Function at 0x1400d6220
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, rdx
mov rsi, rcx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov rcx, rdx
mov edx, 0x3c
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jns 0x1400d643a
mov ebp, eax
or ebp, 0x10000000
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
xor ecx, ecx
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
mov rdi, qword [rsp + 0x28]
cmp ebp, 0x90000005
je 0x1400d6296
cmp ebp, 0xd0000004
je 0x1400d6296
cmp ebp, 0xd0000023
jne 0x1400d6320
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400d62a0
test rdi, rdi
je 0x1400d643a
mov rcx, qword [rdi]
mov r8d, 0x96a741db
nop word cs:[rax + rax]
mov eax, dword [0x141dd7388]
xor edx, edx
div dword [0x141dd738c]
or eax, 0x3ecf4f6b
imul rax, r8
shr rax, 0x3f
cmp eax, 0x4b8f1234
je 0x1400d62c0
mov r14, qword [rcx + 0x10]
mov eax, dword [0x141dd7390]
sub eax, dword [0x141dd7394]
and eax, 0x49afc29a
add eax, 0xa5af420
and eax, 0x58949492
cmp eax, 0x68d7d60a
jne 0x1400d63fd
jmp 0x1400d6432
mov eax, dword [0x141dd7368]
sub eax, dword [0x141dd736c]
or eax, 0x960b6408
and eax, 0xb62f6448
cmp eax, 0x91a9ac79
je 0x1400d6320
mov eax, 0xe0ef4447
nop word cs:[rax + rax]
mov ecx, dword [0x141dd7370]
imul ecx, dword [0x141dd7374]
xor ecx, 0x3d75118b
imul rcx, rax
shr rcx, 0x3d
imul ecx, ecx, 0x2d68b509
cmp ecx, 0x2b4726c
jb 0x1400d6350
test rdi, rdi
je 0x1400d66b3
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400d6390
mov rbx, qword [rdi]
mov eax, dword [0x141dd7378]
add eax, dword [0x141dd737c]
imul eax, eax, 0xc6844e30
imul rax, rax, 0x6746db3
shr rax, 0x3a
cmp eax, 0x23b1b0fc
jbe 0x1400d63c1
mov rcx, rdi
call qword [rbx + 0x10]
mov r14d, 0xcd164183
nop word [rax + rax]
mov eax, dword [0x141dd7380]
or eax, dword [0x141dd7384]
imul rax, r14
shr rax, 0x3b
imul ebp, eax, 0x93d585ff
mov rcx, rdi
call qword [rbx + 0x10]
cmp ebp, 0x1aed33cd
je 0x1400d63d0
jmp 0x1400d66b3
mov eax, dword [0x141dd7398]
xor edx, edx
div dword [0x141dd739c]
or eax, 0x143e1835
add eax, 0x6b506ce7
mov r15d, 0xa7d55c6b
imul r15, rax
shr r15, 0x3f
mov rcx, rdi
call r14
cmp r15d, 0x5e658f74
jne 0x1400d643a
mov rcx, rdi
call r14
jmp 0x1400d63fd
mov eax, dword [0x141dd73a0]
xor eax, dword [0x141dd73a4]
and eax, 0x16090884
add eax, 0x896a432b
cmp eax, 0xcdeadea2
jbe 0x1400d6460
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x28], eax
nop
mov eax, dword [0x141dd73a8]
or eax, dword [0x141dd73ac]
add eax, 0xf9f2214f
and eax, 0x62800300
mov ebp, dword [rsp + 0x34]
mov dword [rsp + 0x28], ebp
cmp eax, 0x4b9d4545
ja 0x1400d6460
mov r14d, ebp
shr r14d, 1
lea rdx, [r14*2 + 2]
movzx eax, byte [0x141dda6b8]
xor ecx, ecx
call fcn.1400bf230
mov rdi, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd73b0]
or eax, dword [0x141dd73b4]
add eax, 0x40112616
or eax, 0x95a26a8a
imul eax, eax, 0xa9c889f7
cmp eax, 0x6cbd87cf
jb 0x1400d64b0
test rdi, rdi
je 0x1400d65cb
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov edx, 0x3c
mov r8, rdi
mov r9d, ebp
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
js 0x1400d6597
mov eax, dword [0x141dd73e8]
xor edx, edx
div dword [0x141dd73ec]
and eax, 0x408a400a
imul eax, eax, 0xdd98b3fe
cmp eax, 0x7485ffd8
jae 0x1400d6530
mov word [rdi + r14*2], 0
nop dword [rax + rax]
mov eax, dword [0x141dd73f0]
sub eax, dword [0x141dd73f4]
add eax, 0x15a8569b
xor eax, 0x3cf59d40
add eax, 0x938b24f6
mov word [rdi + r14*2], 0
cmp eax, 0xd3fac69d
ja 0x1400d6530
mov rdx, qword [rdi + 8]
mov rcx, rsi
call fcn.1400d5d30
mov rsi, qword [0x141dda6a0]
mov eax, dword [0x141dd73f8]
xor eax, dword [0x141dd73fc]
or eax, 0xdb9788c5
add eax, 0xbbd94af2
or eax, 0x45a61160
cmp eax, 0xf1b56e76
jne 0x1400d6796
jmp 0x1400d67c8
mov eax, dword [0x141dd73c0]
imul eax, dword [0x141dd73c4]
ud2