Function at 0x14009f1d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x848]
sub rsp, 0x920
mov rax, qword [0x140181c48]
xor rax, rsp
mov qword [rbp + 0x810], rax
mov rsi, rcx
mov qword [rsp + 0x60], rcx
mov ecx, 0x69
call fcn.140018c14
mov rcx, qword [rsi]
call fcn.1400829d4
mov qword [rbp - 0x68], rax
xor edx, edx
movabs r8, 0x7fffffff7fffffff
mov rcx, qword [rsi]
call fcn.1400a2690
and qword [rbp - 0x60], 0
xor r12d, r12d
mov qword [rbp - 0x58], r12
and qword [rbp - 0x50], r12
and qword [rbp - 0x48], r12
xor edi, edi
lea r15, [rsi + 0x100]
mov qword [rsp + 0x70], r15
lea r13d, [r12 + 1]
cmp qword [rsi + 0xc8], rdi
jbe 0x14009f29e
xor ebx, ebx
mov rcx, qword [rsi + 0xc0]
mov rax, qword [r15]
cmp qword [rcx + rbx], rax
jne 0x14009f288
mov edx, dword [rcx + rbx + 8]
lea rcx, [rbp - 0x60]
call fcn.1400a06cc
add rdi, r13
add rbx, 0x18
cmp rdi, qword [rsi + 0xc8]
jb 0x14009f26b
mov r12, qword [rbp - 0x58]
jmp 0x14009f2a3
mov qword [rsp + 0x70], r15
mov eax, 0x818
mul r12
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140117fec
mov r14, rax
mov qword [rsp + 0x68], rax
lea r9, [0x1400a0430]
mov r8d, 0x20
mov rdx, qword [rsi + 0x88]
mov rcx, qword [rsi + 0x80]
call fcn.140128d30
mov rdx, qword [rsi + 0xa8]
lea rcx, [rbp - 0x80]
call fcn.14009de80
nop
xor r10d, r10d
cmp qword [rsi + 0xa8], r10
jbe 0x14009f371
xor r9d, r9d
mov r14, qword [rbp - 0x80]
mov r8, qword [rsi + 0xa0]
mov rax, qword [r15]
cmp qword [r9 + r8], rax
jne 0x14009f35c
mov r8, qword [r9 + r8 + 8]
mov rdx, r8
shr rdx, 3
and rdx, qword [rbp - 0x70]
movzx ecx, byte [rdx + r14]
mov eax, r8d
and eax, 7
bts ecx, eax
mov byte [rdx + r14], cl
shr r8, 0x1e
mov rcx, r8
shr rcx, 3
and rcx, qword [rbp - 0x70]
movzx eax, byte [rcx + r14]
and r8d, 7
bts eax, r8d
mov byte [rcx + r14], al
add r10, r13
add r9, 0x28
cmp r10, qword [rsi + 0xa8]
jb 0x14009f30a
mov r14, qword [rsp + 0x68]
lea rcx, [rbp + 0x10]
call fcn.1400787fc
xor edi, edi
mov dword [rsp + 0x4c], edi
mov r15d, 0x7fffffff
mov dword [rsp + 0x58], r15d
xor edx, edx
test r12, r12
je 0x14009f421
xor eax, eax
mov rsi, qword [rbp - 0x60]
imul r10, rax, 0x818
mov ecx, dword [rsi + rax*4]
mov dword [r10 + r14], ecx
mov eax, ecx
cmp ecx, edi
cmovbe eax, edi
mov edi, eax
cmp ecx, r15d
cmovae ecx, r15d
mov r15d, ecx
mov byte [r10 + r14 + 0x810], 0
xor r8d, r8d
lea r9, [r10 + 8]
add r9, r14
mov ebx, 0x100
movzx eax, r8b
mov rcx, qword [rbp + rax*8 + 0x10]
cmp dword [r10 + r14], 0
jbe 0x14009f3fa
mov r11d, dword [r10 + r14]
movzx eax, cl
shr rcx, 8
xor rcx, qword [rbp + rax*8 + 0x10]
sub r11, r13
jne 0x14009f3e9
mov qword [r9], rcx
add r8, r13
add r9, 8
sub rbx, r13
jne 0x14009f3d5
add edx, r13d
mov eax, edx
cmp rax, r12
jb 0x14009f39c
mov dword [rsp + 0x4c], edi
mov dword [rsp + 0x58], r15d
mov rsi, qword [rsp + 0x60]
mov ebx, 0x400000
mov ecx, ebx
call fcn.140117fec
mov r15, rax
mov qword [rsp + 0x78], rax
mov r9, qword [rsi]
mov rcx, qword [r9]
mov rax, qword [rcx + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, r9
call qword [case.0x1400a07c7.0]
mov r9, qword [rsi]
mov rcx, qword [r9]
mov rax, qword [rcx + 0x18]
