Function at 0x2a2e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x330
mov rax, qword [0x0001c170]
xor rax, rsp
mov qword [rsp + 0x320], rax
xor r15d, r15d
mov rdi, r8
mov qword [rsp + 0x48], r8
mov rbx, rcx
mov r13, rdx
mov qword [rsp + 0x98], rdx
lea r8d, [r15 + 0x14]
lea rcx, [rsp + 0x84]
xor edx, edx
mov r14d, r15d
mov dword [rsp + 0x44], r15d
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x80], r15d
call fcn.00011100
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x68]
mov rcx, rbx
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x70], r15d
mov r12, r15
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x64], r15d
call fcn.0002a0bc
mov rsi, qword [rsp + 0x68]
cmp eax, r15d
mov ebp, eax
jl 0x2a8f2
cmp dword [rsp + 0x44], 0x18
jae 0x2a398
mov ebp, 0xc0000102
jmp 0x2a8f2
lea rdx, [0x00019288]
mov r8d, 0x10
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rax, 0x10
jne 0x2a8e3
cmp dword [rsi + 0x10], 1
jne 0x2a8e3
mov r9d, 0xb4
cmp dword [rsi + 0x14], r9d
jne 0x2a8e3
cmp dword [rsp + 0x44], 0xc0
jb 0x2a38e
mov edx, dword [rsi + 0xb8]
lea rax, [rsp + 0x1a0]
lea rcx, [rsi + 0xbc]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov r8, rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call fcn.00026834
cmp eax, r15d
mov ebp, eax
mov dword [rsp + 0x78], eax
jl 0x2a8f2
cmp dword [rsp + 0x80], r15d
je 0x2a8f2
cmp qword [rsp + 0x90], r15
je 0x2a8f2
test dword [rsp + 0x88], 0xffff0000
jne 0x2a8f2
lea rcx, [rsp + 0x80]
call fcn.00025038
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov rcx, rax
call fcn.0008dfe8
cmp al, r15b
je 0x2a8f2
lea rdx, [0x00019298]
lea rcx, [rsp + 0x80]
call fcn.0002506c
cmp al, r15b
je 0x2a8f2
mov edx, 0x14
xor ecx, ecx
mov r8d, 0x44424352
mov qword [rsp + 0x58], r15
mov ebx, r15d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, r15
jne 0x2a4bd
mov r15d, 0xc0000017
jmp 0x2a7bb
xor eax, eax
lea rcx, [rsp + 0x58]
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov dword [rdi + 0x10], eax
call fcn.000180f4
xor ecx, ecx
mov r15d, eax
mov dword [rsp + 0x40], eax
cmp eax, ecx
jne 0x2a7a8
mov r12, qword [rsp + 0x58]
mov r14d, dword [r12]
cmp r14d, ecx
jbe 0x2a656
xor esi, esi
lea ebp, [rcx + 2]
mov r13, rsi
lea rcx, [rsp + 0xf8]
xor edx, edx
mov r8d, 0xa0
mov word [rsp + 0xf0], si
call fcn.00011100
mov rdx, qword [r13 + r12 + 8]
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0xf8], rdx
mov word [rsp + 0xf0], bp
call fcn.000180ec
lea rcx, [rsp + 0xf0]
cmp eax, esi
mov eax, 0x17
mov word [rsp + 0xf0], ax
sete r15b
call fcn.000180ec
mov r12, qword [rsp + 0x58]
cmp eax, esi
sete al
cmp dword [r13 + r12 + 0x470], 6
jne 0x2a62c
cmp r15b, sil
je 0x2a62c
cmp al, sil
je 0x2a62c
xor eax, eax
lea rcx, [rsp + 0x250]
mov byte [rsp + 0x2b0], sil
mov qword [rsp + 0x2b1], rax
mov qword [rsp + 0x2b9], rax
mov word [rsp + 0x2c1], ax
mov byte [rsp + 0x2c3], al
call fcn.00091df0
mov rax, qword [rsp + 0x58]
mov edx, ebx
lea rcx, [rsp + 0x250]
mov r8d, 0x20
imul rdx, rdx, 0x548
lea rdx, [rdx + rax + 0x42c]
call fcn.00092fb0
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x250]
call fcn.000930e8
lea r8, [rsp + 0x2b0]
mov r15d, esi
mov dword [rsp + 0x40], esi
mov rcx, rdi
mov edx, 0x14
sub r8, rdi
mov al, byte [r8 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x2a616
mov r12, qword [rsp + 0x58]
jmp 0x2a631
mov r15d, dword [rsp + 0x40]
inc ebx
add r13, 0x548
cmp ebx, r14d
jb 0x2a4fe
mov rsi, qword [rsp + 0x68]
mov ebp, dword [rsp + 0x78]
mov r13, qword [rsp + 0x98]
xor ecx, ecx
xor eax, eax
mov byte [rsp + 0x2c8], cl
lea rcx, [rsp + 0xb0]
lea r12d, [rax + 0x40]
xor edx, edx
mov qword [rsp + 0x2c9], rax
mov r8, r12
mov qword [rsp + 0x2d1], rax
mov word [rsp + 0x2d9], ax
mov byte [rsp + 0x2db], al
call fcn.00011100
xor eax, eax
xor ecx, ecx
cpuid
mov r9d, edx
mov r11d, ecx
mov r8d, ebx
mov r10d, eax
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0xb4], edx
mov dword [rsp + 0xb8], ecx
test eax, eax
je 0x2a6e4
lea eax, [r12 - 0x3f]
xor ecx, ecx
cpuid
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0xa0], ecx
mov dword [rsp + 0xbc], eax
mov dword [rsp + 0xc0], edx
mov eax, dword [0x00019278]
mov ecx, 0xfafafafa
xor eax, ecx
cmp r8d, eax
jne 0x2a710
mov eax, dword [0x0001927c]
xor eax, ecx
cmp r9d, eax
jne 0x2a710
mov eax, dword [0x00019280]
xor eax, ecx
cmp r11d, eax
je 0x2a73b
cmp r10d, 1
jbe 0x2a73b
mov eax, 2
xor ecx, ecx
cpuid
mov dword [rsp + 0xc4], eax
mov dword [rsp + 0xc8], ebx
mov dword [rsp + 0xcc], ecx
mov dword [rsp + 0xd0], edx
lea rcx, [rsp + 0x1f0]
call fcn.00091df0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x1f0]
mov r8d, r12d
call fcn.00092fb0
lea rdx, [rsp + 0x2c8]
lea rcx, [rsp + 0x1f0]
call fcn.000930e8
lea rdx, [rsp + 0x2c8]
mov r8d, 0x14
mov rcx, rdi
mov rbx, r8
sub rdx, rdi
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
sub rbx, 1
jne 0x2a78c
xor ecx, ecx
mov r12, rdi
mov ebx, r8d
mov rdi, rcx
mov r14d, ecx
cmp rdi, rcx
je 0x2a7bb
mov edx, 0x44424352
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x2a7ca
call fcn.000180e4
test r15d, r15d
jne 0x2a8ea
cmp ebx, 0x14
jne 0x2a8ea
mov rdx, qword [r12]
cmp rdx, qword [rsi + 0xa0]
jne 0x2a80c
mov rdx, qword [r12 + 8]
cmp rdx, qword [rsi + 0xa8]
jne 0x2a80c
mov edx, dword [r12 + 0x10]
cmp edx, dword [rsi + 0xb0]
jne 0x2a80c
xor r15d, r15d
mov eax, r15d
jmp 0x2a814
sbb eax, eax
sbb eax, 0xffffffff
xor r15d, r15d
cmp eax, r15d
jne 0x2a8ed
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x50]
call fcn.0008e688
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x2a8ed
mov rbx, qword [rsp + 0x90]
cmp rbx, r15
je 0x2a8ed
mov edi, r15d
cmp dword [rbx + 0x10], r15d
jbe 0x2a8c4
xor edx, edx
lea rcx, [rsp + 0x2e0]
lea r8d, [rdx + 0x40]
call fcn.00011100
lea rax, [rsp + 0x70]
mov r8d, edi
shl r8, 4
lea r9, [rsp + 0x2e0]
mov edx, 1
add r8, qword [rbx + 8]
mov ecx, 0x8004
mov qword [rsp + 0x20], rax
call fcn.00026360
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x2e0]
mov r8d, 2
call fcn.0008e5ac
cmp eax, r15d
jne 0x2a8ed
mov rbx, qword [rsp + 0x90]
inc edi
cmp edi, dword [rbx + 0x10]
jb 0x2a854
mov rcx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x44]
mov rdx, rsi
call fcn.0002a258
mov rdi, qword [rsp + 0x48]
cmp eax, r15d
jne 0x2a8f2
mov r14d, 1
jmp 0x2a8f2
mov ebp, 0xc0000001
jmp 0x2a8f2
xor r15d, r15d
mov rdi, qword [rsp + 0x48]
cmp rsi, r15
je 0x2a902
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r12, r15
je 0x2a912
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rcx, [rsp + 0x80]
call fcn.00025000
cmp r13, r15
je 0x2a928
mov dword [r13], r14d
cmp rdi, r15
je 0x2a937
mov eax, dword [rsp + 0x64]
or eax, dword [rsp + 0x60]
mov dword [rdi], eax
cmp qword [rsp + 0x50], r15
je 0x2a948
lea rcx, [rsp + 0x50]
call fcn.0008e540
mov eax, ebp
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.000110ac
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret