Function at 0x1400f0c00
Capabilities:
Encode data using xor
Terminate process

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
nop
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x15b8e469
add r8d, 0x6006087a
add r8d, 0x635c79b
xor r8d, 0x335dc08d
add r8d, 0x266d3b22
xor r8d, 0x1a5c5f2e
xor r8d, 0x8a11b25
sub r8d, 0x69a3b18f
sub r8d, 0x14483887
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
add rcx, 0x5d8
call fcn.14007b5c0
xor ebx, ebx
mov dword [rsp + 0x32], 0x79874eea
xor dword [rsp + 0x32], 0x365d35e9
add dword [rsp + 0x32], 0x28d4534
xor dword [rsp + 0x32], 0x571dee02
add dword [rsp + 0x32], 0x44f2a1ba
sub dword [rsp + 0x32], 0x1a3dcc04
add dword [rsp + 0x32], 0x38786ed8
sub dword [rsp + 0x32], 0x143d8e1f
xor dword [rsp + 0x32], 0xa29f1252
mov edx, ebx
mov dword [rsp + 0x42], 0x3893779e
add dword [rsp + 0x42], 0x17293c2b
sub dword [rsp + 0x42], 0xa6a2c60
sub dword [rsp + 0x42], 0x184e1b92
add dword [rsp + 0x42], 0x44b0d32c
add dword [rsp + 0x42], 0x8dc8c02c
xchg r8, rax
mov rax, r8
xchg r8, rax
mov dword [rsp + 0x46], 0x45de6965
xor dword [rsp + 0x46], 0x382eb08e
sub dword [rsp + 0x46], 0x210f1ead
sub dword [rsp + 0x46], 0xb46c40d
sub dword [rsp + 0x46], 0x1781fd06
add dword [rsp + 0x46], 0xc55b04ff
mov dword [rsp + 0x36], 0x7afe9a02
xor dword [rsp + 0x36], 0x5a591278
add dword [rsp + 0x36], 0x30cc7242
sub dword [rsp + 0x36], 0x3eff47fa
xor dword [rsp + 0x36], 0x12436a2b
add dword [rsp + 0x36], 0x4116a8a5
add dword [rsp + 0x36], 0xb346185
sub dword [rsp + 0x36], 0x466a0f1f
xor dword [rsp + 0x36], 0xf0ee2502
mov dword [rsp + 0x4a], 0x6d4e2e0f
sub dword [rsp + 0x4a], 0xd763e2b
xor dword [rsp + 0x4a], 0x729657c4
add dword [rsp + 0x4a], 0x3d74e0b7
add dword [rsp + 0x4a], 0xcd1908e
sub dword [rsp + 0x4a], 0x54b0fb36
xor dword [rsp + 0x4a], 0xddfdd152
mov dword [rsp + 0x4e], 0x11946686
add dword [rsp + 0x4e], 0x19e921b
add dword [rsp + 0x4e], 0x30dc307
xor dword [rsp + 0x4e], 0x4150e32f
sub dword [rsp + 0x4e], 0x3c6e7512
add dword [rsp + 0x4e], 0x386c88dd
xor dword [rsp + 0x4e], 0x7a48322e
add dword [rsp + 0x4e], 0xd240a3b
xor dword [rsp + 0x4e], 0xc91397da
mov dword [rsp + 0x3a], 0x7c85b29d
xor dword [rsp + 0x3a], 0x65a04dd8
add dword [rsp + 0x3a], 0x1f5e0c6a
sub dword [rsp + 0x3a], 0x123e6bee
xor dword [rsp + 0x3a], 0x3553a6d9
add dword [rsp + 0x3a], 0x160925fc
xor dword [rsp + 0x3a], 0x7839399
add dword [rsp + 0x3a], 0xc85a2a69
mov dword [rsp + 0x52], 0x6ea37262
xor dword [rsp + 0x52], 0x3fb5bdd8
sub dword [rsp + 0x52], 0x321a58d2
add dword [rsp + 0x52], 0x3149584f
sub dword [rsp + 0x52], 0x459688ac
add dword [rsp + 0x52], 0x5476361b
add dword [rsp + 0x52], 0xa05782d6
mov dword [rsp + 0x56], 0x76d74f68
xor dword [rsp + 0x56], 0x246cb984
xor dword [rsp + 0x56], 0x64829c1a
add dword [rsp + 0x56], 0x2fe80d9
add dword [rsp + 0x56], 0x235128bc
add dword [rsp + 0x56], 0xa2f1eaf4
mov word [rsp + 0x3e], 0x1c
xor word [rsp + 0x3e], 0x5923
sub word [rsp + 0x3e], 0x46fe
xor word [rsp + 0x3e], 0x645f
xor word [rsp + 0x3e], 0x2e
sub word [rsp + 0x3e], 0x21d1
add word [rsp + 0x3e], 0x4e7
add word [rsp + 0x3e], 0x9db0
mov dword [rsp + 0x5a], 0x49021c07
sub dword [rsp + 0x5a], 0x4ea51ba
sub dword [rsp + 0x5a], 0x27a2a7e5
add dword [rsp + 0x5a], 0x6ecfff4
add dword [rsp + 0x5a], 0x56c5fb67
sub dword [rsp + 0x5a], 0x3f4dbc40
xor dword [rsp + 0x5a], 0x5020f9d4
add dword [rsp + 0x5a], 0x94756727
mov byte [rsp + 0x40], 0x72
sub byte [rsp + 0x40], 0x49
sub byte [rsp + 0x40], 0xc
sub byte [rsp + 0x40], 0x1a
add byte [rsp + 0x40], 0x23
add byte [rsp + 0x40], 0xd0
mov dword [rsp + 0x5e], 0x7377ef1d
sub dword [rsp + 0x5e], 0x6f322809
add dword [rsp + 0x5e], 0x52360615
xor dword [rsp + 0x5e], 0x41c07d6e
xor dword [rsp + 0x5e], 0x21511c3d
xor dword [rsp + 0x5e], 0x14ffeedf
sub dword [rsp + 0x5e], 0x201d9787
xor dword [rsp + 0x5e], 0x4b7f9f0f
sub dword [rsp + 0x5e], 0x4a8734a3
nop
movzx eax, word [rsp + rdx*2 + 0x42]
movzx ecx, byte [rsp + rdx + 0x32]
add cx, ax
mov word [rsp + rdx*2 + 0x42], cx
mov byte [rsp + rdx + 0x32], bl
inc rdx
cmp rdx, 0xf
jb 0x1400f0f8b
lea rdx, [rsp + 0x42]
lea rcx, [rsp + 0x70]
call fcn.140086cf0
xchg rcx, rax
mov rcx, rbx
xchg rcx, rax
mov byte [rsp + rax + 0x42], bl
inc rax
cmp rax, 0x1e
jb 0x1400f0fc4
mov dword [rsp + 0x20], 0x1c8e143b
add dword [rsp + 0x20], 0x9e21af6
sub dword [rsp + 0x20], 0x7fa7fbf
add dword [rsp + 0x20], 0x20d05075
xor dword [rsp + 0x20], 0x42e94cd5
xor dword [rsp + 0x20], 0x255e301c
add dword [rsp + 0x20], 0x9e0473c8
mov rax, rbx
mov dword [rsp + 0x26], 0x4dfd24da
sub dword [rsp + 0x26], 0x11d86577
xor dword [rsp + 0x26], 0x5fbabf90
xor dword [rsp + 0x26], 0x128af613
xor dword [rsp + 0x26], 0x3c250ec
sub dword [rsp + 0x26], 0x365874a
sub dword [rsp + 0x26], 0xfe2501e
xor dword [rsp + 0x26], 0x1fcc67f0
xor dword [rsp + 0x26], 0xbf3e561b
mov dword [rsp + 0x2a], 0x39edb8ee
xor dword [rsp + 0x2a], 0x67e4eda2
sub dword [rsp + 0x2a], 0xf47b5d0
xor dword [rsp + 0x2a], 0x7130f635
add dword [rsp + 0x2a], 0x1cf87dc8
add dword [rsp + 0x2a], 0xa290186b
mov byte [rsp + 0x24], 0x56
sub byte [rsp + 0x24], 6
xor byte [rsp + 0x24], 0x6b
sub byte [rsp + 0x24], 0x19
xor byte [rsp + 0x24], 0x3d
sub byte [rsp + 0x24], 0xd
add byte [rsp + 0x24], 0x22
add byte [rsp + 0x24], 0xc2
mov dword [rsp + 0x2e], 0x3ee6e0cd
xor dword [rsp + 0x2e], 0x7c3cf882
sub dword [rsp + 0x2e], 0x9ef2cb9
add dword [rsp + 0x2e], 0x25fd73c5
sub dword [rsp + 0x2e], 0x47431b62
add dword [rsp + 0x2e], 0x673c2f1e
sub dword [rsp + 0x2e], 0x530fad3a
xor dword [rsp + 0x2e], 0x74eb1d8c
sub dword [rsp + 0x2e], 0x5f39d8d5
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x26]
movzx edx, byte [rsp + rax + 0x20]
add dx, cx
mov word [rsp + rax*2 + 0x26], dx
mov byte [rsp + rax + 0x20], bl
inc rax
cmp rax, 5
jb 0x1400f1102
mov r9d, 0x2102dcf2
sub r9d, 0x1bf5bdcf
add r9d, 0x22b1a278
xor r9d, 0x428b7df6
xor r9d, 0x3f4270de
add r9d, 0x1f6e65e7
xor r9d, 0x79e6328a
lea r8, [rsp + 0x26]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop word [rax + rax]
mov byte [rsp + rbx + 0x26], 0x40
sub byte [rsp + rbx + 0x26], 1
sub byte [rsp + rbx + 0x26], 0xa
add byte [rsp + rbx + 0x26], 7
add byte [rsp + rbx + 0x26], 0x15
sub byte [rsp + rbx + 0x26], 0x42
add byte [rsp + rbx + 0x26], 0x34
add byte [rsp + rbx + 0x26], 0x2e
xor byte [rsp + rbx + 0x26], 0x71
inc rbx
cmp rbx, 0xa
jb 0x1400f1170
mov ecx, 0x990c016
add ecx, 0x1573e94b
add ecx, 0x2a639103
sub ecx, 0x25f21d4d
add ecx, 0x37b33754
sub ecx, 0x5632bf05
add ecx, 0x6ba469b4
sub ecx, 0x1944ab2
xor ecx, 0x90f94b97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3