Function at 0x180005b50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r13
push r14
mov rbp, rsp
sub rsp, 0x50
xor r14d, r14d
mov dword [rbp - 0x20], 0x6238ecf5
mov dword [rbp - 0x1c], 0x8bb1e37b
mov rbx, rcx
mov dword [rbp - 0x18], 0x4959490
movabs r13, 0xaaaaaaaaaaaaaaab
mov word [rbp - 0x14], 0x5a
mov qword [rbp + 0x30], r14
mov rax, qword [rbp + 0x30]
nop word [rax + rax]
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x30]
movzx r8d, byte [rbp + rax - 0x1f]
mov rax, r13
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rbp + 0x30]
shl dl, 3
sub cl, dl
mov edx, 0xa81f8af
sar edx, cl
xor dl, r8b
mov byte [rbp + rax - 0x1f], dl
mov rax, qword [rbp + 0x30]
inc rax
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
cmp rax, 0xc
jb 0x180005ba0
mov byte [rbp - 0x13], r14b
call fcn.180001970
mov rcx, qword gs:[0x58]
mov rsi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rdi, qword [rcx + rdx*8]
add rdi, rax
mov ecx, dword [rdi]
cmp dword [0x180286968], ecx
jle 0x180005c4b
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x180005c4b
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rdi]
cmp dword [0x18028a99c], eax
jle 0x180005c84
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x180005c84
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rsi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rbp - 0x1f]
mov rcx, rax
call r8
test rax, rax
je 0x180005e5e
mov qword [rsp + 0x88], r12
xor ecx, ecx
mov qword [rsp + 0x90], r15
call rax
movdqa xmm0, xmmword [0x18027af00]
lea r12, [rbx + 0x10]
movdqu xmmword [rbp - 0x12], xmm0
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [r12], r14
mov qword [rbx + 0x18], r14
mov word [rbp - 2], 0xe5
mov qword [rbp + 0x30], r14
mov rax, qword [rbp + 0x30]
nop dword [rax]
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x30]
movzx r8d, byte [rbp + rax - 0x11]
mov rax, r13
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rbp + 0x30]
shl dl, 3
sub cl, dl
mov edx, 0x1b4051ea
sar edx, cl
xor dl, r8b
mov byte [rbp + rax - 0x11], dl
mov rax, qword [rbp + 0x30]
inc rax
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
cmp rax, 0x10
jb 0x180005cf0
mov byte [rbp - 1], r14b
call fcn.180001970
mov edx, dword [rdi]
mov r14, rax
cmp dword [0x180286968], edx
jle 0x180005d80
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x180005d80
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rdx
call fcn.180249db8
mov eax, dword [rdi]
cmp dword [0x18028a99c], eax
jle 0x180005db9
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x180005db9
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, r14
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rbp - 0x11]
mov rcx, rax
call r8
mov rdi, rax
test rax, rax
je 0x180005e37
xor edx, edx
mov qword [rsp + 0x20], r12
lea r9, [0x18027a6c8]
lea rcx, [0x18027a510]
lea r8d, [rdx + 0x17]
call rdi
xor edx, edx
mov qword [rsp + 0x20], rbx
lea r9, [0x18027a820]
lea rcx, [0x18027a708]
lea r8d, [rdx + 0x17]
call rdi
test eax, eax
js 0x180005e37
mov rcx, qword [rbx]
lea rdx, [rbx + 8]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
js 0x180005e37
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov r12, qword [rsp + 0x88]
mov rax, rbx
mov r15, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
mov rax, rbx
jmp 0x180005e4a