Function at 0x1400b7970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rdi, r8
mov r15, rdx
lea rax, vtable.Gdiplus::Bitmap.0
mov qword [rbp + 7], rax
xor ebx, ebx
mov qword [rbp - 0x11], rbx
lea r8, [rbp - 0x11]
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov dword [rbp + 0x17], eax
mov r13, qword [rbp - 0x11]
mov qword [rbp + 0xf], r13
mov qword [rbp - 0x19], rbx
lea r8, [rbp - 0x19]
lea edx, [rbx + 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov dword [rbp + 0x67], 0xcdd1d9
mov byte [rbp + 0x6b], 1
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x45]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x1400b79f0
mov byte [rbp + 0x6b], 0
lea rax, [rbp + 0x67]
mov rbx, 0xffffffffffffffff
mov rsi, rbx
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400b7a12
mov r14, qword [rdi + 0x10]
mov rcx, rdi
mov r12, qword [rdi + 0x18]
cmp r12, 0xf
jbe 0x1400b7a2f
mov rcx, qword [rdi]
mov r8, r14
cmp rsi, r14
cmovb r8, rsi
lea rdx, [rbp + 0x67]
call fcn.1400f1fc0
test eax, eax
jne 0x1400b7b0b
cmp r14, rsi
jb 0x1400b7b0b
ja 0x1400b7b0b
mov dword [rbp - 0x69], 0xef88efc7
mov dword [rbp - 0x65], 0xef88ef8b
mov dword [rbp - 0x61], 0xefa7efa3
mov dword [rbp - 0x5d], 0xeff3eff6
mov dword [rbp - 0x59], 0xefe8eff4
mov dword [rbp - 0x55], 0xefa6eff7
mov dword [rbp - 0x51], 0xeffdeff8
mov dword [rbp - 0x4d], 0xeffaefe7
mov dword [rbp - 0x49], 0xefa9effd
mov dword [rbp - 0x45], 0xefe2effd
mov dword [rbp - 0x41], 0xefb0efe9
mov dword [rbp - 0x3d], 0xefe0efe5
mov dword [rbp - 0x39], 0xefe5eff9
mov dword [rbp - 0x35], 0xefe7efe6
mov dword [rbp - 0x31], 0xefbfefe8
mov dword [rbp - 0x2d], 0xefeaefe2
mov dword [rbp - 0x29], 0xefbbefb9
mov dword [rbp - 0x25], 0xefedefed
mov dword [rbp - 0x21], 0xef9cef85
xor r12d, r12d
mov word [rbp - 0x1d], r12w
mov byte [rbp - 0x1b], 1
mov edx, r12d
mov ecx, 0x1044
movzx eax, dx
sub ax, cx
xor word [rbp + rdx*2 - 0x69], ax
inc rdx
cmp rdx, 0x26
jb 0x1400b7af2
jmp 0x1400b7fc4
mov dword [rbp + 0x67], 0xdaccd1
mov byte [rbp + 0x6b], 1
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx - 0x45]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x1400b7b20
mov byte [rbp + 0x6b], 0
lea rax, [rbp + 0x67]
mov rsi, rbx
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400b7b40
mov rcx, rdi
cmp r12, 0xf
jbe 0x1400b7b55
mov rcx, qword [rdi]
mov r8, r14
cmp rsi, r14
cmovb r8, rsi
lea rdx, [rbp + 0x67]
call fcn.1400f1fc0
test eax, eax
jne 0x1400b7c39
cmp r14, rsi
jb 0x1400b7c39
ja 0x1400b7c39
mov dword [rbp - 0x69], 0xef88efc7
mov dword [rbp - 0x65], 0xef88ef8b
mov dword [rbp - 0x61], 0xefa7efa3
mov dword [rbp - 0x5d], 0xeff3eff6
mov dword [rbp - 0x59], 0xefe8eff5
mov dword [rbp - 0x55], 0xefa6eff7
mov dword [rbp - 0x51], 0xeffdeff8
mov dword [rbp - 0x4d], 0xeffaefe7
mov dword [rbp - 0x49], 0xefa9effd
mov dword [rbp - 0x45], 0xefe2effd
mov dword [rbp - 0x41], 0xefb0efe9
mov dword [rbp - 0x3d], 0xefe0efe5
mov dword [rbp - 0x39], 0xefe5eff9
mov dword [rbp - 0x35], 0xefe7efe6
mov dword [rbp - 0x31], 0xefbfefe8
mov dword [rbp - 0x2d], 0xefeaefe2
mov dword [rbp - 0x29], 0xefbbefb9
mov dword [rbp - 0x25], 0xefedefed
mov dword [rbp - 0x21], 0xef9cef85
xor r12d, r12d
mov word [rbp - 0x1d], r12w
mov byte [rbp - 0x1b], 1
mov edx, r12d
mov ecx, 0x1044
nop dword [rax + rax]
movzx eax, dx
sub ax, cx
xor word [rbp + rdx*2 - 0x69], ax
inc rdx
cmp rdx, 0x26
jb 0x1400b7c20
jmp 0x1400b7fc4
mov dword [rbp + 0x67], 0xdbd5dc
mov byte [rbp + 0x6b], 1
xor r12d, r12d
mov ecx, r12d
nop word [rax + rax]
lea eax, [rcx - 0x45]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x1400b7c50
mov byte [rbp + 0x6b], r12b
lea rax, [rbp + 0x67]
mov rsi, rbx
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], r12b
jne 0x1400b7c70
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400b7c86
mov rcx, qword [rdi]
mov r8, r14
cmp rsi, r14
cmovb r8, rsi
lea rdx, [rbp + 0x67]
call fcn.1400f1fc0
test eax, eax
jne 0x1400b7d69
cmp r14, rsi
jb 0x1400b7d69
ja 0x1400b7d69
mov dword [rbp - 0x69], 0xef88efc7
mov dword [rbp - 0x65], 0xef88ef8b
mov dword [rbp - 0x61], 0xefa7efa3
mov dword [rbp - 0x5d], 0xeff3eff6
mov dword [rbp - 0x59], 0xefe8eff6
mov dword [rbp - 0x55], 0xefa6eff7
mov dword [rbp - 0x51], 0xeffdeff8
mov dword [rbp - 0x4d], 0xeffaefe7
mov dword [rbp - 0x49], 0xefa9effd
mov dword [rbp - 0x45], 0xefe2effd
mov dword [rbp - 0x41], 0xefb0efe9
mov dword [rbp - 0x3d], 0xefe0efe5
mov dword [rbp - 0x39], 0xefe5eff9
mov dword [rbp - 0x35], 0xefe7efe6
mov dword [rbp - 0x31], 0xefbfefe8
mov dword [rbp - 0x2d], 0xefeaefe2
mov dword [rbp - 0x29], 0xefbbefb9
mov dword [rbp - 0x25], 0xefedefed
mov dword [rbp - 0x21], 0xef9cef85
mov word [rbp - 0x1d], r12w
mov byte [rbp - 0x1b], 1
mov rdx, r12
mov ecx, 0x1044
nop word [rax + rax]
movzx eax, dx
sub ax, cx
xor word [rbp + rdx*2 - 0x69], ax
inc rdx
cmp rdx, 0x26
jb 0x1400b7d50
jmp 0x1400b7fc4
mov dword [rbp + 0x67], 0xdbd5cf
mov byte [rbp + 0x6b], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x45]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x1400b7d80
mov byte [rbp + 0x6b], r12b
lea rax, [rbp + 0x67]
mov rsi, rbx
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], r12b
jne 0x1400b7da0
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400b7db6
mov rcx, qword [rdi]
mov r8, r14
cmp rsi, r14
cmovb r8, rsi
lea rdx, [rbp + 0x67]
call fcn.1400f1fc0
test eax, eax
jne 0x1400b7e99
cmp r14, rsi
jb 0x1400b7e99
ja 0x1400b7e99
mov dword [rbp - 0x69], 0xef88efc7
mov dword [rbp - 0x65], 0xef88ef8b
mov dword [rbp - 0x61], 0xefa7efa3
mov dword [rbp - 0x5d], 0xeff3eff6
mov dword [rbp - 0x59], 0xefe8eff1
mov dword [rbp - 0x55], 0xefa6eff7
mov dword [rbp - 0x51], 0xeffdeff8
mov dword [rbp - 0x4d], 0xeffaefe7
mov dword [rbp - 0x49], 0xefa9effd
mov dword [rbp - 0x45], 0xefe2effd
mov dword [rbp - 0x41], 0xefb0efe9
mov dword [rbp - 0x3d], 0xefe0efe5
mov dword [rbp - 0x39], 0xefe5eff9
mov dword [rbp - 0x35], 0xefe7efe6
mov dword [rbp - 0x31], 0xefbfefe8
mov dword [rbp - 0x2d], 0xefeaefe2
mov dword [rbp - 0x29], 0xefbbefb9
mov dword [rbp - 0x25], 0xefedefed
mov dword [rbp - 0x21], 0xef9cef85
mov word [rbp - 0x1d], r12w
mov byte [rbp - 0x1b], 1
mov rdx, r12
mov ecx, 0x1044
nop word [rax + rax]
movzx eax, dx
sub ax, cx
xor word [rbp + rdx*2 - 0x69], ax
inc rdx
cmp rdx, 0x26
jb 0x1400b7e80
jmp 0x1400b7fc4
mov dword [rbp + 0x67], 0xdad2cb
mov byte [rbp + 0x6b], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x45]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x1400b7eb0
mov byte [rbp + 0x6b], r12b
lea rax, [rbp + 0x67]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x1400b7ed0
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400b7ee6
mov rcx, qword [rdi]
mov r8, r14
cmp rbx, r14
cmovb r8, rbx
lea rdx, [rbp + 0x67]
call fcn.1400f1fc0
test eax, eax
jne 0x1400b7fd6
cmp r14, rbx
jb 0x1400b7fd6
ja 0x1400b7fd6
mov dword [rbp - 0x69], 0xef88efc7
mov dword [rbp - 0x65], 0xef88ef8b
mov dword [rbp - 0x61], 0xefa7efa3
mov dword [rbp - 0x5d], 0xeff3eff6
mov dword [rbp - 0x59], 0xefe8eff2
mov dword [rbp - 0x55], 0xefa6eff7
mov dword [rbp - 0x51], 0xeffdeff8
mov dword [rbp - 0x4d], 0xeffaefe7
mov dword [rbp - 0x49], 0xefa9effd
mov dword [rbp - 0x45], 0xefe2effd
mov dword [rbp - 0x41], 0xefb0efe9
mov dword [rbp - 0x3d], 0xefe0efe5
mov dword [rbp - 0x39], 0xefe5eff9
mov dword [rbp - 0x35], 0xefe7efe6
mov dword [rbp - 0x31], 0xefbfefe8
mov dword [rbp - 0x2d], 0xefeaefe2
mov dword [rbp - 0x29], 0xefbbefb9
mov dword [rbp - 0x25], 0xefedefed
mov dword [rbp - 0x21], 0xef9cef85
mov word [rbp - 0x1d], r12w
mov byte [rbp - 0x1b], 1
mov rdx, r12
mov ecx, 0x1044
nop word [rax + rax]
movzx eax, dx
sub ax, cx
xor word [rbp + rdx*2 - 0x69], ax
inc rdx
cmp rdx, 0x26
jb 0x1400b7fb0
mov byte [rbp - 0x1b], r12b
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x69]
call qword [sym.imp.ole32.dll_CLSIDFromString]
xor r9d, r9d
lea r8, [rbp - 9]
mov rdx, qword [rbp - 0x19]
mov rcx, r13
call qword [sym.imp.gdiplus.dll_GdipSaveImageToStream]
test eax, eax
je 0x1400b8007
mov rcx, r13
call qword [sym.imp.gdiplus.dll_GdipDisposeImage]
nop
mov rcx, rdi
call fcn.14005ed40
xor al, al
jmp 0x1400b80b5
mov qword [rbp + 0x7f], r12
lea rdx, [rbp + 0x7f]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ole32.dll_GetHGlobalFromStream]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_GlobalSize]
movsxd rsi, eax
mov r14, qword [r15 + 8]
mov rdx, qword [r15]
mov rcx, r14
sub rcx, rdx
cmp rsi, rcx
jae 0x1400b803e
lea rax, [rdx + rsi]
jmp 0x1400b8070
jbe 0x1400b8074
mov rax, qword [r15 + 0x10]
sub rax, rdx
cmp rsi, rax
jbe 0x1400b8059
mov rdx, rsi
mov rcx, r15
call fcn.1400b1eb0
jmp 0x1400b8074
mov rbx, rsi
sub rbx, rcx
mov r8, rbx
xor edx, edx
mov rcx, r14
call fcn.1400f14e0
lea rax, [rbx + r14]
mov qword [r15 + 8], rax
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rsi
mov rdx, rax
mov rcx, qword [r15]
call fcn.1400f18a0
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbp - 0x19]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, r13
call qword [sym.imp.gdiplus.dll_GdipDisposeImage]
nop
mov rcx, rdi
call fcn.14005ed40
mov al, 1
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret