Function at 0x140001bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r11, qword [rcx]
mov rdi, rcx
test r11, r11
jne 0x140002064
mov edx, dword [rcx + 8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
lea eax, [rdx + rdx]
cmp eax, edx
cmovae edx, eax
mov esi, edx
lea rcx, [rdx*4 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [section..data]
mov ebp, 4
mov r10d, dword [0x14000e004]
mov r11, rax
mov rbx, rax
nop word [rax + rax]
mov edx, r10d
mov r8d, ecx
shl edx, 7
mov eax, ecx
shr eax, 0xc
mov r9d, ecx
movzx eax, al
shr r8d, 0x19
or r8d, edx
shr r9d, 0x18
movzx edx, r8b
xor edx, eax
shl r10d, 8
or r9d, r10d
mov byte [rbx], dl
shl ecx, 8
mov eax, r9d
or ecx, edx
shl eax, 7
shl r9d, 8
mov edx, ecx
shr edx, 0x19
mov r10d, ecx
or edx, eax
shr r10d, 0x18
or r10d, r9d
movzx r8d, dl
mov eax, ecx
shl ecx, 8
shr eax, 0xc
movzx eax, al
xor r8d, eax
mov eax, r10d
shl eax, 7
or ecx, r8d
mov byte [rbx + 1], r8b
mov edx, ecx
shr edx, 0x19
mov r9d, ecx
or edx, eax
shr r9d, 0x18
movzx r8d, dl
mov eax, ecx
shr eax, 0xc
movzx eax, al
xor r8d, eax
shl r10d, 8
or r9d, r10d
mov byte [rbx + 2], r8b
shl ecx, 8
mov eax, r9d
or ecx, r8d
shl eax, 7
shl r9d, 8
mov edx, ecx
shr edx, 0x19
mov r10d, ecx
or edx, eax
shr r10d, 0x18
movzx r8d, dl
or r10d, r9d
mov eax, ecx
shl ecx, 8
shr eax, 0xc
movzx eax, al
xor r8d, eax
mov eax, r10d
or ecx, r8d
shl eax, 7
mov byte [rbx + 3], r8b
mov edx, ecx
shr edx, 0x19
mov r9d, ecx
or edx, eax
shr r9d, 0x18
mov eax, ecx
movzx r8d, dl
shr eax, 0xc
movzx eax, al
xor r8d, eax
shl r10d, 8
or r9d, r10d
mov byte [rbx + 4], r8b
shl ecx, 8
mov eax, r9d
shl eax, 7
or ecx, r8d
mov edx, ecx
shl r9d, 8
shr edx, 0x19
mov r10d, ecx
or edx, eax
shr r10d, 0x18
or r10d, r9d
movzx r8d, dl
mov eax, ecx
shl ecx, 8
shr eax, 0xc
movzx eax, al
xor r8d, eax
mov eax, r10d
shl eax, 7
or ecx, r8d
mov byte [rbx + 5], r8b
mov edx, ecx
shr edx, 0x19
mov r9d, ecx
or edx, eax
shr r9d, 0x18
movzx r8d, dl
mov eax, ecx
shr eax, 0xc
movzx eax, al
xor r8d, eax
shl r10d, 8
or r9d, r10d
mov byte [rbx + 6], r8b
shl ecx, 8
mov eax, r9d
shl eax, 7
or ecx, r8d
mov edx, ecx
shl r9d, 8
shr edx, 0x19
mov r10d, ecx
or edx, eax
shr r10d, 0x18
movzx r8d, dl
or r10d, r9d
mov eax, ecx
shl ecx, 8
shr eax, 0xc
movzx eax, al
xor r8d, eax
mov eax, r10d
or ecx, r8d
shl eax, 7
mov byte [rbx + 7], r8b
mov edx, ecx
shr edx, 0x19
mov r9d, ecx
or edx, eax
shr r9d, 0x18
movzx r8d, dl
mov eax, ecx
shr eax, 0xc
movzx eax, al
xor r8d, eax
shl r10d, 8
shl ecx, 8
or r9d, r10d
or ecx, r8d
mov byte [rbx + 8], r8b
mov edx, ecx
mov eax, r9d
shl eax, 7
shr edx, 0x19
or edx, eax
mov eax, ecx
shr eax, 0xc
movzx eax, al
movzx r8d, dl
xor r8d, eax
shl r9d, 8
mov byte [rbx + 9], r8b
mov r10d, ecx
shr r10d, 0x18
or r10d, r9d
shl ecx, 8
or ecx, r8d
mov eax, r10d
shl eax, 7
mov edx, ecx
shr edx, 0x19
mov r9d, ecx
or edx, eax
shl r10d, 8
movzx r8d, dl
mov eax, ecx
shr eax, 0xc
movzx eax, al
xor r8d, eax
shl ecx, 8
or ecx, r8d
mov byte [rbx + 0xa], r8b
shr r9d, 0x18
mov edx, ecx
or r9d, r10d
shr edx, 0x19
mov r10d, ecx
mov eax, r9d
shl eax, 7
or edx, eax
shr r10d, 0x18
movzx r8d, dl
mov eax, ecx
shr eax, 0xc
movzx eax, al
xor r8d, eax
shl r9d, 8
or r10d, r9d
shl ecx, 8
or ecx, r8d
mov byte [rbx + 0xb], r8b
mov edx, ecx
mov eax, r10d
shl eax, 7
mov r9d, ecx
shr edx, 0x19
or edx, eax
shl r10d, 8
movzx r8d, dl
mov eax, ecx
shr eax, 0xc
movzx eax, al
xor r8d, eax
shl ecx, 8
or ecx, r8d
shr r9d, 0x18
or r9d, r10d
mov byte [rbx + 0xc], r8b
mov edx, ecx
mov r10d, ecx
shr edx, 0x19
mov eax, r9d
shl eax, 7
or edx, eax
shr r10d, 0x18
movzx r8d, dl
mov eax, ecx
shr eax, 0xc
movzx eax, al
xor r8d, eax
shl r9d, 8
shl ecx, 8
or r10d, r9d
or ecx, r8d
mov byte [rbx + 0xd], r8b
mov edx, ecx
mov eax, r10d
shr edx, 0x19
shl eax, 7
or edx, eax
movzx r8d, dl
mov eax, ecx
shr eax, 0xc
mov r9d, ecx
movzx eax, al
xor r8d, eax
shr r9d, 0x18
mov byte [rbx + 0xe], r8b
shl r10d, 8
or r9d, r10d
shl ecx, 8
or ecx, r8d
mov eax, r9d
shl eax, 7
mov edx, ecx
shr edx, 0x19
mov r10d, ecx
or edx, eax
shl r9d, 8
movzx r8d, dl
mov eax, ecx
shr eax, 0xc
movzx eax, al
xor r8d, eax
shr r10d, 0x18
or r10d, r9d
mov byte [rbx + 0xf], r8b
shl ecx, 8
mov eax, r10d
or ecx, r8d
shl eax, 7
mov edx, ecx
shl r10d, 8
shr edx, 0x19
mov r9d, ecx
or edx, eax
shr r9d, 0x18
or r9d, r10d
movzx r8d, dl
mov eax, ecx
shl ecx, 8
shr eax, 0xc
movzx eax, al
xor r8d, eax
mov eax, r9d
or ecx, r8d
shl eax, 7
mov byte [rbx + 0x10], r8b
mov edx, ecx
shr edx, 0x19
mov r10d, ecx
or edx, eax
shl r9d, 8
mov eax, ecx
movzx r8d, dl
shr eax, 0xc
movzx eax, al
xor r8d, eax
shr r10d, 0x18
or r10d, r9d
shl ecx, 8
or ecx, r8d
mov byte [rbx + 0x11], r8b
mov edx, ecx
mov r9d, ecx
shr edx, 0x19
mov eax, r10d
shl eax, 7
or edx, eax
shr r9d, 0x18
mov eax, ecx
movzx r8d, dl
shr eax, 0xc
shl r10d, 8
movzx eax, al
or r9d, r10d
xor r8d, eax
shl ecx, 8
or ecx, r8d
mov byte [rbx + 0x12], r8b
mov edx, ecx
mov r10d, ecx
shr edx, 0x19
mov eax, r9d
shr r10d, 0x18
shl eax, 7
lea rbx, [rbx + 0x14]
or edx, eax
shl r9d, 8
mov eax, ecx
movzx r8d, dl
shr eax, 0xc
or r10d, r9d
shl ecx, 8
movzx eax, al
xor r8d, eax
or ecx, r8d
mov byte [rbx - 1], r8b
sub rbp, 1
jne 0x140001c10
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov dword [section..data], ecx
mov dword [0x14000e004], r10d
test r11, r11
jne 0x140002056
xor eax, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [r11], 0
mov dword [r11 + 8], esi
mov qword [rdi], r11
mov rsi, qword [rsp + 0x40]
mov rax, r11
add rsp, 0x20
pop rdi
ret