Function at 0x14009c030
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r10, r8
mov rsi, rcx
mov eax, dword [0x141dce0e8]
and eax, dword [0x141dce0ec]
add eax, 0x6ba4acfc
imul rax, rax, 0x26b2d7ed
shr rax, 0x3d
or eax, 0x7cca34cc
cmp eax, 0x71ce762e
jb 0x14009c0ed
mov eax, dword [0x141dce0f0]
or eax, dword [0x141dce0f4]
imul rax, rax, 0xa9d37ab
shr rax, 0x3b
xor eax, 0xc8b6f2f5
imul ecx, eax, 0x8ba1da56
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov r13, rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov r14, rsp
mov eax, 0x250
call fcn.1400ed360
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov rdi, rsp
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov r8, rsp
cmp ecx, 0x82f9c30d
jbe 0x14009c133
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x250
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
jmp 0x14009c073
mov ecx, dword [0x141dce0f8]
sub ecx, dword [0x141dce0fc]
lea rax, [r8 + 0x20]
xor ecx, 0xb790d74
imul ecx, ecx, 0xbd2f2bf4
cmp ecx, 0x8ca76db3
jne 0x14009c170
mov dword [r8 + 0x14], 0
mov word [rax + 4], 0
mov dword [rax], 0
nop dword [rax + rax]
mov ecx, dword [0x141dce100]
xor ecx, dword [0x141dce104]
and ecx, 0x598670d8
add ecx, 0xd861d479
and ecx, 0x5989f098
mov dword [r8 + 0x14], 0
mov word [rax + 4], 0
mov dword [rax], 0
cmp ecx, 0x765b155c
je 0x14009c170
mov qword [r8 + 0x18], 7
mov qword [r8 + 8], 0
mov qword [r8], 1
mov r12d, r9d
mov eax, r9d
or eax, 0x2000000
mov dword [r8 + 0x10], eax
sub rsp, 0x20
mov qword [rbp - 0x18], rdx
mov rcx, rdx
mov qword [rbp], r10
mov rdx, r10
call fcn.1400913c0
add rsp, 0x20
mov rbx, rdx
test rax, rax
je 0x14009c3ce
nop word [rax + rax]
mov eax, dword [str.C_oZ]
xor eax, dword [0x141dce124]
imul eax, eax, 0x1585fe2
imul rax, rax, 0x4be79c0f
shr rax, 0x3e
cmp eax, 0xf8194949
ja 0x14009c200
nop word cs:[rax + rax]
mov eax, dword [0x141dce128]
or eax, dword [0x141dce12c]
or eax, 0x75a1c02b
add eax, 0xd8861fbb
xor eax, 0x8bafaf0d
cmp eax, 0x82165a27
ja 0x14009c230
mov eax, ebx
and eax, 3
cmp eax, 2
jb 0x14009c33d
cmp eax, 2
jne 0x14009c320
mov rax, rbx
shr rax, 0x20
cmp rax, 5
je 0x14009c27f
cmp eax, 0x20
jne 0x14009c33d
mov qword [rbp - 8], rsi
mov dword [rbp - 0xc], r12d
xor eax, eax
test al, al
je 0x14009c2a5
sub rsp, 0x20
mov rcx, r14
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp]
call fcn.14008f360
add rsp, 0x20
mov rsi, qword [rbp - 0x18]
nop dword [rax]
mov eax, dword [0x141dce150]
and eax, dword [0x141dce154]
imul r12d, eax, 0xacd3bb3e
add r12d, 0x183b508
sub rsp, 0x20
mov rcx, r14
mov rdx, rsi
mov r8, qword [rbp]
call fcn.14008f360
add rsp, 0x20
cmp r12d, 0x45094991
ja 0x14009c2b0
mov rcx, qword [r14]
mov r12, qword [r14 + 8]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x14009c406
mov al, 1
mov rcx, qword [rbp - 8]
nop word [rax + rax]
test al, al
je 0x14009c310
jmp 0x14009c54a
mov eax, dword [0x141dce130]
and eax, dword [0x141dce134]
add eax, 0x1b83e603
xor eax, 0xacd04c3f
cmp eax, 0xad56b80a
jbe 0x14009c320
xor eax, eax
nop
test al, al
jne 0x14009c340
mov eax, dword [0x141dce138]
imul eax, dword [0x141dce13c]
imul eax, eax, 0xf62f456
or eax, 0xf2e034d4
cmp eax, 0xa6bb94bf
jne 0x14009c370
mov qword [rsi + 8], rbx
mov qword [rsi], 2
nop
mov eax, dword [0x141dce140]
xor eax, dword [0x141dce144]
or eax, 0x62100041
xor eax, 0x1020088
and eax, 0x6f1200cd
mov qword [rsi + 8], rbx
mov qword [rsi], 2
cmp eax, 0x20f4f3b4
jb 0x14009c370
nop dword [rax]
mov eax, dword [0x141dce148]
add eax, dword [0x141dce14c]
imul eax, eax, 0xb44bdb92
imul rax, rax, 0x12c18977
shr rax, 0x3c
or eax, 0xc2470b94
cmp eax, 0x587afc4
jb 0x14009c3a0
jmp 0x14009c48e
sub rsp, 0x20
mov rcx, rsi
mov rdx, rbx
call fcn.140091f50
add rsp, 0x20
mov eax, dword [0x141dce108]
sub eax, dword [0x141dce10c]
add eax, 0x69029f02
and eax, 0x3504a464
imul eax, eax, 0xeef83484
cmp eax, 0xb281593f
jne 0x14009c41c
jmp 0x14009c451
xor eax, eax
test al, al
mov qword [rbp], r12
mov rsi, rcx
je 0x14009c4a5
jmp 0x14009c4fe
mov eax, dword [0x141dce110]
and eax, dword [0x141dce114]
add eax, 0xba0f0074
imul rsi, rax, 0x72ec8d3b
shr rsi, 0x3c
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
cmp esi, 0xcdebe362
jbe 0x14009c470
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
jmp 0x14009c41c
mov eax, dword [0x141dce118]
imul eax, dword [0x141dce11c]
or eax, 0x10111890
and eax, 0xb29ddc95
cmp eax, 0x2cfff14a
je 0x14009c470
mov al, 1
test al, al
je 0x14009c490
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r12d, dword [0x141dce158]
sub r12d, dword [0x141dce15c]
or r12d, 0x82888c1e
and r12d, 0x8bb8cc7e
xor r12d, 0xdf876f61
mov rax, qword [r14 + 0x10]
mov qword [r13], rcx
mov rcx, qword [rbp]
mov qword [r13 + 8], rcx
mov qword [r13 + 0x10], rax
sub rsp, 0x20
mov rcx, rdi
mov rdx, r13
mov r8b, 1
call fcn.1400928a0
mov rcx, rsi
add rsp, 0x20
cmp r12d, 0xb8a053bd
jbe 0x14009c530
mov rax, qword [r14 + 0x10]
mov qword [r13], rcx
mov rcx, qword [rbp]
mov qword [r13 + 8], rcx
mov qword [r13 + 0x10], rax
sub rsp, 0x20
mov rcx, rdi
mov rdx, r13
mov r8b, 1
call fcn.1400928a0
mov rcx, rsi
add rsp, 0x20
jmp 0x14009c4a5
mov r14, qword [rdi]
mov r12, qword [rdi + 8]
movabs rax, 0x8000000000000000
cmp r14, rax
jne 0x14009c55a
mov rcx, qword [rbp - 8]
mov qword [rcx + 8], r12
mov qword [rcx], 2
jmp 0x14009c494
sub rsp, 0x20
mov r8d, 0x250
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, r12
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
add rsp, 0x20
nop
mov ecx, dword [0x141dce160]
or ecx, dword [0x141dce164]
or ecx, 0xf3f89ae6
and ecx, 0xf7f9dbef
cmp ecx, 0x4881757d
je 0x14009c580
cmp rax, 0xffffffffffffffff
je 0x14009c6ac
sub rsp, 0x20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
add rsp, 0x20
mov eax, dword [r15]
movups xmm0, xmmword [r15 + 4]
movsd xmm1, qword [r15 + 0x14]
mov ecx, dword [r15 + 0x20]
mov edx, dword [r15 + 0x1c]
shl rdx, 0x20
or rdx, rcx
mov ecx, eax
shl ecx, 0x15
sar ecx, 0x1f
mov r8d, dword [0x141dce168]
sub r8d, dword [0x141dce16c]
imul r8, r8, 0x52cc509
shr r8, 0x39
imul r8d, r8d, 0xcf11195d
cmp r8d, 0xc06d135a
je 0x14009c5e0
and ecx, dword [r15 + 0x24]
cmp dword [rbp - 0xc], 0
mov r10, qword [rbp - 8]
jne 0x14009c68c
xor r8d, r8d
test r8b, r8b
jne 0x14009c61a
mov r9d, ecx
shr r9d, 0x1d
mov r8d, eax
shr r8d, 0xa
and r8d, r9d
and r8d, 1
xor r9d, r9d
test r9b, r9b
jne 0x14009c637
mov r9d, dword [0x141dce188]
add r9d, dword [0x141dce18c]
imul r9d, r9d, 0xe109ec0c
add r9d, 0xfb19e614
cmp r9d, 0xbdd8eb57
ja 0x14009c63c
test r8b, r8b
je 0x14009c68c
mov eax, dword [0x141dce1d8]
and eax, dword [0x141dce1dc]
add eax, 0x1901a0a0
or eax, 0xf45f14fb
cmp eax, 0x318096c9
jae 0x14009c928
jmp 0x14009c956
mov r8d, dword [0x141dce190]
add r8d, dword [0x141dce194]
cmp r8d, 0x7f927794
jne 0x14009c769
jmp 0x14009c7b8
xor eax, eax
test al, al
mov rcx, qword [rbp - 8]
je 0x14009c6d0
mov qword [rcx + 8], rbx
mov qword [rcx], 2
nop word cs:[rax + rax]
mov eax, dword [0x141dce170]
xor eax, dword [0x141dce174]
or eax, 0x8151beb3
xor eax, 0x65c49bfe
imul eax, eax, 0xc26717b9
mov qword [rcx + 8], rbx
mov qword [rcx], 2
cmp eax, 0x983b0bd2
je 0x14009c6d0
nop
mov eax, dword [0x141dce178]
xor edx, edx
div dword [0x141dce17c]
add eax, 0x359fb184
xor eax, 0xe2678152
cmp eax, 0xbff26c0f
jb 0x14009c700
test r14, r14
je 0x14009c48e
mov rcx, qword [0x141dd7fe0]
sub rsp, 0x20
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov eax, dword [0x141dce180]
and eax, dword [0x141dce184]
and eax, 0x20000e
xor eax, 0x8821000e
or eax, 0x735eff21
cmp eax, 0x9df71f83
jb 0x14009c742
jmp 0x14009c48e
mov r8d, dword [0x141dce198]
or r8d, dword [0x141dce19c]
imul r8d, r8d, 0x1ff16e6
mov qword [r10], 0
mov dword [r10 + 0x10], 0
mov dword [r10 + 0x18], 0
movups xmmword [r10 + 0x20], xmm0
movlps qword [r10 + 0x30], xmm1
mov qword [r10 + 0x38], rdx
mov dword [r10 + 0x40], 0
mov dword [r10 + 0x4c], eax
cmp r8d, 0xd5612b07
jne 0x14009c7ee
mov qword [r10], 0
mov dword [r10 + 0x10], 0
mov dword [r10 + 0x18], 0
movups xmmword [r10 + 0x20], xmm0
movlps qword [r10 + 0x30], xmm1
mov qword [r10 + 0x38], rdx
mov dword [r10 + 0x40], 0
mov dword [r10 + 0x4c], eax
jmp 0x14009c769
mov eax, dword [0x141dce1a0]
sub eax, dword [0x141dce1a4]
cmp eax, 0xfb8aff22
je 0x14009c82a
mov eax, dword [0x141dce1a8]
xor edx, edx
div dword [0x141dce1ac]
xor eax, 0xa55c2524
imul rax, rax, 0x7a3b7863
shr rax, 0x3e
mov dword [r10 + 0x50], ecx
cmp eax, 0x72f46605
jne 0x14009c830
mov dword [r10 + 0x50], ecx
jmp 0x14009c801
mov eax, dword [0x141dce1b0]
or eax, dword [0x141dce1b4]
add eax, 0xb23257f0
xor eax, 0x4d8a529a
cmp eax, 0x8753c934
jb 0x14009c830
test r14, r14
je 0x14009c48e
mov eax, dword [0x141dce1b8]
imul eax, dword [0x141dce1bc]
imul eax, eax, 0xdeb78b23
add eax, 0xe9a1b26a
cmp eax, 0xfb30ae2b
jbe 0x14009c880
mov rax, qword [0x141dd7fe0]
nop dword [rax]
mov eax, dword [0x141dce1c0]
add eax, dword [0x141dce1c4]
xor eax, 0x17658394
imul rax, rax, 0x51105b47
shr rax, 0x3d
or eax, 0x38ef24cc
mov rsi, qword [0x141dd7fe0]
cmp eax, 0xa59a1115
ja 0x14009c880
mov eax, dword [0x141dce1c8]
mov ecx, dword [0x141dce1cc]
add eax, ecx
add eax, 0x472541e2
xor eax, 0x9c240882
and eax, 0xbf240b92
cmp eax, 0xbfd803c7
jbe 0x14009c8e9
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [0x141dce1d0]
imul ebx, dword [0x141dce1d4]
or ebx, 0x22300006
and ebx, 0xa6322006
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r12
call rdi
add rsp, 0x20
cmp ebx, 0x4d7f4612
je 0x14009c8f0
jmp 0x14009c48e
mov eax, dword [0x141dce1e0]
sub eax, dword [0x141dce1e4]
imul eax, eax, 0x2cfd6a62
or eax, 0xb482812
and eax, 0x4f4f28da
mov qword [r10 + 8], rbx
mov qword [r10], 2
cmp eax, 0x4c6c4e65
jbe 0x14009c963
mov qword [r10 + 8], rbx
mov qword [r10], 2
jmp 0x14009c928
test r14, r14
je 0x14009c48e
mov eax, dword [0x141dce1e8]
and eax, dword [0x141dce1ec]
add eax, 0xf10d4c07
imul rcx, rax, 0x223299e1
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
or eax, 0xee588836
cmp eax, 0xe4f4b6cd
je 0x14009c9c8
mov eax, dword [0x141dce1f0]
imul eax, dword [0x141dce1f4]
imul eax, eax, 0x845ba3cb
add eax, 0x3fef2352
or eax, 0xefecce9e
mov rsi, qword [0x141dd7fe0]
cmp eax, 0xe2a65841
jne 0x14009c9d1
mov rax, qword [0x141dd7fe0]
jmp 0x14009c99d
mov eax, dword [0x141dce1f8]
or eax, dword [0x141dce1fc]
or eax, 0xfbfbfb2b
cmp eax, 0x1d403370
je 0x14009ca1f
mov eax, dword [0x141dce200]
xor eax, dword [0x141dce204]
imul edi, eax, 0x1a069642
and edi, 0xd746663e
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp edi, 0x45bced3
jne 0x14009ca37
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x14009c9e9
mov eax, dword [0x141dce208]
xor eax, dword [0x141dce20c]
imul eax, eax, 0x258c2ab0
add eax, 0x8fae5710
cmp eax, 0x1030199e
jbe 0x14009ca37
jmp 0x14009c48e