Function at 0x1400f0528
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x848]
sub rsp, 0x920
mov rax, qword [0x140231ec8]
xor rax, rsp
mov qword [rbp + 0x810], rax
mov r13, rcx
mov qword [rsp + 0x68], rcx
mov ecx, 0x6c
call fcn.14002f66c
mov rcx, qword [r13]
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x1400f1dc3.0]
mov qword [rbp - 0x40], rax
xor edx, edx
movabs r8, 0x7fffffff7fffffff
mov rcx, qword [r13]
call fcn.1400f4084
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x68], r14
xor edi, edi
mov r8, qword [r13 + 0xa8]
lea r12, [r13 + 0xd8]
mov qword [rsp + 0x78], r12
mov rcx, qword [r13 + 0xb0]
sub rcx, r8
movabs r15, 0x2aaaaaaaaaaaaaab
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
lea ebx, [rdi + 1]
add rdx, rax
mov rsi, qword [rbp - 0x70]
je 0x1400f066d
xor ebx, ebx
mov rax, qword [r12]
cmp qword [rbx + r8], rax
jne 0x1400f0630
add r8, 8
add r8, rbx
cmp rsi, r14
je 0x1400f061c
mov eax, dword [r8]
mov dword [rsi], eax
add rsi, 4
mov qword [rbp - 0x70], rsi
jmp 0x1400f0630
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.1400ee3d8
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x70]
inc rdi
add rbx, 0x18
mov r8, qword [r13 + 0xa8]
mov rcx, qword [r13 + 0xb0]
sub rcx, r8
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jb 0x1400f05f7
mov qword [rsp + 0x70], r14
mov ebx, 1
jmp 0x1400f0672
mov qword [rsp + 0x78], r12
mov rdi, qword [rbp - 0x78]
sub rsi, rdi
sar rsi, 2
mov eax, 0x818
mul rsi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1401afd6c
mov r15, rax
mov rcx, qword [r13 + 0x78]
mov rdx, qword [r13 + 0x80]
sub rdx, rcx
sar rdx, 5
lea r9, [0x1400f1a30]
mov r8d, 0x20
call fcn.1401c0250
mov rcx, qword [r13 + 0x98]
sub rcx, qword [r13 + 0x90]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rcx, [rbp - 0x58]
call fcn.1400eeb34
nop
xor r10d, r10d
mov r8, qword [r13 + 0x90]
mov rcx, qword [r13 + 0x98]
sub rcx, r8
movabs r11, 0x6666666666666667
mov rax, r11
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400f07ae
xor r9d, r9d
mov r14, qword [rbp - 0x58]
mov rax, qword [r12]
cmp qword [r9 + r8], rax
jne 0x1400f077d
mov r8, qword [r9 + r8 + 8]
mov rdx, r8
shr rdx, 3
and rdx, qword [rbp - 0x48]
movzx ecx, byte [rdx + r14]
mov eax, r8d
and eax, 7
bts ecx, eax
mov byte [rdx + r14], cl
shr r8, 0x1e
mov rcx, r8
shr rcx, 3
and rcx, qword [rbp - 0x48]
movzx eax, byte [rcx + r14]
and r8d, 7
bts eax, r8d
mov byte [rcx + r14], al
add r10, rbx
add r9, 0x28
mov r8, qword [r13 + 0x90]
mov rcx, qword [r13 + 0x98]
sub rcx, r8
mov rax, r11
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r10, rdx
jb 0x1400f0731
lea rcx, [rbp + 0x10]
call fcn.1400bbe20
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x60], 0x7fffffff
xor r8d, r8d
test rsi, rsi
je 0x1400f086a
xor eax, eax
mov r14d, 0x7fffffff
lea r13d, [r12 + 1]
imul rdx, rax, 0x818
mov ecx, dword [rdi + rax*4]
mov dword [rdx + r15], ecx
mov eax, ecx
cmp ecx, r12d
cmovbe eax, r12d
mov r12d, eax
cmp ecx, r14d
cmovae ecx, r14d
mov r14d, ecx
mov byte [rdx + r15 + 0x810], 0
xor r9d, r9d
lea r10, [rdx + 8]
add r10, r15
mov ebx, 0x100
movzx eax, r9b
mov rcx, qword [rbp + rax*8 + 0x10]
cmp dword [rdx + r15], 0
jbe 0x1400f0841
mov r11d, dword [rdx + r15]
movzx eax, cl
shr rcx, 8
xor rcx, qword [rbp + rax*8 + 0x10]
sub r11, r13
jne 0x1400f0830
mov qword [r10], rcx
add r9, r13
add r10, 8
sub rbx, r13
jne 0x1400f081c
add r8d, r13d
mov eax, r8d
cmp rax, rsi
jb 0x1400f07e0
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x60], r14d
mov r13, qword [rsp + 0x68]
mov ebx, 0x400000
mov ecx, ebx
call fcn.1401afd6c
mov r12, rax
mov qword [rbp - 0x80], rax
mov r9, qword [r13]
mov rcx, qword [r9]
mov rax, qword [rcx + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, r9
call qword [case.0x1400f1dc3.0]
mov r9, qword [r13]
mov rcx, qword [r9]
mov rax, qword [rcx + 0x18]
mov r8d, ebx
mov rdx, r12
mov rcx, r9
call qword [case.0x1400f1dc3.0]
movsxd rbx, eax
mov qword [rsp + 0x40], rbx
xor edi, edi
lea edx, [rdi + 1]
test rsi, rsi
je 0x1400f0909
xor eax, eax
mov r13, rbx
imul rbx, rax, 0x818
mov r8d, dword [rbx + r15]
cmp r13, r8
jb 0x1400f08f6
mov rdx, r12
xor ecx, ecx
call fcn.1400bbca0
mov qword [rbx + r15 + 0x808], rax
mov edx, 1
mov byte [rbx + r15 + 0x810], dl
add edi, edx
mov eax, edi
cmp rax, rsi
jb 0x1400f08c7
mov r13, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x40]
and dword [rsp + 0x48], 0
xor r8d, r8d
mov qword [rbp - 0x60], r8
xor r14d, r14d
mov qword [rsp + 0x38], r14
xor edi, edi
mov ecx, dword [rsp + 0x30]
lea rax, [rdi + 0x40]
cmp rax, rbx
jae 0x1400f0a43
cmp byte [rdi + r12], 0x7b
jne 0x1400f0a43
cmp byte [rdi + r12 + 1], 0x52
jne 0x1400f0a43
cmp byte [rdi + r12 + 2], 0x42
jne 0x1400f0a43
cmp byte [rdi + r12 + 3], 0x7d
jne 0x1400f0a43
cmp byte [rdi + r12 + 0x14], dl
jne 0x1400f0a43
mov eax, dword [rdi + r12 + 0xc]
mov qword [rsp + 0x58], rax
add rax, rcx
add rax, rdi
cmp rax, rbx
jae 0x1400f0a43
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
lea rax, [rdi + r14]
mov qword [rbp], rax
mov rdx, qword [r13 + 0x78]
mov r8, qword [r13 + 0x80]
sub r8, rdx
sar r8, 5
lea rax, [0x1400f1a30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea rcx, [rbp - 0x10]
call fcn.1401c0660
test rax, rax
je 0x1400f0a43
add rdi, qword [rsp + 0x58]
and dword [rsp + 0x50], 0
test rsi, rsi
mov ecx, dword [rsp + 0x30]
mov edx, 1
je 0x1400f0923
xor eax, eax
lea rcx, [rdi + r12]
mov r13d, dword [rsp + 0x50]
mov r12, rcx
mov r14d, edx
imul rbx, rax, 0x818
mov r8d, dword [rbx + r15]
mov rdx, r12
xor ecx, ecx
call fcn.1400bbca0
mov qword [rbx + r15 + 0x808], rax
mov byte [rbx + r15 + 0x810], r14b
add r13d, r14d
mov eax, r13d
cmp rax, rsi
jb 0x1400f09f6
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x68]
mov r12, qword [rbp - 0x80]
mov edx, 1
jmp 0x1400f091f
xor r10d, r10d
mov dword [rsp + 0x50], r10d
xor cl, cl
mov dword [rsp + 0x34], ecx
and dword [rsp + 0x58], r10d
test rsi, rsi
je 0x1400f0cb2
xor eax, eax
mov r12d, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x38]
lea r14d, [r10 + 1]
imul r9, rax, 0x818
cmp byte [r9 + r15 + 0x810], 0
je 0x1400f0c1a
mov r8, qword [r9 + r15 + 0x808]
mov qword [rbp - 0x30], r8
mov cl, r8b
and cl, 7
mov edx, r14d
shl edx, cl
mov rax, r8
shr rax, 3
and rax, qword [rbp - 0x48]
mov r11, qword [rbp - 0x58]
test byte [rax + r11], dl
je 0x1400f0c16
shr r8, 0x1e
mov cl, r8b
and cl, 7
mov edx, 1
shl edx, cl
shr r8, 3
and r8, qword [rbp - 0x48]
test byte [r8 + r11], dl
je 0x1400f0c10
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov qword [rbp - 0x38], rax
mov eax, dword [r9 + r15]
mov dword [rbp - 0x18], eax
mov r10, qword [r13 + 0x90]
mov rcx, qword [r13 + 0x98]
sub rcx, r10
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov r8, rdx
shr r8, 0x3f
add r8, rdx
lea rax, [0x1400f19d0]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
mov rdx, r10
lea rcx, [rbp - 0x38]
call fcn.1401c0660
mov r8, rax
test rax, rax
je 0x1400f0c0b
mov r10, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov rcx, rdx
sub rcx, r10
mov r9, r10
sub r9, rdx
cmp r10, rdx
cmovbe r9, rcx
lea r11, [rdi + rbx]
cmp r11, rdx
jbe 0x1400f0b70
mov rax, rdi
sub rax, rdx
add rax, rbx
jmp 0x1400f0b79
mov rax, rdx
sub rax, rdi
sub rax, rbx
movabs rcx, 0x7fffffff7fffffff
cmp r10, rcx
je 0x1400f0b8d
cmp rax, r9
jae 0x1400f0c0b
mov qword [r8 + 0x18], r11
mov r10d, dword [rbp - 0x18]
mov dword [rsp + 0x50], r10d
mov r14, qword [rbp - 0x60]
test r14, r14
je 0x1400f0bcf
mov eax, dword [r14 + 0x20]
cmp eax, dword [r8 + 0x20]
jne 0x1400f0bcf
mov rcx, qword [r14 + 0x18]
add rcx, rax
cmp rcx, r11
jne 0x1400f0bcf
mov rcx, qword [r14 + 0x10]
add rcx, rax
cmp rcx, rdx
jne 0x1400f0bcf
mov r11d, dword [rsp + 0x48]
inc r11d
jmp 0x1400f0bd2
xor r11d, r11d
mov dword [rsp + 0x48], r11d
xor edx, edx
mov eax, dword [rsp + 0x30]
div dword [r8 + 0x20]
inc eax
mov ecx, 5
cmp eax, ecx
cmovb eax, ecx
mov ecx, dword [rsp + 0x34]
movzx ecx, cl
cmp r11d, eax
mov r14d, 1
cmova ecx, r14d
mov dword [rsp + 0x34], ecx
mov qword [rbp - 0x60], r8
jmp 0x1400f0c1a
mov r10d, dword [rsp + 0x50]
mov r14d, 1
mov ecx, dword [rsp + 0x34]
add r12d, r14d
mov eax, r12d
cmp rax, rsi
jb 0x1400f0a6f
mov r12, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x40]
test cl, cl
je 0x1400f0cad
mov edx, dword [rsp + 0x30]
test r10d, r10d
je 0x1400f0ca6
mov ecx, r10d
lea rax, [rcx + rdx]
add rax, rdi
cmp rax, rbx
jae 0x1400f0ca6
cmp byte [rdi + r12], 0
je 0x1400f0ca6
add rdi, rcx
mov qword [rsp + 0x50], rdi
xor r13d, r13d
xor eax, eax
lea rcx, [rdi + r12]
mov r12, rcx
lea edi, [rax + 1]
imul rbx, rax, 0x818
mov r8d, dword [rbx + r15]
mov rdx, r12
xor ecx, ecx
call fcn.1400bbca0
mov qword [rbx + r15 + 0x808], rax
mov byte [rbx + r15 + 0x810], dil
add r13d, edi
mov eax, r13d
cmp rax, rsi
jb 0x1400f0c6c
mov rdi, qword [rsp + 0x50]
jmp 0x1400f0a26
mov r14, qword [rsp + 0x38]
jmp 0x1400f0cb6
mov r14, qword [rsp + 0x38]
mov edx, dword [rsp + 0x30]
lea rax, [rdx + rdi]
cmp rax, rbx
jb 0x1400f0d3d
sub rbx, rdi
cmp rbx, rdx
jne 0x1400f0d28
call fcn.1401005e4
lea rdx, [rdi + r12]
mov r8, rbx
mov rcx, r12
call fcn.1401b1b70
xor edi, edi
mov rax, qword [rsp + 0x40]
sub rax, rbx
add r14, rax
mov qword [rsp + 0x38], r14
mov rcx, qword [r13]
mov rax, qword [rcx]
mov r8d, 0x400000
sub r8, rbx
lea rdx, [rbx + r12]
mov rax, qword [rax + 0x18]
call qword [case.0x1400f1dc3.0]
movsxd rcx, eax
add rbx, rcx
mov qword [rsp + 0x40], rbx
mov r8, qword [rbp - 0x40]
mov rdx, r14
mov rcx, qword [r13]
call fcn.1400f4084
jmp 0x1400f0d2d
mov rbx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x60]
add rax, rdi
cmp rax, rbx
jae 0x1400f0dbd
xor r10d, r10d
lea edx, [r10 + 1]
test rsi, rsi
je 0x1400f0db5
xor r8d, r8d
imul r9, r8, 0x818
mov r11d, dword [r9 + r15]
add r11, rdi
cmp r11, rbx
jae 0x1400f0da1
mov rdx, qword [r9 + r15 + 0x808]
movzx ecx, byte [rdi + r12]
imul rax, r8, 0x103
add rcx, rax
movzx eax, byte [r11 + r12]
xor rax, rdx
movzx eax, al
mov rcx, qword [r15 + rcx*8 + 8]
xor rcx, qword [rbp + rax*8 + 0x10]
shr rdx, 8
xor rcx, rdx
mov qword [r9 + r15 + 0x808], rcx
mov edx, 1
jmp 0x1400f0daa
mov byte [r9 + r15 + 0x810], 0
add r10d, edx
mov r8d, r10d
cmp r8, rsi
jb 0x1400f0d4c
add rdi, rdx
jmp 0x1400f091f
mov rcx, r12
call fcn.1401af9bc
mov rcx, r15
call fcn.1401af9bc
mov edx, reloc.SHELL32.dll_SHRestricted
mov r8d, edx
mov rcx, qword [r13]
call fcn.1400f4084
nop
mov edx, 1
mov rcx, qword [rbp - 0x58]
call fcn.1401af9bc
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
mov r14, qword [rsp + 0x70]
je 0x1400f0e39
sub r14, rcx
and r14, 0xfffffffffffffffc
mov rax, rcx
cmp r14, 0x1000
jb 0x1400f0e24
add r14, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f0e69
mov rdx, r14
call fcn.1401af9bc
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
and qword [rbp - 0x68], 0
mov rcx, qword [rbp + 0x810]
xor rcx, rsp
call fcn.1401afad0
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401b6b94
int3