Function at 0x1400b7d10
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.1400965b0
mov rax, qword [rsp + 0x40]
movabs r15, 0x8000000000000000
nop word [rax + rax]
mov ecx, dword [0x141f41038]
sub ecx, dword [0x141f4103c]
imul rcx, rcx, 0x36ff9ae5
shr rcx, 0x3d
or ecx, 0xd4d798fa
cmp ecx, 0xe96b4b0
je 0x1400b7d40
mov rdi, qword [rsp + 0x48]
cmp rax, r15
jne 0x1400b7d99
nop
mov eax, dword [0x141f41040]
xor edx, edx
div dword [0x141f41044]
add eax, 0x2c78c0e1
or eax, 0x1aa273b4
xor eax, 0x8d771492
cmp eax, 0x6861af88
jb 0x1400b7d70
jmp 0x1400b7e40
mov ecx, dword [0x141f41048]
and ecx, dword [0x141f4104c]
add ecx, 0xcc27ec0d
mov edx, 0xb843c209
imul rdx, rcx
shr rdx, 0x3d
cmp edx, 0x89afc0b2
nop
mov ecx, dword [0x141f41050]
xor ecx, dword [0x141f41054]
and ecx, 0x80204012
cmp ecx, 0x3a4a9b5c
ja 0x1400b7dc0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.1400b8380
mov rbx, qword [rsp + 0x28]
nop word cs:[rax + rax]
mov eax, dword [0x141f41058]
or eax, dword [0x141f4105c]
or eax, 0xfffefdff
cmp eax, 0xc4a754cb
jb 0x1400b7e10
mov rdi, qword [rsp + 0x30]
cmp rbx, r15
jne 0x1400b7f15
nop word cs:[rax + rax]
mov eax, dword [0x141f41070]
add eax, dword [0x141f41074]
xor eax, 0xdf0f75ab
imul rcx, rax, 0x843df7d
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
add eax, 0x3996a346
cmp eax, 0x121f3a3c
jb 0x1400b7e40
mov eax, edi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400b8309
test rax, rax
je 0x1400b8309
cmp eax, 1
jne 0x1400b7f34
mov eax, dword [0x141f41080]
xor edx, edx
div dword [0x141f41084]
lea rbx, [rdi - 1]
nop dword [rax + rax]
mov eax, dword [0x141f41088]
xor edx, edx
div dword [0x141f4108c]
imul eax, eax, 0x9da2ca1e
imul rax, rax, 0x5d5b9d05
shr rax, 0x3b
or eax, 0x6c79f344
cmp eax, 0xca240847
je 0x1400b7eb0
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov r12, qword [rdi]
test r12, r12
je 0x1400b8166
mov eax, dword [0x141f41090]
xor eax, dword [0x141f41094]
or eax, 0xaf015209
add eax, 0x5b7faef
cmp eax, 0x49cc1495
jae 0x1400b8152
jmp 0x1400b815e
mov eax, dword [0x141f41060]
and eax, dword [0x141f41064]
or eax, 0xdb3314ab
add eax, 0x53ff6af9
cmp eax, 0x230d63fe
jae 0x1400b7f63
jmp 0x1400b7f98
mov eax, 0xf5b69f09
mov ecx, dword [0x141f41078]
add ecx, dword [0x141f4107c]
imul rcx, rax
shr rcx, 0x3e
imul ecx, ecx, 0xe6588ede
xor ecx, 0xe180abb1
cmp ecx, 0xe3fad7a5
ja 0x1400b7f39
ud2
mov ebp, dword [0x141f41068]
imul ebp, dword [0x141f4106c]
or ebp, 0xc8002200
and ebp, 0xf8f03f54
xor ebp, 0x85895ac9
mov r14, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp ebp, 0xa868e346
jbe 0x1400b7fa3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1400b7f63
cmp eax, 0xffffffff
je 0x1400b7fcf
mov eax, dword [0x141f410e0]
add eax, dword [0x141f410e4]
or eax, 0x41b14b66
imul eax, eax, 0xa5150ff2
cmp eax, 0x48ed003e
jne 0x1400b8097
jmp 0x1400b80b6
mov eax, dword [0x141f41108]
xor eax, dword [0x141f4110c]
or eax, 0xa8308536
xor eax, 0x53300ddf
cmp eax, 0x1816f9a1
jae 0x1400b7fef
mov qword [rsi], r15
xor eax, eax
nop word cs:[rax + rax]
mov qword [rsi], r15
test al, al
jne 0x1400b8000
test rbx, rbx
je 0x1400b8310
mov eax, dword [0x141f41110]
or eax, dword [0x141f41114]
add eax, 0x30785b65
and eax, 0xa9bda0b9
add eax, 0x6ae8edf
cmp eax, 0xf45dda68
jbe 0x1400b8039
mov rax, qword [0x141f49060]
mov eax, 0xd9dcd503
nop
mov ecx, dword [0x141f41118]
or ecx, dword [0x141f4111c]
imul rcx, rax
shr rcx, 0x3d
add ecx, 0x1c4dd63e
mov rsi, qword [0x141f49060]
cmp ecx, 0x3eda68b7
ja 0x1400b8040
mov eax, dword [0x141f41120]
xor edx, edx
div dword [0x141f41124]
imul eax, eax, 0x1edf2960
xor eax, 0x6a3fbb1a
add eax, 0x85560ae9
cmp eax, 0xe48135d0
jae 0x1400b833e
jmp 0x1400b836d
mov eax, dword [0x141f410e8]
sub eax, dword [0x141f410ec]
and eax, 0xe118393c
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
cmp eax, 0x5bd2aed4
jne 0x1400b80bf
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
jmp 0x1400b8097
mov eax, dword [0x141f410f0]
imul eax, dword [0x141f410f4]
and eax, 0xaaf2e6be
mov ecx, 0xa1bd875b
imul rcx, rax
shr rcx, 0x3e
add ecx, 0xec4b3a5
cmp ecx, 0x29c29be4
ja 0x1400b8122
mov eax, dword [0x141f410f8]
imul eax, dword [0x141f410fc]
add eax, 0xdcd7f594
or eax, 0xcb6b432b
imul rcx, rax, 0xcc98e23
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
mov qword [rsi + 0x10], r14
cmp eax, 0x49ff3dac
jbe 0x1400b8130
mov qword [rsi + 0x10], r14
jmp 0x1400b80ec
mov eax, dword [0x141f41100]
and eax, dword [0x141f41104]
add eax, 0xbc170b46
or eax, 0xcdbfcab8
cmp eax, 0x5ded2ddb
jbe 0x1400b8130
jmp 0x1400b8310
mov rcx, r14
call r12
xor eax, eax
test al, al
je 0x1400b8166
mov rcx, r14
call r12
jmp 0x1400b8152
mov r8, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
nop
mov eax, dword [0x141f41098]
xor edx, edx
div dword [0x141f4109c]
or eax, 0xfe9cef20
add eax, 0xf2e96ce7
and eax, 0xf2200801
cmp eax, 0x85da7a16
je 0x1400b8170
test r8, r8
je 0x1400b82b3
nop dword [rax]
mov eax, dword [0x141f410a0]
and eax, dword [0x141f410a4]
imul eax, eax, 0x81ab17c1
add eax, 0x3eb2c28e
cmp eax, 0xe73a7af3
ja 0x1400b81a0
nop
mov eax, dword [0x141f410a8]
or eax, dword [0x141f410ac]
imul eax, eax, 0x6bda3a26
add eax, 0xa32fe9ba
cmp eax, 0x6128a31e
ja 0x1400b81c0
cmp rcx, 0x11
jb 0x1400b823d
mov eax, dword [0x141f410b0]
xor edx, edx
div dword [0x141f410b4]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400b8200
nop word cs:[rax + rax]
mov eax, dword [0x141f410b8]
add eax, dword [0x141f410bc]
imul rax, rax, 0x5624643
shr rax, 0x37
or eax, 0xeb73c81e
imul eax, eax, 0x909544c8
cmp eax, 0x1769798d
je 0x1400b8210
mov r14, qword [r14 - 8]
mov eax, dword [0x141f410c0]
imul eax, dword [0x141f410c4]
or eax, 0xb6becaef
imul eax, eax, 0x2a8d4dbf
cmp eax, 0x67c8d5c1
jbe 0x1400b826e
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141f410c8]
and eax, dword [0x141f410cc]
imul rax, rax, 0x5860881d
shr rax, 0x3c
imul ebp, eax, 0xb75c7728
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, r14
call rdi
cmp ebp, 0x7ec88c5e
je 0x1400b8280
mov rdi, qword [0x141f49060]
mov eax, dword [0x141f410d0]
xor eax, dword [0x141f410d4]
add eax, 0xac462168
or eax, 0xf5aa44ee
cmp eax, 0xd2194cd8
je 0x1400b82f9
mov ebp, dword [0x141f410d8]
xor ebp, dword [0x141f410dc]
mov rcx, rdi
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0xde74cdf6
jne 0x1400b8309
mov rcx, rdi
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400b82d7
mov qword [rsi], r15
nop dword [rax]
mov eax, dword [0x141f41130]
imul eax, dword [0x141f41134]
imul eax, eax, 0xe8a5b70a
and eax, 0x81400932
cmp eax, 0xaf2fa001
ja 0x1400b8310
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ebx, dword [0x141f41128]
imul ebx, dword [0x141f4112c]
add ebx, 0xcc7fcfe2
xor ebx, 0x4e8a5629
mov rcx, rsi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xd27a1016
jbe 0x1400b8310
mov rcx, rsi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400b833e