Function at 0x180029830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1800a3d18]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov ebx, dword [rsp + 0x40]
lea esi, [rdx + 0x5a0]
mov qword [rsp + 0x78], rcx
xor r10d, r10d
mov rax, qword [rsp + 0x78]
mov r12, r8
mov qword [rbp - 0x30], r8
mov r8d, edx
mov qword [rbp - 0x80], rax
mov r9, rcx
mov dword [rsp + 0x38], edx
mov edi, edx
cmp edx, esi
jae 0x180029ad4
lea edx, [r10 + 0x43]
mov r9d, 0x6572
lea r13d, [r10 + 0x77]
mov ecx, 0x6c68
mov r8d, 0x7574
lea r11d, [rdx + 0x35]
lea r14d, [rdx - 0x11]
lea r10d, [r9 + 2]
lea r15d, [rdx + 0x29]
cmp edi, 0x1b7
ja 0x180029a05
je 0x1800299f9
cmp edi, 0xc7
ja 0x1800299a4
je 0x180029996
mov eax, edi
sub eax, 0x27
je 0x180029986
sub eax, 0x45
je 0x18002995c
sub eax, 0xb
je 0x180029978
cmp eax, 0x45
jne 0x180029abc
mov ecx, 0xb5
nop dword [rax + rax]
mov eax, ecx
sub eax, 0xb5
je 0x18002994d
cmp eax, 1
jne 0x180029952
mov eax, ebx
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.18008f350
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ebx, 1
inc ecx
cmp ecx, 0xb7
jb 0x180029910
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
xor edx, edx
mov rcx, r12
lea r8d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
jmp 0x180029a91
mov byte [rbp - 0x1b], 0
mov word [rbp], r13w
jmp 0x180029abc
mov dword [rbp - 0x20], 0x6f746e
mov word [rbp - 0x1d], cx
jmp 0x180029abc
mov eax, 0x73
mov word [rbp + 2], ax
jmp 0x180029abc
mov eax, edi
sub eax, 0x117
je 0x1800299ed
sub eax, 0xe
je 0x1800299e1
sub eax, 0x42
je 0x1800299cc
cmp eax, 0xe
jne 0x180029abc
mov dword [rbp - 0x15], 0x65727574
jmp 0x180029abc
mov eax, 0x33
mov dword [rbp + 0xa], 0x2e0032
mov word [rbp + 8], ax
jmp 0x180029abc
mov dword [rbp - 0x18], 0x786574
jmp 0x180029abc
mov dword [rbp + 4], 0x5f0032
jmp 0x180029abc
mov dword [rbp + 0xe], 0x6c0064
jmp 0x180029abc
cmp edi, 0x2f7
ja 0x180029a5f
je 0x180029a51
mov eax, edi
sub eax, 0x1c5
je 0x180029a4b
sub eax, 0x42
je 0x180029a45
sub eax, 0x50
je 0x180029a3c
cmp eax, 0x50
jne 0x180029abc
mov word [rbp + 0x1c], r14w
mov dword [rbp + 0x1e], 0x33005f
jmp 0x180029abc
mov dword [rbp + 0x18], 0x730077
jmp 0x180029abc
mov dword [rbp + 0x12], r15d
jmp 0x180029abc
mov word [rbp - 0x11], dx
jmp 0x180029abc
mov word [rbp + 0x22], r14w
mov dword [rbp + 0x24], 0x64002e
jmp 0x180029abc
mov eax, edi
sub eax, 0x347
je 0x180029ab7
sub eax, 0x50
je 0x180029ab1
cmp eax, 0x50
jne 0x180029abc
xor r8d, r8d
lea rax, [rbp]
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r8 + 0x1d]
call fcn.180010940
mov qword [rbp - 0x80], rax
mov edx, 0x43
mov r9d, 0x6572
mov ecx, 0x6c68
mov r8d, 0x7574
lea r10d, [r9 + 2]
lea r11d, [rdx + 0x35]
jmp 0x180029abc
mov dword [rbp + 0x2a], r15d
jmp 0x180029abc
mov word [rbp + 0x28], r15w
add edi, 0x50
cmp edi, esi
jb 0x1800298c1
mov r8d, dword [rsp + 0x38]
xor r10d, r10d
mov r9, qword [rsp + 0x78]
lea edx, [r8 + 0x12]
mov dword [rsp + 0x3c], edx
cmp r8d, edx
jae case.0x180029b32.48
mov r14, qword [rbp - 0x78]
mov eax, 0x6275
mov r13, qword [rbp - 0x40]
mov r15, qword [rbp - 0x48]
mov rdi, qword [rsp + 0x48]
lea r11, [0x180000000]
mov esi, 0x3b
cmp r8d, 0x125
ja 0x18002a084
je 0x18002a074
lea eax, [r8 - 0x27]
cmp eax, 9
ja case.default.0x18002a09f
mov ecx, dword [r11 + rax*4 + 0x2a150]
add rcx, r11
jmp rcx
mov qword [rbp - 0x58], r10
mov rdi, r10
mov qword [rsp + 0x48], r10
jmp case.default.0x18002a09f
mov r14, qword [r12 + 0x40]
mov qword [rbp - 0x78], r14
mov r13, r14
jmp case.default.0x18002a09f
mov rcx, qword [rsp + 0x50]
cmp rcx, 2
jb case.default.0x18002a09f
mov r14, qword [rbp - 0x28]
mov esi, 0x2a
mov r15, qword [rbp - 0x80]
cmp esi, 0x2a
je 0x180029c39
cmp esi, 0x1872
jne 0x180029c50
movzx edx, byte [r13 + 1]
mov r8, qword [rbp - 0x38]
shr rdx, 5
and edx, 4
mov qword [rbp - 0x58], rdx
cmp r8, 0x7e
jae 0x180029bde
cmp rcx, rdx
jb 0x180029bda
mov ecx, 0x5c
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x5b
je 0x180029bc3
cmp eax, 1
jne 0x180029bcc
mov qword [rsp + 0x60], r8
jmp 0x180029bcc
lea rax, [rdx + 2]
mov qword [rsp + 0x48], rax
dec ecx
cmp ecx, 0x5a
ja 0x180029bb0
mov rcx, qword [rsp + 0x50]
jmp 0x180029c50
cmp r8, 0x7e
jne 0x180029c05
lea rax, [rdx + 4]
cmp rcx, rax
jb 0x180029c05
movzx ecx, word [r13 + 2]
mov qword [rsp + 0x48], rax
call r14
mov rcx, qword [rsp + 0x50]
movzx eax, ax
mov qword [rsp + 0x60], rax
jmp 0x180029c50
lea rax, [rdx + 0xa]
cmp rcx, rax
jb 0x180029c50
mov ecx, dword [r13 + 2]
mov qword [rsp + 0x48], rax
call r15
mov ecx, dword [r13 + 6]
mov edi, eax
shl rdi, 0x20
call r15
mov rcx, qword [rsp + 0x50]
mov r12d, eax
add r12, rdi
mov qword [rsp + 0x60], r12
jmp 0x180029c50
movzx r8d, byte [r13 + 1]
and r8d, 0x7f
mov qword [rbp - 0x38], r8
nop word [rax + rax]
add esi, 0x1848
cmp esi, 0x3090
jbe 0x180029b72
mov r14, qword [rbp - 0x78]
mov r15, qword [rbp - 0x48]
mov r12, qword [rbp - 0x30]
mov rdi, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
xor r10d, r10d
mov eax, 0x6275
inc r8d
mov dword [rsp + 0x38], r8d
cmp r8d, edx
jae case.0x180029b32.48
mov r9, qword [rsp + 0x78]
jmp 0x180029afb
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x180029f3e
mov esi, pe_nt_image_headers64
mov dword [rsp + 0x68], esi
nop dword [rax]
nop dword [rax + rax]
mov eax, esi
sub eax, 0x110
je 0x180029efe
sub eax, 0x4e
je 0x180029eae
cmp eax, 0x4e
jne 0x180029f13
cmp dword [rsp + 0x40], 0
je 0x180029e34
mov edi, 0x42
lea esi, [rax + 0x25]
mov eax, edi
sub eax, 0x40
je 0x180029da0
sub eax, 1
je 0x180029d82
cmp eax, 1
jne 0x180029e23
movzx eax, byte [rbp - 0x60]
lea rdx, [rsp + 0x30]
mov ecx, esi
mov byte [rsp + 0x30], al
call fcn.180050db0
test eax, eax
je 0x180029e23
mov ebx, 0xc8
mov eax, ebx
sub eax, 0xc8
je 0x180029d49
cmp eax, 0x6c
jne 0x180029d72
xor eax, eax
lea r13, [r14 + 5]
mov dword [r15], eax
jmp 0x180029d72
mov rax, qword [r12 + 0x50]
lea r9, [r12 + 0x40]
add rax, 4
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x70], rax
mov edx, 0x103
call fcn.1800766e0
and byte [r14], 0xf0
add ebx, 0x6c
cmp ebx, 0x1a0
jb 0x180029d30
jmp 0x180029e23
mov rdx, qword [rbp - 0x70]
mov rcx, r13
mov r8, qword [rbp - 0x40]
sub r8, rdx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [rbp - 0x68]
add dword [r15], eax
jmp 0x180029e23
mov rax, r13
sub rax, qword [rbp - 0x70]
add qword [r12 + 0x48], rax
test byte [rbp - 0x60], 0x80
je 0x180029e23
mov ebx, 0xdf
mov eax, ebx
sub eax, 0xdf
je 0x180029e11
sub eax, 1
je 0x180029e08
cmp eax, 1
jne 0x180029e19
mov r9, r12
lea r8, [rbp - 0x70]
lea edx, [rax + 0x4f]
xor ecx, ecx
call fcn.18002b550
mov eax, dword [r15]
lea rcx, [rsp + 0x70]
add rax, 5
xor r9d, r9d
mov qword [rsp + 0x70], rax
xor r8d, r8d
lea rax, [r12 + 0x40]
mov edx, 0xeb
mov qword [rsp + 0x20], rax
call fcn.1800755b0
jmp 0x180029e19
mov eax, dword [r15]
mov qword [rbp - 0x68], rax
jmp 0x180029e19
lea rax, [r14 + 5]
mov qword [rbp - 0x70], rax
inc ebx
cmp ebx, 0xe2
jb 0x180029db7
dec edi
cmp edi, 0x3f
ja 0x180029cf2
mov esi, dword [rsp + 0x68]
jmp 0x180029e95
mov r14, qword [rbp - 0x50]
mov ebx, 0xde
nop dword [rax]
mov eax, ebx
sub eax, 0xde
je 0x180029e74
cmp eax, 1
jne 0x180029e87
lea rax, [r12 + 0x40]
mov qword [rsp + 0x70], r14
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsp + 0x70]
mov edx, 0xeb
call fcn.1800755b0
jmp 0x180029e87
mov r9, r12
lea r8, [rbp - 0x70]
mov edx, 0x50
xor ecx, ecx
call fcn.18002b550
inc ebx
cmp ebx, 0xe0
jb 0x180029e40
mov r14, qword [rbp - 0x78]
movzx eax, byte [r13]
and al, 0xf
cmp al, 8
jne 0x180029f13
or dword [r12 + 0xc0], 0x400
jmp 0x180029f13
mov r8, qword [rbp - 0x58]
movzx eax, byte [r13]
mov byte [rbp - 0x60], al
test r8, r8
je 0x180029f13
mov r9, qword [rsp + 0x60]
mov rcx, r10
test r9, r9
je 0x180029f13
mov r10, qword [rsp + 0x48]
lea rdx, [r10 + r13]
nop word [rax + rax]
mov rax, rcx
and eax, 3
sub rax, r8
add rax, r13
movzx eax, byte [rax + r10]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, r9
jb 0x180029ee0
jmp 0x180029f13
mov rax, qword [rsp + 0x60]
mov qword [rbp - 0x68], rax
mov rax, qword [rsp + 0x48]
add rax, r13
mov qword [rbp - 0x70], rax
add esi, 0x4e
mov r10d, 0
mov dword [rsp + 0x68], esi
cmp esi, 0x1fa
jb 0x180029cc0
mov rdi, qword [rsp + 0x48]
mov edx, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x58]
mov r8d, dword [rsp + 0x38]
mov ebx, eax
jmp 0x180029c7c
mov r9d, 0xf
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0xe]
call fcn.180010940
mov edx, dword [rsp + 0x3c]
xor r10d, r10d
mov r8d, dword [rsp + 0x38]
mov qword [rsp + 0x60], r10
mov qword [rbp - 0x28], rax
jmp case.default.0x18002a09f
mov rax, qword [r12 + 0x48]
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x50], r10
jmp case.default.0x18002a09f
mov rcx, qword [rsp + 0x60]
add rcx, rdi
mov qword [rbp - 0x50], rcx
je 0x180029fb1
cmp rcx, qword [rsp + 0x50]
ja 0x180029fb1
mov dword [rsp + 0x58], 1
jmp case.default.0x18002a09f
mov dword [rsp + 0x58], r10d
jmp case.default.0x18002a09f
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x18002a06a
movzx eax, byte [r14]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov byte [rsp + 0x30], al
xor r8d, r8d
mov ecx, 0xd9
call fcn.18004b0b0
test eax, eax
je 0x18002a05e
test dword [r12 + 0xc0], 0x2000
jne 0x18002a05e
movzx eax, byte [r14]
lea rdx, [rsp + 0x30]
mov ecx, 0x73
mov byte [rsp + 0x30], al
mov dword [rsp + 0x40], 1
call fcn.180050db0
test eax, eax
jne 0x180029c73
cmp rsi, 5
jb 0x180029c73
mov ecx, dword [r15]
mov edx, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
lea rax, [rcx + 5]
cmp rsi, rax
mov eax, 0x6275
jb 0x18002a056
add r13, 5
sub rsi, rcx
add r13, rcx
sub rsi, 5
mov qword [rsp + 0x50], rsi
xor r10d, r10d
jmp 0x180029c84
mov r8d, dword [rsp + 0x38]
xor r10d, r10d
mov edx, dword [rsp + 0x3c]
mov dword [rsp + 0x40], r10d
jmp case.default.0x18002a09f
mov word [rbp - 0x10], ax
mov dword [rbp - 0xe], 0x75732865
jmp 0x180029c84
lea eax, [r8 - 0x126]
cmp eax, 6
ja case.default.0x18002a09f
mov ecx, dword [r11 + rax*4 + 0x2a178]
add rcx, r11
jmp rcx
mov eax, 0x76
mov word [rbp - 7], ax
jmp case.default.0x18002a09f
mov dword [rbp - 0xa], 0x3b3143
jmp case.default.0x18002a09f
mov eax, dword [r9]
lea rcx, [rbp - 0x18]
add dword [r12], eax
call qword [sym.imp.SHLWAPI.dll_PathIsUNCA]
jmp 0x180029c73
mov ecx, 0x1d
nop word [rax + rax]
mov eax, ecx
sub eax, 0x1c
je case.0x180029b32.48
cmp eax, 1
jne 0x18002a0f4
mov ebx, dword [r12]
dec ecx
cmp ecx, 0x1b
ja 0x18002a0e0
mov rax, qword [rsp + 0x50]
lea r15, [r14 + 1]
add rax, r14
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], rax
jmp case.default.0x18002a09f
mov ecx, 0x66
mov eax, 0x33
mov word [rbp - 6], cx
mov word [rbp - 5], ax
jmp case.default.0x18002a09f
mov r9d, 0x4e
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000ee10
jmp 0x180029c73
mov word [rbp - 4], si
jmp case.default.0x18002a09f