Function at 0x140002dfc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebp, dword [rsp + 0xa0]
lea r10d, [rdx + 0xcde]
mov rbx, qword [rsp + 0x90]
lea eax, [r10 + 0x3f]
mov r15d, ecx
lea esi, [rdx + 0xa94]
mov ecx, dword [rsp + 0x98]
xor ebp, 0x3b8c
mov edi, ecx
xor r15d, 0x43d8
xor edi, 0x72a1
lea r13d, [rcx + 0x127d]
xor ecx, 0x73bc
cmp ecx, eax
jg 0x1400031a2
lea eax, [rcx + 0x619]
xor r14d, r14d
cmp r10d, eax
je 0x140003001
cmp dword [rbx + 0x34], 0xebae
je 0x140002e9c
mov rdx, qword [section..data]
mov eax, 0x122ed3
sub eax, dword [rbx + 0xc0]
add dword [rdx + 0x44], eax
lea eax, [rsi - 0x938]
mov r8d, ebp
mov dword [rsp + 0x30], eax
lea r9d, [rdi - 0xa94]
xor r10d, 0x760e
mov dword [rsp + 0x28], eax
xor r8d, 0x486a
mov qword [rsp + 0x20], rbx
lea edx, [rbp + 0x3bef]
mov ecx, r10d
call fcn.140001834
mov r10, r14
mov rax, qword [rbx + 0x78]
mov ecx, dword [0x140608010]
mov r9d, dword [r10 + rax]
add r10, 4
imul r9d, dword [rbx + 0x44]
mov eax, dword [0x14060804c]
xor eax, 0x17b7ab
imul ecx, eax
mov rax, qword [section..data]
mov r8d, r9d
shr r8d, 0x18
mov dword [0x140608010], ecx
mov rcx, qword [rax + 0x98]
movsxd rdx, dword [rbx + 0x48]
mov byte [rdx + rcx], r8b
mov r8d, r9d
inc dword [rbx + 0x48]
movsxd rdx, dword [rbx + 0x48]
mov rax, qword [section..data]
shr r8d, 0x10
mov rcx, qword [rax + 0x98]
mov byte [rdx + rcx], r8b
mov edx, r9d
inc dword [rbx + 0x48]
movsxd rcx, dword [rbx + 0x48]
mov rax, qword [rbx + 0x98]
shr edx, 8
mov byte [rcx + rax], dl
inc dword [rbx + 0x48]
mov eax, dword [rbx + 0x108]
mov r8, qword [section..data]
sub eax, 0xc5036
xor dword [0x140608010], eax
mov eax, dword [0x14060807c]
mov ecx, dword [r8 + 8]
mov edx, dword [r8]
add ecx, 0xffebc74a
add edx, ecx
imul eax, edx
mov dword [0x14060807c], eax
mov eax, dword [rbx + 0x10c]
xor eax, 0xe1256
sub dword [r8 + 0xa8], eax
mov eax, dword [rbx + 0x138]
mov rcx, qword [section..data]
xor eax, 0x8e63a
sub dword [rcx + 0x138], eax
mov eax, dword [rbx + 0x8c]
mov rcx, qword [section..data]
sub eax, dword [rcx + 0xa4]
inc eax
or dword [0x140608034], eax
mov rax, qword [0x1406080a8]
movsxd rcx, dword [rcx + 0x48]
mov byte [rcx + rax], r9b
mov rax, qword [section..data]
inc dword [rax + 0x48]
cmp r10, 0x23a90
jl 0x140002ed8
sub esi, 0xe4
mov edx, 0x11d53
cmp dword [rbx + 0xa8], edx
je 0x140003026
mov ecx, dword [rbx + 0x24]
mov eax, dword [0x140608018]
add eax, 0xfff781db
add ecx, eax
mov dword [0x140608054], ecx
jmp 0x14000303d
mov rax, qword [section..data]
mov ecx, dword [rbx + 0x138]
xor ecx, dword [rax]
xor ecx, edx
mov dword [rbx + 0x138], ecx
mov r9, qword [section..data]
lea r8d, [rdi + 0x289]
xor edi, 0x74fe
mov dword [rsp + 0x20], r13d
mov edx, edi
lea ecx, [rbp + 0x40a8]
call section..text
cmp dword [rbx + 0x24], 0x12ad8
je 0x140003079
lea rax, [0x140608150]
mov qword [rbx + 0x78], rax
jmp 0x14000308b
mov eax, dword [rbx + 0x34]
xor eax, dword [rbx + 0xa8]
sub eax, dword [rbx + 8]
or dword [rbx + 0xf0], eax
mov rax, qword [rbx + 0x78]
mov r9d, dword [r14 + rax]
add r14, 4
mov rax, qword [section..data]
mov ecx, dword [rax + 0x80]
mov edx, dword [rax + 0x34]
add ecx, 0xfe700d04
mov eax, dword [rbx + 0x108]
add edx, ecx
imul eax, edx
mov dword [rbx + 0x108], eax
mov rax, qword [section..data]
mov ecx, dword [0x140608010]
imul r9d, dword [rax + 0x44]
mov eax, dword [rbx + 0x3c]
xor eax, 0x17b7aa
add dword [0x14060811c], eax
sub ecx, dword [rbx + 0xcc]
mov eax, dword [rbx + 0xa4]
sub ecx, 0x1438b5
imul eax, ecx
mov edx, r9d
movsxd rcx, dword [rbx + 0x48]
mov r8d, r9d
shr edx, 0x10
shr r8d, 8
mov dword [rbx + 0xa4], eax
mov rax, qword [rbx + 0x98]
mov byte [rcx + rax], dl
inc dword [rbx + 0x48]
mov rax, qword [section..data]
movsxd rdx, dword [rbx + 0x48]
mov rcx, qword [rax + 0x98]
mov byte [rdx + rcx], r8b
inc dword [rbx + 0x48]
mov eax, dword [rbx + 0x80]
movsxd rcx, dword [rbx + 0x48]
sub eax, 0x18ff2fc
or dword [rbx + 0x8c], eax
mov rax, qword [rbx + 0x98]
mov byte [rcx + rax], r9b
inc dword [rbx + 0x48]
mov eax, dword [rbx + 0x6c]
sub eax, dword [rbx + 0x80]
add eax, 0x173d19d
add dword [rbx + 0xa4], eax
mov eax, dword [rbx + 0x68]
mov rcx, qword [section..data]
add eax, 0x5cb23
xor dword [rcx + 0x80], eax
cmp r14, 0xbfb0
jl 0x14000308b
mov eax, dword [0x140608148]
sub eax, dword [rbx + 0x8c]
sub eax, 0x8cbc0
mov dword [rbx + 0x44], eax
jmp 0x140003290
lea eax, [rbp - 0x43d8]
cmp dword [rbx + 4], eax
jb 0x140003290
mov eax, dword [rbx + 0x84]
mov r14d, dword [0x140608098]
add eax, 0x4c82
cmp r14d, eax
jae 0x140003290
mov rax, qword [section..data]
mov edx, dword [rax + 0xa4]
mov eax, dword [rbx + 0x84]
mov r12d, edi
or eax, 0x3eba
sub eax, edx
cmp edi, eax
jb 0x140003278
mov ecx, dword [0x1406080e4]
xor ecx, edi
sub ecx, r15d
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov eax, dword [rbx + 8]
xor eax, dword [rbx + 0x58]
xor eax, r13d
mov dword [rbx + 0x58], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, dword [0x1406080e0]
or edx, dword [0x140608148]
mov ecx, dword [rbx + 0x3c]
mov eax, dword [rbx + 8]
imul edx, r15d
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov rcx, qword [section..data]
mov edx, dword [rcx + 0x68]
mov ecx, dword [rcx + 8]
or edx, r15d
sub edx, 0x5263
add ecx, ebp
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov rax, qword [section..data]
add r12d, 4
mov edx, dword [rax + 0xa4]
mov eax, dword [rbx + 0x84]
or eax, 0x3eba
sub eax, edx
cmp r12d, eax
jae 0x1400031f1
mov ecx, dword [rbx + 0x84]
inc r14d
add ecx, 0x4c82
cmp r14d, ecx
jb 0x1400031d9
lea r11, [rsp + 0x40]
xor esi, 0x124
mov rbx, qword [r11 + 0x30]
mov eax, esi
mov rsi, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret