Function at 0x1400f0e70
Capabilities:
Encode data using xor
Terminate process

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
mov qword [rsp + 0x10], rsi
xchg rdi, r10
mov qword [rsp + 0x18], r10
xchg r10, rdi
nop
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
xchg rbx, rdx
mov rdx, rcx
xchg rdx, rbx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x584f2a08
xor r8d, 0xf840b1a
xor r8d, 0x49e6a75d
add r8d, 0x4e0b7972
xor r8d, 0x2f0bbbe6
xor r8d, 0x39d6f9c3
xor r8d, 0x3f1a9b3a
xor r8d, 0x45ff2cd6
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
sub rcx, 0xfffffffffffffa28
call fcn.14007b7d0
xor ebx, ebx
mov dword [rsp + 0x32], 0x7ec428c4
xor dword [rsp + 0x32], 0x27caf0e7
xor dword [rsp + 0x32], 0x728de4de
add dword [rsp + 0x32], 0xe48849a
sub dword [rsp + 0x32], 0x317a46a5
add dword [rsp + 0x32], 0x3b04eae4
xor dword [rsp + 0x32], 0xb5a09320
mov edx, ebx
mov dword [rsp + 0x42], 0x1895abb9
xor dword [rsp + 0x42], 0x658c73e0
sub dword [rsp + 0x42], 0x1ba80664
sub dword [rsp + 0x42], 0x28441254
xor dword [rsp + 0x42], 0xd16fb67
add dword [rsp + 0x42], 0x269fab84
sub dword [rsp + 0x42], 0x18bb0fa8
add dword [rsp + 0x42], 0x179019fa
xor dword [rsp + 0x42], 0xa6d205b3
xchg r8, rbp
mov rbp, rax
xchg rbp, r8
mov dword [rsp + 0x46], 0x2c47e415
xor dword [rsp + 0x46], 0x533a2cad
xor dword [rsp + 0x46], 0x1f148d57
xor dword [rsp + 0x46], 0x4b481a98
sub dword [rsp + 0x46], 0x356fa52
xor dword [rsp + 0x46], 0x54eb193b
xor dword [rsp + 0x46], 0x12ef3c22
add dword [rsp + 0x46], 0x9da5beee
mov dword [rsp + 0x36], 0x2bc0d7b5
add dword [rsp + 0x36], 0x1de8bf4d
add dword [rsp + 0x36], 0x3310ef98
xor dword [rsp + 0x36], 0x2896142
sub dword [rsp + 0x36], 0x14d08b7e
xor dword [rsp + 0x36], 0x9f95aaac
mov dword [rsp + 0x4a], 0x261e3321
xor dword [rsp + 0x4a], 0x3cb3f03d
sub dword [rsp + 0x4a], 0x14f0bc79
add dword [rsp + 0x4a], 0x67735ce6
xor dword [rsp + 0x4a], 0x17da42a
sub dword [rsp + 0x4a], 0x532329f0
xor dword [rsp + 0x4a], 0xe60062ce
mov dword [rsp + 0x4e], 0xafb8a18
add dword [rsp + 0x4e], 0x1755589
add dword [rsp + 0x4e], 0x5b48948a
sub dword [rsp + 0x4e], 0x767d3c6
sub dword [rsp + 0x4e], 0x42550d35
add dword [rsp + 0x4e], 0xe17d6c3d
mov dword [rsp + 0x3a], 0x20e3195f
add dword [rsp + 0x3a], 0x1d54c023
xor dword [rsp + 0x3a], 0x43562203
xor dword [rsp + 0x3a], 0x3f857c3b
sub dword [rsp + 0x3a], 0x3e9e89fd
add dword [rsp + 0x3a], 0x398353f1
add dword [rsp + 0x3a], 0xb92da548
mov dword [rsp + 0x52], 0x78fe23ce
xor dword [rsp + 0x52], 0x7d0f3b5b
xor dword [rsp + 0x52], 0x7071600d
sub dword [rsp + 0x52], 0x52f7aedf
add dword [rsp + 0x52], 0x2e2f7219
xor dword [rsp + 0x52], 0x4f7487a7
add dword [rsp + 0x52], 0xdfb04307
mov dword [rsp + 0x56], 0x5f4b4c5c
sub dword [rsp + 0x56], 0x56399067
xor dword [rsp + 0x56], 0x4b0e883f
xor dword [rsp + 0x56], 0x2db4f0cf
sub dword [rsp + 0x56], 0x18e3d67b
add dword [rsp + 0x56], 0xa8b312f5
mov word [rsp + 0x3e], 0x2610
add word [rsp + 0x3e], 0x358
xor word [rsp + 0x3e], 0x3d8c
xor word [rsp + 0x3e], 0x9db
xor word [rsp + 0x3e], 0x1ff6
xor word [rsp + 0x3e], 0x55c7
xor word [rsp + 0x3e], 0x69e6
xor word [rsp + 0x3e], 0x7031
add word [rsp + 0x3e], 0xa81d
mov dword [rsp + 0x5a], 0x7e1f329b
sub dword [rsp + 0x5a], 0x7d08d5b1
xor dword [rsp + 0x5a], 0x679423e5
sub dword [rsp + 0x5a], 0x65b3ff30
add dword [rsp + 0x5a], 0xb423dc5
add dword [rsp + 0x5a], 0x1d9f86fd
add dword [rsp + 0x5a], 0x5d1fe12
xor dword [rsp + 0x5a], 0x750a73d2
add dword [rsp + 0x5a], 0xa4e7ce1d
mov byte [rsp + 0x40], 0x4b
add byte [rsp + 0x40], 0x13
sub byte [rsp + 0x40], 0x2d
add byte [rsp + 0x40], 0xc
xor byte [rsp + 0x40], 0x38
add byte [rsp + 0x40], 0x2f
add byte [rsp + 0x40], 0xc2
mov dword [rsp + 0x5e], 0x46ab6a53
sub dword [rsp + 0x5e], 0xe02fb7
xor dword [rsp + 0x5e], 0x27191d97
add dword [rsp + 0x5e], 0x16c4d38c
sub dword [rsp + 0x5e], 0x70b01a64
xor dword [rsp + 0x5e], 0x8e61f5d
nop
movzx eax, word [rsp + rdx*2 + 0x42]
movzx ecx, byte [rsp + rdx + 0x32]
add cx, ax
mov word [rsp + rdx*2 + 0x42], cx
mov byte [rsp + rdx + 0x32], bl
inc rdx
cmp rdx, 0xf
jb 0x1400f11df
lea rdx, [rsp + 0x42]
lea rcx, [rsp + 0x70]
call fcn.140087020
xchg r11, rax
mov r11, rbx
xchg r11, rax
mov byte [rsp + rax + 0x42], bl
inc rax
cmp rax, 0x1e
jb 0x1400f1218
mov dword [rsp + 0x20], 0x1eb9ef1d
xor dword [rsp + 0x20], 0x71d02ac4
sub dword [rsp + 0x20], 0x6de1a833
xor dword [rsp + 0x20], 0x4192a234
xor dword [rsp + 0x20], 0x812b33f
add dword [rsp + 0x20], 0xaeeeea49
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov dword [rsp + 0x26], 0x442bffeb
xor dword [rsp + 0x26], 0x89be44c
xor dword [rsp + 0x26], 0x2c412d6e
sub dword [rsp + 0x26], 0x53b5666f
add dword [rsp + 0x26], 0x4f44f431
xor dword [rsp + 0x26], 0x66669734
xor dword [rsp + 0x26], 0x5eb165ad
xor dword [rsp + 0x26], 0x2ff472fd
add dword [rsp + 0x26], 0xb3d9ba60
mov dword [rsp + 0x2a], 0x19170fe3
add dword [rsp + 0x2a], 0x666f9527
sub dword [rsp + 0x2a], 0x26aada6b
sub dword [rsp + 0x2a], 0x12b7e8d
add dword [rsp + 0x2a], 0x19edf168
xor dword [rsp + 0x2a], 0x6d38e91c
add dword [rsp + 0x2a], 0x282eb723
xor dword [rsp + 0x2a], 0x4e5a5db9
add dword [rsp + 0x2a], 0xf4ea294c
mov byte [rsp + 0x24], 1
add byte [rsp + 0x24], 0x73
sub byte [rsp + 0x24], 0x6f
add byte [rsp + 0x24], 0x6f
sub byte [rsp + 0x24], 0x53
add byte [rsp + 0x24], 0xd5
mov dword [rsp + 0x2e], 0x502ccda4
sub dword [rsp + 0x2e], 0x37bcc06e
add dword [rsp + 0x2e], 0x5faec1aa
sub dword [rsp + 0x2e], 0x30c9903f
add dword [rsp + 0x2e], 0x2aaa4a14
xor dword [rsp + 0x2e], 0x6e5e65bb
xor dword [rsp + 0x2e], 0x36595920
sub dword [rsp + 0x2e], 0x29f7b4b2
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x26]
movzx edx, byte [rsp + rax + 0x20]
add dx, cx
mov word [rsp + rax*2 + 0x26], dx
mov byte [rsp + rax + 0x20], bl
inc rax
cmp rax, 5
jb 0x1400f1358
mov r9d, 0x42fd4e0a
add r9d, 0x20a68f50
xor r9d, 0x3ac2a728
sub r9d, 0x3659f1c
sub r9d, 0x546b8ef1
sub r9d, 0x1904c55
lea r8, [rsp + 0x26]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop word [rax + rax]
mov byte [rsp + rbx + 0x26], 0x25
add byte [rsp + rbx + 0x26], 0x1b
xor byte [rsp + rbx + 0x26], 0x11
add byte [rsp + rbx + 0x26], 0xd
xor byte [rsp + rbx + 0x26], 0x53
add byte [rsp + rbx + 0x26], 0x2a
sub byte [rsp + rbx + 0x26], 3
xor byte [rsp + rbx + 0x26], 0x2a
sub byte [rsp + rbx + 0x26], 0x1e
inc rbx
cmp rbx, 0xa
jb 0x1400f13bf
mov ecx, 0x473104f9
sub ecx, 0x3f518a2f
xor ecx, 0x3e63d846
xor ecx, 0x76f9cc15
xor ecx, 0x3bcdfcbd
sub ecx, 0x32146045
add ecx, 0x341a509c
xor ecx, 0x55a3b2c3
xor ecx, 0xdcd2cf47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3