Function at 0x1400c12b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov r13, qword [rcx + 0x18]
movzx ecx, word [r13 + 0x3d2]
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x48], rax
movzx eax, word [rax + 0x3d2]
mov qword [rsp + 0x58], rax
lea rbp, [rcx + rax]
inc rbp
cmp rbp, 0xc
jae 0x1400c1354
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rsp + 0xa8], rax
mov rax, rcx
mov qword [rsp + 0x40], rcx
lea r12, [rcx + 1]
mov qword [rsp + 0x28], rdx
movzx r14d, word [rdx + 0x3d2]
mov eax, dword [0x141dd83c8]
imul eax, dword [0x141dd83cc]
imul eax, eax, 0x285573e1
add eax, 0xcb7a9a97
imul rcx, rax, 0x7847fe77
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
cmp eax, 0x8cecc5a6
jbe 0x1400c1356
jmp 0x1400c13fb
ud2
mov eax, dword [0x141dd83d0]
xor eax, dword [0x141dd83d4]
imul rax, rax, 0x63b4e3cb
shr rax, 0x3a
imul ebx, eax, 0xe6950244
add ebx, 0x65ec4674
mov r15, qword [rsi + 0x10]
mov word [r13 + 0x3d2], bp
imul rax, r15, 0x38
mov r8, qword [rsp + 0x28]
lea rcx, [r8 + rax]
add rcx, 0x168
mov rdx, qword [r8 + rax + 0x198]
mov qword [rsp + 0x90], rdx
movups xmm0, xmmword [r8 + rax + 0x168]
movups xmm1, xmmword [r8 + rax + 0x178]
movups xmm2, xmmword [r8 + rax + 0x188]
movaps xmmword [rsp + 0x80], xmm2
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
lea rdx, [r8 + rax]
add rdx, 0x1a0
mov rdi, r15
not rdi
add rdi, r14
imul r8, rdi, 0x38
call sub.VCRUNTIME140.dll_memmove
cmp ebx, 0x6c19bf6f
jbe 0x1400c1476
mov rax, qword [rsi + 0x10]
mov word [r13 + 0x3d2], bp
imul rdx, rax, 0x38
mov r9, qword [rsp + 0x28]
lea rcx, [r9 + rdx]
add rcx, 0x168
mov r8, qword [r9 + rdx + 0x198]
mov qword [rsp + 0x90], r8
movups xmm0, xmmword [r9 + rdx + 0x168]
movups xmm1, xmmword [r9 + rdx + 0x178]
movups xmm2, xmmword [r9 + rdx + 0x188]
movaps xmmword [rsp + 0x80], xmm2
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
add rdx, r9
add rdx, 0x1a0
not rax
add rax, r14
imul r8, rax, 0x38
call sub.VCRUNTIME140.dll_memmove
jmp 0x1400c1356
mov qword [rsp + 0xa0], r14
lea rax, [r15 + 1]
mov qword [rsp + 0x30], rax
lea rbp, [r13 + 0x168]
mov eax, dword [0x141dd83d8]
xor eax, dword [0x141dd83dc]
add eax, 0xa410c00b
or eax, 0x9c790d83
add eax, 0x39b38318
cmp eax, 0x9df69cd0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x38], r13
mov r14, r15
mov r12, rdi
mov qword [rsp + 0x98], rdi
ja 0x1400c1613
mov eax, dword [0x141dd83e0]
xor edx, edx
div dword [0x141dd83e4]
or eax, 0xc1489a2
add eax, 0xe2a34841
imul rax, rax, 0x235bae07
shr rax, 0x3b
mov qword [rsp + 0xb0], rax
mov rdi, qword [rsp + 0x40]
imul rax, rdi, 0x38
mov rcx, qword [rsp + 0x90]
mov qword [rbp + rax + 0x30], rcx
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movaps xmm2, xmmword [rsp + 0x80]
movups xmmword [rbp + rax + 0x20], xmm2
movups xmmword [rbp + rax + 0x10], xmm1
movups xmmword [rbp + rax], xmm0
mov rsi, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
lea rdx, [r12 + 0x168]
mov r15, qword [rsp + 0x50]
imul rcx, r15, 0x38
add rcx, rbp
mov rbx, qword [rsp + 0x58]
imul r8, rbx, 0x38
call sub.VCRUNTIME140.dll_memcpy
mov rax, r14
shl rax, 5
lea rcx, [rsi + rax]
movups xmm0, xmmword [rsi + rax]
movups xmm1, xmmword [rsi + rax + 0x10]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov rdx, r13
shl rdx, 5
add rdx, rsi
mov r8, qword [rsp + 0x98]
shl r8, 5
call sub.VCRUNTIME140.dll_memmove
shl rdi, 5
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
movups xmmword [rcx + rdi], xmm0
mov rcx, qword [rsp + 0x38]
movups xmmword [rcx + rdi + 0x10], xmm1
mov rcx, r15
mov r15, qword [rsp + 0x38]
shl rcx, 5
add rcx, r15
shl rbx, 5
mov rdx, r12
mov r12, qword [rsp + 0x98]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + r13*8]
add rcx, 0x3d8
lea rdx, [rsi + r14*8]
add rdx, 0x3e8
lea r8, [r12*8]
call sub.VCRUNTIME140.dll_memmove
cmp dword [rsp + 0xb0], 0xc3874c87
jbe 0x1400c1717
mov rdi, qword [rsp + 0x40]
imul rax, rdi, 0x38
mov rcx, qword [rsp + 0x90]
mov qword [rbp + rax + 0x30], rcx
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movaps xmm2, xmmword [rsp + 0x80]
movups xmmword [rbp + rax + 0x20], xmm2
movups xmmword [rbp + rax + 0x10], xmm1
movups xmmword [rbp + rax], xmm0
mov rax, qword [rsp + 0x48]
lea rdx, [rax + 0x168]
mov r15, qword [rsp + 0x50]
imul rcx, r15, 0x38
add rcx, rbp
mov r13, qword [rsp + 0x58]
imul r8, r13, 0x38
call sub.VCRUNTIME140.dll_memcpy
mov rax, r14
shl rax, 5
mov rbx, qword [rsp + 0x28]
lea rcx, [rbx + rax]
movups xmm0, xmmword [rbx + rax]
movups xmm1, xmmword [rbx + rax + 0x10]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov rsi, qword [rsp + 0x30]
mov rdx, rsi
shl rdx, 5
add rdx, rbx
mov r8, r12
shl r8, 5
call sub.VCRUNTIME140.dll_memmove
mov rax, rdi
shl rax, 5
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
movups xmmword [rcx + rax], xmm0
mov rcx, qword [rsp + 0x38]
movups xmmword [rcx + rax + 0x10], xmm1
mov rcx, r15
shl rcx, 5
add rcx, qword [rsp + 0x38]
shl r13, 5
mov rdx, qword [rsp + 0x48]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rsi*8]
add rcx, 0x3d8
lea rdx, [rbx + r14*8]
add rdx, 0x3e8
lea r8, [r12*8]
call sub.VCRUNTIME140.dll_memmove
jmp 0x1400c14cc
mov r10, qword [rsp + 0xa0]
cmp qword [rsp + 0x30], r10
mov rbx, qword [rsp + 0x50]
jae 0x1400c1864
mov rcx, r10
sub rcx, r14
add rcx, 0xfffffffffffffffe
and r12d, 3
nop dword [rax]
mov eax, dword [0x141dd83e8]
xor edx, edx
div dword [0x141dd83ec]
imul rax, rax, 0x482edf4f
shr rax, 0x3c
imul eax, eax, 0xa9e83f82
and eax, 0x2745576
cmp eax, 0x7287e124
ja 0x1400c1740
nop dword [rax + rax]
mov eax, dword [0x141dd83f0]
xor eax, dword [0x141dd83f4]
xor eax, 0xd55929a7
imul eax, eax, 0xeee7330b
xor eax, 0xb4dd1b4b
cmp eax, 0x65336930
jb 0x1400c1770
test r12, r12
je 0x1400c17dd
mov rax, qword [rsp + 0x28]
lea rdx, [rax + r14*8]
add rdx, 0x3e0
xor eax, eax
nop word [rax + rax]
mov r8, qword [rdx + rax*8]
mov r9, qword [rsp + 0x28]
mov qword [r8 + 0x160], r9
mov r9, qword [rsp + 0x30]
add r9d, eax
mov word [r8 + 0x3d0], r9w
inc rax
cmp r12, rax
jne 0x1400c17b0
add qword [rsp + 0x30], rax
cmp rcx, 3
jb 0x1400c1864
mov r8, qword [rsp + 0x28]
nop dword [rax]
mov rdx, qword [rsp + 0x30]
mov rax, qword [r8 + rdx*8 + 0x3d8]
mov qword [rax + 0x160], r8
mov word [rax + 0x3d0], dx
mov rax, qword [r8 + rdx*8 + 0x3e0]
mov qword [rax + 0x160], r8
lea ecx, [rdx + 1]
mov word [rax + 0x3d0], cx
mov rax, qword [r8 + rdx*8 + 0x3e8]
mov qword [rax + 0x160], r8
lea ecx, [rdx + 2]
mov word [rax + 0x3d0], cx
mov rax, qword [r8 + rdx*8 + 0x3f0]
mov qword [rax + 0x160], r8
lea ecx, [rdx + 3]
mov word [rax + 0x3d0], cx
add rdx, 4
mov qword [rsp + 0x30], rdx
cmp rdx, r10
jne 0x1400c17f0
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x3d2]
mov ecx, dword [0x141dd83f8]
and ecx, dword [0x141dd83fc]
and ecx, 0x8564d037
add ecx, 0xf8b9ce22
xor ecx, 0x115116a6
cmp ecx, 0x83b0e0a4
jb 0x1400c18cc
mov ecx, dword [0x141dd8400]
or ecx, dword [0x141dd8404]
imul ecx, ecx, 0x555f360
and ecx, 0xfe868fe0
add ecx, 0x1103e002
lea edx, [rax - 1]
mov r8, qword [rsp + 0x28]
mov word [r8 + 0x3d2], dx
cmp ecx, 0x6544f34b
jae 0x1400c18dd
lea ecx, [rax - 1]
mov rdx, qword [rsp + 0x28]
mov word [rdx + 0x3d2], cx
jmp 0x1400c1896
xor eax, eax
mov r14, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
nop word cs:[rax + rax]
test al, al
jne 0x1400c1900
cmp r14, 2
jb 0x1400c1a03
lea rcx, [r15 + rbx*8]
add rcx, 0x3d8
lea rdx, [r13 + 0x3d8]
lea r8, [rdi*8 + 8]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rdi + 1]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd8408]
imul ecx, dword [0x141dd840c]
xor ecx, 0x6002c47c
add ecx, 0xd3cc43f7
xor ecx, 0x3b25e055
cmp ecx, 0xe56ec6bb
ja 0x1400c1940
nop word [rax + rax]
mov ecx, dword [0x141dd8410]
add ecx, dword [0x141dd8414]
and ecx, 0x466446d8
cmp ecx, 0xd78f55ff
je 0x1400c1970
test al, 3
je 0x1400c19e0
mov rax, qword [rsp + 0x40]
lea rax, [r15 + rax*8]
add rax, 0x3e0
lea ecx, [rdi + 1]
movzx ecx, cl
and ecx, 3
xor edx, edx
nop dword [rax + rax]
mov r8, qword [rax + rdx*8]
mov qword [r8 + 0x160], r15
lea r9d, [rbx + rdx]
mov word [r8 + 0x3d0], r9w
inc rdx
cmp rcx, rdx
jne 0x1400c19b0
add rbx, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dd8418]
add eax, dword [0x141dd841c]
imul eax, eax, 0x35826098
cmp eax, 0x4a79a081
je 0x1400c19e0
cmp di, 3
jae 0x1400c1ad5
mov eax, dword [0x141dd8430]
imul eax, dword [0x141dd8434]
or eax, 0x1547ef95
xor eax, 0xb9c35afc
add eax, 0xbd3fe369
cmp eax, 0x5e451b48
jae 0x1400c1a38
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, dword [0x141dd8438]
add eax, dword [0x141dd843c]
imul ebx, eax, 0x31d23cf5
or ebx, 0xde75ffbb
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, r13
call rdi
cmp ebx, 0xef6c17b9
jb 0x1400c1a40
nop
mov eax, dword [0x141dd8440]
add eax, dword [0x141dd8444]
xor eax, 0x411676b
imul eax, eax, 0xdaa0ec85
cmp eax, 0x67aabc20
je 0x1400c1a70
nop
mov eax, dword [0x141dd8448]
imul eax, dword [0x141dd844c]
add eax, 0xd9f5297e
imul rax, rax, 0x56e7c1f1
shr rax, 0x3c
or eax, 0x6cfeca80
cmp eax, 0x2c1ec47b
jb 0x1400c1a90
mov rax, qword [rsp + 0x28]
mov rdx, r14
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x40]
add rax, rdi
add rax, 2
jmp 0x1400c1afd
add rbx, 4
cmp rax, rbx
je 0x1400c1a03
mov ecx, dword [0x141dd8420]
imul ecx, dword [0x141dd8424]
xor ecx, 0x54c45c9b
imul ecx, ecx, 0x34912d0b
cmp ecx, 0x8d80682
jb 0x1400c1bba
nop word cs:[rax + rax]
mov ecx, dword [0x141dd8428]
xor ecx, dword [0x141dd842c]
add ecx, 0x4fe43c46
or ecx, 0xb7f8f36e
lea edx, [rbx + 1]
lea r8d, [rbx + 2]
mov r9, qword [r15 + rbx*8 + 0x3d8]
mov qword [r9 + 0x160], r15
mov word [r9 + 0x3d0], bx
mov r9, qword [r15 + rbx*8 + 0x3e0]
mov qword [r9 + 0x160], r15
mov word [r9 + 0x3d0], dx
lea edx, [rbx + 3]
mov r9, qword [r15 + rbx*8 + 0x3e8]
mov qword [r9 + 0x160], r15
mov word [r9 + 0x3d0], r8w
mov r8, qword [r15 + rbx*8 + 0x3f0]
mov qword [r8 + 0x160], r15
mov word [r8 + 0x3d0], dx
cmp ecx, 0x79f460f0
jae 0x1400c1af0
mov rcx, qword [r15 + rbx*8 + 0x3d8]
mov qword [rcx + 0x160], r15
mov word [rcx + 0x3d0], bx
mov rcx, qword [r15 + rbx*8 + 0x3e0]
mov qword [rcx + 0x160], r15
lea edx, [rbx + 1]
mov word [rcx + 0x3d0], dx
mov rcx, qword [r15 + rbx*8 + 0x3e8]
mov qword [rcx + 0x160], r15
lea edx, [rbx + 2]
mov word [rcx + 0x3d0], dx
mov rcx, qword [r15 + rbx*8 + 0x3f0]
mov qword [rcx + 0x160], r15
lea edx, [rbx + 3]
mov word [rcx + 0x3d0], dx
jmp 0x1400c1b30