mov r8d, ebx
mov rdx, r15
mov rcx, r9
call qword [case.0x1400a07c7.0]
movsxd r13, eax
mov qword [rsp + 0x30], r13
xor edi, edi
test r12, r12
je 0x14009f4b2
xor eax, eax
lea esi, [rdi + 1]
imul rbx, rax, 0x818
mov r8d, dword [rbx + r14]
cmp r13, r8
jb 0x14009f4a4
mov rdx, r15
xor ecx, ecx
call fcn.14007867c
mov qword [rbx + r14 + 0x808], rax
mov byte [rbx + r14 + 0x810], sil
add edi, esi
mov eax, edi
cmp rax, r12
jb 0x14009f47a
mov rsi, qword [rsp + 0x60]
and dword [rsp + 0x48], 0
and qword [rsp + 0x68], 0
xor edx, edx
mov qword [rsp + 0x40], rdx
xor edi, edi
mov ecx, dword [rsp + 0x4c]
mov qword [rsp + 0x38], rcx
jmp 0x14009f4d6
mov r13, qword [rsp + 0x30]
lea rax, [rdi + 0x40]
cmp rax, r13
jae 0x14009f5ec
cmp byte [rdi + r15], 0x7b
jne 0x14009f5ec
cmp byte [rdi + r15 + 1], 0x52
jne 0x14009f5ec
cmp byte [rdi + r15 + 2], 0x42
jne 0x14009f5ec
cmp byte [rdi + r15 + 3], 0x7d
jne 0x14009f5ec
mov eax, 1
cmp byte [rdi + r15 + 0x14], al
jne 0x14009f5ec
mov ebx, dword [rdi + r15 + 0xc]
lea rax, [rcx + rbx]
add rax, rdi
cmp rax, r13
jae 0x14009f5ec
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
lea rax, [rdi + rdx]
mov qword [rbp - 8], rax
lea rax, [0x1400a0430]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x80]
lea rcx, [rbp - 0x18]
call fcn.1401293c4
test rax, rax
je 0x14009f5ec
add rdi, rbx
xor r13d, r13d
test r12, r12
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
je 0x14009f4d1
xor eax, eax
lea rcx, [rdi + r15]
mov r15, rcx
lea esi, [rax + 1]
imul rbx, rax, 0x818
mov r8d, dword [rbx + r14]
mov rdx, r15
xor ecx, ecx
call fcn.14007867c
mov qword [rbx + r14 + 0x808], rax
mov byte [rbx + r14 + 0x810], sil
add r13d, esi
mov eax, r13d
cmp rax, r12
jb 0x14009f59e
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x78]
mov r13, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
jmp 0x14009f4d6
xor r10d, r10d
mov dword [rsp + 0x50], r10d
xor r13b, r13b
xor ebx, ebx
test r12, r12
je 0x14009f812
xor eax, eax
mov r15, qword [rsp + 0x68]
lea r8d, [r10 + 1]
imul r9, rax, 0x818
cmp byte [r9 + r14 + 0x810], 0
je 0x14009f789
mov r8, qword [r9 + r14 + 0x808]
mov qword [rbp - 0x38], r8
mov cl, r8b
and cl, 7
mov edx, 1
shl edx, cl
mov rax, r8
shr rax, 3
and rax, qword [rbp - 0x70]
mov r11, qword [rbp - 0x80]
test byte [rax + r11], dl
je 0x14009f783
shr r8, 0x1e
mov cl, r8b
and cl, 7
mov edx, 1
shl edx, cl
shr r8, 3
and r8, qword [rbp - 0x70]
test byte [r8 + r11], dl
je 0x14009f783
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rbp - 0x40], rax
mov eax, dword [r9 + r14]
mov dword [rbp - 0x20], eax
lea rax, [0x1400a03d0]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
mov r8, qword [rsi + 0xa8]
mov rdx, qword [rsi + 0xa0]
lea rcx, [rbp - 0x40]
call fcn.1401293c4
mov r8, rax
test rax, rax
je 0x14009f77e
mov rdx, qword [rax + 0x18]
mov r11, qword [rax + 0x10]
mov rcx, r11
sub rcx, rdx
mov r10, rdx
sub r10, r11
cmp rdx, r11
cmovbe r10, rcx
mov r9, qword [rsp + 0x40]
add r9, rdi
mov rax, r11
sub rax, r9
mov rcx, r9
sub rcx, r11
cmp r9, r11
cmovbe rcx, rax
movabs rax, 0x7fffffff7fffffff
cmp rdx, rax
je 0x14009f70a
cmp rcx, r10
jae 0x14009f77e
mov qword [r8 + 0x18], r9
mov r10d, dword [rbp - 0x20]
mov dword [rsp + 0x50], r10d
test r15, r15
je 0x14009f748
mov eax, dword [r15 + 0x20]
cmp eax, dword [r8 + 0x20]
jne 0x14009f748
mov rcx, qword [r15 + 0x18]
add rcx, rax
cmp rcx, r9
jne 0x14009f748
mov rcx, qword [r15 + 0x10]
add rcx, rax
cmp rcx, r11
jne 0x14009f748
mov r11d, dword [rsp + 0x48]
inc r11d
jmp 0x14009f74b
xor r11d, r11d
mov dword [rsp + 0x48], r11d
xor edx, edx
mov eax, dword [rsp + 0x4c]
div dword [r8 + 0x20]
inc eax
mov ecx, 5
cmp eax, ecx
cmovb eax, ecx
movzx r13d, r13b
cmp r11d, eax
mov ecx, 1
cmova r13d, ecx
mov r15, r8
mov r8d, ecx
jmp 0x14009f789
mov r10d, dword [rsp + 0x50]
mov r8d, 1
add ebx, r8d
mov eax, ebx
cmp rax, r12
jb 0x14009f60d
mov qword [rsp + 0x68], r15
mov r15, qword [rsp + 0x78]
test r13b, r13b
je 0x14009f812
mov rdx, qword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
test r10d, r10d
je 0x14009f81c
mov ecx, r10d
lea rax, [rdx + rcx]
add rax, rdi
cmp rax, r13
jae 0x14009f81c
cmp byte [rdi + r15], 0
je 0x14009f81c
add rdi, rcx
xor r13d, r13d
xor eax, eax
lea rcx, [rdi + r15]
mov r15, rcx
lea esi, [rax + 1]
imul rbx, rax, 0x818
mov r8d, dword [rbx + r14]
mov rdx, r15
xor ecx, ecx
call fcn.14007867c
mov qword [rbx + r14 + 0x808], rax
mov byte [rbx + r14 + 0x810], sil
add r13d, esi
mov eax, r13d
cmp rax, r12
jb 0x14009f7dd
jmp 0x14009f5ce
mov rdx, qword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
lea rax, [rdx + rdi]
cmp rax, r13
jb 0x14009f897
mov rbx, r13
sub rbx, rdi
cmp rbx, rdx
jne 0x14009f887
call fcn.1400ab4fc
lea rdx, [rdi + r15]
mov r8, rbx
mov rcx, r15
call fcn.14011a0e0
xor edi, edi
sub r13, rbx
add qword [rsp + 0x40], r13
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov r8d, 0x400000
sub r8, rbx
lea rdx, [rbx + r15]
mov rax, qword [rax + 0x18]
call qword [case.0x1400a07c7.0]
movsxd r13, eax
add r13, rbx
mov qword [rsp + 0x30], r13
mov r8, qword [rbp - 0x68]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsi]
call fcn.1400a2690
mov eax, dword [rsp + 0x58]
add rax, rdi
cmp rax, r13
jae 0x14009f917
xor r10d, r10d
test r12, r12
je 0x14009f90f
xor r8d, r8d
lea esi, [r10 + 1]
imul r9, r8, 0x818
mov r11d, dword [r9 + r14]
add r11, rdi
cmp r11, r13
jae 0x14009f8f6
mov rdx, qword [r9 + r14 + 0x808]
movzx ecx, byte [rdi + r15]
imul rax, r8, 0x103
add rcx, rax
movzx eax, byte [r11 + r15]
xor rax, rdx
movzx eax, al
mov rcx, qword [r14 + rcx*8 + 8]
xor rcx, qword [rbp + rax*8 + 0x10]
shr rdx, 8
xor rcx, rdx
mov qword [r9 + r14 + 0x808], rcx
jmp 0x14009f8ff
mov byte [r9 + r14 + 0x810], 0
add r10d, esi
mov r8d, r10d
cmp r8, r12
jb 0x14009f8a6
mov rsi, qword [rsp + 0x60]
inc rdi
jmp 0x14009f5dd
mov rcx, r15
call fcn.140117b78
mov rcx, r14
call fcn.140117b78
mov edx, reloc.SHELL32.dll_SHRestricted
mov r8d, edx
mov rcx, qword [rsi]
call fcn.1400a2690
nop
mov edx, 1
mov rcx, qword [rbp - 0x80]
call fcn.140117b78
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14009f955
call fcn.140123a48
mov rcx, qword [rbp + 0x810]
xor rcx, rsp
call fcn.140117fa0
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret