Function at 0x1401a1b3c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor eax, eax
mov r15, rcx
mov ebx, eax
mov dword [rbp + 0x78], eax
cmp byte [rcx + 8], al
jne 0x1401a1b79
mov esi, 0xc004d101
mov ecx, esi
jmp 0x1401a1d93
mov rax, qword [rcx]
mov r13d, dword [rbp + 0x68]
mov r14d, r13d
mov esi, dword [rax + 0x10]
sub r14d, esi
mov dword [rbp + 0x78], esi
dec r14d
mov dword [rbp + 0x48], esi
mov dword [rbp + 0x70], r14d
lea eax, [rsi + rsi]
cmp eax, esi
jb 0x1401a1d8c
lea eax, [rsi + r14]
lea ecx, [rsi + rax]
add eax, esi
cmp r14d, eax
ja 0x1401a1d8c
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
xor eax, eax
test rdi, rdi
jne 0x1401a1bd7
mov ebx, eax
jmp 0x1401a1be6
mov rcx, rdi
mov rbx, rdi
mov qword [rbp - 0x10], rcx
test rdi, rdi
jne 0x1401a1bed
mov esi, 0x8007000e
jmp 0x1401a1b72
mov eax, dword [rbp + 0x78]
lea r12, [rdi + rsi]
mov r9, rcx
lea r8, [rbp + 0x78]
mov rdx, rcx
add r12, rax
mov rcx, qword [r15]
lea rbx, [rdi + rax]
mov qword [rbp - 0x20], rbx
call fcn.1401a1408
mov esi, eax
test eax, eax
jns 0x1401a1c26
mov ecx, eax
call fcn.14007ac40
mov rbx, rdi
jmp 0x1401a1d98
mov ecx, dword [rbp + 0x78]
lea eax, [rcx*2 + 2]
cmp ecx, eax
jbe 0x1401a1c3d
mov ecx, 0x8007006f
mov esi, ecx
jmp 0x1401a1c19
cmp r13d, eax
jb 0x1401a1c34
lea eax, [rcx + 1]
mov dword [rsp + 0x28], ecx
add rax, qword [rbp + 0x60]
lea r8, [rbp + 0x48]
mov edx, r13d
mov qword [rbp - 0x18], rax
sub edx, ecx
mov r9, rax
mov rcx, qword [r15]
dec edx
mov dword [rbp - 0x28], edx
mov dword [rsp + 0x20], edx
mov rdx, rbx
call fcn.1401a14e0
mov esi, eax
test eax, eax
js 0x1401a1c17
mov edx, dword [rbp + 0x48]
cmp edx, dword [rbp + 0x78]
ja 0x1401a1c34
mov r9, qword [rbp - 0x20]
mov rbx, rdi
test edx, edx
je 0x1401a1cad
mov r13, qword [rbp + 0x60]
mov rcx, r9
inc r13
mov r8d, edx
sub r13, r9
mov al, byte [rcx + r13]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1401a1c9a
mov r13d, dword [rbp + 0x68]
mov rcx, qword [r15]
lea r8, [rbp + 0x70]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edx
mov rdx, r12
call fcn.1401a14e0
mov esi, eax
test eax, eax
jns 0x1401a1cd2
mov ecx, eax
jmp 0x1401a1d93
mov r15d, dword [rbp + 0x78]
sub r13d, r15d
mov r14d, dword [rbp + 0x70]
dec r13d
cmp r14d, r13d
ja 0x1401a1d8c
mov eax, dword [rbp - 0x28]
test eax, eax
je 0x1401a1d0f
mov r8, qword [rbp - 0x18]
mov rcx, r12
sub r8, r12
mov edx, eax
mov al, byte [r8 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1401a1cfc
mov r15d, dword [rbp + 0x78]
mov edi, r15d
cmp r15d, r14d
jae 0x1401a1d27
mov eax, edi
cmp byte [rax + r12], 0
jne 0x1401a1d27
inc edi
cmp edi, r14d
jb 0x1401a1d17
cmp edi, r14d
je 0x1401a1d82
mov eax, edi
cmp byte [rax + r12], 1
jne 0x1401a1d82
mov rdx, qword [rbp - 0x10]
mov rcx, r12
mov r8d, r15d
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1401a1d82
mov rax, qword [rbp + 0x60]
cmp byte [rax], 0
jne 0x1401a1d82
mov rcx, qword [rbp + 0x58]
sub edi, r15d
sub r14d, edi
sub r14d, r15d
dec r14d
mov eax, dword [rcx]
mov dword [rcx], r14d
cmp eax, r14d
jb 0x1401a1d8c
mov rcx, qword [rbp + 0x50]
lea edx, [r15 + 1]
add edx, edi
mov r8d, r14d
add rdx, r12
call sub.msvcrt.dll_memcpy
jmp 0x1401a1d98
mov esi, 0xc004d210
jmp 0x1401a1b72
mov ecx, 0x8007006f
mov esi, ecx
call fcn.14007ac40
mov ecx, esi
call fcn.14007ace8
test rbx, rbx
je 0x1401a1db8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret