Function at 0x140029ee0
Capabilities:
Encode data using xor

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
movzx r13d, byte [0x140042b82]
mov ecx, 0x4b
movzx eax, byte [0x140042a8c]
mov edx, 0x1b5
movzx r12d, byte [0x140042a86]
or al, 1
mov edi, dword [0x140042b6c]
and r12b, al
mov r15d, dword [0x140042b40]
lea esi, [rcx - 0x4a]
movzx ebp, byte [0x140042b81]
mov ebx, dword [0x140042a64]
mov r11d, dword [0x140042b48]
movzx r10d, byte [0x140042a62]
mov r14d, dword [0x140042b5c]
mov dword [rsp + 0x44], edi
mov byte [rsp + 0xa0], r12b
xor r12d, r12d
mov eax, r12d
mov dword [rsp + 0xb8], r13d
cmp byte [0x140042b54], al
mov r8d, r12d
mov r9d, r12d
mov dword [rsp + 0x30], 0x2b
sete al
cmp r13d, 9
mov r13d, dword [0x140042b60]
setg r8b
mov dword [0x140042b2c], eax
cmp byte [0x140042b64], 0xa
mov dword [rsp + 0x24], r13d
setg r9b
add r15d, 3
or edi, 1
mov dword [rsp + 0x28], edi
mov edi, dword [0x140042b3c]
nop dword [rax]
cmp r9d, r8d
jne 0x140029fed
test bpl, bpl
jne 0x140029fd1
mov eax, r12d
test ebx, ebx
jne 0x140029fd3
mov eax, esi
add edi, eax
mov eax, r11d
xor eax, esi
add r11d, eax
mov eax, r12d
cmp dword [0x140042a8c], 0x70
sete al
or r14d, eax
and r10b, r13b
test r11d, r11d
jne 0x14002a000
mov eax, 0xa8
shl eax, cl
or eax, ecx
je 0x14002a004
movzx eax, sil
movzx ecx, al
and ecx, 3
mov byte [rsp + 0xa8], al
sub rdx, rsi
jne 0x140029fc0
mov r8d, dword [rsp + 0x24]
mov r12d, r15d
movzx ebx, byte [0x140042b64]
and r12d, 3
mov r13d, dword [rsp + 0xb8]
imul r8d, r15d
sar bl, 0xb0
mov dword [0x140042b3c], edi
and bl, r11b
mov edi, dword [0x140042b4c]
mov dword [0x140042b5c], r14d
mov r14d, 0x2b
shr r8d, 2
mov byte [0x140042a62], r10b
lea eax, [rdi + rcx]
mov dword [rsp + 0x24], r8d
mov ecx, r15d
shr eax, cl
add byte [rsp + 0xa0], al
movsx eax, byte [0x140042b56]
add r12d, eax
mov byte [rsp + 0xb0], al
lea eax, [r11 + 0x38]
lea ecx, [rax + rax*2]
mov eax, 0x38e38e39
mul ecx
shr edx, 1
lea eax, [rdx + rdx*8]
sub ecx, eax
je 0x14002a140
sub ecx, esi
je 0x14002a107
sub ecx, esi
je 0x14002a0db
mov ebp, dword [0x140042a88]
cmp ecx, esi
jne 0x14002a15e
lea ecx, [r13*8]
mov eax, 0x66666667
add ecx, r13d
imul ecx
mov ecx, edx
sar ecx, 1
mov eax, ecx
shr eax, 0x1f
add ecx, eax
mov dword [rsp + 0x30], ecx
jmp 0x14002a15e
mov eax, dword [0x140042b40]
xor ecx, ecx
mov edx, ecx
add eax, 9
cmp eax, 0x25
mov ecx, r14d
movzx eax, bpl
mov ebp, dword [0x140042a88]
sete dl
sub ecx, eax
and edx, ecx
sub dword [0x140042b78], edx
jmp 0x14002a15e
cmp dword [0x140042b5c], 0
jne 0x14002a134
xor ecx, ecx
cmp r12d, 0x70
mov eax, ecx
sete al
xor eax, 9
je 0x14002a128
cmp dword [0x140042a8c], ecx
jne 0x14002a134
mov ebp, dword [0x140042a88]
mov eax, ecx
and bl, al
jmp 0x14002a15e
mov ebp, dword [0x140042a88]
mov eax, esi
and bl, al
jmp 0x14002a15e
mov ebp, dword [0x140042a88]
mov eax, 0xaaaaaaab
lea ecx, [rbp*4]
add ecx, ebp
add ecx, ecx
mul ecx
mov r15d, edx
shr r15d, 1
mov r14d, dword [0x140042b38]
mov eax, 0xcccccccd
mov ecx, r14d
imul ecx, dword [rsp + 0x30]
mul ecx
movzx ecx, byte [0x140042b65]
movzx eax, bpl
and al, 0x81
mov r9d, edx
and cl, al
shr r9d, 2
mov byte [rsp + 0x2e], cl
test edi, edi
jne 0x14002a1ad
mov ecx, 0x4a
sub ecx, r8d
mov r8d, 0xa
shl r8d, cl
test r8d, r8d
jne 0x14002a1ad
mov eax, r8d
jmp 0x14002a1b2
mov eax, esi
xor r8d, r8d
mov edx, dword [rsp + 0x24]
sub r11d, eax
mov ecx, r12d
mov dword [rsp + 0x40], r11d
mov r11d, dword [rsp + 0x30]
movzx eax, r15b
shl bl, cl
sub al, dl
xor byte [rsp + 0xb0], bl
movzx ecx, byte [rsp + 0xa8]
movzx ebx, byte [0x140042b80]
and al, bl
or cl, al
movzx eax, byte [rsp + 0xa0]
mov byte [rsp + 0xa8], cl
test r12d, r12d
mov byte [0x140042b83], cl
mov ecx, r8d
setne cl
sub eax, ecx
or dword [0x140042b7c], eax
cmp r11d, ebp
jae 0x14002a235
cmp byte [0x140042b64], 0
jne 0x14002a227
lea eax, [rdx + 0xa]
test r9d, eax
mov eax, r8d
je 0x14002a229
mov eax, esi
movzx ebp, byte [0x140042a63]
or bpl, al
jmp 0x14002a23c
movzx ebp, byte [0x140042a63]
test r8b, r8b
je 0x14002a256
mov eax, r13d
xor eax, r12d
xor eax, 0x5f
je 0x14002a256
mov byte [rsp + 0xa0], sil
jmp 0x14002a25f
xor al, al
mov byte [rsp + 0xa0], al
movsx eax, r10b
or r13d, r12d
mov r10d, dword [rsp + 0x24]
or r13d, r15d
and dword [rsp + 0x28], r13d
mov ecx, 0x4a
mov dword [rsp + 0x34], eax
test bl, bl
setne r8b
imul ebx, eax, 0x5f
sub ecx, r15d
xor r14d, 0x89
or r8b, bpl
mov dword [0x140042b38], r14d
and r8b, byte [rsp + 0xb0]
mov eax, 0x55555556
and r8b, 0xa
imul ebx
mov byte [0x140042a63], r8b
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, dword [0x140042b28]
sub ebx, eax
lea eax, [rbx - 0xa]
and al, dl
mov byte [rsp + 0xb8], al
mov byte [0x140042a86], al
mov eax, r10d
shl eax, cl
movzx ecx, al
mov eax, r14d
shl eax, cl
and edx, eax
cmp byte [0x140042b67], 0
mov dword [rsp + 0x38], edx
je 0x14002a2fb
test ebx, ebx
je 0x14002a2fb
mov ecx, esi
jmp 0x14002a2fd
xor ecx, ecx
or cl, byte [0x140042a87]
movzx edx, byte [0x140042b57]
mov r8d, dword [0x140042b34]
movzx eax, dl
movzx ebp, byte [rsp + 0xa0]
xor al, 0xa
or al, 0x51
and al, cl
mov ecx, r10d
and ecx, 0xa
mov byte [0x140042a87], al
or ecx, 0x70
movzx r13d, al
and ecx, r14d
mov r10d, 0x1ed
mov r14d, dword [0x140042b40]
mov dword [rsp + 0x3c], ecx
mov edi, dword [rsp + 0x3c]
mov dword [0x140042b60], ecx
mov ecx, dword [0x140042b44]
nop dword [rax]
cmp r9d, 0x70
je 0x14002a381
movzx eax, dl
xor eax, r12d
je 0x14002a3c9
mov ecx, r8d
mov eax, 0x5f
shl eax, cl
cmp eax, 0xa8
jne 0x14002a3c9
mov ecx, esi
xor r15d, r15d
xor dl, sil
test r8d, r8d
je 0x14002a399
lea eax, [r11 + 0xa]
mov byte [rsp + 0x21], sil
test eax, eax
jne 0x14002a39e
mov byte [rsp + 0x21], 0
lea eax, [rcx - 0x5f]
cmp eax, r9d
sete r15b
mov dword [0x140042b68], r15d
test edi, edi
je 0x14002a3d1
xor eax, eax
cmp r9d, ebx
sete al
xor eax, r9d
je 0x14002a3d1
test r14d, r14d
je 0x14002a3d1
mov eax, esi
jmp 0x14002a3d3
xor r15d, r15d
mov ecx, r15d
jmp 0x14002a384
xor eax, eax
xor r8d, eax
cmp r13d, 0xa8
sete al
sub bpl, al
sub r10, rsi
jne 0x14002a360
mov r11d, dword [rsp + 0x40]
mov edi, dword [rsp + 0x28]
mov r14d, dword [0x140042b38]
mov byte [rsp + 0xa0], bpl
movzx ebp, byte [rsp + 0xa8]
mov dword [0x140042b34], r8d
cmp r9d, 0xa8
je 0x14002a421
test bpl, bpl
je 0x14002a434
mov r13d, dword [rsp + 0x30]
cmp dword [rsp + 0x34], r13d
sete byte [0x140042b64]
jmp 0x14002a439
mov r13d, dword [rsp + 0x30]
lea eax, [r9 + 0xa]
add eax, ecx
jne 0x14002a456
mov ecx, dword [0x140042b40]
mov eax, r9d
shl eax, cl
test eax, eax
jne 0x14002a456
mov byte [rsp + 0x20], al
jmp 0x14002a45b
mov byte [rsp + 0x20], sil
movzx eax, byte [rsp + 0xb8]
or eax, r12d
mov r12d, dword [rsp + 0x34]
je 0x14002a47f
mov eax, 0x51
mov ecx, r12d
sar eax, cl
test al, 0x70
je 0x14002a47f
mov eax, esi
jmp 0x14002a481
xor eax, eax
mov ecx, dword [rsp + 0x38]
mov r10d, 0x35
sub ecx, eax
mov eax, 0x55555556
imul r9d
mov dword [0x140042b28], ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dl
add al, al
add dl, al
movzx eax, r9b
sub al, dl
mov edx, dword [rsp + 0x24]
add al, byte [0x140042b4c]
cmp dword [0x140042a8c], 0
mov byte [rsp + 0xb8], al
movzx eax, bpl
setne byte [0x140042b66]
lea ebp, [r12 + r12*4]
movzx r12d, byte [rsp + 0x20]
test edx, edx
sete cl
add ebp, ebp
shr al, cl
lea ecx, [rdx + 0xa8]
mov byte [rsp + 0x2c], al
xor ecx, r8d
movzx r8d, byte [rsp + 0xa0]
mov eax, 0x55555556
imul ebp
mov dword [rsp + 0x38], ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, dword [0x140042b58]
sub ebp, eax
cmp dword [0x140042b5c], r9d
mov dword [rsp + 0x28], ebp
sete byte [rsp + 0x2d]
nop dword [rax + rax]
movzx eax, byte [0x140042b54]
or r11d, ecx
and al, byte [rsp + 0x2c]
dec r10d
mov byte [0x140042b54], al
xor ecx, ecx
test r12b, r12b
setne al
sub r8b, al
lea eax, [rdx + 0xa8]
mov dword [0x140042a64], eax
movzx eax, byte [rsp + 0xb0]
or al, byte [rsp + 0x2d]
mov byte [rsp + 0xb0], al
mov byte [0x140042b56], al
cmp ebx, r9d
jbe 0x14002a59d
cmp byte [0x140042b82], cl
je 0x14002a594
xor ebx, 0xffffff81
je 0x14002a594
mov r14d, esi
mov dword [0x140042b38], esi
jmp 0x14002a59d
mov r14d, ecx
mov dword [0x140042b38], ecx
test r15d, r15d
je 0x14002a5c1
movsx ecx, byte [rsp + 0xb8]
mov eax, r13d
shl eax, cl
mov ecx, ebp
shl eax, cl
test dword [0x140042b3c], eax
je 0x14002a5bf
mov eax, esi
jmp 0x14002a5c3
xor ecx, ecx
mov eax, ecx
sub edi, eax
lea ebx, [r14 + 0x2a]
xor edi, dword [rsp + 0x34]
xor edi, r9d
cmp dword [0x140042a8c], 0
jne 0x14002a5e5
mov ecx, dword [rsp + 0x24]
mov eax, ebp
shl eax, cl
test eax, eax
je 0x14002a5e7
mov eax, esi
mov ecx, dword [rsp + 0x38]
add edx, eax
test r10d, r10d
jne 0x14002a530
movsx eax, byte [rsp + 0xb0]
mov r10d, 0x4a
mov dword [0x140042b58], edx
movzx ecx, bpl
mov edx, r10d
mov byte [rsp + 0xa0], r8b
mov r8d, dword [0x140042b34]
shr edx, cl
and edx, r10d
mov dword [0x140042b48], r11d
movzx ecx, dl
mov dword [0x140042b30], edi
shl eax, cl
cmp byte [rsp + 0xa8], 0
mov dword [0x140042b44], eax
je 0x14002a65c
movsx edx, byte [0x140042b64]
mov ecx, ebp
shl r10d, cl
or r10d, edx
je 0x14002a663
mov eax, esi
jmp 0x14002a665
movzx edx, byte [0x140042b64]
xor eax, eax
mov r11d, dword [0x140042b40]
mov ecx, dword [rsp + 0x44]
movzx r10d, byte [0x140042b67]
xor ecx, eax
movsx eax, dl
movzx edx, byte [rsp + 0x2e]
sub eax, 0xa8
mov dword [0x140042b6c], ecx
and r11d, eax
inc cl
mov dword [0x140042b40], r11d
and r12b, cl
mov ecx, 0xea
mov byte [0x140042b57], r12b
xor ebp, ebp
nop word [rax + rax]
dec ecx
test r8d, r8d
je 0x14002a6c1
mov eax, r9d
xor eax, r13d
mov eax, esi
jne 0x14002a6c3
mov eax, ebp
add dl, al
or eax, 0xffffffff
sub al, dil
add r10b, al
test ecx, ecx
jne 0x14002a6b0
mov ebp, dword [rsp + 0x28]
mov byte [0x140042b65], dl
mov byte [0x140042b67], r10b
test ebp, ebp
jne 0x14002a6f4
neg r13d
jne 0x14002a6f4
xor r12d, r12d
mov ecx, r12d
jmp 0x14002a6f9
mov ecx, esi
xor r12d, r12d
movzx eax, byte [rsp + 0xa0]
mov edx, dword [rsp + 0x3c]
sar edx, cl
mov ecx, ebp
xor al, dl
mov byte [0x140042b55], al
lea eax, [r11 - 0x4a]
shr eax, cl
and dword [0x140042a88], eax
test r11d, r11d
je 0x14002a735
lea eax, [r9 + 0x28]
test al, 0x5f
je 0x14002a735
cmp byte [0x140042b80], 0
mov eax, esi
jne 0x14002a738
mov eax, r12d
movzx ecx, byte [rsp + 0x21]
and cl, al
mov byte [0x140042b81], cl
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
movsx r8d, byte [rsp + 0xb8]
movzx eax, byte [0x140042a86]
mov edi, r8d
imul r15d, eax, 0xfffffffe
mov r14d, r8d
and r15d, 3
and edi, 0x80000003
jge 0x14002a778
dec edi
or edi, 0xfffffffc
inc edi
add edi, dword [0x140042b60]
movzx ecx, byte [0x140042b65]
je 0x14002a795
test cl, cl
mov eax, r12d
setne al
and dword [0x140042b58], eax
cmp dword [0x140042a88], 0
je 0x14002a7a8
lea eax, [r14 - 0x75]
test eax, eax
mov eax, esi
jne 0x14002a7ab
mov eax, r12d
xor byte [0x140042b81], al
lea edx, [r8 + r15]
and dl, byte [0x140042b67]
mov eax, 0x158
xor cl, dl
sub rax, rsi
jne 0x14002a7c0
mov ebp, dword [0x140042b6c]
mov eax, r12d
mov byte [0x140042b65], cl
test ebp, ebp
mov ecx, edi
setne al
imul ebp, dword [rsp + 0x24]
xor dword [0x140042b7c], eax
mov eax, 0xcccccccd
mul ebp
shr edx, 2
lea eax, [rdx + rdx*4]
mov edx, 0x70
sar edx, cl
sub ebp, eax
movzx ecx, byte [0x140042b78]
and dl, 0x4a
sub cl, dl
mov dword [rsp + 0x34], ebp
mov byte [0x140042b64], cl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, dword [0x140042b2c]
movzx ecx, bpl
movsx r13d, byte [0x140042b64]
sub cl, r8b
movzx r9d, byte [0x140042a62]
mov eax, 0x5f
mov r10d, dword [0x140042b78]
mov r12d, 0x122
mov r11d, dword [0x140042b44]
sar eax, cl
mov ecx, r14d
or eax, r13d
mov r13d, dword [rsp + 0x28]
mov dword [rsp + 0xa0], eax
mov eax, 0xcccccccd
mul edi
mov eax, edx
shr eax, 2
add eax, r8d
movzx r8d, byte [0x140042b80]
mov dword [rsp + 0x30], eax
test r14d, r14d
mov r14d, dword [0x140042b68]
sete al
and al, byte [0x140042b58]
mov byte [rsp + 0xb0], al
movzx eax, bpl
add al, byte [0x140042b4c]
mov byte [rsp + 0xa8], al
movzx eax, byte [0x140042b82]
shl eax, cl
lea ecx, [rdi - 0x4a]
mov dword [rsp + 0x44], eax
mov eax, ebp
cdq
and edx, 3
add eax, edx
xor edx, edx
sar eax, 2
cmp ecx, dword [0x140042b5c]
movzx ecx, byte [0x140042a86]
mov dword [rsp + 0x38], eax
mov eax, edx
sete al
cmp ecx, ebp
mov ebp, dword [0x140042b60]
mov dword [rsp + 0x40], eax
mov eax, edx
sete al
mov dword [rsp + 0x3c], eax
cmp r15d, 0x5f
je 0x14002a921
cmp dword [0x140042b6c], 0
je 0x14002a921
mov edx, dword [0x140042b30]
movsx ecx, byte [rsp + 0xb8]
shr edx, cl
cmp dword [0x140042b7c], 0x5f
sete al
and dl, al
xor r8b, dl
xor r9b, byte [rsp + 0xa8]
sub r8b, byte [rsp + 0xb0]
mov eax, dword [rsp + 0xa0]
or eax, ebx
movsx ecx, r9b
imul ecx, dword [rsp + 0x24]
sub ebp, eax
mov eax, 0xaaaaaaab
mul ecx
mov ebx, edx
xor edx, edx
mov eax, edx
shr ebx, 1
cmp dword [rsp + 0x44], edx
setne al
or r14d, dword [rsp + 0x3c]
or r11d, eax
mov eax, dword [rsp + 0x38]
add eax, r10d
mov dword [rsp + 0x28], eax
mov eax, r11d
and eax, r13d
xor eax, dword [rsp + 0x40]
and r10d, eax
cmp byte [0x140042b56], dl
jne 0x14002a996
mov ecx, edi
mov dword [0x140042b38], edx
mov eax, 0x5f
shl eax, cl
or eax, edi
je 0x14002a99c
mov dword [0x140042b38], esi
sub r12, rsi
jne 0x14002a8f3
movzx r13d, byte [0x140042b64]
and r13b, byte [rsp + 0x24]
xor r13b, byte [rsp + 0x34]
sub byte [0x140042b88], r13b
movzx eax, byte [0x140042b65]
mov byte [0x140042b80], r8b
mov byte [0x140042a62], r9b
mov dword [0x140042b78], r10d
mov dword [0x140042b44], r11d
mov dword [0x140042b60], ebp
mov dword [0x140042b68], r14d
add eax, dword [rsp + 0x30]
je 0x14002aa04
mov ecx, ebx
shl ebx, cl
mov ecx, dword [0x140042b48]
shl ebx, cl
test ebx, ebx
jne 0x14002aa06
mov esi, edx
xor dword [0x140042b3c], esi
call fcn.140029160
mov eax, dword [rsp + 0x28]
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret