Function at 0x1400b0bd0
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rdi, r8
mov r15, rdx
mov rsi, rcx
mov eax, dword [0x141dd2638]
imul eax, dword [0x141dd263c]
add eax, 0xfbfdcf25
imul rax, rax, 0x48f4b5d
shr rax, 0x38
cmp eax, 0xfc1c6016
jbe 0x1400b0c20
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
nop word [rax + rax]
mov eax, dword [0x141dd2640]
or eax, dword [0x141dd2644]
or eax, 0x9b0ab106
imul rcx, rax, 0x796bc955
shr rcx, 0x3d
add ecx, 0xaf54d657
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
cmp ecx, 0x93d76164
jb 0x1400b0c20
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov r12, rsp
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov rbx, rsp
mov eax, dword [0x141dd2648]
or eax, dword [0x141dd264c]
imul eax, eax, 0x3db8d0c3
cmp eax, 0x88ddb76e
je 0x1400b0ccf
mov r13d, dword [0x141dd2650]
imul r13d, dword [0x141dd2654]
or r13d, 0x4403c10c
and r13d, 0x440bc16e
sub rsp, 0x20
mov rcx, r12
mov rdx, r15
mov r8, rdi
call fcn.140090680
add rsp, 0x20
cmp r13d, 0x833de478
jne 0x1400b0ce7
sub rsp, 0x20
mov rcx, r12
mov rdx, r15
mov r8, rdi
call fcn.140090680
add rsp, 0x20
jmp 0x1400b0c93
mov r15, qword [r12]
mov rdi, qword [r12 + 8]
movabs r13, 0x8000000000000000
cmp r15, r13
jne 0x1400b0d1f
nop
mov eax, dword [0x141dd2658]
xor edx, edx
div dword [0x141dd265c]
or eax, 0xbff7ff6f
cmp eax, 0xd76c83ba
je 0x1400b0d00
jmp 0x1400b0e30
mov eax, 0xa810ffd7
nop word cs:[rax + rax]
mov ecx, dword [0x141dd2660]
or ecx, dword [0x141dd2664]
imul rcx, rax
shr rcx, 0x3f
xor ecx, 0x8afe8a19
cmp ecx, 0x7522d71a
jb 0x1400b0d30
mov r12, qword [r12 + 0x10]
mov eax, dword [0x141dd2668]
sub eax, dword [0x141dd266c]
xor eax, 0x6051186f
mov ecx, 0xbdcbe713
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0xc5ffd6ce
cmp eax, 0x21f5361f
jae 0x1400b0da0
mov qword [r14], r15
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], r12
sub rsp, 0x20
mov rcx, rbx
mov rdx, r14
call fcn.1400b1360
add rsp, 0x20
mov eax, dword [0x141dd2670]
imul eax, dword [0x141dd2674]
imul r13d, eax, 0x4082bea8
xor r13d, 0x9820923
or r13d, 0x647564cc
mov qword [r14], r15
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], r12
sub rsp, 0x20
mov rcx, rbx
mov rdx, r14
call fcn.1400b1360
add rsp, 0x20
cmp r13d, 0x6bed7d71
jb 0x1400b0da0
mov r14, qword [rbx]
nop dword [rax]
mov eax, dword [0x141dd2678]
imul eax, dword [0x141dd267c]
imul eax, eax, 0xa95bd95e
add eax, 0x46ac8fd4
cmp eax, 0x4850e99b
jb 0x1400b0df0
mov rdi, qword [rbx + 8]
movabs r13, 0x8000000000000000
cmp r14, r13
jne 0x1400b1030
nop word cs:[rax + rax]
mov eax, dword [0x141dd26a0]
xor eax, dword [0x141dd26a4]
imul rax, rax, 0x65d15761
shr rax, 0x3e
add eax, 0x226fb5f1
cmp eax, 0x7d34b2f7
ja 0x1400b0e30
mov eax, edi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400b12d4
test rax, rax
je 0x1400b12d4
cmp eax, 1
jne 0x1400b1071
lea rbx, [rdi - 1]
mov eax, dword [0x141dd26b0]
xor edx, edx
div dword [0x141dd26b4]
nop word [rax + rax]
mov eax, dword [0x141dd26b8]
mov ecx, dword [0x141dd26bc]
add eax, ecx
add eax, 0x227f141d
and eax, 0x464101e8
imul eax, eax, 0xc7685feb
cmp eax, 0x243d80a5
jb 0x1400b0e90
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov r15, qword [rdi]
test r15, r15
je 0x1400b0f30
mov eax, dword [0x141dd26c0]
xor edx, edx
div dword [0x141dd26c4]
imul eax, eax, 0xe2eb3467
add eax, 0xd8e0ea16
cmp eax, 0x194c2cbc
jae 0x1400b0f00
sub rsp, 0x20
mov rcx, r14
call r15
add rsp, 0x20
nop word cs:[rax + rax]
mov r12d, dword [0x141dd26c8]
sub r12d, dword [0x141dd26cc]
sub rsp, 0x20
mov rcx, r14
call r15
add rsp, 0x20
cmp r12d, 0x85c3c83b
je 0x1400b0f00
nop word cs:[rax + rax]
mov eax, dword [0x141dd26d0]
or eax, dword [0x141dd26d4]
or eax, 0xdea37f7f
and eax, 0xdebfffff
cmp eax, 0xda005e83
jb 0x1400b0f30
cmp qword [rdi + 8], 0
je 0x1400b12ba
cmp qword [rdi + 0x10], 0x11
jb 0x1400b1000
mov eax, dword [0x141dd26d8]
xor edx, edx
div dword [0x141dd26dc]
nop word cs:[rax + rax]
mov eax, dword [0x141dd26e0]
xor eax, dword [0x141dd26e4]
xor eax, 0xfa2bf0e9
imul eax, eax, 0x4a4af5c1
or eax, 0x55c5bf4c
cmp eax, 0x168f8131
je 0x1400b0f80
mov eax, 0x9596008d
nop dword [rax + rax]
mov ecx, dword [0x141dd26e8]
imul ecx, dword [0x141dd26ec]
imul rcx, rax
shr rcx, 0x3d
imul ecx, ecx, 0xc3a6cc12
cmp ecx, 0x74c43f4d
je 0x1400b0fb0
mov r14, qword [r14 - 8]
nop word [rax + rax]
mov eax, dword [0x141dd26f0]
xor edx, edx
div dword [0x141dd26f4]
imul eax, eax, 0x302305e0
and eax, 0xc856ea80
cmp eax, 0x28dabbeb
je 0x1400b0fe0
mov eax, dword [0x141dd26f8]
xor eax, dword [0x141dd26fc]
imul eax, eax, 0xd8bb9ecd
cmp eax, 0x705fa77
jne 0x1400b125e
jmp 0x1400b129e
mov eax, dword [str.4lHC]
sub eax, dword [0x141dd2684]
and eax, 0x644819
xor eax, 0x78230ab9
cmp eax, 0xda237bb7
ja 0x1400b1030
mov eax, dword [0x141dd2688]
xor eax, dword [0x141dd268c]
add eax, 0x4c18b10a
and eax, 0x10e388f7
add eax, 0x39ef983f
cmp eax, 0x49387194
jbe 0x1400b1096
jmp 0x1400b10e4
mov eax, dword [0x141dd26a8]
sub eax, dword [0x141dd26ac]
add eax, 0xd1e8eb87
xor eax, 0x81a804c4
imul eax, eax, 0xf2d13b4d
cmp eax, 0x77aaf62c
ja 0x1400b1071
ud2
mov eax, dword [0x141dd2690]
xor eax, dword [0x141dd2694]
mov ecx, 0x91a6c205
imul rcx, rax
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1a
imul r12d, eax, 0x3b2f1b2f
add r12d, 0xa99f5ac8
mov r15, qword [rbx + 0x10]
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add rsp, 0x20
cmp r12d, 0xd6bcce95
jae 0x1400b1100
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add rsp, 0x20
jmp 0x1400b1096
mov ecx, dword [0x141dd2698]
sub ecx, dword [0x141dd269c]
and ecx, 0x7a0c4f47
add ecx, 0x1c9d711
and ecx, 0x69922607
cmp ecx, 0xed583419
ja 0x1400b1100
cmp eax, 0xffffffff
je 0x1400b1161
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov eax, dword [0x141dd2710]
sub eax, dword [0x141dd2714]
mov ecx, 0x840e0db7
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x8012da99
cmp eax, 0x6f8d69d6
jne 0x1400b1227
jmp 0x1400b1258
mov qword [rsi], r13
nop word cs:[rax + rax]
mov eax, dword [0x141dd2720]
xor edx, edx
div dword [0x141dd2724]
or eax, 0x2f4f8c75
and eax, 0x2f4f9cff
cmp eax, 0xea00f640
ja 0x1400b1170
nop
mov eax, dword [0x141dd2728]
imul eax, dword [0x141dd272c]
imul eax, eax, 0xb4fe370a
add eax, 0x803f28cb
and eax, 0xebf39104
cmp eax, 0x11b14e01
je 0x1400b1190
test r14, r14
je 0x1400b1302
xor eax, eax
test al, al
je 0x1400b11d0
mov rax, qword [0x141dda6a0]
nop word [rax + rax]
mov eax, dword [0x141dd2730]
and eax, dword [0x141dd2734]
and eax, 0xd2d0a08c
imul rax, rax, 0x1eb0670d
shr rax, 0x3b
imul eax, eax, 0xa55b8b9c
mov rsi, qword [0x141dda6a0]
cmp eax, 0x11e96663
ja 0x1400b11d0
mov eax, dword [0x141dd2738]
or eax, dword [0x141dd273c]
or eax, 0x210a86da
imul eax, eax, 0x9c30eede
cmp eax, 0xff204bbb
jne 0x1400b1313
jmp 0x1400b133d
mov eax, dword [0x141dd2718]
add eax, dword [0x141dd271c]
imul rax, rax, 0x11c553d3
shr rax, 0x3c
imul eax, eax, 0xc295fb14
add eax, 0x8a4a1535
mov qword [rsi + 0x10], r15
cmp eax, 0x4763bb7d
jae 0x1400b1302
mov qword [rsi + 0x10], r15
jmp 0x1400b1227
mov eax, dword [0x141dd2700]
add eax, dword [0x141dd2704]
imul edi, eax, 0x4a874085
add edi, 0x41193118
and edi, 0xad1b34db
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp edi, 0xa4258c3c
jne 0x1400b12ba
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1400b125e
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov qword [rsi], r13
nop word [rax + rax]
mov eax, dword [0x141dd2708]
or eax, dword [0x141dd270c]
add eax, 0x56448570
xor eax, 0x20a7a09
and eax, 0xbb2afe09
cmp eax, 0xe87bdf2b
ja 0x1400b12e0
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ebx, dword [0x141dd2740]
and ebx, dword [0x141dd2744]
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp ebx, 0xbdae7742
jne 0x1400b1302
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1400b1313