Function at 0x10009d30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1328
call fcn.1004b140
sub rsp, rax
movdqa xmmword [rsp + 0x1310], xmm9
movdqa xmmword [rsp + 0x1300], xmm8
movdqa xmmword [rsp + 0x12f0], xmm7
movdqa xmmword [rsp + 0x12e0], xmm6
mov qword [rsp + 0xd8], r8
mov qword [rsp + 0xd0], rdx
mov rsi, rcx
call fcn.1004d310
test eax, eax
mov qword [rsp + 0xc8], rsi
je 0x1000a1f7
call fcn.1004d310
test eax, eax
je 0x1000b068
xorps xmm0, xmm0
movaps xmmword [rsp + 0x3c0], xmm0
movaps xmmword [rsp + 0x3b0], xmm0
movaps xmmword [rsp + 0x3a0], xmm0
movaps xmmword [rsp + 0x390], xmm0
movaps xmmword [rsp + 0x380], xmm0
movaps xmmword [rsp + 0x370], xmm0
movaps xmmword [rsp + 0x360], xmm0
movaps xmmword [rsp + 0x350], xmm0
movaps xmmword [rsp + 0x340], xmm0
movaps xmmword [rsp + 0x330], xmm0
movaps xmmword [rsp + 0x320], xmm0
movaps xmmword [rsp + 0x310], xmm0
movaps xmmword [rsp + 0x300], xmm0
movaps xmmword [rsp + 0x2f0], xmm0
movaps xmmword [rsp + 0x2e0], xmm0
lea r12, [rsp + 0x350]
lea r13, [rsp + 0x340]
lea rbp, [rsp + 0x330]
lea rdi, [rsp + 0x320]
lea rbx, [rsp + 0x310]
lea rsi, [rsp + 0x300]
lea r15, [rsp + 0x2f0]
mov byte [rsp + 0x3d0], 0xa
lea rcx, str.fi1du5epf48x1hlv1f15787e3v42qh3lError_decrypting:
lea r14, [rsp + 0x2e0]
mov rdx, r14
call fcn.1004cf80
mov rcx, r15
call fcn.1004cef0
mov rcx, rsi
call fcn.1004cef0
mov rcx, rbx
call fcn.1004cef0
mov rcx, rdi
call fcn.1004cef0
mov rcx, rbp
call fcn.1004cef0
mov rcx, r13
call fcn.1004cef0
mov rcx, r12
call fcn.1004cef0
lea rcx, [rsp + 0x360]
call fcn.1004cef0
lea rcx, [rsp + 0x370]
call fcn.1004cef0
lea rcx, [rsp + 0xe8]
mov r8d, 0xf1
mov rdx, r14
call sub.ntdll.dll_memcpy
movzx eax, byte [0x100cf160]
mov rcx, qword [0x100cf0d0]
test rcx, rcx
jne 0x10009f09
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1000b046
mov rcx, rax
mov qword [0x100cf0d0], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1000b046
mov rsi, rax
movups xmm0, xmmword [0x10085f98]
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x2e0]
lea rdx, [rsp + 0xe8]
mov r8d, 0xf1
call sub.ntdll.dll_memcpy
movzx eax, byte [0x100cf160]
mov rcx, qword [0x100cf0d0]
test rcx, rcx
jne 0x10009f72
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1000b046
mov rcx, rax
mov qword [0x100cf0d0], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1000b046
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0x2e0]
mov r8d, 0xf1
call sub.ntdll.dll_memcpy
movzx eax, byte [0x100cf160]
mov rcx, qword [0x100cf0d0]
test rcx, rcx
jne 0x10009fd7
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1000b046
mov rcx, rax
mov qword [0x100cf0d0], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1000b046
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movzx eax, byte [0x100cf160]
mov rcx, qword [0x100cf0d0]
test rcx, rcx
jne 0x1000a021
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1000b046
mov rcx, rax
mov qword [0x100cf0d0], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1000b046
mov r13, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x2e0]
lea rdx, [rsp + 0x1e0]
mov r8d, 0xf1
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x5b]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x93], ecx
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x3b]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x33], ecx
movzx eax, byte [0x100cf160]
mov rcx, qword [0x100cf0d0]
test rcx, rcx
jne 0x1000a0c6
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1000b057
mov rcx, rax
mov qword [0x100cf0d0], rax
mov r8d, 0x1c8
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1000b057
mov r14, rax
mov qword [rax], rsi
mov qword [rax + 8], 0x10
mov qword [rax + 0x10], 0x10
mov qword [rax + 0x18], 1
pxor xmm6, xmm6
movdqu xmmword [rax + 0x20], xmm6
mov qword [rax + 0x30], r12
mov qword [rax + 0x38], 0x10
mov qword [rax + 0x40], 0x10
mov qword [rax + 0x48], 0x10
mov qword [rax + 0x50], 0
mov qword [rax + 0x58], r15
mov qword [rax + 0x60], 0x10
mov qword [rax + 0x68], 0x10
mov rcx, rax
add rcx, 0x70
lea rdx, [rsp + 0x2e0]
mov r8d, 0xf1
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x90]
mov ecx, dword [rsp + 0x93]
mov dword [r14 + 0x164], ecx
mov dword [r14 + 0x161], eax
mov qword [r14 + 0x168], 0x10
mov qword [r14 + 0x170], r13
mov qword [r14 + 0x178], 0x10
mov qword [r14 + 0x180], 0x10
mov qword [r14 + 0x188], 0x10
movdqu xmmword [r14 + 0x190], xmm6
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmm1, xmmword [rsp + 0xb0]
movups xmmword [r14 + 0x1a0], xmm0
movups xmmword [r14 + 0x1b0], xmm1
mov byte [r14 + 0x1c0], 2
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x33]
mov dword [r14 + 0x1c1], eax
mov dword [r14 + 0x1c4], ecx
lea rdi, [0x1004f800]
jmp 0x1000acbc
xorps xmm0, xmm0
movaps xmmword [rsp + 0x380], xmm0
movaps xmmword [rsp + 0x370], xmm0
movaps xmmword [rsp + 0x360], xmm0
movaps xmmword [rsp + 0x350], xmm0
movaps xmmword [rsp + 0x340], xmm0
movaps xmmword [rsp + 0x330], xmm0
movaps xmmword [rsp + 0x320], xmm0
movaps xmmword [rsp + 0x310], xmm0
movaps xmmword [rsp + 0x300], xmm0
movaps xmmword [rsp + 0x2f0], xmm0
movaps xmm0, xmmword [str.fi1du5epf48x1hlv]
movaps xmmword [rsp + 0x2e0], xmm0
mov esi, 4
jmp 0x1000a2a2
lea rcx, [rsi + 1]
lea rdx, [rsi*4 - 0x10]
and rdx, 0xfffffffffffffff0
add rdx, rsp
add rdx, 0x2e0
shl rsi, 2
and rsi, 0xfffffffffffffff0
xor eax, dword [rdx + r8*4]
lea rdx, [rsp + rsi]
add rdx, 0x2e0
mov dword [rdx + r8*4], eax
mov rsi, rcx
cmp rcx, 0x2c
je 0x1000a5d5
lea rax, [rsi - 1]
mov ecx, eax
and ecx, 3
and rax, 0xfffffffffffffffc
lea rax, [rsp + rax*4]
add rax, 0x2e0
mov eax, dword [rax + rcx*4]
mov r8, rsi
and r8, 3
jne 0x1000a260
mov qword [rsp + 0xe0], r8
rol eax, 0x18
movzx r10d, ax
mov ecx, eax
and ecx, 1
mov r12d, r10d
shr r12d, 4
mov edx, r12d
and edx, 0x10
or edx, ecx
mov ebp, eax
shr ebp, 8
mov ecx, ebp
and ecx, 0x100
or ecx, edx
mov r13d, eax
shr r13d, 0xc
mov edx, r13d
and edx, 0x1000
or edx, ecx
mov dword [rsp + 0x50], edx
mov ecx, eax
shr ecx, 1
and ecx, 1
mov edx, r10d
shr edx, 5
mov r8d, edx
and r8d, 0x10
or r8d, ecx
mov edi, eax
shr edi, 9
mov ecx, edi
and ecx, 0x100
or ecx, r8d
mov r15d, eax
shr r15d, 0xd
mov r8d, r15d
and r8d, 0x1000
or r8d, ecx
mov dword [rsp + 0x8c], r8d
mov ecx, eax
shr ecx, 2
and ecx, 1
mov r14d, r10d
shr r14d, 6
mov r8d, r14d
and r8d, 0x10
or r8d, ecx
mov r9d, eax
shr r9d, 0xa
mov ecx, r9d
and ecx, 0x100
or ecx, r8d
mov r11d, eax
shr r11d, 0xe
mov r8d, r11d
and r8d, 0x1000
or r8d, ecx
mov dword [rsp + 0x88], r8d
mov ecx, eax
shr ecx, 3
and ecx, 1
shr r10d, 7
mov dword [rsp + 0x84], r10d
and r10d, 0x10
or r10d, ecx
mov r8d, eax
shr r8d, 0xb
mov ecx, r8d
and ecx, 0x100
or ecx, r10d
mov r10d, eax
shr r10d, 0xf
mov ebx, r10d
and ebx, 0x1000
or ebx, ecx
and r12d, 1
and ebp, 0x10
or ebp, r12d
and r13d, 0x100
or r13d, ebp
mov ebp, eax
shr ebp, 0x10
and ebp, 0x1000
or ebp, r13d
and edx, 1
and edi, 0x10
or edi, edx
and r15d, 0x100
or r15d, edi
mov edx, eax
shr edx, 0x11
and edx, 0x1000
or edx, r15d
and r14d, 1
and r9d, 0x10
or r9d, r14d
and r11d, 0x100
or r11d, r9d
mov r9d, eax
shr r9d, 0x12
and r9d, 0x1000
or r9d, r11d
mov ecx, dword [rsp + 0x84]
and ecx, 1
and r8d, 0x10
or r8d, ecx
and r10d, 0x100
or r10d, r8d
shr eax, 0x13
and eax, 0x1000
or eax, r10d
mov r8d, dword [rsp + 0x50]
xor r9d, r8d
xor edx, r9d
mov ecx, edx
mov r10d, dword [rsp + 0x8c]
xor ecx, r10d
xor ebx, r10d
mov r10d, dword [rsp + 0x88]
xor r9d, r10d
xor r9d, ebx
mov word [rsp + 0xe8], r9w
mov word [rsp + 0xea], dx
mov word [rsp + 0xec], r8w
xor r8d, ebp
xor r8d, eax
xor r8d, ebx
mov r9d, edx
xor r9d, ebp
xor edx, eax
xor eax, r10d
mov word [rsp + 0xee], r8w
mov word [rsp + 0xf0], dx
xor eax, ecx
mov word [rsp + 0xf2], cx
mov word [rsp + 0xf4], r9w
mov word [rsp + 0xf6], ax
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0xe8]
call fcn.10012a00
mov r10d, dword [rsp + 0x1e8]
mov r9d, dword [rsp + 0x1ec]
movzx eax, word [rsp + 0x1e0]
xor ax, r9w
xor r9d, r10d
movzx edx, word [rsp + 0x1e6]
movzx ebx, word [rsp + 0x1ea]
mov ecx, ebx
xor ecx, edx
movzx ebp, word [rsp + 0x1ee]
mov r8d, ecx
xor r8d, ebp
movzx edi, word [rsp + 0x1e2]
movzx r11d, word [rsp + 0x1e4]
xor r11w, cx
xor r11d, eax
mov r14d, r8d
xor r14d, r9d
xor r9d, edi
not r9d
xor edi, r10d
xor edi, ebx
not edi
not eax
xor edx, ebp
not edx
mov word [rsp + 0x58], r9w
mov word [rsp + 0x5a], di
mov word [rsp + 0x5c], r11w
mov word [rsp + 0x5e], r14w
mov word [rsp + 0x60], r8w
mov word [rsp + 0x62], ax
mov word [rsp + 0x64], dx
mov word [rsp + 0x66], cx
lea rcx, [rsp + 0x58]
xor edx, edx
call fcn.10012d30
mov rdx, rsi
shr rdx, 2
lea rcx, [rdx - 1]
cmp rcx, 9
ja 0x1000b022
lea rcx, [0x100c5270]
xor eax, dword [rcx + rdx*4 - 4]
mov r8, qword [rsp + 0xe0]
jmp 0x1000a260
mov eax, 0x10
movdqa xmm0, xmmword [0x1004f010]
movdqa xmm1, xmmword [0x1004f020]
movdqa xmm2, xmmword [str.eeee]
nop word cs:[rax + rax]
movdqa xmm3, xmmword [rsp + rax + 0x2e0]
movdqa xmm5, xmm3
paddd xmm5, xmm3
pand xmm5, xmm0
movdqa xmm4, xmm3
psrld xmm4, 7
pand xmm4, xmm1
pshufd xmm6, xmm4, 0xf5
pmuludq xmm4, xmm2
pshufd xmm4, xmm4, 0xe8
pmuludq xmm6, xmm2
pshufd xmm6, xmm6, 0xe8
punpckldq xmm4, xmm6
pxor xmm4, xmm5
movdqa xmm6, xmm4
paddd xmm6, xmm4
pand xmm6, xmm0
movdqa xmm5, xmm4
psrld xmm5, 7
pand xmm5, xmm1
pshufd xmm7, xmm5, 0xf5
pmuludq xmm5, xmm2
pshufd xmm5, xmm5, 0xe8
pmuludq xmm7, xmm2
pshufd xmm7, xmm7, 0xe8
punpckldq xmm5, xmm7
pxor xmm5, xmm6
movdqa xmm7, xmm5
paddd xmm7, xmm5
pand xmm7, xmm0
movdqa xmm6, xmm5
psrld xmm6, 7
pand xmm6, xmm1
pshufd xmm8, xmm6, 0xf5
pmuludq xmm6, xmm2
pshufd xmm6, xmm6, 0xe8
pmuludq xmm8, xmm2
pshufd xmm8, xmm8, 0xe8
punpckldq xmm6, xmm8
pxor xmm6, xmm7
pxor xmm3, xmm6
movdqa xmm7, xmm3
pxor xmm7, xmm4
movdqa xmm8, xmm7
psrld xmm8, 8
pslld xmm7, 0x18
por xmm7, xmm8
movdqa xmm8, xmm3
pxor xmm8, xmm5
movdqa xmm9, xmm8
psrld xmm9, 0x10
pslld xmm8, 0x10
por xmm8, xmm9
movdqa xmm9, xmm3
psrld xmm9, 0x18
pslld xmm3, 8
por xmm3, xmm9
pxor xmm3, xmm8
pxor xmm7, xmm4
pxor xmm7, xmm3
pxor xmm6, xmm5
pxor xmm6, xmm7
movdqa xmmword [rsp + rax + 0x2e0], xmm6
add rax, 0x10
cmp rax, 0xa0
jne 0x1000a600
mov edx, dword [rsp + 0x2e0]
mov r8d, dword [rsp + 0x2e4]
mov r9d, dword [rsp + 0x2e8]
mov eax, dword [rsp + 0x2ec]
mov dword [rsp + 0x20], eax
lea rsi, [rsp + 0xe8]
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x1e0], xmm0
mov edx, dword [rsp + 0x2f0]
mov r8d, dword [rsp + 0x2f4]
mov r9d, dword [rsp + 0x2f8]
mov eax, dword [rsp + 0x2fc]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x1f0], xmm0
mov edx, dword [rsp + 0x300]
mov r8d, dword [rsp + 0x304]
mov r9d, dword [rsp + 0x308]
mov eax, dword [rsp + 0x30c]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x200], xmm0
mov edx, dword [rsp + 0x310]
mov r8d, dword [rsp + 0x314]
mov r9d, dword [rsp + 0x318]
mov eax, dword [rsp + 0x31c]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x210], xmm0
mov edx, dword [rsp + 0x320]
mov r8d, dword [rsp + 0x324]
mov r9d, dword [rsp + 0x328]
mov eax, dword [rsp + 0x32c]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x220], xmm0
mov edx, dword [rsp + 0x330]
mov r8d, dword [rsp + 0x334]
mov r9d, dword [rsp + 0x338]
mov eax, dword [rsp + 0x33c]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x230], xmm0
mov edx, dword [rsp + 0x340]
mov r8d, dword [rsp + 0x344]
mov r9d, dword [rsp + 0x348]
mov eax, dword [rsp + 0x34c]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x240], xmm0
mov edx, dword [rsp + 0x350]
mov r8d, dword [rsp + 0x354]
mov r9d, dword [rsp + 0x358]
mov eax, dword [rsp + 0x35c]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x250], xmm0
mov edx, dword [rsp + 0x360]
mov r8d, dword [rsp + 0x364]
mov r9d, dword [rsp + 0x368]
mov eax, dword [rsp + 0x36c]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x260], xmm0
mov edx, dword [rsp + 0x370]
mov r8d, dword [rsp + 0x374]
mov r9d, dword [rsp + 0x378]
mov eax, dword [rsp + 0x37c]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x270], xmm0
mov edx, dword [rsp + 0x380]
mov r8d, dword [rsp + 0x384]
mov r9d, dword [rsp + 0x388]
mov eax, dword [rsp + 0x38c]
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.10013110
movups xmm0, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x280], xmm0
lea rcx, [rsp + 0xe8]
lea rdx, [rsp + 0x1e0]
mov r8d, 0xb0
call sub.ntdll.dll_memcpy
movzx eax, byte [0x100cf160]
mov rcx, qword [0x100cf0d0]
test rcx, rcx
jne 0x1000aa05
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1000b046
mov rcx, rax
mov qword [0x100cf0d0], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1000b046
mov rsi, rax
movups xmm0, xmmword [0x10085f98]
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x2e0]
lea rdx, [rsp + 0xe8]
mov r8d, 0xb0
call sub.ntdll.dll_memcpy
movzx eax, byte [0x100cf160]
mov rcx, qword [0x100cf0d0]
test rcx, rcx
jne 0x1000aa6e
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1000b046
mov rcx, rax
mov qword [0x100cf0d0], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1000b046
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0x2e0]
mov r8d, 0xb0
call sub.ntdll.dll_memcpy
movzx eax, byte [0x100cf160]
mov rcx, qword [0x100cf0d0]
test rcx, rcx
jne 0x1000aad3
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1000b046
mov rcx, rax
mov qword [0x100cf0d0], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1000b046
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movzx eax, byte [0x100cf160]
mov rcx, qword [0x100cf0d0]
test rcx, rcx
jne 0x1000ab1d
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1000b046
mov rcx, rax
mov qword [0x100cf0d0], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1000b046
mov r13, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x2e0]
lea rdx, [rsp + 0x1e0]
mov r8d, 0xb0
call sub.ntdll.dll_memcpy
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x5b]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3b], ecx
movzx eax, byte [0x100cf160]
mov rcx, qword [0x100cf0d0]
test rcx, rcx
jne 0x1000abac
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1000b06f
mov rcx, rax
mov qword [0x100cf0d0], rax
mov r8d, 0x180
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1000b06f
mov r14, rax
mov qword [rax], rsi
mov qword [rax + 8], 0x10
mov qword [rax + 0x10], 0x10
mov qword [rax + 0x18], 1
pxor xmm6, xmm6
movdqu xmmword [rax + 0x20], xmm6
mov qword [rax + 0x30], r12
mov qword [rax + 0x38], 0x10
mov qword [rax + 0x40], 0x10
mov qword [rax + 0x48], 0x10
mov qword [rax + 0x50], 0
mov qword [rax + 0x58], r15
mov qword [rax + 0x60], 0x10
mov qword [rax + 0x68], 0x10
mov rcx, rax
add rcx, 0x70
lea rdx, [rsp + 0x2e0]
mov r8d, 0xb0
call sub.ntdll.dll_memcpy
mov qword [r14 + 0x120], 0x10
mov qword [r14 + 0x128], r13
mov qword [r14 + 0x130], 0x10
mov qword [r14 + 0x138], 0x10
mov qword [r14 + 0x140], 0x10
movdqu xmmword [r14 + 0x148], xmm6
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmm1, xmmword [rsp + 0xb0]
movups xmmword [r14 + 0x158], xmm0
movups xmmword [r14 + 0x168], xmm1
mov byte [r14 + 0x178], 2
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x3b]
mov dword [r14 + 0x179], eax
mov dword [r14 + 0x17c], ecx
lea rdi, [0x1004f820]
mov qword [rsp + 0x38], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 0
xor ebx, ebx
lea rsi, [rsp + 0x2e0]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call sub.ntdll.dll_memset
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xf0], 0x1000
mov qword [rsp + 0xf8], 0x1000
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x50], rdi
mov rsi, qword [rdi + 0x18]
mov edi, 1
lea r12, [rsp + 0xe8]
jmp 0x1000ad6e
mov qword [rsp + 0x48], rbx
test r13b, r13b
je 0x1000af5a
mov rcx, r14
lea rdx, [rsp + 0xa0]
mov r8, r12
mov r9b, 1
call rsi
mov r13d, edx
and r13b, 1
test al, 1
je 0x1000ae1a
mov byte [rsp + 0x30], r13b
lea rax, [rsp + 0x30]
mov qword [rsp + 0x90], rax
lea rax, [0x10013f60]
mov qword [rsp + 0x98], rax
lea rax, [0x10085fe0]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], 1
mov qword [rsp + 0x200], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1f8], 1
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x1e0]
call fcn.1000d1c0
mov rax, qword [rsp + 0x58]
movzx r13d, byte [rsp + 0x60]
test rax, rax
jne 0x1000af7d
mov rdx, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0x100]
cmp rbp, rdx
ja 0x1000b035
mov r15, qword [rsp + 0xe8]
mov qword [rsp + 0x100], 0
mov rax, qword [rsp + 0x40]
sub rax, rbx
cmp rax, rbp
jb 0x1000af31
test rbp, rbp
je 0x1000ad60
cmp rbp, 0x20
jb 0x1000ae74
lea rax, [rbx + rdi]
sub rax, r15
cmp rax, 0x20
jae 0x1000aee0
mov rax, r15
mov rcx, r15
lea rdx, [r15 + rbp]
add ebp, r15d
sub ebp, eax
not rax
add rax, rdx
and rbp, 3
je 0x1000aea3
nop
movzx r8d, byte [rcx]
inc rcx
mov byte [rdi + rbx], r8b
inc rbx
dec rbp
jne 0x1000ae90
cmp rax, 3
jb 0x1000ad60
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdi + rbx], al
movzx eax, byte [rcx + 1]
mov byte [rdi + rbx + 1], al
movzx eax, byte [rcx + 2]
mov byte [rdi + rbx + 2], al
movzx eax, byte [rcx + 3]
mov byte [rdi + rbx + 3], al
add rbx, 4
add rcx, 4
cmp rcx, rdx
jne 0x1000aeb0
jmp 0x1000ad60
mov rax, rbp
and rax, 0xffffffffffffffe0
lea rcx, [rdi + rbx]
add rcx, 0x10
add rbx, rax
xor edx, edx
nop word cs:[rax + rax]
movups xmm0, xmmword [r15 + rdx]
movups xmm1, xmmword [r15 + rdx + 0x10]
movups xmmword [rcx + rdx - 0x10], xmm0
movups xmmword [rcx + rdx], xmm1
add rdx, 0x20
cmp rax, rdx
jne 0x1000af00
cmp rbp, rax
je 0x1000ad60
add rax, r15
mov rcx, rax
jmp 0x1000ae7a
lea rcx, [rsp + 0x38]
mov rdx, rbx
mov r8, rbp
call fcn.100184e0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
cmp rbp, 0x20
jae 0x1000ae67
jmp 0x1000ae74
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
mov qword [rcx + 0x18], rax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rcx + 8], xmm0
mov qword [rcx], 0
jmp 0x1000afbf
mov rcx, qword [rsp + 0x61]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0xc8]
mov qword [r8 + 0x18], rdx
mov qword [r8 + 0x11], rcx
mov qword [r8 + 8], rax
mov byte [r8 + 0x10], r13b
mov qword [r8], 1
cmp qword [rsp + 0x40], 0
je 0x1000afbf
mov rcx, qword [0x100cf0d0]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov rcx, r14
mov rsi, qword [rsp + 0x50]
call qword [rsi]
cmp qword [rsi + 8], 0
je 0x1000afec
cmp qword [rsi + 0x10], 0x11
jb 0x1000afdb
mov r14, qword [r14 - 8]
mov rcx, qword [0x100cf0d0]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x12e0]
movaps xmm7, xmmword [rsp + 0x12f0]
movaps xmm8, xmmword [rsp + 0x1300]
movaps xmm9, xmmword [rsp + 0x1310]
add rsp, 0x1328
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.C:Users001.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rust_crypto_0.2.36_src_aessafe.rs
mov edx, 0xa
call fcn.1000dd60
ud2
lea r8, str.C:Users001.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rust_crypto_0.2.36_src_buffer.rs
mov rcx, rbp
call fcn.1000e630
ud2
mov ecx, 1
mov edx, 0x10
call fcn.1000cd70
ud2
mov ecx, 8
mov edx, 0x1c8
call fcn.1000cd70
ud2
call fcn.100129c0
ud2
mov ecx, 8
mov edx, 0x180
call fcn.1000cd70
ud2