Function at 0x401ece
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r14, rcx
mov eax, dword [0x0044825c]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x00448258], 0xa
setl cl
test cl, al
jne 0x401f0e
xor cl, al
je 0x4021d0
mov eax, 0x10
call fcn.00441940
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.00441940
sub rsp, rax
mov r13, rsp
mov r8, qword [0x00448168]
mov eax, dword [0x00448254]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete al
cmp dword [0x00448250], 0xa
setl r9b
mov edx, r9d
and dl, al
xor r9b, al
or r9b, dl
cmp r9b, 1
jne 0x40201d
mov byte [r13], 0
mov byte [r13 + 1], 0xd6
mov al, 0x92
mov byte [r13 + 2], al
mov dl, 0xb0
mov byte [r13 + 3], dl
mov byte [r13 + 4], 0xfe
mov byte [r13 + 5], 0xaa
mov r10b, 0xbe
mov byte [r13 + 6], r10b
mov byte [r13 + 7], dl
mov byte [r13 + 8], al
mov dl, 0x82
mov byte [r13 + 9], dl
mov r11b, 0xf0
mov byte [r13 + 0xa], r11b
mov bl, 0x8a
mov byte [r13 + 0xb], bl
mov byte [r13 + 0xc], dl
mov byte [r13 + 0xd], al
mov byte [r13 + 0xe], 0xda
mov byte [r13 + 0xf], r10b
mov byte [r13 + 0x10], 0xd4
mov byte [r13 + 0x11], bl
mov byte [r13 + 0x12], pe_nt_image_headers64
mov byte [r13 + 0x13], al
mov byte [r13 + 0x14], r11b
mov byte [r13 + 0x15], bl
mov byte [r13 + 0x16], dl
mov byte [r13 + 0x17], al
mov byte [r13 + 0x18], 0x58
test r9b, r9b
je 0x40201d
mov eax, dword [0x0044824c]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp dword [0x00448248], 0xa
setl dl
test dl, al
jne 0x40209c
xor dl, al
je 0x4020d8
jmp 0x40209c
mov byte [r13], 0
mov byte [r13 + 1], 0xd6
mov al, 0x92
mov byte [r13 + 2], al
mov dl, 0xb0
mov byte [r13 + 3], dl
mov byte [r13 + 4], 0xfe
mov byte [r13 + 5], 0xaa
mov r10b, 0xbe
mov byte [r13 + 6], r10b
mov byte [r13 + 7], dl
mov byte [r13 + 8], al
mov dl, 0x82
mov byte [r13 + 9], dl
mov r11b, 0xf0
mov byte [r13 + 0xa], r11b
mov bl, 0x8a
mov byte [r13 + 0xb], bl
mov byte [r13 + 0xc], dl
mov byte [r13 + 0xd], al
mov byte [r13 + 0xe], 0xda
mov byte [r13 + 0xf], r10b
mov byte [r13 + 0x10], 0xd4
mov byte [r13 + 0x11], bl
mov byte [r13 + 0x12], pe_nt_image_headers64
mov byte [r13 + 0x13], al
mov byte [r13 + 0x14], r11b
mov byte [r13 + 0x15], bl
mov byte [r13 + 0x16], dl
mov byte [r13 + 0x17], al
mov byte [r13 + 0x18], 0x58
jmp 0x401f6b
mov r9b, byte [r13]
mov edx, dword [0x0044824c]
mov esi, dword [0x00448248]
lea ebx, [rdx - 1]
imul ebx, edx
mov edx, ebx
xor edx, 0xfffffffe
test edx, ebx
setne r10b
sete al
cmp esi, 9
setg bl
cmp esi, 0xa
setl dl
xor dl, al
jne 0x4020de
or bl, r10b
xor bl, 1
jne 0x4020de
mov al, byte [r13]
jmp 0x40209c
movabs r12, 0xe0c1da7dded5e9b4
mov rdx, r13
inc rdx
mov eax, r9d
xor al, 0xfe
test al, r9b
jne 0x402139
mov esi, 1
xor edi, edi
mov bl, byte [r13 + rsi]
mov ecx, ebx
shr cl, 1
shl bl, 7
mov eax, ecx
not al
not bl
and al, 0xf0
and cl, 0xf
or cl, al
and bl, 0xf0
xor bl, cl
mov eax, ebx
not al
and al, 0x2c
and bl, 0xd3
or bl, al
mov byte [r13 + rsi], bl
inc rdi
inc rsi
cmp rsi, 0x19
jne 0x4020ff
movabs r13, 0xfffffffd49ef6f00
mov rcx, qword [0x00448158]
sub rsp, 0x20
call r8
mov rcx, r15
call rax
add rsp, 0x20
mov ecx, dword [r15]
mov edx, dword [r15 + 4]
shl rdx, 0x20
mov rbx, rdx
not rbx
mov rax, r12
not rax
and rdx, rax
and eax, ecx
not rcx
and rbx, r12
or rdx, rbx
and rcx, r12
or rax, rcx
xor rax, rdx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
mov eax, dword [0x0044825c]
mov edi, dword [0x00448258]
lea ecx, [rax - 1]
imul ecx, eax
mov esi, ecx
xor esi, 0xfffffffe
and esi, ecx
setne r8b
sete cl
cmp edi, 9
setg al
cmp edi, 0xa
setl bl
xor bl, cl
jne 0x40223c
or al, r8b
xor al, 1
jne 0x40223c
mov eax, 0x10
call fcn.00441940
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.00441940
sub rsp, rax
mov rdi, rsp
mov r11, qword [0x00448168]
mov eax, dword [0x00448254]
mov ebx, dword [0x00448250]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
setne r8b
sete al
cmp ebx, 9
setg r9b
cmp ebx, 0xa
setl bl
xor bl, al
or r9b, r8b
xor r9b, 1
or r9b, bl
cmp r9b, 1
je 0x402297
jmp 0x40233f
add rdx, r13
test r14, r14
je 0x402260
mov qword [r14], rdx
mov eax, dword [0x0044825c]
mov edi, dword [0x00448258]
lea ecx, [rax - 1]
imul ecx, eax
mov esi, ecx
xor esi, 0xfffffffe
and esi, ecx
test esi, esi
sete bl
setne r8b
cmp edi, 0xa
setl al
cmp edi, 9
setg cl
cmp al, bl
jne 0x402283
or cl, r8b
xor cl, 1
jne 0x402283
jmp 0x402281
mov rax, rdx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov byte [rdi], 0
mov byte [rdi + 1], 0xd6
mov al, 0x92
mov byte [rdi + 2], al
mov bl, 0xb0
mov byte [rdi + 3], bl
mov byte [rdi + 4], 0xfe
mov byte [rdi + 5], 0xaa
mov r8b, 0xbe
mov byte [rdi + 6], r8b
mov byte [rdi + 7], bl
mov byte [rdi + 8], al
mov bl, 0x82
mov byte [rdi + 9], bl
mov r10b, 0xf0
mov byte [rdi + 0xa], r10b
mov dl, 0x8a
mov byte [rdi + 0xb], dl
mov byte [rdi + 0xc], bl
mov byte [rdi + 0xd], al
mov byte [rdi + 0xe], 0xda
mov byte [rdi + 0xf], r8b
mov byte [rdi + 0x10], 0xd4
mov byte [rdi + 0x11], dl
mov byte [rdi + 0x12], pe_nt_image_headers64
mov byte [rdi + 0x13], al
mov byte [rdi + 0x14], r10b
mov byte [rdi + 0x15], dl
mov byte [rdi + 0x16], bl
mov byte [rdi + 0x17], al
mov byte [rdi + 0x18], 0x58
test r9b, r9b
je 0x40233f
mov eax, dword [0x0044824c]
mov esi, dword [0x00448248]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
setne r8b
sete al
cmp esi, 9
setg bl
cmp esi, 0xa
setl dl
xor dl, al
jne 0x4023a8
or bl, r8b
xor bl, 1
je 0x4023d3
jmp 0x4023a8
mov byte [rdi], 0
mov byte [rdi + 1], 0xd6
mov al, 0x92
mov byte [rdi + 2], al
mov dl, 0xb0
mov byte [rdi + 3], dl
mov byte [rdi + 4], 0xfe
mov byte [rdi + 5], 0xaa
mov r8b, 0xbe
mov byte [rdi + 6], r8b
mov byte [rdi + 7], dl
mov byte [rdi + 8], al
mov dl, 0x82
mov byte [rdi + 9], dl
mov r10b, 0xf0
mov byte [rdi + 0xa], r10b
mov bl, 0x8a
mov byte [rdi + 0xb], bl
mov byte [rdi + 0xc], dl
mov byte [rdi + 0xd], al
mov byte [rdi + 0xe], 0xda
mov byte [rdi + 0xf], r8b
mov byte [rdi + 0x10], 0xd4
mov byte [rdi + 0x11], bl
mov byte [rdi + 0x12], pe_nt_image_headers64
mov byte [rdi + 0x13], al
mov byte [rdi + 0x14], r10b
mov byte [rdi + 0x15], bl
mov byte [rdi + 0x16], dl
mov byte [rdi + 0x17], al
mov byte [rdi + 0x18], 0x58
jmp 0x402297
mov bl, byte [rdi]
mov eax, dword [0x0044824c]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete dl
cmp dword [0x00448248], 0xa
setl al
test al, dl
jne 0x4023d7
xor al, dl
jne 0x4023d7
mov al, byte [rdi]
jmp 0x4023a8
mov rdx, rdi
inc rdx
mov eax, ebx
xor al, 0xfe
test al, bl
jne 0x40240f
mov ebx, 1
xor esi, esi
mov al, byte [rdi + rbx]
mov ecx, eax
shr cl, 1
ror al, 1
not cl
and cl, 0x5e
and al, 0xa1
or al, cl
xor al, 0x72
mov byte [rdi + rbx], al
inc rsi
inc rbx
cmp rbx, 0x19
jne 0x4023ec
mov rcx, qword [0x00448158]
sub rsp, 0x20
call r11
mov rcx, r15
call rax
add rsp, 0x20
jmp 0x401f0e