Function at 0x14004d730
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r15, rcx
mov qword [rbp - 0x29], rcx
xor ebx, ebx
mov dword [rbp - 0x55], ebx
lea rcx, [rbp - 0x49]
call fcn.14004d270
nop
mov rcx, qword [rbp - 0x49]
cmp dword [rcx - 0x10], ebx
jne 0x14004d7df
call fcn.14004a6c0
test al, al
jne 0x14004d7a7
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea rdx, [0x14014bc30]
mov rcx, r15
call fcn.1400021f0
mov dword [rbp - 0x55], 1
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004ddba
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
jmp 0x14004ddba
mov dword [rbp - 0x51], ebx
mov dword [rbp - 0x59], ebx
mov qword [rbp - 0x39], rbx
mov r14d, dword [0x1401bdd80]
lea r8d, [r14 + 2]
lea eax, [r14 + 1]
imul r8d, eax
imul r8d, r14d
mov eax, 0x78787879
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 5
jne 0x14004d869
lea r9d, [r8 + 0x4c]
mov edi, ebx
mov eax, r14d
cdq
sub eax, edx
sar eax, 1
mov esi, eax
nop
test esi, esi
jle 0x14004d862
mov eax, r14d
cdq
and edx, 3
add eax, edx
sar eax, 2
mov r10d, ebx
mov r11, rsi
test eax, eax
jle 0x14004d85a
mov edx, r10d
mov r8d, eax
add r9d, edx
dec edx
dec r8
jne 0x14004d850
add r10d, edi
dec r11
jne 0x14004d846
inc edi
cmp edi, r9d
jl 0x14004d830
mov rax, qword [0x1401bf530]
test rax, rax
jne 0x14004d904
lea rcx, str.Version.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
mov edx, dword [0x1401bdd80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0xf
jne 0x14004d8d0
lea edx, [r8 - 5]
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400cc3f4
test rdi, rdi
je 0x14004d8ee
lea rdx, str.GetFileVersionInfoSizeW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401bf530], rax
jmp 0x14004d8f5
mov rax, qword [0x1401bf530]
test rax, rax
je 0x14004d900
mov rcx, qword [rbp - 0x49]
jmp 0x14004d904
mov edi, ebx
jmp 0x14004d90c
lea rdx, [rbp - 0x51]
call rax
mov edi, eax
lea rcx, [0x1401b59a8]
mov rdx, qword [0x1401b59a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rdx, [0x14014bc30]
test rdx, 0xffffffffffff0000
jne 0x14004d955
movzx esi, dx
mov ecx, esi
call fcn.1400019e0
test rax, rax
je 0x14004d965
mov r8d, esi
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.140002690
jmp 0x14004d965
mov r8d, 3
lea rcx, [rbp - 0x41]
call fcn.1400023a0
nop
test edi, edi
je 0x14004dd1a
mov r8d, dword [0x1401bdd80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xb
jne 0x14004da3e
mov edx, ebx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
add r8d, eax
inc edx
cmp edx, 0x100
jl 0x14004d9a4
mov dword [0x1401bdd80], r8d
mov ecx, edi
call fcn.1400cb128
mov r14, rax
call fcn.140029030
mov rcx, rax
mov qword [rsp + 0x20], r14
mov r9d, edi
mov r8d, dword [rbp - 0x51]
mov rdx, qword [rbp - 0x49]
call fcn.14003fb00
test eax, eax
je 0x14004dd12
lea r9, [rbp - 0x59]
lea r8, [rbp - 0x39]
lea rdx, [0x1401496d0]
mov rcx, r14
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov r9d, dword [0x1401bdd80]
test eax, eax
je 0x14004dcde
cmp dword [rbp - 0x59], 0
je 0x14004dc8e
lea ecx, [r9 + 2]
lea eax, [r9 + 1]
imul ecx, eax
imul ecx, r9d
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
cmp ecx, 1
jne 0x14004db04
mov ecx, 0x28
call fcn.1400cb128
mov rsi, rax
mov rdi, rbx
call fcn.1400cc4a0
add eax, dword [0x1401bdd80]
mov dword [rsi + rdi*4], eax
inc rdi
cmp rdi, 0xa
jl 0x14004dad5
mov ecx, dword [rsi + 0x24]
mov dword [0x1401bdd80], ecx
mov rcx, rsi
call fcn.1400cc208
mov r9d, dword [0x1401bdd80]
mov rax, qword [rbp - 0x39]
cmp dword [rax], 0xfeef04bd
jne 0x14004db41
movzx r8d, word [rax + 0xa]
movzx r9d, word [rax + 8]
movzx ecx, word [rax + 0xe]
movzx eax, word [rax + 0xc]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, [0x14014bc68]
lea rcx, [rbp - 0x41]
call fcn.140012200
mov r9d, dword [0x1401bdd80]
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xb
jne 0x14004dc8e
mov rdi, rbx
call fcn.1400cc4a0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rbp + rdi*8 - 0x19], xmm0
inc rdi
cmp rdi, 9
jb 0x14004db70
mov r8d, 8
lea r9d, [r8 + 1]
nop word [rax + rax]
mov ecx, 8
cmp rbx, rcx
jge 0x14004dc78
cmp r8, 4
jl 0x14004dc4d
lea rax, [rbp + 0x17]
mov edx, 4
sub rdx, rbx
shr rdx, 2
inc rdx
mov ecx, 2
sub rcx, rdx
shl rcx, 2
nop word [rax + rax]
movsd xmm0, qword [rax + 0x10]
movsd xmm1, qword [rax + 8]
comisd xmm0, xmm1
jbe 0x14004dbfa
movsd qword [rax + 0x10], xmm1
movsd qword [rax + 8], xmm0
movsd xmm0, qword [rax + 8]
movsd xmm1, qword [rax]
comisd xmm0, xmm1
jbe 0x14004dc12
movsd qword [rax + 8], xmm1
movsd qword [rax], xmm0
movsd xmm0, qword [rax]
movsd xmm1, qword [rax - 8]
comisd xmm0, xmm1
jbe 0x14004dc2a
movsd qword [rax], xmm1
movsd qword [rax - 8], xmm0
movsd xmm0, qword [rax - 8]
movsd xmm1, qword [rax - 0x10]
comisd xmm0, xmm1
jbe 0x14004dc44
movsd qword [rax - 8], xmm1
movsd qword [rax - 0x10], xmm0
sub rax, 0x20
dec rdx
jne 0x14004dbe0
cmp rcx, rbx
jle 0x14004dc78
movsd xmm0, qword [rbp + rcx*8 - 0x19]
movsd xmm1, qword [rbp + rcx*8 - 0x21]
comisd xmm0, xmm1
jbe 0x14004dc70
movsd qword [rbp + rcx*8 - 0x19], xmm1
movsd qword [rbp + rcx*8 - 0x21], xmm0
dec rcx
cmp rcx, rbx
jg 0x14004dc52
inc rbx
dec r8
dec r9
jne 0x14004dba0
mov r9d, dword [0x1401bdd80]
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xc
jne 0x14004dcde
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
lea r9d, [r8 + 1]
mov dword [0x1401bdd80], r9d
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0xf
jne 0x14004dd12
dec dword [0x1401bef50]
mov rcx, r14
call fcn.1400cc208
mov rbx, qword [rbp - 0x41]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x14004dd41
cmp rax, qword [rbx - 0x18]
jne 0x14004dd41
lea rdi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x14004dd7e
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
jne 0x14004dd5d
call fcn.140002580
int3
mov eax, dword [rbx - 0x10]
mov dword [rdi + 8], eax
mov eax, dword [rbx - 0x10]
inc eax
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rdi + 0x18]
call fcn.1400cc4cc
lea rax, [rdi + 0x18]
mov qword [r15], rax
mov dword [rbp - 0x55], 1
lock add dword [rbx - 8], 0xffffffff
jg 0x14004dda2
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004ddba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r15
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400cbae0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret