Function at 0x14009c6ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1080
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1070], rax
xor r14d, r14d
mov bpl, cl
cmp byte [0x140185281], r14b
je 0x14009c73b
cmp dl, r14b
je 0x14009cbea
or r12, 0xffffffffffffffff
cmp dword [0x140130004], r14d
je 0x14009c799
mov r9, r14
mov rcx, r14
lea rdi, str.8g30w1_5r7_2ta
lea ebx, [r12 + 2]
mov r8d, 0x480
xor byte [r9 + rdi], cl
movabs rax, 0xaaaaaaaaaaaaaaab
add r9, rbx
mul rcx
shr rdx, 1
lea rcx, [rdx + rcx + 3]
and ecx, 0xffffff
cmp r9, r8
jb 0x14009c760
cmp dword [0x140130004], r14d
je 0x14009c839
jmp 0x14009c82f
mov ecx, 0x4f8
call fcn.14005fad8
mov ebx, 1
cmp word [rax], 0x23
mov rsi, rax
jne 0x14009c7cf
cmp word [rax + 2], 0x23
jne 0x14009c7cf
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
cmp rcx, 0x64
jae 0x14009c7d6
mov rsi, qword [str.0C69__259Yrbtmee_fon_Okskcift._kckgvgfa:_Ipitvdg8RBTMEEiambhj_rdgf_gmuqqexvhvbfvftrmhl8_U_vdjltfeuqug8_B7:_FUG9__1hwrq___waqj_f_ajm_Hnpndleq__hflbubad9_Nslssgb_WAQJ_Fndngoocwcbe_cxtnp_dpdvtkjn__Wfpfhjrdgswwe___F]
mov edi, 0x1000
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8, rdi
call fcn.1400eada0
lea rcx, [rsi + 4]
lea rdx, [rsp + 0x70]
mov r8, rdi
call fcn.1400688e8
xor eax, eax
lea rdi, [rsp + 0x70]
mov rcx, r12
lea rdx, [rsp + 0x70]
repne scasb al, byte [rdi]
lea rdi, str.8g30w1_5r7_2ta
not rcx
sub rcx, rbx
mov r8, rcx
mov rcx, rdi
call fcn.14009c250
cmp al, r14b
jne 0x14009c839
mov r8d, 0x480
xor edx, edx
mov rcx, rdi
call fcn.1400eada0
cmp byte [0x1401410c0], r14b
jne 0x14009c857
mov eax, dword [0x1401571f4]
cmp eax, 0x28
jg 0x14009c852
cmp eax, r14d
jge 0x14009c857
mov sil, bl
jmp 0x14009c85a
mov sil, r14b
cmp bpl, r14b
je 0x14009cbb6
call fcn.140044e44
cmp eax, 0x501
ja 0x14009c87d
bt dword [0x140130000], 9
jae 0x14009cbea
cmp byte [0x140130370], r14b
je 0x14009cbea
mov byte [0x14013011b], r14b
mov byte [0x14013021f], r14b
mov byte [0x14013046f], r14b
cmp sil, r14b
jne 0x14009c8bc
mov al, byte [0x140130000]
and al, 0x80
neg al
sbb eax, eax
and eax, dword [0x140130008]
mov dword [0x140130008], eax
mov dil, r14b
mov r15d, 0x100
lea r12, [0x140130370]
lea rbp, str.InterfaceMisc
cmp dword [0x140130018], r14d
jbe 0x14009c92e
cmp byte [0x1401410c0], r14b
jne 0x14009c92e
lea rdx, str.RemShown
xor r8d, r8d
mov rcx, rbp
call fcn.14009b908
cmp eax, dword [0x140130018]
jae 0x14009c92e
lea r8d, [rax + 1]
lea rdx, str.RemShown
mov rcx, rbp
call fcn.14009b8a0
mov dil, bl
cmp byte [0x14013001c], r14b
je 0x14009c9db
lea rdx, [0x14013001c]
jmp 0x14009c9d0
cmp dword [0x14013011c], r14d
jbe 0x14009c97e
cmp sil, r14b
je 0x14009c97e
lea rdx, str.ExpRemShown
xor r8d, r8d
mov rcx, rbp
call fcn.14009b908
cmp eax, dword [0x14013011c]
jae 0x14009c97e
lea r8d, [rax + 1]
lea rdx, str.ExpRemShown
mov rcx, rbp
call fcn.14009b8a0
mov dil, bl
cmp byte [0x140130120], r14b
je 0x14009c9db
lea rdx, [0x140130120]
jmp 0x14009c9d0
cmp dword [0x140130220], r14d
jbe 0x14009c9db
cmp byte [0x1401410c0], r14b
je 0x14009c9db
lea rdx, str.RegRemShown
xor r8d, r8d
mov rcx, rbp
call fcn.14009b908
cmp eax, dword [0x140130220]
jae 0x14009c9db
lea r8d, [rax + 1]
lea rdx, str.RegRemShown
mov rcx, rbp
call fcn.14009b8a0
mov dil, bl
cmp byte [0x140130224], r14b
je 0x14009c9db
lea rdx, [0x140130224]
mov r8, r15
mov rcx, r12
call fcn.140065cd0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov eax, edx
shr eax, 6
cmp byte [0x1401410c0], r14b
je 0x14009ca11
mov ecx, dword [0x140130014]
cmp ecx, r14d
jbe 0x14009ca45
xor edx, edx
div ecx
cmp edx, r14d
jne 0x14009ca45
mov dil, bl
jmp 0x14009ca45
cmp sil, r14b
jne 0x14009ca2c
mov ecx, dword [0x14013000c]
cmp ecx, r14d
jbe 0x14009ca45
xor edx, edx
div ecx
cmp edx, r14d
jne 0x14009ca45
jmp 0x14009ca4e
mov ecx, dword [0x140130010]
cmp ecx, r14d
jbe 0x14009ca45
xor edx, edx
movzx edi, dil
div ecx
cmp edx, r14d
cmove edi, ebx
cmp dil, r14b
je 0x14009cbea
test byte [0x140130000], 2
mov ebp, 0x16c80000
mov eax, 0x16cc0000
cmove ebp, eax
test byte [0x140130000], 8
jne 0x14009ca71
or ebp, 0x30000
mov edi, 0x80000000
mov esi, edi
mov r12d, edi
mov r13d, edi
cmp dword [0x140130328], r14d
je 0x14009cb23
cmp dword [0x140130324], r14d
je 0x14009cb23
mov ecx, 0x21
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 4
mov edi, eax
lea esi, [rdi + rdi]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
add esi, eax
mov eax, dword [0x140130000]
add esi, dword [0x140130328]
test al, 0x40
jne 0x14009cacb
bt eax, 8
jb 0x14009cace
add esi, 0x1e
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [0x140130324]
xor edx, edx
lea edi, [rcx + rax*2]
lea r8, [rsp + 0x60]
lea ecx, [rdx + 0x30]
xor r9d, r9d
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [rsp + 0x68]
cmp edi, eax
mov r12d, eax
cmovl r12d, edi
sub eax, r12d
cdq
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [rsp + 0x6c]
cmp esi, eax
mov r13d, eax
cmovl r13d, esi
sub eax, r13d
cdq
sub eax, edx
sar eax, 1
mov esi, eax
lea rcx, [0x140130370]
mov rdx, r15
call fcn.14009bfe4
mov rcx, qword [0x140149f10]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r12d
lea r8, [0x14010d538]
lea rdx, str.RarReminder
mov r9d, ebp
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExW]
test byte [0x140130000], bl
je 0x14009cba5
mov dword [rsp + 0x30], 3
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp qword [0x140157290], r14
je 0x14009cbea
mov byte [0x140185281], bl
jmp 0x14009cbea
cmp sil, r14b
je 0x14009cbea
mov byte [0x140185281], bl
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, qword [0x140149f18]
lea r9, [0x1400c6390]
lea rdx, str.REMINDER
mov r8, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret