Function at 0x1401520f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x150], rbx
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r15, rdx
mov rsi, rcx
mov rax, qword [rdx]
lea rdx, [rsp + 0x38]
mov rcx, r15
call qword [rax + 0x90]
mov r12, qword [rax + 8]
xor ebx, ebx
mov edi, ebx
mov rcx, rsi
call fcn.1400a9ab0
cmp eax, 0xb
jne 0x14015229a
mov rcx, rsi
call fcn.1401947d0
test al, al
je 0x14015229a
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1401440b0
mov r14, rax
mov rcx, rax
call fcn.1401a69a0
test al, al
je 0x14015229a
mov r8, rsi
mov rdx, r15
lea rcx, [rbp - 0x71]
call fcn.140141170
nop
mov r8, rsi
mov rdx, r15
lea rcx, [rbp - 0x29]
call fcn.140141170
nop
mov rcx, rsi
call fcn.140194920
mov r15, qword [rax + 0x28]
mov rcx, rsi
call fcn.140194920
mov rsi, qword [rax + 0x28]
mov rax, qword [r14]
lea rdx, [rbp - 0x71]
mov rcx, r14
call qword [rax + 0x30]
mov rax, qword [r14]
lea rdx, [rbp - 0x29]
mov rcx, r14
call qword [rax + gethostname]
mov rcx, qword [rbp - 0x69]
mov rax, qword [rcx]
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x71]
call qword [rax + 0x28]
test al, al
jne 0x140152252
lea rdx, [rbp - 0x61]
mov rcx, r15
call fcn.140155a20
lea rbx, [rax + 2]
lea rdx, [rbp - 0x39]
lea rcx, [rsi + 0x98]
call fcn.140155cc0
add rbx, rax
mov ecx, ebx
or ecx, 1
bsr edx, ecx
lea edx, [rdx + rdx*8]
add edx, 0x49
shr rdx, 6
add rdx, rbx
add rdi, rdx
mov rcx, qword [rbp - 0x69]
mov rax, qword [rcx]
lea rdx, [rbp - 0x71]
call qword [rax + 0x90]
mov rcx, qword [rbp - 0x69]
mov rax, qword [rcx]
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x71]
call qword [rax + 0x28]
test al, al
je 0x1401521f0
mov rcx, qword [rbp - 0x21]
mov rax, qword [rcx]
lea rdx, [rbp - 0x29]
call qword [rax + 0x80]
cmp dword [rbp + 7], 9
jne 0x140152273
lea rcx, [rbp - 0x19]
call fcn.14013bd30
nop
mov rcx, qword [rbp - 0x69]
mov r8, qword [rcx]
lea rdx, [rbp - 0x71]
call qword [r8 + 0x80]
cmp dword [rbp - 0x41], 9
jne 0x140152295
lea rcx, [rbp - 0x61]
call fcn.14013bd30
nop
jmp case.default.0x14015230e
cmp dword [rsi + 0x3c], 3
jne 0x1401522b3
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140143340
mov r14d, eax
jmp 0x1401522e8
mov rax, qword [rsi + 0x50]
mov rcx, qword [rax + 0x20]
cmp byte [rcx + 0x4b], bl
je 0x1401522c8
mov r14d, 1
jmp 0x1401522e8
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1401456f0
mov rcx, rbx
mov r14d, 1
test al, al
cmovne rcx, r14
mov r14, rcx
mov rcx, rsi
call fcn.1400a9ab0
dec eax
cmp eax, 0x11
ja case.default.0x14015230e
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x1527cc]
add rcx, rdx
jmp rcx
cmp dword [rsi + 0x3c], 3
jne 0x14015235c
test r14, r14
je case.default.0x14015230e
nop
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140144920
test eax, eax
jns 0x14015233c
mov eax, 0xa
jmp 0x14015234c
or eax, 1
bsr eax, eax
lea eax, [rax + rax*8]
add eax, 0x49
shr rax, 6
add rdi, rax
inc rbx
cmp rbx, r14
jb 0x140152320
jmp case.default.0x14015230e
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140143e70
test eax, eax
jns 0x140152378
mov edi, 0xa
jmp case.default.0x14015230e
or eax, 1
bsr eax, eax
jmp 0x140152448
cmp dword [rsi + 0x3c], 3
jne 0x1401523c5
test r14, r14
je case.default.0x14015230e
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1401449f0
or rax, 1
bsr rcx, rax
lea ecx, [rcx + rcx*8]
add ecx, 0x49
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x140152392
jmp case.default.0x14015230e
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140143f90
or rax, 1
bsr rcx, rax
lea edi, [rcx*8 + 0x49]
add edi, ecx
jmp 0x140152451
cmp dword [rsi + 0x3c], 3
jne 0x14015242b
test r14, r14
je case.default.0x14015230e
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140144920
mov ecx, eax
sar ecx, 0x1f
add eax, eax
xor ecx, eax
or ecx, 1
bsr eax, ecx
lea ecx, [rax*8 + 0x49]
add ecx, eax
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x1401523f1
jmp case.default.0x14015230e
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140143e70
mov ecx, eax
sar ecx, 0x1f
add eax, eax
xor ecx, eax
or ecx, 1
bsr eax, ecx
lea edi, [rax*8 + 0x49]
add edi, eax
shr rdi, 6
mov rax, rdi
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14013a450
mov rbx, qword [rsp + 0x150]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [rsi + 0x3c], 3
jne 0x1401524d0
test r14, r14
je case.default.0x14015230e
nop word [rax + rax]
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1401449f0
mov rcx, rax
sar rcx, 0x3f
add rax, rax
xor rcx, rax
or rcx, 1
bsr rax, rcx
lea ecx, [rax*8 + 0x49]
add ecx, eax
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x140152490
jmp case.default.0x14015230e
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140143f90
mov rcx, rax
sar rcx, 0x3f
add rax, rax
xor rcx, rax
or rcx, 1
bsr rax, rcx
jmp 0x140152448
cmp dword [rsi + 0x3c], 3
jne 0x140152541
test r14, r14
je case.default.0x14015230e
nop word [rax + rax]
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140144d80
or eax, 1
bsr ecx, eax
lea ecx, [rcx + rcx*8]
add ecx, 0x49
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x140152510
jmp case.default.0x14015230e
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140145170
or eax, 1
bsr ecx, eax
lea edi, [rcx*8 + 0x49]
add edi, ecx
jmp 0x140152451
cmp dword [rsi + 0x3c], 3
jne 0x1401525a5
test r14, r14
je case.default.0x14015230e
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140144e50
or rax, 1
bsr rcx, rax
lea ecx, [rcx + rcx*8]
add ecx, 0x49
shr rcx, 6
add rdi, rcx
inc rbx
cmp rbx, r14
jb 0x140152572
jmp case.default.0x14015230e
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140145290
jmp 0x1401523d3
lea rdi, [r14*4]
jmp case.default.0x14015230e
lea rdi, [r14*8]
jmp case.default.0x14015230e
mov rdi, r14
jmp case.default.0x14015230e
cmp dword [rsi + 0x3c], 3
jne 0x14015261a
test r14, r14
je case.default.0x14015230e
nop dword [rax]
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140144ac0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x40]
add rdi, rax
inc rbx
cmp rbx, r14
jb 0x1401525f0
jmp case.default.0x14015230e
xor r9d, r9d
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140144120
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x40]
mov rdi, rax
jmp case.default.0x14015230e
cmp dword [rsi + 0x3c], 3
jne 0x140152679
test r14, r14
je case.default.0x14015230e
nop dword [rax + rax]
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140144ac0
mov rcx, rax
call fcn.14014d520
add rdi, rax
inc rbx
cmp rbx, r14
jb 0x140152650
jmp case.default.0x14015230e
xor r9d, r9d
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.140144120
mov rcx, rax
call fcn.14014d520
mov rdi, rax
jmp case.default.0x14015230e
cmp dword [rsi + 0x3c], 3
jne 0x1401526ef
test r14, r14
je case.default.0x14015230e
nop dword [rax]
mov r9d, ebx
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1401446a0
mov ecx, dword [rax + 0x10]
test ecx, ecx
jns 0x1401526cf
mov eax, 0xa
jmp 0x1401526df
or ecx, 1
bsr eax, ecx
lea eax, [rax + rax*8]
add eax, 0x49
shr rax, 6
add rdi, rax
inc rbx
cmp rbx, r14
jb 0x1401526b0
jmp case.default.0x14015230e
mov r8, rsi
mov rdx, r15
mov rcx, r12
call fcn.1401438c0
mov ecx, dword [rax + 0x10]
test ecx, ecx
js 0x14015236e
jmp 0x140152442
mov r13, rbx
test r14, r14
je case.default.0x14015230e
nop dword [rax]
mov qword [rsp + 0x58], rbx
mov qword [rbp - 0x79], InitCommonControls
mov byte [rsp + 0x48], 0
mov r8, rsi
mov rdx, r15
mov rcx, r12
cmp dword [rsi + 0x3c], 3
jne 0x140152755
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, r13d
call fcn.140144cb0
jmp 0x14015275f
lea r9, [rsp + 0x48]
call fcn.140145050
mov rdx, qword [rax + 0x10]
mov eax, edx
or eax, 1
bsr ecx, eax
lea ecx, [rcx + rcx*8]
add ecx, 0x49
shr rcx, 6
add rcx, rdx
add rdi, rcx
mov rdx, qword [rbp - 0x79]
cmp rdx, 0x10
jb 0x1401527b3
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401527ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401527c4
call fcn.14013aa70
inc r13
cmp r13, r14
jae case.default.0x14015230e
jmp 0x140152720
call fcn.140221e44
int3