Function at 0x1400f0a60
Capabilities:
Encode data using xor
Terminate process

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rdx, rbx
mov qword [rsp + 0x10], rsi
xchg rdi, rbx
mov qword [rsp + 0x18], rbx
xchg rbx, rdi
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
xchg rbx, r14
mov r14, rcx
xchg r14, rbx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x500a1313
xor r8d, 0x8474b78
sub r8d, 0x3b1086a6
add r8d, 0x2aa3dec1
add r8d, 0x2e9f2411
sub r8d, 0x767fca8f
call sub.VCRUNTIME140.dll_memset
xchg rdx, rcx
mov rdx, qword [rbx]
xchg rcx, rdx
add rcx, 0x5d8
call fcn.14007b910
xor ebx, ebx
mov dword [rsp + 0x32], 0xbb955f6
sub dword [rsp + 0x32], 0x2268522
xor dword [rsp + 0x32], 0x616208
xor dword [rsp + 0x32], 0x5e579909
sub dword [rsp + 0x32], 0xd0ba1e7
sub dword [rsp + 0x32], 0x1f1268ef
xor dword [rsp + 0x32], 0x5ec99859
xor dword [rsp + 0x32], 0x83b94e50
mov edx, ebx
mov dword [rsp + 0x42], 0x469d8ea9
xor dword [rsp + 0x42], 0x6c3300cf
sub dword [rsp + 0x42], 0x17738c44
sub dword [rsp + 0x42], 0x6c669ec
sub dword [rsp + 0x42], 0xb81c75e
add dword [rsp + 0x42], 0xfe8b2e57
mov r8, rax
mov dword [rsp + 0x46], 0x381baa47
xor dword [rsp + 0x46], 0x2df9525
add dword [rsp + 0x46], 0x34aa8742
sub dword [rsp + 0x46], 0x28d950a3
add dword [rsp + 0x46], 0x1c328486
xor dword [rsp + 0x46], 0x4d7ff9f7
add dword [rsp + 0x46], 0x20098f56
xor dword [rsp + 0x46], 0xb0b26dec
mov dword [rsp + 0x36], 0x20158d
add dword [rsp + 0x36], 0x266b1802
add dword [rsp + 0x36], 0x342589e9
xor dword [rsp + 0x36], 0x664bb301
xor dword [rsp + 0x36], 0x15dace26
xor dword [rsp + 0x36], 0xdfd73ca9
mov dword [rsp + 0x4a], 0x4aa7d0e8
sub dword [rsp + 0x4a], 0xaa48ed9
sub dword [rsp + 0x4a], 0xaf6cf7
sub dword [rsp + 0x4a], 0x2273e8a5
xor dword [rsp + 0x4a], 0x47f62f3a
xor dword [rsp + 0x4a], 0xa4033c34
mov dword [rsp + 0x4e], 0x1287be1f
add dword [rsp + 0x4e], 0x45120047
sub dword [rsp + 0x4e], 0x41ef4b0b
add dword [rsp + 0x4e], 0x5e62236e
sub dword [rsp + 0x4e], 0x6d69637
xor dword [rsp + 0x4e], 0x651901e0
xor dword [rsp + 0x4e], 0x366a6ed5
sub dword [rsp + 0x4e], 0x39d8ca1d
add dword [rsp + 0x4e], 0xfb0d59e3
mov dword [rsp + 0x3a], 0x727d63be
xor dword [rsp + 0x3a], 0x454e4e4e
sub dword [rsp + 0x3a], 0xe714dec
add dword [rsp + 0x3a], 0x543afa82
xor dword [rsp + 0x3a], 0x5543ce47
add dword [rsp + 0x3a], 0xcd37e235
mov dword [rsp + 0x52], 0xcc605c8
add dword [rsp + 0x52], 0x4eade029
xor dword [rsp + 0x52], 0x4f8dd3b8
xor dword [rsp + 0x52], 0x7e8b9478
sub dword [rsp + 0x52], 0x44cb604f
sub dword [rsp + 0x52], 0xb060e84
xor dword [rsp + 0x52], 0xe5d8cc22
mov dword [rsp + 0x56], 0x1b25df5e
xor dword [rsp + 0x56], 0x442c0243
sub dword [rsp + 0x56], 0x5e8c0225
add dword [rsp + 0x56], 0x68047e7
add dword [rsp + 0x56], 0x64db5549
sub dword [rsp + 0x56], 0x101e61b5
xor dword [rsp + 0x56], 0xa4c1e90c
mov word [rsp + 0x3e], 0x4a8e
sub word [rsp + 0x3e], 0x1652
add word [rsp + 0x3e], 0x4a1d
sub word [rsp + 0x3e], 0x1119
sub word [rsp + 0x3e], 0x4428
sub word [rsp + 0x3e], 0x74
add word [rsp + 0x3e], 0x246e
xor word [rsp + 0x3e], 0xbbe4
mov dword [rsp + 0x5a], 0x5b716845
xor dword [rsp + 0x5a], 0x3178d1ca
sub dword [rsp + 0x5a], 0x569632ee
add dword [rsp + 0x5a], 0x5c2b0ce0
sub dword [rsp + 0x5a], 0x292bdf79
xor dword [rsp + 0x5a], 0x71dde3b7
sub dword [rsp + 0x5a], 0x351f6a23
add dword [rsp + 0x5a], 0xfce011e2
mov byte [rsp + 0x40], 0x10
xor byte [rsp + 0x40], 0x1b
xor byte [rsp + 0x40], 0x5c
xor byte [rsp + 0x40], 0x38
add byte [rsp + 0x40], 3
sub byte [rsp + 0x40], 0x71
xor byte [rsp + 0x40], 0x69
add byte [rsp + 0x40], 0x8e
mov dword [rsp + 0x5e], 0x250c72b2
add dword [rsp + 0x5e], 0x107f5168
add dword [rsp + 0x5e], 0x3d7269e
add dword [rsp + 0x5e], 0x3c1ffbf
add dword [rsp + 0x5e], 0xa214de2
sub dword [rsp + 0x5e], 0x3d8db503
sub dword [rsp + 0x5e], 0x9b783e8
nop
movzx eax, word [rsp + rdx*2 + 0x42]
movzx ecx, byte [rsp + rdx + 0x32]
add cx, ax
mov word [rsp + rdx*2 + 0x42], cx
mov byte [rsp + rdx + 0x32], bl
inc rdx
cmp rdx, 0xf
jb 0x1400f0db6
lea rdx, [rsp + 0x42]
lea rcx, [rsp + 0x70]
call fcn.140086fd0
xchg rbx, r8
mov rax, r8
xchg r8, rbx
mov byte [rsp + rax + 0x42], bl
inc rax
cmp rax, 0x1e
jb 0x1400f0df1
mov dword [rsp + 0x20], 0x2e299790
xor dword [rsp + 0x20], 0x7451b4ba
sub dword [rsp + 0x20], 0x43667790
sub dword [rsp + 0x20], 0x10b24b93
add dword [rsp + 0x20], 0x1268adf5
add dword [rsp + 0x20], 0x3ad89043
add dword [rsp + 0x20], 0x2322e035
add dword [rsp + 0x20], 0x80337882
xchg r15, rax
mov r15, rbx
xchg r15, rax
mov dword [rsp + 0x26], 0x6fb2eeb3
sub dword [rsp + 0x26], 0x550f6621
sub dword [rsp + 0x26], 0x66a3897
add dword [rsp + 0x26], 0x261f8a02
sub dword [rsp + 0x26], 0x322241
sub dword [rsp + 0x26], 0x2c42c35d
add dword [rsp + 0x26], 0x18395c0b
add dword [rsp + 0x26], 0xd95faee5
mov dword [rsp + 0x2a], 0xc4d558
add dword [rsp + 0x2a], 0x25c00254
xor dword [rsp + 0x2a], 0x54161e0b
sub dword [rsp + 0x2a], 0x6a9b0ff7
sub dword [rsp + 0x2a], 0x4cc6d14
sub dword [rsp + 0x2a], 0x17fb9ab
add dword [rsp + 0x2a], 0xfdce6c8b
mov byte [rsp + 0x24], 0x18
add byte [rsp + 0x24], 0x35
sub byte [rsp + 0x24], 0x2a
add byte [rsp + 0x24], 2
add byte [rsp + 0x24], 0x4d
sub byte [rsp + 0x24], 0x54
add byte [rsp + 0x24], 0x53
sub byte [rsp + 0x24], 6
add byte [rsp + 0x24], 0x8b
mov dword [rsp + 0x2e], 0x3e89a951
xor dword [rsp + 0x2e], 0x6eb70f99
sub dword [rsp + 0x2e], 0x2fac420
add dword [rsp + 0x2e], 0x8504a1f
sub dword [rsp + 0x2e], 0x1719d207
xor dword [rsp + 0x2e], 0x3e7aa5bc
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x26]
movzx edx, byte [rsp + rax + 0x20]
add dx, cx
mov word [rsp + rax*2 + 0x26], dx
mov byte [rsp + rax + 0x20], bl
inc rax
cmp rax, 5
jb 0x1400f0f28
mov r9d, 0x7b58dd65
sub r9d, 0xa75f50c
xor r9d, 0x67ff7bef
xor r9d, 0x6cfaf0a6
sub r9d, 0x6aba10cb
sub r9d, 0xfa831d3
add r9d, 0x44314ac7
add r9d, 0x27922d6
xor r9d, 0x482f8e1f
lea r8, [rsp + 0x26]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop word [rax + rax]
mov byte [rsp + rbx + 0x26], 0x14
add byte [rsp + rbx + 0x26], 0x2b
add byte [rsp + rbx + 0x26], 0xd
xor byte [rsp + rbx + 0x26], 0x70
xor byte [rsp + rbx + 0x26], 0x48
sub byte [rsp + rbx + 0x26], 0x74
inc rbx
cmp rbx, 0xa
jb 0x1400f0fa4
mov ecx, 0x2a5a947b
sub ecx, 0x13b6e093
add ecx, 0x5c94bdfd
xor ecx, 0x545c788b
xor ecx, 0x44ea38a6
sub ecx, 0x3cd62d69
xor ecx, 0x7a68a28e
sub ecx, 0x46561513
add ecx, 0xe9856e41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3