Function at 0x1401a1b4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
xor eax, eax
mov r15, rcx
mov ebx, eax
mov dword [rbp + 0x78], eax
cmp byte [rcx + 8], al
jne 0x1401a1b89
mov esi, 0xc004d101
mov ecx, esi
jmp 0x1401a1da3
mov rax, qword [rcx]
mov r13d, dword [rbp + 0x68]
mov r14d, r13d
mov esi, dword [rax + 0x10]
sub r14d, esi
mov dword [rbp + 0x78], esi
dec r14d
mov dword [rbp + 0x48], esi
mov dword [rbp + 0x70], r14d
lea eax, [rsi + rsi]
cmp eax, esi
jb 0x1401a1d9c
lea eax, [rsi + r14]
lea ecx, [rsi + rax]
add eax, esi
cmp r14d, eax
ja 0x1401a1d9c
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
xor eax, eax
test rdi, rdi
jne 0x1401a1be7
mov ebx, eax
jmp 0x1401a1bf6
mov rcx, rdi
mov rbx, rdi
mov qword [rbp - 0x10], rcx
test rdi, rdi
jne 0x1401a1bfd
mov esi, 0x8007000e
jmp 0x1401a1b82
mov eax, dword [rbp + 0x78]
lea r12, [rdi + rsi]
mov r9, rcx
lea r8, [rbp + 0x78]
mov rdx, rcx
add r12, rax
mov rcx, qword [r15]
lea rbx, [rdi + rax]
mov qword [rbp - 0x20], rbx
call fcn.1401a1418
mov esi, eax
test eax, eax
jns 0x1401a1c36
mov ecx, eax
call fcn.14007ac40
mov rbx, rdi
jmp 0x1401a1da8
mov ecx, dword [rbp + 0x78]
lea eax, [rcx*2 + 2]
cmp ecx, eax
jbe 0x1401a1c4d
mov ecx, 0x8007006f
mov esi, ecx
jmp 0x1401a1c29
cmp r13d, eax
jb 0x1401a1c44
lea eax, [rcx + 1]
mov dword [rsp + 0x28], ecx
add rax, qword [rbp + 0x60]
lea r8, [rbp + 0x48]
mov edx, r13d
mov qword [rbp - 0x18], rax
sub edx, ecx
mov r9, rax
mov rcx, qword [r15]
dec edx
mov dword [rbp - 0x28], edx
mov dword [rsp + 0x20], edx
mov rdx, rbx
call fcn.1401a14f0
mov esi, eax
test eax, eax
js 0x1401a1c27
mov edx, dword [rbp + 0x48]
cmp edx, dword [rbp + 0x78]
ja 0x1401a1c44
mov r9, qword [rbp - 0x20]
mov rbx, rdi
test edx, edx
je 0x1401a1cbd
mov r13, qword [rbp + 0x60]
mov rcx, r9
inc r13
mov r8d, edx
sub r13, r9
mov al, byte [rcx + r13]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1401a1caa
mov r13d, dword [rbp + 0x68]
mov rcx, qword [r15]
lea r8, [rbp + 0x70]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edx
mov rdx, r12
call fcn.1401a14f0
mov esi, eax
test eax, eax
jns 0x1401a1ce2
mov ecx, eax
jmp 0x1401a1da3
mov r15d, dword [rbp + 0x78]
sub r13d, r15d
mov r14d, dword [rbp + 0x70]
dec r13d
cmp r14d, r13d
ja 0x1401a1d9c
mov eax, dword [rbp - 0x28]
test eax, eax
je 0x1401a1d1f
mov r8, qword [rbp - 0x18]
mov rcx, r12
sub r8, r12
mov edx, eax
mov al, byte [r8 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1401a1d0c
mov r15d, dword [rbp + 0x78]
mov edi, r15d
cmp r15d, r14d
jae 0x1401a1d37
mov eax, edi
cmp byte [rax + r12], 0
jne 0x1401a1d37
inc edi
cmp edi, r14d
jb 0x1401a1d27
cmp edi, r14d
je 0x1401a1d92
mov eax, edi
cmp byte [rax + r12], 1
jne 0x1401a1d92
mov rdx, qword [rbp - 0x10]
mov rcx, r12
mov r8d, r15d
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1401a1d92
mov rax, qword [rbp + 0x60]
cmp byte [rax], 0
jne 0x1401a1d92
mov rcx, qword [rbp + 0x58]
sub edi, r15d
sub r14d, edi
sub r14d, r15d
dec r14d
mov eax, dword [rcx]
mov dword [rcx], r14d
cmp eax, r14d
jb 0x1401a1d9c
mov rcx, qword [rbp + 0x50]
lea edx, [r15 + 1]
add edx, edi
mov r8d, r14d
add rdx, r12
call sub.msvcrt.dll_memcpy
jmp 0x1401a1da8
mov esi, 0xc004d210
jmp 0x1401a1b82
mov ecx, 0x8007006f
mov esi, ecx
call fcn.14007ac40
mov ecx, esi
call fcn.14007ace8
test rbx, rbx
je 0x1401a1dc8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret