Function at 0x140006b80
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
imul eax, dword [0x1401f2b80], 0xb162627e
imul ecx, dword [0x1401f2b84], 0xf6fe0b63
add eax, ecx
add eax, 0x1fc9ecf3
shl rax, 4
lea rax, [rax + rax*2]
call fcn.140053000
sub rsp, rax
mov rdi, rsp
imul eax, dword [0x1401f2b88], 0x27672eb0
imul ecx, dword [0x1401f2b8c], 0x39fa09b5
add eax, ecx
add eax, 0x5cfca9b
lea rax, [rax + rax*2]
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.140053000
sub rsp, rax
mov r15, rsp
imul eax, dword [0x1401f2b90], 0x689f24e6
imul ecx, dword [0x1401f2b94], 0x7a488961
add eax, ecx
add eax, 0x811a8b5
imul rax, rax, 0x1388
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140053000
sub rsp, rax
mov qword [rbp - 8], rsp
mov ebx, dword [0x140215f48]
sub rsp, 0x20
call fcn.14003feb0
add rsp, 0x20
mov eax, dword [0x1401f2b98]
mov ecx, dword [0x1401f2b9c]
shrd ecx, eax, 0x1e
xor ecx, 0xf7ef0526
cmp ebx, ecx
je 0x1400071fe
cmp qword [0x140215f28], 0
jne 0x1400071fe
xorps xmm0, xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
mov rax, qword [0x1401f2ba0]
mov rcx, qword [0x1401f2ba8]
shrd rcx, rax, 0x22
movups xmmword [rdi], xmm0
movabs r8, 0x1a88867ee0b7ede
xor r8, rcx
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
add rsp, 0x20
mov rbx, rax
sub rsp, 0x20
call fcn.14003ff30
add rsp, 0x20
movabs rax, 0xd37b0847c7f5cdb5
imul rax, qword [0x1401f2bb0]
movabs rcx, 0x7d2da0354a8b568b
imul rcx, qword [0x1401f2bb8]
add rcx, rax
movabs r13, 0x60bcefe338a309f0
add r13, rcx
mov r12d, dword [rdi + 0x28]
sub rsp, 0x20
call fcn.14003ffb0
add rsp, 0x20
cmp rbx, r13
je 0x1400071fe
cdqe
lea rcx, [0x140062640]
cmp r12d, dword [rcx + rax*4]
jne 0x1400071fe
mov r14d, dword [0x140215f48]
sub rsp, 0x20
call fcn.140040030
add rsp, 0x20
cdqe
lea rcx, [0x14006264c]
mov eax, dword [rcx + rax*4]
mov dword [rbp - 0xc], eax
mov ebx, dword [rdi + 0x24]
sub rsp, 0x20
call fcn.1400400b0
add rsp, 0x20
cdqe
lea rcx, [0x140062658]
mov edi, dword [rcx + rax*4]
xor edi, ebx
sub rsp, 0x20
call fcn.140040140
add rsp, 0x20
cdqe
lea rcx, [0x140062664]
mov r12d, dword [rcx + rax*4]
and r12d, ebx
sub rsp, 0x20
call fcn.1400401c0
add rsp, 0x20
imul eax, dword [0x1401f2bc0], 0x558f3a0d
imul ecx, dword [0x1401f2bc4], 0x89d01a5
add eax, ecx
add eax, 0xae8c9ab5
cmp r12d, eax
jne 0x140006f13
sub rsp, 0x20
call fcn.140040240
add rsp, 0x20
cdqe
lea rcx, [0x140062670]
mov r12d, dword [rcx + rax*4]
and r12d, edi
sub rsp, 0x20
call fcn.1400402c0
add rsp, 0x20
cdqe
lea rcx, [0x14006267c]
mov eax, dword [rcx + rax*4]
and eax, ebx
mov r13d, eax
or r13d, r12d
sub rsp, 0x20
call fcn.140040340
add rsp, 0x20
cdqe
lea rcx, [0x140062688]
xor r13d, dword [rcx + rax*4]
and r13d, ebx
sub rsp, 0x20
call fcn.1400403b0
add rsp, 0x20
mov eax, dword [0x1401f2bc8]
mov ecx, dword [0x1401f2bcc]
shrd ecx, eax, 1
xor ecx, 0xbe26c87e
cmp r13d, ecx
jne 0x140006f13
mov eax, dword [0x1401f2bd0]
mov ecx, dword [str._Ne]
shrd ecx, eax, 0x1f
xor ecx, 0x6539a4e9
mov eax, dword [0x1401f2bd8]
mov edx, dword [0x1401f2bdc]
shrd edx, eax, 0x19
xor edx, 0x1855fdd3
cmp r14d, dword [rbp - 0xc]
mov r12d, edx
cmove r12d, ecx
sub rsp, 0x20
call fcn.140040430
add rsp, 0x20
cdqe
lea rcx, [0x140062694]
and ebx, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.1400404b0
add rsp, 0x20
cdqe
lea rcx, [0x1400626a0]
mov eax, dword [rcx + rax*4]
and eax, edi
mov r13d, eax
or r13d, ebx
sub rsp, 0x20
call fcn.140040540
add rsp, 0x20
cdqe
lea rcx, [0x1400626ac]
mov eax, dword [rcx + rax*4]
and eax, r12d
mov ebx, eax
xor ebx, r13d
sub rsp, 0x20
call fcn.1400405d0
add rsp, 0x20
cdqe
lea rcx, [0x1400626b8]
xor ebx, dword [rcx + rax*4]
and r12d, edi
or r12d, ebx
sub rsp, 0x20
call fcn.140040650
add rsp, 0x20
cdqe
lea rcx, [0x1400626c4]
cmp r12d, dword [rcx + rax*4]
je 0x1400071fe
mov rdi, r15
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add rsp, 0x20
mov ecx, dword [0x1401f2be0]
mov edx, dword [0x1401f2be4]
shrd edx, ecx, 0xf
mov r8d, edx
xor r8d, 0x4753b5cd
sub rsp, 0x20
mov rcx, r15
mov rdx, rax
call fcn.14000f580
add rsp, 0x20
mov r15, qword [r15]
mov rbx, qword [rdi + 8]
sub rsp, 0x20
call fcn.1400406d0
call fcn.140040760
call fcn.1400407d0
call fcn.140040860
add rsp, 0x20
cmp r15, rbx
je 0x14000720f
mov r14, qword [rbp - 8]
sub rsp, 0x20
call fcn.1400408e0
call fcn.140040950
call fcn.1400409c0
call fcn.140040a50
add rsp, 0x20
mov rax, r15
jmp 0x140006fc3
mov rcx, rax
add rcx, 0x30
mov rax, rcx
cmp rcx, rbx
je 0x14000720f
mov rcx, qword [rax]
cmp rcx, rsi
jae 0x140006fb0
mov rdx, qword [rax + 0x18]
lea r8, [rdx + rcx]
cmp r8, rsi
jbe 0x140006fb0
mov qword [rbp - 8], rdi
mov qword [0x140215f28], rcx
mov qword [0x140215f30], rdx
sub rsp, 0x20
call fcn.140040ae0
add rsp, 0x20
movzx eax, byte [0x1401f2bf8]
movzx ecx, byte [0x1401f2bf9]
imul eax, eax, 0x5c
mov edx, ecx
shl edx, 7
sub edx, ecx
mov ecx, edx
add cl, al
add cl, 0xb1
mov byte [0x140215f38], cl
nop
sub rsp, 0x20
call fcn.140053290
add rsp, 0x20
nop
mov r13d, eax
sub rsp, 0x20
call fcn.140040b50
add rsp, 0x20
cdqe
lea rcx, [0x140062718]
mov eax, dword [rcx + rax*4]
mov dword [r14 + 0x1384], eax
mov dword [r14 + 4], r13d
lea rbx, [0x140062730]
mov rsi, r14
lea r14, [0x140062740]
lea r15, [0x140062760]
mov r12d, 1
mov eax, r13d
nop word cs:[rax + rax]
mov r13d, eax
sub rsp, 0x20
call fcn.140040be0
add rsp, 0x20
cdqe
lea rcx, [0x140062724]
movzx ecx, byte [rcx + rax*4]
mov edi, r13d
shr edi, cl
xor edi, r13d
sub rsp, 0x20
call fcn.140040c60
add rsp, 0x20
cdqe
imul edi, dword [rbx + rax*4]
mov eax, r12d
mov ecx, edi
lea edi, [rax + rcx]
mov dword [rsi + r12*4 + 4], edi
sub rsp, 0x20
call fcn.140040cd0
add rsp, 0x20
cdqe
mov r13, r12
add r13, qword [r14 + rax*8]
sub rsp, 0x20
call fcn.140040d60
add rsp, 0x20
movsxd rcx, eax
mov r12, r13
mov eax, edi
cmp r13, qword [r15 + rcx*8]
jne 0x140007080
sub rsp, 0x20
call fcn.140040dd0
call fcn.140040e50
call fcn.140040ed0
call fcn.140040f40
call fcn.140040fb0
add rsp, 0x20
cdqe
lea rcx, [0x14006279c]
mov eax, dword [rcx + rax*4]
mov dword [rsi], eax
sub rsp, 0x20
call fcn.140041020
call fcn.140041090
call fcn.140041100
call fcn.140041170
add rsp, 0x20
nop
sub rsp, 0x20
mov rcx, rsi
call fcn.140018220
add rsp, 0x20
nop
mov dword [0x140215f3c], eax
mov rax, qword [rbp - 8]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400071fe
mov rsi, qword [rax + 0x10]
sub rsi, rbx
sub rsp, 0x20
call fcn.1400411e0
add rsp, 0x20
cdqe
lea rcx, [0x1400627d0]
cmp rsi, qword [rcx + rax*8]
jbe 0x1400071eb
mov rdi, qword [rbx - 8]
sub rsp, 0x20
call fcn.140041250
add rsp, 0x20
cdqe
lea rcx, [0x1400627f0]
add rbx, qword [rcx + rax*8]
sub rbx, rdi
sub rsp, 0x20
call fcn.1400412c0
add rsp, 0x20
cdqe
lea rcx, [0x140062810]
cmp rbx, qword [rcx + rax*8]
jae 0x140007235
sub rsp, 0x20
call fcn.140041340
add rsp, 0x20
cdqe
lea rcx, [0x140062830]
add rsi, qword [rcx + rax*8]
mov rdx, rsi
mov rcx, rdi
jmp 0x1400071f1
mov rdx, rsi
mov rcx, rbx
sub rsp, 0x20
call fcn.140052fb0
add rsp, 0x20
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
imul eax, dword [0x1401f2c0c], 0xe0e57daf
imul ecx, dword [0x1401f2c10], 0xdc5543fa
add ecx, eax
add ecx, 0xfaa740fb
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_ExitProcess]
sub rsp, 0x20
call fcn.140055ba4
int3