsp + 0x49]
movzx r9d, byte [rsp + 0x4b]
movzx r8d, byte [rsp + 0x4d]
movzx edx, byte [rsp + 0x4f]
movzx ecx, byte [rsp + 0x51]
cmp byte [rsp + 0x48], 2
movzx r12d, byte [rsp + 0x4a]
movzx ebx, dil
cmove ebx, eax
movzx eax, byte [rsp + 0x4c]
shl cx, 8
shl r9w, 8
shl r8w, 8
shl dx, 8
or r9w, ax
movzx eax, byte [rsp + 0x4e]
or r8w, ax
movzx eax, byte [rsp + 0x50]
movzx r11d, r9w
or dx, ax
movzx eax, byte [rsp + 0x52]
movzx r10d, r8w
or cx, ax
mov word [0x00015a84], dx
mov word [0x00015a80], r9w
movzx eax, cx
mov word [0x00015a86], cx
movzx ecx, dx
movzx edx, byte [rsp + 0x48]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov word [0x00015a82], r8w
mov dword [rsp + 0x28], r10d
lea rcx, [0x000186a0]
mov r9d, r12d
movzx r8d, bl
mov dword [rsp + 0x20], r11d
call sub.ntoskrnl.exe_DbgPrint
movzx r9d, word [0x00015a80]
movzx r10d, word [0x00015a82]
movzx ebx, word [0x00015a84]
movzx ebp, word [0x00015a86]
cmp r12w, di
jne 0x173a1
movzx edx, bx
movzx ecx, bp
call fcn.000109f8
movzx edx, r10w
movzx ecx, ax
movzx r9d, ax
call fcn.000109f8
mov bx, ax
movzx edx, ax
mov bp, ax
xor bx, r9w
movzx ecx, bx
call fcn.000109f8
mov r10w, bp
mov r9w, ax
xor r10w, ax
mov r11d, 3
cmp r12w, 5
jne 0x1742b
and r10b, 0xf
mov cl, bpl
xor cl, bl
and cl, 0xf
cmp cl, r10b
movzx ecx, r9w
sbb r10w, r10w
not r10w
and r10w, r11w
movzx edx, r10w
call fcn.000109f8
movzx edx, bp
movzx ecx, ax
call fcn.000109f8
movzx edx, r10w
movzx ecx, bx
movzx r9d, ax
call fcn.000109f8
movzx edx, r9w
movzx ecx, ax
call fcn.000109f8
movzx edx, r9w
mov bx, ax
mov r10w, ax
xor bx, r9w
movzx ecx, bx
call fcn.000109f8
xor r10w, ax
movzx ecx, ax
mov r9w, ax
movzx edx, r10w
call fcn.000109f8
mov bp, ax
movzx eax, r9w
mov word [0x00015a84], bx
mov byte [0x00015a6a], bl
shr ax, 8
mov word [0x00015a80], r9w
mov word [0x00015a82], r10w
mov byte [0x00015a65], al
movzx eax, r10w
mov word [0x00015a86], bp
shr ax, 8
mov byte [0x00015a60], 0x5a
mov byte [0x00015a64], dil
mov byte [0x00015a67], al
movzx eax, bx
mov byte [0x00015a63], dil
shr ax, 8
mov byte [0x00015a62], dil
mov byte [0x00015a61], dil
mov byte [0x00015a69], al
movzx eax, bp
mov byte [0x00015a66], r9b
shr ax, 8
mov byte [0x00015a68], r10b
mov byte [0x00015a6c], bpl
mov byte [0x00015a6b], al
lea rbx, [0x00015a60]
mov al, byte [rsi + 1]
xor byte [r11 + rbx + 2], al
add r11, r15
cmp r11, 0xb
jl 0x174c4
jmp 0x17a74
mov r8b, byte [rsi + 1]
add rsi, 2
lea rdx, [rsp + 0x48]
mov ecx, 8
mov al, byte [rsi]
add rsi, r15
xor al, r8b
mov byte [rdx], al
add rdx, r15
sub rcx, r15
jne 0x174ec
cmp byte [rsp + 0x48], 0x3f
ja 0x17518
movzx eax, byte [rsp + 0x48]
lea rdx, [0x00010000]
dec byte [rax + rdx + 0x5800]
xor edi, edi
mov byte [0x00015a60], 0x5a
mov byte [0x00015a64], dil
mov byte [0x00015a63], dil
mov byte [0x00015a62], dil
mov byte [0x00015a61], dil
jmp 0x1724a
lea rdx, [rsp + 0x48]
lea r8, [rsi + 5]
mov al, byte [r8]
add r8, r15
xor al, byte [rsi + 1]
mov byte [rdx], al
add rdx, r15
sub rcx, r15
jne 0x1754b
mov al, byte [0x00013225]
lea rbx, [0x00015a65]
lea rdx, [rsp + 0x48]
mov byte [rsp + 0x40], al
mov al, byte [0x00013224]
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x41], al
mov al, byte [0x00013229]
mov r8, rbx
mov byte [rsp + 0x42], al
mov al, byte [0x00013228]
mov byte [rsp + 0x43], al
call fcn.00010b60
xor edi, edi
mov byte [0x00015a60], 0x5a
mov byte [0x00015a64], dil
mov byte [0x00015a63], dil
lea ecx, [rdi + 8]
mov byte [0x00015a62], dil
mov byte [0x00015a61], dil
mov al, byte [rsi + 1]
xor byte [rbx], al
add rbx, r15
sub rcx, r15
jne 0x175c7
mov rax, qword [rsi + 0xd]
lea rdx, [0x00010000]
mov qword [rdx + 0x5a6d], rax
movzx eax, word [rsi + 0x15]
mov word [rdx + 0x5a75], ax
jmp 0x1724a
lea rdx, [rsp + 0x48]
lea r8, [rsi + 2]
mov ecx, 8
mov al, byte [rsi + 1]
xor al, byte [r8]
add r8, r15
mov byte [rdx], al
add rdx, r15
sub rcx, r15
jne 0x17604
mov al, byte [rsp + 0x48]
lea rdx, [0x00010000]
cmp al, 0x3f
ja 0x17634
movzx ecx, al
mov al, byte [rsp + 0x4c]
mov byte [rcx + rdx + 0x5800], al
xor edi, edi
mov byte [0x00015a60], 0x5a
mov byte [0x00015a64], dil
mov byte [0x00015a63], dil
mov byte [0x00015a62], dil
mov byte [0x00015a61], dil
jmp 0x1722b
lea rdx, [rsi + 5]
mov al, byte [rsi + 1]
xor byte [rdx], al
add rdx, r15
sub rcx, r15
jne 0x17662
movzx ecx, byte [rsi + 5]
movzx eax, byte [rsi + 6]
shl cx, 8
or cx, ax
cmp cx, word [0x00013224]
jne 0x177a0
movzx ecx, byte [rsi + 7]
movzx eax, byte [rsi + 8]
shl cx, 8
or cx, ax
cmp cx, word [0x00013228]
jne 0x177a0
xor edi, edi
mov byte [0x00015a60], 0x5a
mov byte [0x00015a64], dil
mov byte [0x00015a63], dil
mov byte [0x00015a62], dil
mov byte [0x00015a61], dil
mov al, byte [rsi + 1]
xor al, 0xfa
mov byte [0x00015a65], al
mov al, byte [rsi + 1]
xor al, 7
mov byte [0x00015a66], al
mov al, byte [rsi + 1]
xor al, 0xfb
mov byte [0x00015a67], al
mov al, byte [rsi + 1]
xor al, 0x6f
jmp 0x1721e
xor eax, eax
xor edi, edi
mov rcx, rdi
mov qword [rsp + 0x49], rax
mov dword [rsp + 0x51], eax
mov al, byte [rcx + rsi + 2]
xor al, byte [rsi + 1]
mov byte [rsp + rcx + 0x48], al
add rcx, r15
cmp rcx, 0xb
jl 0x17707
mov al, byte [rsp + 0x4b]
mov byte [0x00015a60], 0x5a
mov byte [0x00015a64], dil
mov byte [0x0001322c], al
mov al, byte [rsp + 0x4c]
mov byte [0x00015a63], dil
mov byte [0x0001322d], al
mov al, byte [rsp + 0x4d]
mov byte [0x00015a62], dil
mov byte [0x0001322e], al
mov al, byte [rsp + 0x4e]
mov byte [0x00015a61], dil
mov byte [0x0001322f], al
jmp 0x17a74
sub r11d, 0xd
je 0x179ed
sub r11d, r15d
je 0x17992
sub r11d, r15d
je 0x178c9
sub r11d, r15d
je 0x177d1
sub r11d, 0x28
je 0x177a0
mov ecx, 8
cmp r11d, ecx
jne 0x17a74
xor eax, eax
mov qword [0x00015a62], rax
mov qword [0x00015a6a], rax
mov dword [0x00015a72], eax
mov byte [0x00015a76], al
mov al, byte [rsi + 1]
mov byte [0x00015a60], 0x65
mov byte [0x00015a61], al
jmp 0x1724a
mov r8b, byte [rsi + 1]
add rsi, 2
lea rcx, [rsp + 0x48]
mov edx, 0x14
mov al, byte [rsi]
add rsi, r15
xor al, r8b
mov byte [rcx], al
add rcx, r15
sub rdx, r15
jne 0x177e3
movzx eax, byte [rsp + 0x4a]
movzx ebx, byte [rsp + 0x49]
movzx edi, byte [rsp + 0x48]
shl bx, 8
lea rcx, [0x00018730]
mov edx, edi
or bx, ax
movzx r8d, bx
call sub.ntoskrnl.exe_DbgPrint
mov ebp, 0x10
cmp dil, r15b
jne 0x17853
movzx eax, bx
lea rcx, [rsp + 0x4b]
mov r8d, ebp
lea rdx, [rax + r12 + 0xc]
call fcn.00010a20
lea rdx, [r12 + 0xc]
lea rcx, [0x00018760]
mov r8d, 0x200
call fcn.00010a60
cmp dil, 2
jne 0x1788b
movzx eax, bx
lea rcx, [rsp + 0x4b]
mov r8d, ebp
lea rdx, [rax + r12 + 0x20c]
call fcn.00010a20
lea rdx, [r12 + 0x20c]
lea rcx, [0x00018780]
mov r8d, 0x200
call fcn.00010a60
xor edi, edi
lea rdx, [0x00015a65]
lea rcx, [rsp + 0x4b]
mov r8d, ebp
mov byte [0x00015a60], 0x5a
mov byte [0x00015a64], dil
mov byte [0x00015a63], dil
mov byte [0x00015a62], dil
mov byte [0x00015a61], dil
call fcn.00010a20
jmp 0x1724a
lea rcx, [rsp + 0x48]
lea rdx, [rsi + 2]
mov r8d, 0xe
mov al, byte [rdx]
add rdx, r15
xor al, byte [rsi + 1]
mov byte [rcx], al
add rcx, r15
sub r8, r15
jne 0x178d8
movzx eax, byte [rsp + 0x4a]
movzx r13d, byte [rsp + 0x49]
movzx edx, byte [rsp + 0x48]
shl r13w, 8
lea rcx, [0x00018700]
or r13w, ax
movzx r8d, r13w
call sub.ntoskrnl.exe_DbgPrint
xor edi, edi
mov byte [0x00015a60], 0x5a
mov byte [0x00015a64], dil
mov byte [0x00015a63], dil
mov byte [0x00015a62], dil
lea ebp, [rdi + 0x10]
mov byte [0x00015a61], dil
lea rbx, [0x00015a65]
cmp byte [rsp + 0x48], r15b
jne 0x1795d
movzx eax, r13w
mov r8d, ebp
mov rdx, rbx
lea rcx, [rax + r12 + 0xc]
call fcn.00010a20
cmp byte [rsp + 0x48], 2
jne 0x1797b
movzx eax, r13w
mov r8d, ebp
mov rdx, rbx
lea rcx, [rax + r12 + 0x20c]
call fcn.00010a20
mov ecx, 0x12
mov al, byte [rsi + 1]
xor byte [rbx], al
add rbx, r15
sub rcx, r15
jne 0x17980
jmp 0x1724a
mov byte [0x00015a60], 0x5a
xor edi, edi
lea rdx, [0x00010000]
mov byte [0x00015a64], dil
mov byte [0x00015a63], dil
mov byte [0x00015a62], dil
mov byte [0x00015a61], dil
mov al, byte [rsi + 1]
xor al, 9
mov byte [0x00015a65], al
mov rax, qword [rsi + 6]
mov qword [rdx + 0x5a66], rax
mov rax, qword [rsi + 0xe]
mov qword [rdx + 0x5a6e], rax
mov al, byte [rsi + 0x16]
mov byte [rdx + 0x5a76], al
jmp 0x1724a
mov ebp, 0x10
lea rcx, [rsp + 0x48]
lea rdx, [rsi + 2]
mov r8, rbp
add rdx, r15
add rcx, r15
sub r8, r15
jne 0x179fe
xor edi, edi
mov byte [0x00015a60], 0x5a
lea rdx, [0x00010000]
mov byte [0x00015a64], dil
mov byte [0x00015a63], dil
mov byte [0x00015a62], dil
mov byte [0x00015a61], dil
mov al, byte [rdi + rdx + 0x5800]
xor al, byte [rsi + 1]
mov byte [rdi + rbx + 5], al
add rdi, r15
sub rbp, r15
jne 0x17a35
mov rcx, rbx
call fcn.00010a44
mov byte [0x00015a77], al
cmp r13b, r15b
jne 0x17a74
mov rax, qword [rbx]
mov qword [rsi], rax
mov rax, qword [rbx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rbx + 0x10]
mov qword [rsi + 0x10], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.000125a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret