Function at 0x1001120bc
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov edi, dword [rcx + 0x30]
xor eax, eax
xor r13d, r13d
mov r12, rcx
mov qword [r11 - 0x70], r13
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
cmp dword [rcx + 8], r13d
je 0x100112101
mov eax, dword [rcx + 0x18]
jmp 0x100112104
mov eax, dword [rcx + 0x28]
mov ecx, 0x80070216
lea rdx, [0x1004a9500]
cmp edi, eax
jne 0x100112249
mov r10, qword [0x1004a9500]
mov ebx, 0x80070103
cmp r10, rdx
je 0x10011214f
test byte [r10 + 0x3c], 2
je 0x10011214f
mov rcx, qword [r10 + 0x30]
lea r8, [0x10003a208]
mov edx, 0x12
mov r9d, ebx
call fcn.10005c358
mov r10, qword [0x1004a9500]
mov r15, qword [rsp + 0xb0]
mov esi, dword [rsp + 0xb0]
cmp ebx, r13d
jl 0x100112643
mov eax, dword [r15 + 4]
mov ebp, 4
or r9d, 0xffffffff
mov dword [rsp + 0x30], r13d
lea r8, [rsp + 0x30]
lea r10, [0x1000499e0]
mov dword [rsp + 0x40], eax
mov edx, ebp
mov edi, r9d
movzx eax, byte [r8]
mov ecx, edi
add edx, r9d
shr rcx, 0x18
inc r8
xor rcx, rax
mov eax, edi
shl eax, 8
movzx ecx, cl
mov edi, dword [r10 + rcx*4]
xor edi, eax
cmp edx, r13d
ja 0x10011218e
not edi
mov edx, 0xc
lea r8, [r15 + 4]
not edi
movzx eax, byte [r8]
mov ecx, edi
add edx, r9d
shr rcx, 0x18
inc r8
xor rcx, rax
mov eax, edi
shl eax, 8
movzx ecx, cl
mov edi, dword [r10 + rcx*4]
xor edi, eax
cmp edx, r13d
ja 0x1001121c1
mov r8d, dword [r15 + 8]
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0x38]
add r8d, 7
mov edx, esi
mov rcx, r12
and r8d, 0xfffffff8
not edi
mov qword [rsp + 0x20], rax
call fcn.100120d20
xor r11d, r11d
cmp eax, r11d
mov ebx, eax
jl 0x10011263c
mov r13d, dword [rsp + 0xb0]
mov ecx, r13d
sub ecx, esi
lea esi, [r11 + 0x20]
lea eax, [rcx + 0x20]
mov dword [rsp + 0x30], ecx
cmp eax, esi
jb 0x1001122e2
mov esi, eax
mov ebx, r11d
jmp 0x100112320
lea eax, [rdi + 0x10]
mov esi, edi
cmp eax, edi
jb 0x100112259
mov esi, eax
mov ebx, r13d
jmp 0x10011228d
mov ebx, ecx
mov r10, qword [0x1004a9500]
cmp r10, rdx
je 0x100112294
test byte [r10 + 0x3c], 2
je 0x100112294
mov r9d, ecx
mov rcx, qword [r10 + 0x30]
lea r8, [0x10003f830]
mov edx, 0xa
call fcn.10005c358
lea rdx, [0x1004a9500]
mov r10, qword [0x1004a9500]
cmp ebx, r13d
jl 0x100112124
mov ecx, dword [r12 + 8]
cmp ecx, r13d
je 0x1001122ae
mov eax, dword [r12 + 0x18]
jmp 0x1001122b3
mov eax, dword [r12 + 0x28]
cmp esi, eax
jbe 0x1001122c1
mov ebx, 0x8007000d
jmp 0x100112124
cmp ecx, r13d
je 0x1001122cd
mov rax, qword [r12 + 0x10]
jmp 0x1001122d2
mov rax, qword [r12 + 0x20]
lea r15, [rax + rdi]
mov dword [rsp + 0xb0], esi
jmp 0x10011215e
mov ebx, 0x80070216
mov r10, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp r10, rax
je 0x100112327
test byte [r10 + 0x3c], 2
je 0x100112327
mov rcx, qword [r10 + 0x30]
lea r8, [0x10003f830]
mov edx, 0xa
mov r9d, ebx
call fcn.10005c358
mov ecx, dword [rsp + 0x30]
xor r11d, r11d
mov r10, qword [0x1004a9500]
cmp ebx, r11d
jl 0x100112643
cmp ecx, r11d
jbe 0x10011238d
mov edx, dword [r15 + 8]
mov r8, qword [rsp + 0x38]
mov rax, rdx
shr rax, 1
cmp word [r8 + rax*2 - 2], r11w
je 0x100112356
mov ebx, 0x8007000d
jmp 0x100112643
not edi
cmp edx, r11d
jbe 0x100112389
lea r9, [0x1000499e0]
movzx eax, byte [r8]
mov ecx, edi
dec edx
shr rcx, 0x18
inc r8
xor rcx, rax
mov eax, edi
shl eax, 8
movzx ecx, cl
mov edi, dword [r9 + rcx*4]
xor edi, eax
cmp edx, r11d
ja 0x100112364
not edi
jmp 0x100112392
mov qword [rsp + 0x38], r11
cmp dword [r15 + 4], 0x80000002
je 0x1001123ba
cmp dword [r15 + 4], 0x80000004
je 0x1001123ba
cmp dword [r15 + 4], 1
je 0x1001123df
cmp dword [r15 + 4], 2
je 0x1001123ba
cmp dword [r15 + 4], ebp
jne 0x10011234c
mov ebp, dword [r15 + 0xc]
mov dword [rsp + 0x50], ebp
lea eax, [rbp + rsi]
cmp eax, esi
jb 0x100112466
mov esi, eax
mov ebx, r11d
lea r14, [0x1004a9500]
jmp 0x1001124a0
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0x48]
mov r8d, 1
mov edx, r13d
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.100120e44
xor r14d, r14d
cmp eax, r14d
mov ebx, eax
jl 0x10011263c
mov rax, qword [rsp + 0x48]
mov edx, ebp
lea r8, [rsp + 0x48]
mov ecx, dword [rax]
not edi
lea r9, [0x1000499e0]
mov dword [rsp + 0x48], ecx
movzx eax, byte [r8]
mov ecx, edi
dec edx
shr rcx, 0x18
inc r8
xor rcx, rax
mov eax, edi
shl eax, 8
movzx ecx, cl
mov edi, dword [r9 + rcx*4]
xor edi, eax
cmp edx, r14d
ja 0x10011242b
mov r13d, dword [rsp + 0xb0]
mov r10, qword [0x1004a9500]
not edi
jmp 0x1001125ad
mov ebx, 0x80070216
lea r14, [0x1004a9500]
cmp r10, r14
je 0x1001124a0
test byte [r10 + 0x3c], 2
je 0x1001124a0
mov rcx, qword [r10 + 0x30]
lea r8, [0x10003f830]
mov edx, 0xa
mov r9d, ebx
call fcn.10005c358
mov r10, qword [0x1004a9500]
xor r11d, r11d
cmp ebx, r11d
jl 0x100112643
cmp ebp, r11d
jbe 0x100112536
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0x48]
mov r8d, ebp
mov edx, r13d
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.100120d20
xor r11d, r11d
cmp eax, r11d
mov ebx, eax
jl 0x10011263c
mov ebp, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
not edi
mov r8d, ebp
mov r9, rdx
cmp ebp, r11d
jbe 0x100112523
lea r10, [0x1000499e0]
movzx eax, byte [r9]
mov ecx, edi
dec r8d
shr rcx, 0x18
inc r9
xor rcx, rax
mov eax, edi
shl eax, 8
movzx ecx, cl
mov edi, dword [r10 + rcx*4]
xor edi, eax
cmp r8d, r11d
ja 0x1001124fd
mov r13d, dword [rsp + 0xb0]
mov r10, qword [0x1004a9500]
not edi
jmp 0x10011253e
mov rdx, r11
mov qword [rsp + 0x48], rdx
test byte [rsp + 0x40], 2
je 0x10011255b
cmp ebp, r11d
jbe 0x10011255b
mov eax, ebp
shr rax, 1
cmp word [rdx + rax*2 - 2], r11w
jne 0x10011234c
lea eax, [rbp + 7]
and eax, 0xfffffff8
sub eax, ebp
add eax, esi
cmp eax, esi
jb 0x100112570
mov esi, eax
mov ebx, r11d
jmp 0x1001125a1
mov r9d, 0x80070216
mov ebx, r9d
cmp r10, r14
je 0x1001125a1
test byte [r10 + 0x3c], 2
je 0x1001125a1
mov rcx, qword [r10 + 0x30]
lea r8, [0x10003f830]
mov edx, 0xa
call fcn.10005c358
mov r10, qword [0x1004a9500]
xor r14d, r14d
cmp ebx, r14d
jl 0x100112643
lea r8d, [rbp + 7]
and r8d, 0xfffffff8
sub r8d, ebp
je 0x1001125eb
lea rax, [rsp + 0xb0]
xor r9d, r9d
mov edx, r13d
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.100120d20
cmp eax, r14d
mov ebx, eax
jl 0x10011263c
mov r13d, dword [rsp + 0xb0]
mov r10, qword [0x1004a9500]
cmp edi, dword [r15]
je 0x1001125f7
mov ebx, 0x80070017
jmp 0x100112643
mov rcx, qword [rsp + 0xb8]
lea rdx, [rsp + 0x38]
mov r8d, 0x20
mov dword [r12 + 0x30], r13d
call sub.msvcrt.dll_memcpy
mov r11, qword [rsp + 0xc0]
cmp r11, r14
je 0x100112628
mov eax, dword [rsp + 0x30]
mov dword [r11], eax
mov rax, qword [rsp + 0xc8]
cmp rax, r14
je 0x100112637
mov dword [rax], esi
cmp ebx, r14d
jge 0x10011266e
mov r10, qword [0x1004a9500]
lea rax, [0x1004a9500]
cmp r10, rax
je 0x10011266e
test byte [r10 + 0x3c], 2
je 0x10011266e
mov rcx, qword [r10 + 0x30]
lea r8, [0x10003a208]
mov edx, 0x11
mov r9d, ebx
call fcn.10005c358
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret