Function at 0x1401a3240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor ebx, ebx
mov r12, rcx
and dword [rbp + 0x78], ebx
cmp byte [rcx + 8], bl
jne 0x1401a327b
mov edi, 0xc004d101
mov ecx, edi
jmp 0x1401a3490
mov rax, qword [rcx]
mov r14d, dword [rbp + 0x68]
mov r15d, r14d
mov edi, dword [rax + 0x10]
sub r15d, edi
mov dword [rbp + 0x78], edi
dec r15d
mov dword [rbp + 0x48], edi
mov dword [rbp + 0x70], r15d
lea eax, [rdi + rdi]
cmp eax, edi
jb 0x1401a3489
lea eax, [r15 + rdi*2]
cmp r15d, eax
ja 0x1401a3489
lea ebx, [r15 + rdi*2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1401a32d4
xor ebx, ebx
jmp 0x1401a32dc
mov rbx, rsi
test rsi, rsi
jne 0x1401a32e3
mov edi, 0x8007000e
jmp 0x1401a3274
mov eax, dword [rbp + 0x78]
lea r13, [rsi + rdi]
mov rcx, qword [r12]
lea r8, [rbp + 0x78]
mov r9, rsi
mov rdx, rsi
add r13, rax
lea rbx, [rsi + rax]
mov qword [rbp - 0x20], rbx
call fcn.1401a2b2c
mov edi, eax
test eax, eax
jns 0x1401a331d
mov ecx, eax
call fcn.140082a8c
mov rbx, rsi
jmp 0x1401a3495
mov ecx, dword [rbp + 0x78]
lea eax, [rcx*2 + 2]
cmp ecx, eax
jbe 0x1401a3334
mov ecx, 0x8007006f
mov edi, ecx
jmp 0x1401a3310
cmp r14d, eax
jb 0x1401a332b
lea eax, [rcx + 1]
mov dword [rsp + 0x28], ecx
add rax, qword [rbp + 0x60]
lea r8, [rbp + 0x48]
mov edx, r14d
mov qword [rbp - 0x18], rax
sub edx, ecx
mov r9, rax
mov rcx, qword [r12]
dec edx
mov dword [rbp - 0x28], edx
mov dword [rsp + 0x20], edx
mov rdx, rbx
call fcn.1401a2c04
mov edi, eax
test eax, eax
js 0x1401a330e
mov edx, dword [rbp + 0x48]
cmp edx, dword [rbp + 0x78]
ja 0x1401a332b
mov r9, qword [rbp - 0x20]
mov rbx, rsi
test edx, edx
je 0x1401a33a5
mov r14, qword [rbp + 0x60]
mov rcx, r9
inc r14
mov r8d, edx
sub r14, r9
mov al, byte [r14 + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1401a3392
mov r14d, dword [rbp + 0x68]
mov rcx, qword [r12]
lea r8, [rbp + 0x70]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], edx
mov rdx, r13
call fcn.1401a2c04
mov edi, eax
test eax, eax
jns 0x1401a33cb
mov ecx, eax
jmp 0x1401a3490
mov r12d, dword [rbp + 0x78]
sub r14d, r12d
mov r15d, dword [rbp + 0x70]
dec r14d
cmp r15d, r14d
ja 0x1401a3489
mov eax, dword [rbp - 0x28]
test eax, eax
je 0x1401a3408
mov r8, qword [rbp - 0x18]
mov rcx, r13
sub r8, r13
mov edx, eax
mov al, byte [r8 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1401a33f5
mov r12d, dword [rbp + 0x78]
mov r14d, r12d
cmp r12d, r15d
jae 0x1401a3422
mov eax, r14d
cmp byte [rax + r13], 0
jne 0x1401a3422
inc r14d
cmp r14d, r15d
jb 0x1401a3410
cmp r14d, r15d
je 0x1401a347f
mov eax, r14d
cmp byte [rax + r13], 1
jne 0x1401a347f
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1401a347f
mov rax, qword [rbp + 0x60]
cmp byte [rax], 0
jne 0x1401a347f
mov rcx, qword [rbp + 0x58]
sub r14d, r12d
sub r15d, r14d
sub r15d, r12d
dec r15d
mov eax, dword [rcx]
mov dword [rcx], r15d
cmp eax, r15d
jb 0x1401a3489
mov rcx, qword [rbp + 0x50]
lea edx, [r12 + 1]
add edx, r14d
mov r8d, r15d
add rdx, r13
call sub.msvcrt.dll_memcpy
jmp 0x1401a3495
mov edi, 0xc004d210
jmp 0x1401a3274
mov ecx, 0x8007006f
mov edi, ecx
call fcn.140082a8c
mov ecx, edi
call fcn.140082b34
test rbx, rbx
je 0x1401a34b5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret