Function at 0x1401ef450
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
test r8, r8
je 0x1401efdf2
mov qword [rsp + 8], rcx
push rbx
push rdi
mov eax, pe_nt_image_headers64
call fcn.140157170
sub rsp, rax
mov r11d, dword [rcx]
mov rax, r8
mov ebx, dword [rcx + 4]
mov edi, dword [rcx + 8]
mov r10d, dword [rcx + 0xc]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x2c], r10d
nop dword [rax]
dec rax
movzx ecx, byte [rdx]
mov qword [rsp + 0xa0], rax
movzx eax, byte [rdx + 1]
shl eax, 8
or ecx, eax
movzx r9d, byte [rdx + 4]
movzx eax, byte [rdx + 2]
shl eax, 0x10
or ecx, eax
movzx r8d, byte [rdx + 8]
movzx eax, byte [rdx + 3]
shl eax, 0x18
or ecx, eax
movzx eax, byte [rdx + 5]
shl eax, 8
or r9d, eax
mov dword [rsp + 0x98], ecx
movzx eax, byte [rdx + 6]
shl eax, 0x10
or r9d, eax
movzx eax, byte [rdx + 7]
shl eax, 0x18
or r9d, eax
mov eax, r10d
xor eax, edi
mov dword [rsp + 0xc], r9d
and eax, ebx
xor eax, r10d
add eax, ecx
add r11d, eax
mov ecx, r11d
shr ecx, 0x1d
lea eax, [r11*8]
movzx r11d, byte [rdx + 0xc]
or ecx, eax
movzx eax, byte [rdx + 9]
shl eax, 8
or r8d, eax
movzx eax, byte [rdx + 0xa]
shl eax, 0x10
or r8d, eax
movzx eax, byte [rdx + 0xb]
shl eax, 0x18
or r8d, eax
mov eax, edi
xor eax, ebx
mov dword [rsp + 4], r8d
and eax, ecx
xor eax, edi
add eax, r9d
add r10d, eax
movzx eax, byte [rdx + 0xd]
shl eax, 8
mov r9d, r10d
or r11d, eax
shl r10d, 7
movzx eax, byte [rdx + 0xe]
shl eax, 0x10
or r11d, eax
shr r9d, 0x19
movzx eax, byte [rdx + 0xf]
or r9d, r10d
shl eax, 0x18
or r11d, eax
mov eax, ebx
xor eax, ecx
mov dword [rsp + 0x18], r11d
and eax, r9d
xor eax, ebx
add eax, r8d
movzx r8d, byte [rdx + 0x10]
add edi, eax
movzx eax, byte [rdx + 0x11]
mov r10d, edi
shl eax, 8
shr r10d, 0x15
shl edi, 0xb
or r10d, edi
or r8d, eax
movzx eax, byte [rdx + 0x12]
shl eax, 0x10
or r8d, eax
movzx edi, byte [rdx + 0x14]
movzx eax, byte [rdx + 0x13]
shl eax, 0x18
or r8d, eax
mov eax, r9d
xor eax, ecx
mov dword [rsp], r8d
and eax, r10d
xor eax, ecx
add eax, r11d
add ebx, eax
movzx eax, byte [rdx + 0x15]
shl eax, 8
mov r11d, ebx
or edi, eax
shr ebx, 0xd
movzx eax, byte [rdx + 0x16]
shl eax, 0x10
or edi, eax
shl r11d, 0x13
movzx eax, byte [rdx + 0x17]
or r11d, ebx
movzx ebx, byte [rdx + 0x18]
shl eax, 0x18
or edi, eax
mov eax, r9d
xor eax, r10d
mov dword [rsp + 0x14], edi
and eax, r11d
xor eax, r9d
add eax, r8d
add ecx, eax
mov r8d, ecx
shr r8d, 0x1d
lea eax, [rcx*8]
or r8d, eax
movzx eax, byte [rdx + 0x19]
shl eax, 8
or ebx, eax
movzx eax, byte [rdx + 0x1a]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rdx + 0x1b]
shl eax, 0x18
or ebx, eax
mov eax, r10d
xor eax, r11d
mov dword [rsp + 8], ebx
and eax, r8d
xor eax, r10d
add eax, edi
movzx edi, byte [rdx + 0x1c]
add r9d, eax
movzx eax, byte [rdx + 0x1d]
shl eax, 8
mov ecx, r9d
or edi, eax
shl r9d, 7
movzx eax, byte [rdx + 0x1e]
shl eax, 0x10
or edi, eax
shr ecx, 0x19
movzx eax, byte [rdx + 0x1f]
or ecx, r9d
movzx r9d, byte [rdx + 0x20]
shl eax, 0x18
or edi, eax
mov eax, r11d
xor eax, r8d
mov dword [rsp + 0x1c], edi
and eax, ecx
xor eax, r11d
add eax, ebx
add r10d, eax
movzx eax, byte [rdx + 0x21]
mov ebx, r10d
shl r10d, 0xb
shr ebx, 0x15
or ebx, r10d
shl eax, 8
or r9d, eax
movzx ebp, byte [rdx + 0x28]
movzx eax, byte [rdx + 0x22]
shl eax, 0x10
or r9d, eax
movzx eax, byte [rdx + 0x23]
shl eax, 0x18
or r9d, eax
mov eax, ecx
xor eax, r8d
mov dword [rsp + 0xa8], r9d
and eax, ebx
xor eax, r8d
add eax, edi
add r11d, eax
movzx eax, byte [rdx + 0x25]
shl eax, 8
mov r10d, r11d
shr r11d, 0xd
shl r10d, 0x13
or r10d, r11d
movzx r11d, byte [rdx + 0x24]
or r11d, eax
movzx eax, byte [rdx + 0x26]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdx + 0x27]
shl eax, 0x18
or r11d, eax
mov eax, ecx
xor eax, ebx
mov dword [rsp + 0x10], r11d
and eax, r10d
xor eax, ecx
add eax, r9d
add r8d, eax
mov r9d, r8d
shr r9d, 0x1d
lea eax, [r8*8]
or r9d, eax
movzx eax, byte [rdx + 0x29]
shl eax, 8
or ebp, eax
movzx eax, byte [rdx + 0x2a]
shl eax, 0x10
or ebp, eax
movzx eax, byte [rdx + 0x2b]
shl eax, 0x18
or ebp, eax
mov eax, ebx
xor eax, r10d
mov dword [rsp + 0x34], ebp
and eax, r9d
xor eax, ebx
add eax, r11d
add ecx, eax
movzx eax, byte [rdx + 0x2d]
shl eax, 8
mov esi, ecx
shl ecx, 7
shr esi, 0x19
or esi, ecx
movzx ecx, byte [rdx + 0x2c]
or ecx, eax
movzx eax, byte [rdx + 0x2e]
shl eax, 0x10
or ecx, eax
movzx eax, byte [rdx + 0x2f]
shl eax, 0x18
or ecx, eax
mov eax, r10d
xor eax, r9d
mov dword [rsp + 0x30], ecx
and eax, esi
xor eax, r10d
add eax, ebp
add ebx, eax
mov r11d, ebx
shr r11d, 0x15
shl ebx, 0xb
movzx eax, byte [rdx + 0x31]
or r11d, ebx
shl eax, 8
movzx r15d, byte [rdx + 0x30]
movzx r13d, byte [rdx + 0x34]
or r15d, eax
movzx eax, byte [rdx + 0x32]
shl eax, 0x10
movzx r14d, byte [rdx + 0x38]
or r15d, eax
movzx eax, byte [rdx + 0x33]
shl eax, 0x18
movzx r12d, byte [rdx + 0x3c]
lea rdx, [rdx + 0x40]
or r15d, eax
mov eax, esi
xor eax, r9d
and eax, r11d
xor eax, r9d
add eax, ecx
add r10d, eax
movzx eax, byte [rdx - 0xb]
shl eax, 8
mov ecx, r10d
or r13d, eax
shr r10d, 0xd
movzx eax, byte [rdx - 0xa]
shl eax, 0x10
or r13d, eax
shl ecx, 0x13
movzx eax, byte [rdx - 9]
or ecx, r10d
shl eax, 0x18
or r13d, eax
mov eax, esi
xor eax, r11d
and eax, ecx
xor eax, esi
add eax, r15d
add r9d, eax
mov r8d, r9d
shr r8d, 0x1d
lea eax, [r9*8]
or r8d, eax
movzx eax, byte [rdx - 7]
shl eax, 8
or r14d, eax
movzx eax, byte [rdx - 6]
shl eax, 0x10
or r14d, eax
movzx eax, byte [rdx - 5]
shl eax, 0x18
or r14d, eax
mov eax, r11d
xor eax, ecx
and eax, r8d
xor eax, r11d
add eax, r13d
add esi, eax
movzx eax, byte [rdx - 3]
shl eax, 8
mov edi, esi
or r12d, eax
shr edi, 0x19
movzx eax, byte [rdx - 2]
shl eax, 0x10
or r12d, eax
shl esi, 7
movzx eax, byte [rdx - 1]
or edi, esi
shl eax, 0x18
or r12d, eax
mov eax, ecx
xor eax, r8d
and eax, edi
xor eax, ecx
add eax, r14d
add r11d, eax
mov r10d, r11d
shr r10d, 0x15
shl r11d, 0xb
or r10d, r11d
mov eax, edi
xor eax, r8d
and eax, r10d
xor eax, r8d
add r8d, 0x5a827999
add eax, r12d
add ecx, eax
mov eax, r10d
mov r11d, ecx
shr ecx, 0xd
shl r11d, 0x13
or r11d, ecx
mov ecx, r10d
and eax, r11d
or ecx, r11d
and ecx, edi
mov r9d, r11d
or eax, ecx
add edi, 0x5a827999
add eax, dword [rsp + 0x98]
add eax, r8d
mov r8d, r11d
mov ebx, eax
add r11d, 0x5a827999
shr ebx, 0x1d
lea eax, [rax*8]
or ebx, eax
or r9d, ebx
and r8d, ebx
mov ecx, r9d
and ecx, r10d
or ecx, r8d
add ecx, dword [rsp]
add ecx, edi
mov edi, ecx
shl ecx, 5
shr edi, 0x1b
or edi, ecx
and r9d, edi
or r9d, r8d
add r9d, dword [rsp + 0xa8]
lea eax, [r9 + 0x5a827999]
add eax, r10d
mov r10d, eax
shl eax, 9
shr r10d, 0x17
or r10d, eax
mov ecx, r10d
mov eax, r10d
and eax, ebx
or ecx, ebx
and ecx, edi
add ebx, 0x5a827999
or eax, ecx
mov ecx, r10d
add eax, r15d
add eax, r11d
mov r11d, eax
shl eax, 0xd
shr r11d, 0x13
or r11d, eax
mov eax, r10d
or ecx, r11d
and eax, r11d
and ecx, edi
mov r9d, r11d
or eax, ecx
mov r8d, r11d
add eax, dword [rsp + 0xc]
add eax, ebx
mov ebx, eax
shr ebx, 0x1d
lea eax, [rax*8]
or ebx, eax
or r9d, ebx
and r8d, ebx
mov ecx, r9d
and ecx, r10d
or ecx, r8d
add ecx, dword [rsp + 0x14]
add edi, 0x5a827999
add r11d, 0x5a827999
add ecx, edi
mov edi, ecx
shl ecx, 5
shr edi, 0x1b
or edi, ecx
and r9d, edi
or r9d, r8d
add r9d, dword [rsp + 0x10]
lea eax, [r9 + 0x5a827999]
add eax, r10d
mov r10d, eax
shl eax, 9
shr r10d, 0x17
or r10d, eax
mov ecx, r10d
mov eax, r10d
and eax, ebx
or ecx, ebx
and ecx, edi
add ebx, 0x5a827999
or eax, ecx
mov ecx, r10d
add eax, r13d
add eax, r11d
mov r11d, eax
shl eax, 0xd
shr r11d, 0x13
or r11d, eax
mov eax, r10d
and eax, r11d
or ecx, r11d
and ecx, edi
mov r9d, r11d
or eax, ecx
add edi, 0x5a827999
add eax, dword [rsp + 4]
mov r8d, r11d
add eax, ebx
add r11d, 0x5a827999
mov ebx, eax
shr ebx, 0x1d
lea eax, [rax*8]
or ebx, eax
or r9d, ebx
and r8d, ebx
mov ecx, r9d
and ecx, r10d
or ecx, r8d
add ecx, dword [rsp + 8]
add ecx, edi
mov edi, ecx
shl ecx, 5
shr edi, 0x1b
or edi, ecx
and r9d, edi
or r9d, r8d
lea eax, [r9 + rbp]
add eax, 0x5a827999
add eax, r10d
mov esi, eax
shl eax, 9
shr esi, 0x17
or esi, eax
mov ecx, esi
mov eax, esi
and eax, ebx
or ecx, ebx
and ecx, edi
or eax, ecx
mov ecx, esi
add eax, r14d
add eax, r11d
mov ebp, eax
shl eax, 0xd
shr ebp, 0x13
or ebp, eax
mov eax, esi
or ecx, ebp
and ecx, edi
and eax, ebp
add edi, 0x5a827999
or eax, ecx
mov r9d, ebp
add eax, 0x5a827999
mov r8d, ebp
add eax, dword [rsp + 0x18]
add eax, ebx
mov r11d, eax
shr r11d, 0x1d
lea eax, [rax*8]
or r11d, eax
and r8d, r11d
or r9d, r11d
mov ecx, r9d
and ecx, esi
or ecx, r8d
add ecx, dword [rsp + 0x1c]
add ecx, edi
mov edi, dword [rsp + 0x30]
mov r10d, ecx
shl ecx, 5
shr r10d, 0x1b
or r10d, ecx
and r9d, r10d
or r9d, r8d
lea eax, [rdi + r9]
add eax, 0x5a827999
add eax, esi
mov r8d, eax
shl eax, 9
shr r8d, 0x17
or r8d, eax
mov ecx, r8d
mov eax, r8d
or ecx, r11d
and eax, r11d
and ecx, r10d
add r11d, 0x6ed9eba1
or eax, ecx
mov ecx, r8d
add eax, 0x5a827999
add eax, r12d
add eax, ebp
mov ebx, eax
shl eax, 0xd
shr ebx, 0x13
or ebx, eax
mov eax, r10d
xor ecx, ebx
xor eax, r8d
add r10d, 0x6ed9eba1
xor eax, ebx
add eax, dword [rsp + 0x98]
add r8d, 0x6ed9eba1
add eax, r11d
mov r9d, eax
shr r9d, 0x1d
lea eax, [rax*8]
or r9d, eax
xor ecx, r9d
add ecx, dword [rsp + 0xa8]
add ecx, r10d
mov r10d, ecx
shl ecx, 9
shr r10d, 0x17
or r10d, ecx
mov ecx, r10d
xor ecx, ebx
xor ecx, r9d
add ecx, dword [rsp]
add ecx, r8d
mov r8d, r10d
mov r11d, ecx
shl ecx, 0xb
shr r11d, 0x15
or r11d, ecx
xor r8d, r11d
mov ecx, r8d
xor ecx, r9d
add ecx, r15d
add ebx, 0x6ed9eba1
add r10d, 0x6ed9eba1
add ecx, ebx
mov ebx, ecx
shl ecx, 0xf
shr ebx, 0x11
or ebx, ecx
mov ecx, r11d
xor ecx, ebx
xor r8d, ebx
add r8d, dword [rsp + 4]
add r11d, 0x6ed9eba1
lea eax, [r8 + 0x6ed9eba1]
add eax, r9d
mov r9d, eax
shr r9d, 0x1d
lea eax, [rax*8]
or r9d, eax
xor ecx, r9d
add ecx, dword [rsp + 0x34]
add ecx, r10d
mov r10d, ecx
shl ecx, 9
shr r10d, 0x17
or r10d, ecx
mov ecx, r10d
mov r8d, r10d
xor ecx, ebx
add r10d, 0x6ed9eba1
xor ecx, r9d
add ebx, 0x6ed9eba1
add ecx, dword [rsp + 8]
add ecx, r11d
mov r11d, ecx
shl ecx, 0xb
shr r11d, 0x15
or r11d, ecx
xor r8d, r11d
mov ecx, r8d
xor ecx, r9d
add ecx, r14d
add ecx, ebx
mov ebx, ecx
shl ecx, 0xf
shr ebx, 0x11
or ebx, ecx
mov ecx, r11d
xor ecx, ebx
xor r8d, ebx
add r8d, dword [rsp + 0xc]
add r11d, 0x6ed9eba1
lea eax, [r8 + 0x6ed9eba1]
add eax, r9d
mov r9d, eax
shr r9d, 0x1d
lea eax, [rax*8]
or r9d, eax
xor ecx, r9d
add ecx, dword [rsp + 0x10]
add ecx, r10d
mov r10d, ecx
shl ecx, 9
shr r10d, 0x17
or r10d, ecx
mov ecx, r10d
mov r8d, r10d
xor ecx, ebx
add ebx, 0x6ed9eba1
xor ecx, r9d
add ecx, dword [rsp + 0x14]
add ecx, r11d
mov r11d, ecx
shl ecx, 0xb
shr r11d, 0x15
or r11d, ecx
xor r8d, r11d
mov ecx, r8d
xor ecx, r9d
add ecx, r13d
add ecx, ebx
mov ebx, ecx
shl ecx, 0xf
add r10d, 0x6ed9eba1
shr ebx, 0x11
or ebx, ecx
mov ecx, r11d
xor ecx, ebx
xor r8d, ebx
add r8d, dword [rsp + 0x18]
add r11d, 0x6ed9eba1
lea eax, [r8 + 0x6ed9eba1]
add eax, r9d
mov r9d, eax
shr r9d, 0x1d
lea eax, [rax*8]
or r9d, eax
xor ecx, r9d
add ecx, edi
mov edi, dword [rsp + 0x28]
add ecx, r10d
mov r10d, ecx
shl ecx, 9
shr r10d, 0x17
or r10d, ecx
mov ecx, r10d
mov eax, r10d
add r10d, dword [rsp + 0x2c]
xor ecx, ebx
xor ecx, r9d
mov dword [rsp + 0x2c], r10d
add ecx, dword [rsp + 0x1c]
add ecx, r11d
mov r11d, dword [rsp + 0x20]
mov r8d, ecx
add r11d, r9d
shl ecx, 0xb
shr r8d, 0x15
or r8d, ecx
mov dword [rsp + 0x20], r11d
mov rcx, qword [rsp + 0x90]
xor eax, r8d
xor eax, r9d
add edi, r8d
add eax, 0x6ed9eba1
mov dword [rsp + 0x28], edi
add eax, r12d
add ebx, eax
mov dword [rcx], r11d
mov rax, qword [rsp + 0xa0]
ror ebx, 0x11
add ebx, dword [rsp + 0x24]
mov dword [rcx + 4], ebx
mov dword [rcx + 8], edi
mov dword [rcx + 0xc], r10d
mov dword [rsp + 0x24], ebx
test rax, rax
jne 0x1401ef4b0
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
pop rdi
pop rbx
ret