Function at 0x14007cad0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x280
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140495598]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r12, rcx
xor r15d, r15d
lea edi, [r15 + 0x4c]
mov r13d, 0xffff0000
mov r8d, 1
movabs rsi, 0x112e0be826d694b3
mov rax, qword [0x1404962c8]
test rax, rax
je 0x14007d46f
movzx eax, byte [0x1404965e0]
test al, al
setne al
test al, al
je 0x14007cc28
mov qword [rsp + 0x48], shutdown
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x48], shutdown
mov qword [rsp + 0x48], 0x1312d00
call fcn.14030f908
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x48], rax
imul rcx, rax, 0x64
mov qword [rsp + 0x48], rcx
add rcx, 0x1312d00
mov rax, rsi
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], rdx
imul rax, rdx, 0x3b9aca00
mov qword [rsp + 0x48], rax
sub rcx, rax
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x68], ecx
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0xc0], xmm0
movdqa xmmword [rbp + 0xc0], xmm0
lea rcx, [rbp + 0xc0]
call fcn.140310014
movzx eax, byte [0x1404965e0]
test al, al
setne al
test al, al
je 0x14007cc0a
mov rax, qword [0x1404962c8]
test rax, rax
jne 0x14007cb74
mov rax, qword [0x1404962c8]
test rax, rax
je 0x14007d46f
mov rcx, r12
call fcn.14007d920
mov r8d, 1
mov sil, 1
mov byte [rsp + 0x50], sil
xor eax, eax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
nop word [rax + rax]
mov rcx, qword [r12 + 0x1ff8]
mov rax, qword [0x1404962c8]
cmp rax, rcx
jne 0x14007d45d
lea r15, [r12 + 0x190]
movzx eax, byte [r15 + 0x1e70]
imul rcx, rax, 0x268
lea r14, [r15 + 0x1980]
add r14, rcx
mov qword [rsp + 0x48], r14
movzx ecx, byte [r12 + 0x12a]
mov rdx, r8
shl rdx, cl
movzx ecx, byte [r14 + 2]
mov rax, r8
shl rax, cl
cmp rax, rdx
jne 0x14007d45a
movzx r10d, byte [r15 + 0x1e70]
imul r9, r10, 0x268
mov r8d, dword [r9 + r15 + 0x1980]
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007cd10
mov edx, 0x20
jmp 0x14007cd1f
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, rdi
imul rax, r10, 0xcc0
add rax, rdx
mov ebx, dword [rax + r15]
mov dword [rbp + 0xd0], ebx
mov r11, qword [r9 + r15 + 0x19a0]
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007cd63
mov edx, 0x20
jmp 0x14007cd72
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, rdi
imul rcx, r10, 0xcc0
add rcx, rdx
add rcx, r11
mov eax, dword [rcx + r15]
mov dword [rbp + 0xd4], eax
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007cdb1
mov edx, 0x20
jmp 0x14007cdc0
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, rdi
imul rcx, r10, 0x660
add rcx, r11
lea rax, [rdx + rcx*2]
mov ecx, dword [rax + r15]
mov dword [rbp + 0xd8], ecx
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007ce00
mov edx, 0x20
jmp 0x14007ce0f
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, rdi
imul rcx, r10, 0x440
add rcx, r11
lea rax, [rdx + rcx*2]
add rcx, rax
mov eax, dword [rcx + r15]
mov dword [rbp + 0xdc], eax
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007ce52
mov edx, 0x20
jmp 0x14007ce61
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, rdi
imul rcx, r10, 0x330
add rcx, r11
lea rax, [rdx + rcx*4]
mov ecx, dword [rax + r15]
mov dword [rbp + 0xe0], ecx
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007cea2
mov r9d, 0x20
jmp 0x14007ceb2
mov r9d, 0x27
cmp ecx, 0x6c000000
cmove r9, rdi
imul rax, r10, 0xcc0
lea rdx, [r11 + r11*4]
add rax, r9
add rdx, rax
mov eax, dword [rdx + r15]
mov dword [rbp + 0xe4], eax
mov eax, r8d
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, r8d
cmp ecx, 0x6b000000
jne 0x14007cef5
mov edx, 0x20
jmp 0x14007cf04
mov edx, 0x27
cmp ecx, 0x6c000000
cmove rdx, rdi
imul rcx, r10, 0x220
add rcx, r11
lea rax, [rcx + rcx*2]
lea rcx, [rdx + rax*2]
mov eax, dword [rcx + r15]
mov dword [rbp + 0xe8], eax
imul rcx, r10, 0x268
mov r9, qword [rcx + r15 + 0x19a0]
imul rcx, r10, 0x268
mov edx, dword [rcx + r15 + 0x1980]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007cf65
mov r8d, 0x20
jmp 0x14007cf75
mov r8d, 0x27
cmp ecx, 0x6c000000
cmove r8, rdi
imul rax, r10, 0xcc0
imul rdx, r9, 7
add rax, r8
add rdx, rax
mov eax, dword [rdx + r15]
mov dword [rbp + 0xec], eax
mov r10d, 8
mov eax, dword [r12 + 0x2030]
test eax, eax
je 0x14007cfcf
cmp ebx, eax
jae 0x14007d46a
cmp qword [r12 + 0x140], 1
jne 0x14007cfcf
movzx eax, byte [r15 + 0x1e70]
imul rcx, rax, 0xcc0
mov rax, qword [0x1404a38a0]
xor qword [rcx + r15], rax
movzx eax, byte [r15 + 0x1e70]
imul rcx, rax, 0x268
mov edx, dword [rcx + r15 + 0x1980]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, edx
cmp ecx, 0x6b000000
jne 0x14007d00d
mov r9d, 0x20
jmp 0x14007d01d
mov r9d, 0x27
cmp ecx, 0x6c000000
cmove r9, rdi
movzx eax, byte [r15 + 0x1e70]
imul rcx, rax, 0x268
mov edx, dword [rcx + r15 + 0x1980]
mov eax, edx
and eax, 0xff000000
mov r8d, 0xff000000
cmp eax, 0x63000000
cmove r8d, r13d
and r8d, edx
mov ecx, 4
cmp r8d, 0x6b000000
cmove rcx, r10
movzx eax, byte [r15 + 0x1e70]
imul rdi, rax, 0xcc0
lea rax, [r9 + rcx]
add rdi, rax
add rdi, r15
mov edx, dword [r14]
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, edx
cmp ecx, 0x72000000
jne 0x14007d25a
test sil, sil
je 0x14007d111
mov byte [rsp + 0x50], 0
cmp byte [r14 + 0x261], 0
je 0x14007d0d1
movzx eax, byte [r15 + 0x1e70]
imul rdx, rax, 0xcc0
add rdx, r15
mov r9, rdi
mov r8, qword [r14 + 0x20]
mov rcx, r14
call fcn.14003afc0
mov rbx, qword [r12 + 0x2008]
movzx eax, byte [r15 + 0x1e70]
imul r8, rax, 0xcc0
add r8, r15
mov r9, qword [r14 + 0x20]
mov edx, 0x40
lea rcx, [rbp + 0xf0]
call qword [0x1404962e8]
mov rax, qword [rbx]
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [rax + 0x30]
mov edx, 0x8000
cmp dword [r12 + 0x2030], 0
mov eax, 1
cmovne edx, eax
mov rcx, r15
call fcn.14007e1e0
test al, al
je 0x14007d40f
cmp byte [r14 + 0x261], 0
je 0x14007d18d
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rdi + 0x10]
movaps xmmword [rbp + 0x140], xmm1
movups xmm0, xmmword [rdi + 0x20]
movaps xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rdi + 0x30]
movaps xmmword [rbp + 0x160], xmm1
movzx eax, byte [r15 + 0x1e70]
imul rdx, rax, 0xcc0
add rdx, r15
mov r9, rdi
mov r8, qword [r14 + 0x20]
mov rcx, r14
call fcn.14003afc0
mov r13, qword [r14 + 0x20]
movzx eax, byte [r15 + 0x1e70]
mov byte [rsp + 0x40], al
mov rbx, qword [r12 + 0x2008]
mov dword [rsp + 0x58], 0x9fc0
ldmxcsr dword [rsp + 0x58]
xor edi, edi
cmp dword [0x1404a3f64], 1
je 0x14007d209
lea rsi, [rbx + 0x980]
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx]
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [rax + gethostname]
mov r9d, 0x100
mov r8, rsi
mov edx, 0x40
lea rcx, [rbp + 0xf0]
call qword [0x1404962e8]
inc edi
mov eax, dword [0x1404a3f64]
dec eax
cmp edi, eax
jb 0x14007d1d0
mov rax, qword [rbx]
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [rax + gethostname]
movzx eax, byte [rsp + 0x40]
imul r8, rax, 0xcc0
add r8, r15
mov r9, r13
mov edx, 0x40
lea rcx, [rbp + 0xf0]
call qword [0x1404962e8]
lea r13, [r12 + 0x28]
mov rax, qword [rbx]
lea r8, [rbp + 0xf0]
mov rdx, r13
mov rcx, rbx
call qword [rax + 0x18]
jmp 0x14007d327
mov eax, edx
and eax, 0xff000000
mov ecx, 0xff000000
cmp eax, 0x63000000
cmove ecx, r13d
and ecx, edx
lea r13, [r12 + 0x28]
movzx eax, byte [r15 + 0x1e70]
cmp ecx, 0x6c000000
je 0x14007d2d1
mov rsi, qword [r14 + 0x78]
mov r14, qword [r14 + 0x20]
imul rdi, rax, 0xcc0
add rdi, r15
mov r8d, dword [r12 + 0x12c]
mov edx, dword [r12 + 0x134]
mov rcx, qword [rsp + 0x48]
call fcn.1400a00c0
mov qword [rsp + 0x20], rsi
lea r9, [r12 + 0x148]
mov r8, r13
mov rdx, r14
mov rcx, rdi
call rax
mov r14, qword [rsp + 0x48]
jmp 0x14007d301
lea r9, [r12 + 0x148]
imul rcx, rax, 0xcc0
add rcx, r15
mov byte [rsp + 0x28], 1
mov rax, qword [r12 + 0x2028]
mov qword [rsp + 0x20], rax
mov r8, r13
mov rdx, qword [r14 + 0x20]
call fcn.14017d130
mov edx, 0x8000
cmp dword [r12 + 0x2030], 0
mov eax, 1
cmovne edx, eax
mov rcx, r15
call fcn.14007e1e0
test al, al
je 0x14007d430
xor r15d, r15d
mov ebx, r15d
nop dword [rax]
mov rcx, qword [r13 + 0x18]
mov eax, dword [r12 + 0x2030]
test eax, eax
je 0x14007d373
cmp dword [rbp + rbx*4 + 0xd0], eax
jae 0x14007d3c7
prefetchw byte [0x1404a38a0]
mov rax, qword [0x1404a38a0]
nop word [rax + rax]
mov rdx, rax
xor rdx, rcx
lock cmpxchg qword [0x1404a38a0], rdx
jne 0x14007d360
jmp 0x14007d3c7
cmp rcx, qword [r14 + 0x80]
jae 0x14007d3c7
lea rax, [rbp + 0x130]
cmp byte [r14 + 0x261], 0
cmove rax, r15
mov r8d, dword [rbp + rbx*4 + 0xd0]
mov qword [rsp + 0x30], rax
mov r9, r13
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.140088f40
nop
mov rcx, rax
call fcn.140089420
nop
mov rcx, qword [rbp - 0x18]
call fcn.140311600
mov rcx, qword [rbp - 0x28]
call fcn.140311600
inc rbx
add r13, 0x20
cmp rbx, 8
jb 0x14007d330
add qword [r12 + 8], 8
cmp byte [r12 + 0x131], 0
movzx esi, byte [rsp + 0x50]
mov edi, 0x4c
mov r13d, 0xffff0000
lea r8d, [rdi - 0x4b]
je 0x14007cc70
call sub.KERNEL32.dll_SwitchToThread
lea r8d, [rdi - 0x4b]
jmp 0x14007cc70
movzx eax, byte [r12 + 0x2000]
imul rcx, rax, 0x268
add rcx, 0x1b10
add rcx, r12
call fcn.140089300
jmp 0x14007d455
movzx eax, byte [r12 + 0x2000]
imul rcx, rax, 0x268
add rcx, 0x1b10
add rcx, r12
call fcn.140089300
mov r13d, 0xffff0000
mov edi, 0x4c
xor r15d, r15d
mov rcx, r12
call fcn.14007d920
jmp 0x14007cb20
call fcn.140070550
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1403115a0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret