Function at 0x1800287e0
Capabilities:
Encode data using xor
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x70
movabs rax, 0x5b2eaa661173f00b
movabs rcx, 0x5b2e97076512942d
mov qword [rbp + 0x48], rax
mov r12, rdx
mov rax, qword [rbp + 0x48]
xor rax, rcx
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r9d, dword [r12 + 8]
lea r13, [r12 + 8]
and r9d, 0x1fffffff
xor r10d, r10d
mov ebx, eax
cmp eax, r9d
jg 0x18002888f
mov edi, r9d
sub edi, eax
lea eax, [rdi + r10]
xor edx, edx
add eax, ebx
cmp ebx, eax
ja 0x180028883
cmp r10d, r9d
jae 0x180028877
mov r11, qword [r12]
mov ecx, r10d
nop dword [rax + rax]
movzx r8d, byte [rbp + rdx + 0x48]
mov eax, ecx
cmp byte [rax + r11], r8b
jne 0x1800288a0
inc edx
inc ecx
cmp ecx, r9d
jb 0x180028860
cmp byte [rbp + rdx + 0x48], 0
sete al
test al, al
jne 0x1800288a5
inc r10d
lea eax, [r10 + rbx]
cmp eax, r9d
jle 0x180028843
mov eax, 0xffffffff
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
test r8b, r8b
jmp 0x18002887c
test r10d, r10d
js 0x18002888f
mov qword [rsp + 0xa8], rsi
lea r8d, [r10 + 6]
mov qword [rsp + 0x68], r14
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x60], r15
call fcn.180017d40
mov esi, dword [r13]
xor eax, eax
xor r15d, r15d
mov qword [rbp - 0x40], 0
mov dword [rbp - 0x38], eax
and esi, 0x1fffffff
jbe 0x1800288ff
mov r8d, esi
lea rcx, [rbp - 0x40]
mov dl, 0x20
call fcn.1800107b0
mov eax, dword [rbp - 0x38]
mov r14, qword [rbp - 0x40]
test eax, eax
jne 0x180028903
lea r14, [rbp - 0x38]
cmp dword [r13], r15d
je 0x18002890f
mov rdi, qword [r12]
jmp 0x180028912
mov rdi, r13
test esi, esi
je 0x180028952
movzx eax, byte [rdi]
cmp al, 0x25
jne 0x18002893d
movzx ecx, byte [rdi + 1]
call fcn.180007500
movzx ecx, byte [rdi + 2]
add rdi, 2
mov ebx, eax
call fcn.180007500
shl bl, 4
or al, bl
sub esi, 2
mov byte [r14], al
dec esi
inc r14
inc rdi
inc r15d
test esi, esi
jg 0x180028916
mov eax, dword [rbp - 0x38]
test eax, eax
lea rdx, [rbp - 0x38]
mov r8d, r15d
mov rcx, r12
cmovne rdx, qword [rbp - 0x40]
call fcn.180033bf0
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.18002cb90
mov rcx, r12
call fcn.1800173f0
mov rcx, qword [r12]
mov edx, 0x100
mov dword [rbp + 0x40], 0x100
call fcn.180008a20
mov rax, qword [r12]
lea rcx, [rbp + 0x40]
mov r14, qword [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, qword [r14 + 0x18]
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov r15, qword [rsp + 0x60]
test eax, eax
jne 0x1800289e0
mov eax, 0xfffffffe
mov rsi, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x68]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
mov rax, qword [r12]
xor edx, edx
mov r8d, 0x100
mov rcx, r12
movups xmm0, xmmword [rax]
movups xmmword [r14 + 0x24], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r14 + 0x34], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r14 + 0x44], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r14 + 0x54], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r14 + 0x64], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r14 + 0x74], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r14 + 0x84], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [r14 + 0x94], xmm1
movsd xmm0, qword [rax + 0x80]
movsd qword [r14 + 0xa4], xmm0
movzx eax, byte [rax + 0x88]
mov byte [r14 + 0xac], al
call fcn.180017d40
cmp dword [r14 + 0xa9], 0xf4a23f1f
mov rdx, r12
mov rcx, r14
sete r8b
call fcn.180017b70
test eax, eax
jns 0x180028a88
mov eax, 0xfffffffd
jmp 0x1800289c7
test dword [r13], 0x1fffffff
je 0x180028c59
movabs rax, 0x3e40fe6f0673d911
movabs rsi, 0x549a2d1f135dad7a
mov qword [rbp - 0x30], rax
xor r10d, r10d
movabs rax, 0x50b552f63874e10d
mov r11, rsi
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + r10*8 - 0x30]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rbp + r10*8 - 0x30], rdx
inc r10
cmp r10, 2
jb 0x180028ac2
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r9d, dword [r13]
xor r10d, r10d
and r9d, 0x1fffffff
mov ebx, eax
cmp eax, r9d
jg 0x180028c59
mov edi, r9d
sub edi, eax
nop
lea eax, [rdi + r10]
xor edx, edx
add eax, ebx
cmp ebx, eax
ja 0x180028b73
cmp r10d, r9d
jae 0x180028b67
mov r11, qword [r12]
mov eax, r10d
nop dword [rax + rax]
movzx r8d, byte [rbp + rdx - 0x30]
mov ecx, eax
cmp byte [rcx + r11], r8b
jne 0x180028b86
inc edx
inc eax
cmp eax, r9d
jb 0x180028b50
cmp byte [rbp + rdx - 0x30], 0
sete al
test al, al
jne 0x180028b8b
inc r10d
lea eax, [r10 + rbx]
cmp eax, r9d
jle 0x180028b30
xor eax, eax
jmp 0x1800289c7
test r8b, r8b
jmp 0x180028b6c
test r10d, r10d
jle 0x180028c59
movabs rax, 0x3547ff64045fbb11
lea edi, [r10 + 0xe]
mov qword [rbp - 0x20], rax
xor r10d, r10d
movabs rax, 0x508b20de3568d32f
mov qword [rbp - 0x18], rax
nop word [rax + rax]
mov rax, qword [rbp + r10*8 - 0x20]
mov r9d, r10d
neg r9d
mov r8, rsi
and r9d, 0xf
rol r8, 3
not r8
rol rsi, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rbp + r10*8 - 0x20], rdx
inc r10
cmp r10, 2
jb 0x180028bc0
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov r8d, edi
lea rdx, [rbp - 0x20]
mov rcx, r12
call fcn.180028d10
test eax, eax
js 0x180028c59
sub eax, edi
mov ecx, 0xdc
cmp eax, ecx
cmova eax, ecx
cmp dword [r13], 0
je 0x180028c39
mov r13, qword [r12]
movsxd rdx, edi
lea rcx, [r14 + 0xa9c]
add rdx, r13
mov r8d, eax
mov ebx, eax
call fcn.180008d30
mov byte [rbx + r14 + 0xa9c], 0
xor eax, eax
jmp 0x1800289c7