Function at 0x180006890
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xbf0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb68], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [0x180129e24]
mov qword [rbp + 0x4f0], rax
lea rax, [rbp + 0x4f0]
mov rcx, qword [rbp + 0x4f0]
movabs rdx, 0x7332c27717501ffa
mov qword [rbp + 0x4f0], rdx
mov rdx, qword [rbp + 0x4f0]
call fcn.180008d80
mov rdi, rax
lea rcx, [rbp + 0x4f0]
mov r8d, 0x538
xor edx, edx
call fcn.180124a00
mov rax, 0xfffffffffffffff8
lea rcx, [0x18012c120]
nop word cs:[rax + rax]
mov rdx, qword [rax + rcx + 8]
xor rdx, qword [rdi + rax + 8]
mov qword [rbp + rax + 0x4f8], rdx
add rax, 8
cmp rax, 0x530
jb 0x180006920
movzx eax, word [rdi + 0x538]
mov ecx, eax
xor cl, 0x3c
shr eax, 8
xor al, 0xb7
movzx ecx, cl
movzx eax, al
shl eax, 8
or eax, ecx
mov word [rbp + 0xa28], ax
lea rcx, [rbp - 0x4a]
lea rdi, [rbp + 0x4f0]
mov r8d, 0x53a
mov rdx, rdi
call fcn.180124360
lea rax, [0x180120b85]
mov qword [rbp + 0x4f0], rax
mov rcx, qword [rbp + 0x4f0]
movabs rax, 0xa925e372b5a216ed
mov qword [rbp + 0x4f0], rax
mov rdx, qword [rbp + 0x4f0]
call fcn.180008d20
movabs rcx, 0x4f4c685edc7636c9
xor rcx, qword [rax]
mov edx, 0x8abee6dd
xor edx, dword [rax + 8]
movzx eax, word [rax + 0xc]
mov r8d, eax
xor r8b, 0xf
shr eax, 8
xor al, 0xd0
movzx r8d, r8b
movzx eax, al
shl eax, 8
or eax, r8d
mov qword [rbp + 0xb08], rcx
mov dword [rbp + 0xb10], edx
mov word [rbp + 0xb14], ax
lea rdx, [rbp + 0xb08]
mov r8d, 0xe
mov rcx, rdi
call fcn.1800ffeb0
lea rcx, [rbp + 0xa30]
mov r8d, 0xc8
mov rdx, rdi
call fcn.180124360
lea rax, [0x18011f9d9]
mov qword [rbp + 0x4f0], rax
mov rcx, qword [rbp + 0x4f0]
movabs rax, 0xe7138b3793b82621
mov qword [rbp + 0x4f0], rax
mov rdx, qword [rbp + 0x4f0]
call fcn.180008d00
movabs rcx, 0x5cb41f3744906187
xor rcx, qword [rax]
mov qword [rbp + 0xb00], rcx
lea rcx, [rbp + 0xa30]
lea rdx, [rbp + 0xb00]
mov r8d, 8
call fcn.1800fffa0
lea rax, [0x180120b19]
mov qword [rbp + 0x4f0], rax
mov rcx, qword [rbp + 0x4f0]
movabs rax, 0xa5754cc338acdc9e
mov qword [rbp + 0x4f0], rax
mov rdx, qword [rbp + 0x4f0]
call fcn.180008dd0
movabs rcx, 0x151e0112bdae36eb
xor rcx, qword [rax]
mov qword [rbp + 0xaf8], rcx
lea rcx, [rbp + 0xa30]
lea rdx, [rbp + 0xaf8]
mov r8d, 8
call fcn.1800fffa0
lea rcx, [rbp + 0x4f0]
lea rdx, [rbp + 0xa30]
call fcn.1800f7d00
mov rax, qword [rbp + 0x4f0]
mov qword [rbp + 0xb50], rax
test rax, rax
je 0x180006d91
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0xb58], rax
mov rdi, qword [rbp + 0x500]
mov rax, qword [rbp + 0x508]
mov qword [rbp + 0xb30], rax
mov rax, qword [rbp + 0x510]
mov qword [rbp + 0xb40], rax
mov byte [rbp + 0xb67], 0
lea rcx, [rbp + 0xa30]
call fcn.180004450
lea rcx, [rbp + 0x4f0]
mov rdx, qword [rbp + 0xb50]
mov r8, rdi
call fcn.180113580
cmp qword [rbp + 0x4f0], 0
je 0x180006b97
mov rax, qword [rbp + 0x4f8]
movzx ecx, byte [rbp + 0x500]
mov edx, dword [rbp + 0x501]
mov dword [rbp + 0xa30], edx
mov edx, dword [rbp + 0x504]
mov dword [rbp + 0xa33], edx
cmp cl, 2
jne 0x180006e4e
lea rbx, [rbp + 0xa30]
mov rcx, rbx
call fcn.18000b240
mov qword [rbp + 0xb20], rbx
lea rax, [0x180004960]
mov qword [rbp + 0xb28], rax
lea rax, str.C:UsersAppDataLocalTemp_tasklist.txt
mov qword [rbp + 0x4f0], rax
mov qword [rbp + 0x4f8], 2
mov qword [rbp + 0x510], 0
lea rax, [rbp + 0xb20]
mov qword [rbp + 0x500], rax
mov qword [rbp + 0x508], 1
lea rcx, [rbp + 0xb08]
lea rdx, [rbp + 0x4f0]
call fcn.18010f720
mov rdx, qword [rbp + 0xa38]
test rdx, rdx
je 0x180006c29
mov rcx, qword [rbp + 0xa30]
mov r8d, 1
call fcn.18000b030
mov rdx, qword [rbp + 0xb08]
mov rax, qword [rbp + 0xb10]
mov qword [rbp + 0xb48], rax
mov r8, qword [rbp + 0xb18]
mov dword [rbp + 0x4f0], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x4f8], xmm0
mov dword [rbp + 0x508], 7
mov qword [rbp + 0x50c], 0
mov word [rbp + 0x514], 0
mov byte [rbp + 0x511], 1
mov byte [rbp + 0x514], 1
mov byte [rbp + 0x513], 1
lea rcx, [rbp + 0x4f0]
mov qword [rbp + 0xb38], rdx
call fcn.1800f4360
mov r14, rax
mov rbx, rdx
mov rdx, qword [rbp + 0xb48]
test rdx, rdx
je 0x180006cc3
mov r8d, 1
mov rcx, qword [rbp + 0xb38]
call fcn.18000b030
test r14, r14
jne 0x180006dcf
mov qword [rbp + 0xa30], rbx
lea rcx, [rbp + 0xa30]
mov rdx, qword [rbp + 0xb50]
mov r8, rdi
call fcn.1800098d0
test rax, rax
jne 0x180006e06
movzx eax, byte [0x1801e4bc1]
mov ecx, 0x53a
mov edx, 1
call fcn.18000b020
test rax, rax
je 0x180006e3d
mov rdi, rax
lea rdx, [rbp - 0x4a]
mov r8d, 0x53a
mov rcx, rax
call fcn.180124360
mov qword [rsi], rdi
mov qword [rsi + 8], 0x53a
mov qword [rsi + 0x10], 0x53a
mov rcx, qword [rbp + 0xa30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0xb58]
test rdx, rdx
je 0x180006d64
mov r8d, 1
mov rcx, qword [rbp + 0xb50]
call fcn.18000b030
mov rdx, qword [rbp + 0xb40]
test rdx, rdx
je 0x180006d82
mov r8d, 1
mov rcx, qword [rbp + 0xb30]
call fcn.18000b030
nop
add rsp, 0xbf0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0xb20], rax
lea rax, str.src_tools.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x18012bef8]
lea r9, fcn.180004380
lea r8, [rbp + 0xb20]
mov edx, 0x2b
call fcn.18012a4e0
jmp 0x180006ec1
mov qword [rbp + 0x4f0], rbx
lea rax, str.src_tools.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x18012bef8]
lea r9, fcn.180004380
lea r8, [rbp + 0x4f0]
mov edx, 0x2b
call fcn.18012a4e0
jmp 0x180006ec1
mov qword [rbp + 0x4f0], rax
lea rax, str.src_tools.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x18012bef8]
lea r9, fcn.180004380
lea r8, [rbp + 0x4f0]
mov edx, 0x2b
call fcn.18012a4e0
jmp 0x180006ec1
mov ecx, 1
mov edx, 0x53a
call fcn.180129e70
jmp 0x180006ec1
mov rdx, qword [rbp + 0xb50]
mov qword [rbp + 0x4f0], rdx
mov rdx, qword [rbp + 0xb58]
mov qword [rbp + 0x4f8], rdx
mov qword [rbp + 0x500], rdi
mov qword [rbp + 0x508], rax
mov byte [rbp + 0x510], cl
mov eax, dword [rbp + 0xa30]
mov ecx, dword [rbp + 0xa33]
mov dword [rbp + 0x511], eax
mov dword [rbp + 0x514], ecx
lea rax, str.src_tools.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x18012bef8]
lea r9, [0x18012bf48]
lea r8, [rbp + 0x4f0]
mov edx, 0x2b
call fcn.18012a4e0
ud2