Function at 0x1400f07e0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, r11
mov qword [rsp + 0x10], r11
xchg r11, rsi
xchg rdi, r8
mov qword [rsp + 0x18], r8
xchg rdi, r8
nop
mov qword [rsp - 8], rbp
sub rsp, 8
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x15f15fdb
add r8d, 0x36b9eeab
add r8d, 0x101fc59a
xor r8d, 0x3d20102a
sub r8d, 0x37c73081
add r8d, 0x2512a02
xor r8d, 0x60232111
sub r8d, 0x1c36c5cd
sub r8d, 0x30210cc5
call sub.VCRUNTIME140.dll_memset
xchg r8, rcx
mov r8, qword [rbx]
xchg rcx, r8
sub rcx, 0x1ad6ee6d
add rcx, 0x1ad6f445
call fcn.14007b590
xor ebx, ebx
mov dword [rsp + 0x32], 0x11b6e3ec
sub dword [rsp + 0x32], 0x21c1cad
add dword [rsp + 0x32], 0x9736f51
add dword [rsp + 0x32], 0x4b1e8346
sub dword [rsp + 0x32], 0x156c50b2
xor dword [rsp + 0x32], 0x3bd9be77
xor dword [rsp + 0x32], 0x83ef21a5
mov edx, ebx
mov dword [rsp + 0x42], 0xb6ac09f
xor dword [rsp + 0x42], 0x73cfd891
xor dword [rsp + 0x42], 0x1ad54885
add dword [rsp + 0x42], 0x1146bab7
xor dword [rsp + 0x42], 0x2932840f
add dword [rsp + 0x42], 0x3383957
sub dword [rsp + 0x42], 0x27e020fe
add dword [rsp + 0x42], 0xc9a05789
xchg r8, rax
mov rax, r8
xchg r8, rax
mov dword [rsp + 0x46], 0x52099d59
add dword [rsp + 0x46], 0x2bb4acda
sub dword [rsp + 0x46], 0x225adfcf
sub dword [rsp + 0x46], 0x2408442d
add dword [rsp + 0x46], 0x2fd552bd
sub dword [rsp + 0x46], 0xae5984e
xor dword [rsp + 0x46], 0x1726eace
add dword [rsp + 0x46], 0xb407f4c2
mov dword [rsp + 0x36], 0x6f4f9d82
sub dword [rsp + 0x36], 0x27d8ec3c
add dword [rsp + 0x36], 0x325c3705
sub dword [rsp + 0x36], 0x45a3d59f
add dword [rsp + 0x36], 0x11a9c121
sub dword [rsp + 0x36], 0x28772c3c
xor dword [rsp + 0x36], 0x6fcfe557
xor dword [rsp + 0x36], 0x8458b430
mov dword [rsp + 0x4a], 0x10c185ad
add dword [rsp + 0x4a], 0x3e9ca4c3
xor dword [rsp + 0x4a], 0x7bd548f3
sub dword [rsp + 0x4a], 0x26a7a73c
add dword [rsp + 0x4a], 0x2231d0b2
sub dword [rsp + 0x4a], 0x138f1c2e
add dword [rsp + 0x4a], 0x16827bb
xor dword [rsp + 0x4a], 0xc6945a6
add dword [rsp + 0x4a], 0xeda32d5d
mov dword [rsp + 0x4e], 0x3c0abf5a
sub dword [rsp + 0x4e], 0x2d45dc16
add dword [rsp + 0x4e], 0xc81e5e8
xor dword [rsp + 0x4e], 0x73f148b6
xor dword [rsp + 0x4e], 0x465ea375
add dword [rsp + 0x4e], 0xd090dc7e
mov dword [rsp + 0x3a], 0x5eac9e99
xor dword [rsp + 0x3a], 0x4176e5ec
add dword [rsp + 0x3a], 0xec5a0e6
add dword [rsp + 0x3a], 0x291400be
sub dword [rsp + 0x3a], 0x36048403
add dword [rsp + 0x3a], 0x2ab987f9
add dword [rsp + 0x3a], 0xaa8dd5e7
mov dword [rsp + 0x52], 0x3ca8133b
add dword [rsp + 0x52], 0x37405c97
sub dword [rsp + 0x52], 0x4d165a56
add dword [rsp + 0x52], 0x272a8811
sub dword [rsp + 0x52], 0xb646c7
add dword [rsp + 0x52], 0x92bbbb9
add dword [rsp + 0x52], 0x2853defe
add dword [rsp + 0x52], 0x80b70dff
mov dword [rsp + 0x56], 0x1ce9088f
add dword [rsp + 0x56], 0x1bbcb75b
xor dword [rsp + 0x56], 0x307bccdf
xor dword [rsp + 0x56], 0x794b420d
xor dword [rsp + 0x56], 0x4b6d1c75
add dword [rsp + 0x56], 0x41db7d16
xor dword [rsp + 0x56], 0x154807bc
xor dword [rsp + 0x56], 0x49ac5bd8
add dword [rsp + 0x56], 0xdf430978
mov word [rsp + 0x3e], 0x67f1
add word [rsp + 0x3e], 0x9d2
sub word [rsp + 0x3e], 0x6a76
xor word [rsp + 0x3e], 0x66ab
sub word [rsp + 0x3e], 0xc83
add word [rsp + 0x3e], 0x18b3
add word [rsp + 0x3e], 0x88e0
mov dword [rsp + 0x5a], 0x75fa5c70
sub dword [rsp + 0x5a], 0x58062d0d
add dword [rsp + 0x5a], 0x512f5710
sub dword [rsp + 0x5a], 0x2c2e76e4
sub dword [rsp + 0x5a], 0x1c98f619
add dword [rsp + 0x5a], 0x597f760f
xor dword [rsp + 0x5a], 0x6cefbd88
add dword [rsp + 0x5a], 0xec3bcd71
mov byte [rsp + 0x40], 0x19
xor byte [rsp + 0x40], 0x57
sub byte [rsp + 0x40], 0x1a
add byte [rsp + 0x40], 0x39
sub byte [rsp + 0x40], 2
sub byte [rsp + 0x40], 0x13
xor byte [rsp + 0x40], 0x2e
xor byte [rsp + 0x40], 0x4b
add byte [rsp + 0x40], 0xb9
mov dword [rsp + 0x5e], 0x4bd4a6d9
sub dword [rsp + 0x5e], 0x1183802
sub dword [rsp + 0x5e], 0xaa7ec23
sub dword [rsp + 0x5e], 0x13602ee5
sub dword [rsp + 0x5e], 0x2621b508
sub dword [rsp + 0x5e], 0x6919f59
nop
movzx eax, word [rsp + rdx*2 + 0x42]
movzx ecx, byte [rsp + rdx + 0x32]
add cx, ax
mov word [rsp + rdx*2 + 0x42], cx
mov byte [rsp + rdx + 0x32], bl
inc rdx
cmp rdx, 0xf
jb 0x1400f0b88
lea rdx, [rsp + 0x42]
lea rcx, [rsp + 0x70]
call fcn.140086c20
xchg rbx, rbp
mov rax, rbp
xchg rbp, rbx
mov byte [rsp + rax + 0x42], bl
inc rax
cmp rax, 0x1e
jb 0x1400f0bc3
mov dword [rsp + 0x20], 0x795a558f
sub dword [rsp + 0x20], 0x28e77dfc
add dword [rsp + 0x20], 0x2e32f254
sub dword [rsp + 0x20], 0x6d9aa000
add dword [rsp + 0x20], 0x4b6e3c20
add dword [rsp + 0x20], 0x9a7d90ef
mov rax, rbx
mov dword [rsp + 0x26], 0xfccd0f2
add dword [rsp + 0x26], 0x56b30d4b
sub dword [rsp + 0x26], 0x1fdf6bab
add dword [rsp + 0x26], 0x7bc7b17
add dword [rsp + 0x26], 0x5b6648c
sub dword [rsp + 0x26], 0x3d1b8c24
xor dword [rsp + 0x26], 0xe98b395e
mov dword [rsp + 0x2a], 0x6117d4c2
sub dword [rsp + 0x2a], 0x6cd8591
add dword [rsp + 0x2a], 0x23afedc7
xor dword [rsp + 0x2a], 0x5c7de77e
xor dword [rsp + 0x2a], 0x1c920e0
xor dword [rsp + 0x2a], 0x65b49986
xor dword [rsp + 0x2a], 0x458f32a0
add dword [rsp + 0x2a], 0x672a998a
xor dword [rsp + 0x2a], 0x98e616b6
mov byte [rsp + 0x24], 0x30
sub byte [rsp + 0x24], 0x2c
xor byte [rsp + 0x24], 0x30
xor byte [rsp + 0x24], 0x37
xor byte [rsp + 0x24], 0x28
add byte [rsp + 0x24], 0xc
sub byte [rsp + 0x24], 0x18
xor byte [rsp + 0x24], 0x6a
add byte [rsp + 0x24], 0x81
mov dword [rsp + 0x2e], 0x6f834e60
sub dword [rsp + 0x2e], 0x544c82fa
xor dword [rsp + 0x2e], 0x5bde64e6
xor dword [rsp + 0x2e], 0x2db40e4e
sub dword [rsp + 0x2e], 0x280dcac9
sub dword [rsp + 0x2e], 0x454dd789
nop word [rax + rax]
movzx ecx, word [rsp + rax*2 + 0x26]
movzx edx, byte [rsp + rax + 0x20]
add dx, cx
mov word [rsp + rax*2 + 0x26], dx
mov byte [rsp + rax + 0x20], bl
inc rax
cmp rax, 5
jb 0x1400f0cee
mov r9d, 0x60421c77
sub r9d, 0x410bb588
sub r9d, 0xc09cf61
xor r9d, 0x574e053f
sub r9d, 0x1b936e94
xor r9d, 0x25cd089e
add r9d, 0x17049c7b
xor r9d, 0x2406c8ee
lea r8, [rsp + 0x26]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop word [rax + rax]
mov byte [rsp + rbx + 0x26], 0x2a
add byte [rsp + rbx + 0x26], 7
xor byte [rsp + rbx + 0x26], 0x48
sub byte [rsp + rbx + 0x26], 0x41
xor byte [rsp + rbx + 0x26], 0x75
sub byte [rsp + rbx + 0x26], 0x4d
inc rbx
cmp rbx, 0xa
jb 0x1400f0d63
mov ecx, 0x138f9566
add ecx, 0x6fe3d7c
add ecx, 0x3217b7e7
xor ecx, 0x138bdd21
sub ecx, 0x1406938c
xor ecx, 0xb4d83ba3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3