Function at 0x1400760b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x270
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140495598]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov r14, rcx
mov qword [rsp + 0x60], rcx
lea rbx, [0x1404962c8]
mov esi, 8
mov r10d, 0x4c
mov r11d, 0xffff0000
movabs rdi, 0x112e0be826d694b3
xor ecx, ecx
mov rax, qword [0x1404962c8]
test rax, rax
je 0x140076747
movzx eax, byte [0x1404965e0]
test al, al
je 0x140076215
mov qword [rsp + 0x40], shutdown
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x40], shutdown
mov qword [rsp + 0x40], 0x1312d00
nop word [rax + rax]
call fcn.14030f908
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x40], rax
imul rcx, rax, 0x64
mov qword [rsp + 0x40], rcx
add rcx, 0x1312d00
mov rax, rdi
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x70], rdx
imul rax, rdx, 0x3b9aca00
mov qword [rsp + 0x40], rax
sub rcx, rax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x78], ecx
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0xd0], xmm0
movdqa xmmword [rbp + 0xd0], xmm0
lea rcx, [rbp + 0xd0]
call fcn.140310014
movzx eax, byte [0x1404965e0]
test al, al
je 0x1400761f1
mov rax, qword [0x1404962c8]
test rax, rax
jne 0x140076160
mov rax, qword [0x1404962c8]
test rax, rax
je 0x140076747
mov rcx, r14
call fcn.140076c80
mov r10d, 0x4c
mov r11d, 0xffff0000
mov r13b, 1
mov byte [rsp + 0x49], r13b
xor eax, eax
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rax
nop word [rax + rax]
mov rcx, qword [r14 + 0x890]
mov rax, qword [0x1404962c8]
cmp rax, rcx
jne 0x140076735
lea rdi, [r14 + 0x78]
movzx eax, byte [rdi + 0x820]
imul rcx, rax, 0x268
lea r15, [rdi + 0x330]
add r15, rcx
mov qword [rsp + 0x40], r15
movzx ecx, byte [r14 + 0x4a]
mov edx, 1
shl rdx, cl
movzx ecx, byte [r15 + 2]
mov eax, 1
shl rax, cl
cmp rax, rdx
jne 0x140076735
movzx r8d, byte [rdi + 0x820]
imul rcx, r8, 0x268
mov edx, dword [rcx + rdi + 0x330]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r11d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x1400762f7
mov edx, 0x20
jmp 0x140076306
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, r10
movzx eax, r8b
imul rcx, rax, 0x198
add rcx, rdx
mov ebx, dword [rcx + rdi]
mov dword [rsp + 0x58], ebx
mov eax, dword [r14 + 0x8c8]
test eax, eax
je 0x140076352
cmp ebx, eax
jae 0x140076742
cmp qword [r14 + 0x60], 1
jne 0x140076352
movzx eax, byte [rdi + 0x820]
imul rcx, rax, 0x198
mov rax, qword [0x1404a38a0]
xor qword [rcx + rdi], rax
mov ebx, dword [rsp + 0x58]
mov byte [rsp + 0x4a], 1
movzx eax, byte [rdi + 0x820]
imul rcx, rax, 0x268
mov edx, dword [rcx + rdi + 0x330]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r11d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x140076393
mov r9d, 0x20
jmp 0x1400763a3
mov r9d, 0x27
cmp ecx, 0x6c000000
cmove r9, r10
movzx eax, byte [rdi + 0x820]
imul rcx, rax, 0x268
mov edx, dword [rcx + rdi + 0x330]
mov eax, edx
and eax, 0xff000000
mov r8d, 0xff000000
cmp eax, 0x63000000
cmove r8d, r11d
and r8d, edx
mov ecx, 4
cmp r8d, 0x6b000000
cmove rcx, rsi
movzx eax, byte [rdi + 0x820]
imul r12, rax, 0x198
lea rax, [r9 + rcx]
add r12, rax
add r12, rdi
mov edx, dword [r15]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r11d
and ecx, edx
cmp ecx, 0x72000000
jne 0x1400765ca
test r13b, r13b
je 0x140076496
mov byte [rsp + 0x49], 0
cmp byte [r15 + 0x261], 0
je 0x140076453
movzx eax, byte [rdi + 0x820]
imul rdx, rax, 0x198
add rdx, rdi
mov r9, r12
mov r8, qword [r15 + 0x20]
mov rcx, r15
call fcn.14003afc0
mov rsi, qword [r14 + 0x8a0]
movzx eax, byte [rdi + 0x820]
imul r8, rax, 0x198
add r8, rdi
mov r9, qword [r15 + 0x20]
mov edx, 0x40
lea rcx, [rbp + 0xe0]
call qword [0x1404962e8]
mov rax, qword [rsi]
lea rdx, [rbp + 0xe0]
mov rcx, rsi
call qword [rax + 0x30]
mov esi, 8
mov rcx, r14
call fcn.140076980
test al, al
je 0x14007672e
cmp byte [r15 + 0x261], 0
je 0x140076503
movups xmm0, xmmword [r12]
movaps xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [r12 + 0x10]
movaps xmmword [rbp + 0x130], xmm1
movups xmm0, xmmword [r12 + 0x20]
movaps xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [r12 + 0x30]
movaps xmmword [rbp + 0x150], xmm1
movzx eax, byte [rdi + 0x820]
imul rdx, rax, 0x198
add rdx, rdi
mov r9, r12
mov r8, qword [r15 + 0x20]
mov rcx, r15
call fcn.14003afc0
mov rax, qword [r15 + 0x20]
mov qword [rsp + 0x40], rax
movzx eax, byte [rdi + 0x820]
mov byte [rsp + 0x48], al
mov rsi, qword [r14 + 0x8a0]
mov dword [rsp + 0x50], 0x9fc0
ldmxcsr dword [rsp + 0x50]
xor eax, eax
mov r12d, eax
cmp dword [0x1404a3f64], 1
je 0x14007657b
lea r13, [rsi + 0x980]
mov rax, qword [rsi]
lea rdx, [rbp + 0xe0]
mov rcx, rsi
call qword [rax + gethostname]
mov r9d, 0x100
mov r8, r13
mov edx, 0x40
lea rcx, [rbp + 0xe0]
call qword [0x1404962e8]
inc r12d
mov eax, dword [0x1404a3f64]
dec eax
cmp r12d, eax
jb 0x140076540
mov rax, qword [rsi]
lea rdx, [rbp + 0xe0]
mov rcx, rsi
call qword [rax + gethostname]
movzx eax, byte [rsp + 0x48]
imul r8, rax, 0x198
add r8, rdi
mov r9, qword [rsp + 0x40]
mov edx, 0x40
lea rcx, [rbp + 0xe0]
call qword [0x1404962e8]
mov rax, qword [rsi]
lea rdx, [r14 + 0x28]
lea r8, [rbp + 0xe0]
mov rcx, rsi
call qword [rax + 0x18]
jmp 0x140076653
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r11d
and ecx, edx
cmp ecx, 0x6c000000
je 0x14007663e
mov r12, qword [r15 + 0x78]
mov r13, qword [r15 + 0x20]
movzx eax, byte [rdi + 0x820]
imul r15, rax, 0x198
add r15, rdi
mov rax, qword [rsp + 0x60]
mov r8d, dword [rax + 0x4c]
mov edx, dword [rax + 0x54]
mov rcx, qword [rsp + 0x40]
call fcn.1400a00c0
mov qword [rsp + 0x20], r12
lea r9, [r14 + 0x68]
lea r8, [r14 + 0x28]
mov rdx, r13
mov rcx, r15
call rax
mov r14, qword [rsp + 0x60]
mov r15, qword [rsp + 0x40]
mov esi, 8
jmp 0x140076643
mov byte [rsp + 0x4a], 0
mov rcx, r14
call fcn.140076980
test al, al
je 0x14007672e
cmp byte [rsp + 0x4a], 0
je 0x1400766ec
mov rdx, qword [r14 + 0x40]
mov eax, dword [r14 + 0x8c8]
test eax, eax
je 0x140076693
cmp ebx, eax
jae 0x1400766e8
prefetchw byte [0x1404a38a0]
mov rax, qword [0x1404a38a0]
nop
mov rcx, rax
xor rcx, rdx
lock cmpxchg qword [0x1404a38a0], rcx
jne 0x140076680
jmp 0x1400766e8
cmp rdx, qword [r15 + 0x80]
jae 0x1400766e8
lea rax, [rbp + 0x120]
cmp byte [r15 + 0x261], 0
mov ecx, 0
cmove rax, rcx
lea r9, [r14 + 0x28]
mov r8d, ebx
mov qword [rsp + 0x30], rax
mov rdx, r15
lea rcx, [rbp - 0x20]
call fcn.140088f40
nop
mov rcx, rax
call fcn.140089420
nop
mov rcx, qword [rbp - 8]
call fcn.140311600
mov rcx, qword [rbp - 0x18]
call fcn.140311600
inc qword [r14 + 8]
cmp byte [r14 + 0x51], 0
movzx r13d, byte [rsp + 0x49]
lea rbx, [0x1404962c8]
mov esi, 8
lea r10d, [rsi + 0x44]
mov r11d, 0xffff0000
je 0x140076260
call sub.KERNEL32.dll_SwitchToThread
lea rbx, [0x1404962c8]
lea r10d, [rsi + 0x44]
mov r11d, 0xffff0000
jmp 0x140076260
lea rbx, [0x1404962c8]
mov rcx, r14
call fcn.140076c80
jmp 0x140076103
call fcn.140070550
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1403115a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret