Function at 0x140027df0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov eax, dword [0x140042b38]
mov ebp, 0xd
mov r15d, 0x568
mov dword [rsp + 0x28], ebp
mov r13d, 0x344
mov dword [rsp + 0x24], r15d
mov r12b, 0x48
mov dword [rsp + 0x30], r13d
lea ecx, [rax*4 + 0xc1]
mov dword [rsp + 0x38], 0x32
mov eax, 0x38e38e39
mov byte [rsp + 0xb8], r12b
imul ecx
mov ebx, 0x20d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
je 0x140027ec0
sub ecx, 1
je 0x140027ee4
sub ecx, 1
je 0x140027eae
cmp ecx, 1
je 0x140027e96
movzx eax, byte [0x140042b60]
inc al
mov byte [0x140042b80], al
movzx eax, byte [0x140042a87]
xor eax, r13d
setne cl
sub byte [0x140042b57], cl
jmp 0x140027ee4
mov ebp, dword [0x140042b4c]
inc ebp
mov dword [0x140042b40], 1
mov dword [rsp + 0x28], ebp
jmp 0x140027ee4
mov r15d, dword [0x140042b34]
add r15d, 2
mov dword [rsp + 0x24], r15d
jmp 0x140027ee4
movzx eax, byte [0x140042a86]
mov dword [0x140042b58], eax
movsx eax, byte [0x140042b67]
imul r13d, eax, 0x568
shr r13d, 2
mov dword [rsp + 0x30], r13d
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov r9d, dword [0x140042b40]
test r9d, r9d
je 0x140027eff
test ebp, ebp
je 0x140027eff
mov dil, 1
jmp 0x140027f02
xor dil, dil
movzx esi, byte [0x140042b82]
test r9d, r9d
movzx r10d, byte [0x140042a86]
mov ecx, r13d
movzx r8d, byte [0x140042b54]
setne al
add sil, al
mov byte [0x140042b81], dil
xor edx, edx
mov byte [0x140042b82], sil
lea eax, [r10 + r15]
shl eax, cl
mov ecx, 0x42
sub dword [0x140042b4c], eax
cmp dword [0x140042b7c], 0x1f8
mov eax, dword [0x140042b30]
sete dl
or edx, 1
nop dword [rax]
or eax, r8d
sub rcx, 1
jne 0x140027f60
cmp byte [0x140042b65], cl
mov dword [0x140042b30], eax
jne 0x140027f83
mov byte [0x140042b66], cl
cmp r13d, 0x32
jne 0x140027f8a
mov byte [0x140042b66], 1
mov r14d, dword [0x140042b68]
movsx r8d, byte [0x140042b88]
xor r14d, 1
movzx r11d, byte [0x140042b57]
xor r8d, 1
and r8d, dword [0x140042a8c]
add r8d, dword [0x140042b6c]
movzx edi, dil
mov dword [rsp + 0x34], r14d
mov dword [0x140042b68], r14d
mov dword [0x140042a8c], r8d
lea eax, [rdi + rdi*2]
lea ecx, [rax*2 + 0x20d]
and ecx, 0x80000003
jge 0x140027fe7
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x14002808f
sub ecx, 1
je 0x140028072
sub ecx, 1
je 0x14002803f
cmp ecx, 1
je 0x140028029
xor eax, eax
cmp byte [0x140042b80], 0x48
sete al
add r9d, eax
movsx eax, byte [0x140042b67]
xor eax, r15d
mov dword [0x140042b40], r9d
setne cl
and byte [0x140042b56], cl
jmp 0x140028094
movzx r12d, byte [0x140042b55]
add r12b, 0x26
mov byte [rsp + 0xb8], r12b
jmp 0x140028094
sub r11d, r13d
add r11d, 0x4f2
cmp r11d, 0xc1
jne 0x140028065
cmp byte [0x140042a87], 0
jne 0x140028065
xor eax, eax
sub dword [0x140042b78], eax
jmp 0x140028094
mov eax, 1
sub dword [0x140042b78], eax
jmp 0x140028094
xor r10d, r8d
mov ebx, r9d
xor r10d, 0x4f2
imul ebx, r13d
mov dword [0x140042b48], r10d
and ebx, 3
jmp 0x140028094
or edi, 0x32
sub edx, edi
movsx ecx, byte [0x140042b56]
mov eax, 0x1d9
or ecx, 1
xor edx, ecx
sub rax, 1
jne 0x1400280a3
movzx eax, sil
sub dword [0x140042b58], eax
test ebp, ebp
mov dword [0x140042a64], edx
setne cl
and sil, r12b
xor byte [0x140042a63], sil
shl r9d, cl
sub dword [0x140042b5c], r9d
call qword [sym.imp.USER32.dll_GetDesktopWindow]
imul r11d, dword [0x140042a64], 0x32
mov eax, 0xaaaaaaab
mov esi, dword [0x140042b84]
mov ecx, 0x16d
movzx r8d, byte [0x140042a87]
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
mov edx, 0x2c8
sub r11d, eax
mov dword [rsp + 0x44], r11d
nop
cmp dword [0x140042b30], 0
jne 0x140028125
mov byte [0x140042b67], 0
test r11b, r11b
jne 0x14002812c
mov byte [0x140042b67], 1
test r8b, r8b
jne 0x140028139
movzx eax, r12b
xor eax, edx
je 0x14002813e
mov eax, 1
sub esi, eax
sub rcx, 1
jne 0x140028110
movzx eax, byte [0x140042b40]
mov r9d, 0x1ff
movzx ecx, byte [0x140042b80]
and al, 0xc8
movzx edx, byte [0x140042b82]
movzx edi, byte [0x140042a86]
mov r10d, dword [0x140042b78]
mov byte [rsp + 0x21], al
mov byte [0x140042b64], al
movzx eax, r12b
movzx r15d, r11b
movzx r11d, byte [0x140042a62]
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x40], r15d
xor r15d, r15d
cmp dword [0x140042b28], eax
movsx eax, byte [0x140042b66]
sete r15b
mov byte [rsp + 0xb0], r11b
mov r11d, dword [rsp + 0x40]
xor r12d, r12d
cmp eax, 0x4f2
mov dword [rsp + 0x4c], esi
movzx eax, byte [0x140042b34]
setb r12b
sub r14d, dword [rsp + 0x24]
xor r14d, 0x32
cmp dword [0x140042b38], 0x32
sete byte [rsp + 0x20]
and al, r13b
movzx r13d, byte [0x140042b65]
sub cl, al
movzx eax, byte [0x140042b56]
mov byte [rsp + 0xa8], cl
mov ecx, dword [0x140042b48]
mov dword [rsp + 0x3c], ecx
mov byte [rsp + 0xa0], al
jmp 0x140028218
movzx r8d, byte [0x140042a87]
cmp r15d, r12d
jne 0x140028295
mov eax, dword [rsp + 0x34]
mov ecx, r11d
shr eax, cl
movzx ecx, bpl
and al, byte [rsp + 0x24]
xor al, byte [rsp + 0xa0]
xor al, dl
cmp dword [0x140042b38], 0
mov byte [rsp + 0xa0], al
mov byte [0x140042b56], al
setne al
mov byte [rsp + 0xb0], al
mov byte [0x140042a62], al
mov eax, r11d
shr eax, cl
xor ecx, ecx
cmp eax, 0x32
sete cl
or ecx, dword [0x140042a88]
je 0x140028280
cmp byte [0x140042b55], 0
je 0x140028280
mov eax, 1
jmp 0x140028282
xor eax, eax
mov ebx, dword [0x140042b44]
and r10d, eax
mov ecx, dword [rsp + 0x3c]
add ebx, 0xed
movzx eax, r8b
xor eax, ebx
jne 0x1400282a1
test ebx, ebx
je 0x1400282a6
mov eax, 1
movzx r8d, byte [0x140042b28]
and ecx, eax
mov dword [rsp + 0x3c], ecx
mov dword [0x140042b48], ecx
mov ecx, ebx
shl r8b, cl
movzx eax, dil
and r8b, 0xf2
or eax, r14d
or r10d, eax
mov dword [0x140042b78], r10d
test r10d, r10d
jne 0x1400282f9
mov eax, dword [rsp + 0x2c]
xor eax, 0x3b8
jne 0x1400282f9
cmp byte [rsp + 0xb8], al
je 0x1400282f5
cmp dword [0x140042b60], eax
jne 0x1400282f9
xor eax, eax
jmp 0x1400282fe
mov eax, 1
add byte [0x140042a87], al
mov eax, dword [rsp + 0x34]
shr eax, cl
mov ecx, dword [rsp + 0x3c]
and al, r13b
or al, byte [rsp + 0x20]
and dil, al
sub r9, 1
jne 0x140028210
mov r14d, dword [0x140042b2c]
cmp r11d, 0x4f2
mov r11d, dword [rsp + 0x44]
movzx r13d, byte [rsp + 0x21]
mov r15d, dword [rsp + 0x40]
mov dword [rsp + 0x48], r10d
je 0x1400283eb
test r13b, r13b
je 0x140028366
mov ecx, r15d
mov eax, ebp
sar eax, cl
mov ecx, dword [rsp + 0x2c]
test ecx, eax
je 0x14002836a
mov eax, 1
jmp 0x14002836c
mov ecx, dword [rsp + 0x2c]
xor eax, eax
sub dword [0x140042a8c], eax
mov edx, 0x32
movzx eax, byte [0x140042b38]
sub edx, ecx
mov ecx, dword [rsp + 0x24]
sub al, cl
mov r9d, dword [0x140042b7c]
sub al, r11b
shr edx, cl
and r8b, al
xor edx, dword [0x140042b68]
xor edx, r9d
mov dword [0x140042b68], edx
test r14d, r14d
je 0x1400283bc
test ebx, ebx
jne 0x1400283b5
mov eax, dword [rsp + 0x30]
xor eax, ebp
je 0x1400283bc
mov eax, 1
jmp 0x1400283be
xor eax, eax
movzx ecx, byte [rsp + 0xa0]
movzx esi, byte [0x140042b55]
xor cl, al
movzx eax, sil
mov byte [rsp + 0xa0], cl
or al, 0x2a
mov byte [0x140042b56], cl
add byte [rsp + 0xa8], al
jmp 0x1400283ff
mov edx, dword [0x140042b68]
mov r9d, dword [0x140042b7c]
movzx esi, byte [0x140042b55]
mov ecx, dword [rsp + 0x24]
lea eax, [r14 + r14*2]
sub ecx, eax
mov r12d, 0x8aa
and ecx, 7
je 0x1400284cc
sub ecx, 1
je 0x1400284a6
sub ecx, 1
je 0x14002848f
cmp ecx, 1
je 0x14002846b
mov ecx, ebp
movsx eax, sil
shl eax, cl
mov ecx, dword [rsp + 0x2c]
sar eax, cl
xor eax, 0x4f2
je 0x14002844c
test r13b, r13b
je 0x14002844c
mov eax, 1
jmp 0x14002844e
xor eax, eax
movzx r11d, byte [rsp + 0xb0]
xor r11b, al
mov byte [rsp + 0xb0], r11b
mov byte [0x140042a62], r11b
jmp 0x1400284dd
movzx eax, byte [0x140042b40]
add al, r11b
and al, 0xf2
mov byte [0x140042b83], al
xor eax, eax
cmp r14d, dword [rsp + 0x34]
sete al
sub dword [0x140042b34], eax
jmp 0x1400284dd
mov ecx, dword [rsp + 0x30]
movsx eax, r13b
shl eax, cl
cmp eax, dword [rsp + 0x24]
sete byte [0x140042b54]
jmp 0x1400284dd
movzx eax, dil
or eax, dword [rsp + 0x2c]
or dword [0x140042b34], eax
xor eax, eax
cmp edx, 0x32
sete al
or eax, r14d
or eax, r12d
or edx, eax
mov dword [0x140042b68], edx
jmp 0x1400284dd
mov eax, dword [0x140042b6c]
xor eax, ebx
or eax, r15d
or dword [0x140042b40], eax
mov ecx, dword [rsp + 0x24]
lea r13d, [rbx + rbx]
mov eax, dword [0x140042b44]
xor r9d, 1
movzx r15d, byte [0x140042b4c]
cmp r14d, 0x524
movzx r11d, byte [0x140042b57]
mov edi, 0x22e
sete byte [0x140042a86]
mov dword [0x140042b7c], r9d
xor r15b, byte [rsp + 0x28]
shl eax, cl
and r14d, eax
movsx r9d, sil
mov esi, dword [0x140042b7c]
and r9d, ecx
mov eax, 0x66666667
mov dword [0x140042b2c], r14d
imul ebx
mov ebp, edx
mov edx, dword [rsp + 0x34]
sar ebp, 1
sub r12d, edx
and r12d, dword [0x140042b40]
mov eax, ebp
shr eax, 0x1f
add ebp, eax
xor r9d, ebx
mov dword [rsp + 0x44], r9d
movzx r9d, byte [0x140042b82]
jmp 0x140028575
mov r10d, dword [rsp + 0x48]
xor ecx, ecx
cmp dword [rsp + 0x38], esi
sete cl
xor eax, eax
cmp r14d, edx
sete al
cmp eax, ecx
jne 0x1400285f5
movzx eax, byte [0x140042b65]
mov edx, ebx
mov ecx, dword [rsp + 0x34]
cmp eax, 0x2c8
sete al
sar edx, cl
or byte [rsp + 0xa8], al
movzx ecx, r8b
mov eax, dword [0x140042b38]
sub r11b, r14b
shl edx, cl
and eax, ebx
or edx, eax
mov ecx, r13d
add dword [0x140042a64], edx
mov eax, r10d
shr eax, cl
mov ecx, dword [rsp + 0x30]
sub r14d, eax
mov eax, 0xaaaaaaab
mov dword [0x140042b2c], r14d
mul ecx
shr edx, 1
lea eax, [rdx + rdx*2]
movzx edx, r9b
sub edx, eax
add edx, ecx
mov dword [rsp + 0x38], edx
mov edx, dword [rsp + 0x34]
jmp 0x1400285f9
mov ecx, dword [rsp + 0x30]
xor dword [0x140042a88], r12d
lea r10d, [r9 + rbp]
sub r8b, r15b
movzx eax, r10b
shl eax, cl
cmp eax, 0x4f2
mov byte [0x140042a63], r8b
sete r9b
and r9b, r11b
and r9b, byte [rsp + 0xa8]
sub rdi, 1
jne 0x140028570
mov edi, dword [rsp + 0x3c]
movzx ebp, byte [rsp + 0xa8]
movzx edx, byte [0x140042b88]
mov r9d, dword [rsp + 0x44]
mov esi, dword [rsp + 0x4c]
mov r13d, dword [rsp + 0x2c]
mov r12d, dword [rsp + 0x38]
movzx eax, r10b
mov ecx, eax
mov dword [rsp + 0x48], eax
movzx eax, byte [0x140042b83]
shr edi, cl
mov ecx, dword [rsp + 0x30]
shl ebp, cl
cmp eax, 0x3b8
mov byte [0x140042b57], r11b
mov byte [rsp + 0x20], r8b
mov r11d, 0x171
movzx r8d, byte [0x140042b65]
sete r15b
nop dword [rax]
nop dword [rax + rax]
xor r8b, byte [0x140042b38]
sub r9d, ebp
or esi, edi
je 0x1400286cb
xor ecx, ecx
mov byte [0x140042b82], 1
lea eax, [r12 + r13]
cmp eax, 0x3b8
sete cl
xor ecx, dword [0x140042b30]
jne 0x1400286d2
mov byte [0x140042b82], 0
or dl, r15b
sub r11, 1
jne 0x1400286a0
mov r12d, dword [rsp + 0x30]
movzx r13d, byte [rsp + 0xa8]
mov byte [0x140042b65], r8b
movzx r8d, byte [rsp + 0x20]
mov byte [0x140042b88], dl
mov dword [0x140042b58], r9d
mov dword [0x140042b84], esi
test r12d, r12d
je 0x1400287d5
xor r8b, byte [0x140042b67]
xor r8b, r10b
xor r14d, ebx
je 0x140028742
mov ecx, r12d
mov dword [0x140042b78], 1
mov eax, 0x2c8
shl eax, cl
movzx ecx, byte [0x140042a87]
sar eax, cl
test eax, eax
jne 0x14002874c
mov dword [0x140042b78], 0
mov edx, dword [rsp + 0x28]
mov ecx, edx
movzx eax, byte [rsp + 0xa0]
and ecx, 0x4f2
mov r10d, dword [rsp + 0x3c]
or ecx, ebx
shl r10b, cl
movzx ecx, dl
sub cl, byte [rsp + 0x24]
xor al, r10b
mov byte [0x140042b56], al
mov eax, dword [0x140042b5c]
xor eax, dword [rsp + 0x34]
and dword [0x140042b44], eax
movzx eax, byte [rsp + 0xb0]
sar al, cl
movsx eax, al
or r9d, eax
cmp dword [rsp + 0x38], 0
mov dword [0x140042b58], r9d
jne 0x1400287c1
cmp edx, 0x4f2
je 0x1400287c1
xor eax, eax
or al, r8b
add r8b, al
mov byte [0x140042a63], r8b
jmp 0x1400287d9
mov eax, 1
or al, r8b
add r8b, al
mov byte [0x140042a63], r8b
jmp 0x1400287d9
mov edx, dword [rsp + 0x28]
mov eax, dword [0x140042b28]
movzx ecx, dl
sub cl, byte [0x140042b7c]
and al, 0xb8
xor cl, al
imul esi, edx
xor cl, dl
mov eax, 0xaaaaaaab
sub r13b, cl
mov byte [0x140042b80], r13b
mul esi
shr edx, 1
lea eax, [rdx + rdx*2]
sub esi, eax
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
movzx r13d, byte [0x140042a8c]
mov r12d, 0xc5
xor sil, byte [0x140042b83]
sub r13b, byte [rsp + 0xb8]
mov r10d, dword [0x140042b40]
mov r15d, dword [0x140042b5c]
movzx r8d, byte [0x140042b80]
mov r14d, dword [0x140042b30]
movzx r9d, byte [0x140042b54]
movzx ebp, byte [0x140042b56]
mov r11d, dword [0x140042a88]
mov edi, dword [0x140042b3c]
mov byte [rsp + 0xa8], r13b
mov byte [0x140042b55], r13b
mov r13d, dword [0x140042b2c]
nop dword [rax + rax]
xor eax, eax
cmp ebx, r14d
setne al
xor edx, edx
cmp eax, ebx
movzx eax, r9b
setg dl
xor ecx, ecx
cmp eax, dword [rsp + 0x28]
setg cl
cmp ecx, edx
mov edx, dword [rsp + 0x28]
je 0x1400288e5
cmp byte [0x140042a87], 0
je 0x1400288b9
test edx, r15d
je 0x1400288b9
mov eax, 1
jmp 0x1400288bb
xor eax, eax
and r9b, dl
lea r14d, [r10 + 0x9e4]
add r14d, dword [rsp + 0x2c]
lea ecx, [rbx - 0xe]
and r8b, al
or r8b, r9b
movzx r9d, byte [0x140042a86]
shr r9b, cl
mov byte [0x140042b54], r9b
cmp dword [0x140042b6c], 0
jne 0x140028907
mov eax, edx
mov edx, dword [rsp + 0x38]
xor eax, 0x3b8
je 0x140028903
movzx eax, r8b
or eax, edx
jne 0x14002890b
xor eax, eax
jmp 0x140028910
mov edx, dword [rsp + 0x38]
mov eax, 1
mov ecx, dword [rsp + 0x24]
or edi, eax
test r11d, r11d
jne 0x14002892c
mov eax, dword [rsp + 0x2c]
add eax, ecx
mov dword [0x140042b48], r11d
cmp eax, ebx
jne 0x140028936
mov dword [0x140042b48], 1
mov eax, dword [rsp + 0x48]
or r8b, sil
or eax, 0x3b8
or r11d, eax
cmp edi, ebx
je 0x140028959
mov eax, ecx
sub eax, edx
test r13d, eax
je 0x140028959
mov eax, 1
jmp 0x14002895b
xor eax, eax
add bpl, al
sub r12, 1
jne 0x140028880
mov eax, dword [0x140042b38]
mov edx, 0x2c8
movzx r13d, byte [rsp + 0xa8]
sub eax, ecx
mov ecx, dword [0x140042b78]
add r15d, eax
movzx eax, byte [0x140042b44]
sar edx, cl
mov ecx, dword [rsp + 0x30]
add al, cl
xor dl, byte [rsp + 0xb8]
or dl, al
mov byte [0x140042b80], r8b
or byte [0x140042b82], dl
mov eax, 0xa75
sar r13b, cl
movsx ecx, r13b
mov dword [0x140042a88], r11d
mov dword [0x140042b3c], edi
mov byte [0x140042b56], bpl
mov dword [0x140042b30], r14d
mov dword [0x140042b5c], r15d
nop word [rax + rax]
xor r10d, ecx
sub rax, 1
jne 0x1400289e0
mov dword [0x140042b40], r10d
call fcn.1400273a0
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret