Function at 0x1800967f8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [0x1802e8850]
xor rax, rsp
mov qword [rbp + 0x530], rax
xor ebx, ebx
mov r15, r8
mov rdi, rcx
cmp dword [rcx + 0x24], ebx
je 0x18009683f
mov eax, 0x40000
jmp 0x1800972f5
cmp byte [rcx + 0x40], bl
je 0x18009684e
mov eax, 0x50000
jmp 0x1800972f5
mov r12d, ebx
mov esi, dword [rbp + 0x5a0]
mov eax, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
cmp qword [rcx], rbx
je 0x180096868
cmp esi, 4
cmovne r12d, eax
mov r8d, 0x104
lea rcx, [rbp + 0x320]
call fcn.18022a668
movzx ecx, word [rbp + 0x320]
mov word [rbp + 0x526], bx
test cx, cx
je 0x1800972f0
lea rax, [rbp + 0x320]
mov r14d, 0x2f
cmp cx, 0x5c
jne 0x1800968a8
mov word [rax], r14w
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x18009689e
mov eax, 8
cmp esi, 4
jne 0x1800968e2
lea rcx, [rbp + 0x320]
call fcn.18021fa08
cmp word [rbp + rax*2 + 0x31e], r14w
je 0x1800968dd
mov r13b, 1
jmp 0x1800969d8
mov eax, 8
mov r13b, bl
mov r14d, eax
cmp esi, 4
je 0x1800969d8
lea rcx, [rbp + 0x320]
call fcn.18021fa08
lea rbx, [rbp + 0x320]
lea rbx, [rbx + rax*2]
jmp 0x180096914
cmp word [rbx], 0x2e
je 0x180096936
sub rbx, 2
lea rax, [rbp + 0x320]
cmp rbx, rax
ja 0x18009690a
lea rax, [rbp + 0x320]
cmp rbx, rax
jne 0x180096936
cmp word [rbx], 0x2e
jne 0x1800969dd
lea rdx, [0x1802b4004]
mov rcx, rbx
call fcn.180095fe8
test eax, eax
je 0x1800969d6
lea rdx, str..zip
mov rcx, rbx
call fcn.180095fe8
test eax, eax
je 0x1800969d6
lea rdx, str..zoo
mov rcx, rbx
call fcn.180095fe8
test eax, eax
je 0x1800969d6
lea rdx, str..arc
mov rcx, rbx
call fcn.180095fe8
test eax, eax
je 0x1800969d6
lea rdx, str..lzh
mov rcx, rbx
call fcn.180095fe8
test eax, eax
je 0x1800969d6
lea rdx, str..arj
mov rcx, rbx
call fcn.180095fe8
test eax, eax
je 0x1800969d6
lea rdx, [0x1802b4060]
mov rcx, rbx
call fcn.180095fe8
test eax, eax
je 0x1800969d6
lea rdx, str..tgz
mov rcx, rbx
call fcn.180095fe8
xor ebx, ebx
test eax, eax
jne 0x1800969df
jmp 0x1800969d8
xor ebx, ebx
mov r14d, ebx
jmp 0x1800969df
xor ebx, ebx
cmp esi, 2
jne 0x180096a7a
and qword [rdi + 0x8c], 0
mov qword [rdi + 0x98], rbx
mov qword [rdi + 0xa8], rbx
mov byte [rdi + 0xa0], bl
mov dword [rdi + 0x88], ebx
mov dword [rdi + 0xb8], ebx
test r15, r15
je 0x180096ac8
mov qword [rsp + 0x30], rbx
lea r8d, [rsi - 1]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x180096a4f
mov ebx, 0x200
jmp 0x180096acd
mov rdx, r15
mov rcx, rdi
call fcn.18009623c
mov ebx, eax
test eax, eax
je 0x180096a6b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180096acd
xor r15d, r15d
mov byte [rdi + 0xa0], 1
mov ebx, r15d
jmp 0x180096a8f
cmp esi, 1
jne 0x180096a99
mov rdx, r15
mov rcx, rdi
call fcn.18009623c
mov ebx, eax
xor r15d, r15d
test ebx, ebx
je 0x180096b51
jmp 0x180096acd
cmp esi, 3
jne 0x180096ad4
and qword [rdi + 0x8c], 0
and qword [rdi + 0xb4], 0
mov qword [rdi + 0x98], rbx
mov qword [rdi + 0xa8], r15
mov byte [rdi + 0xa0], bl
mov dword [rdi + 0xb0], ebx
mov ebx, 0x10000
mov eax, ebx
jmp 0x1800972f5
cmp esi, 4
jne 0x1800972f0
xor r15d, r15d
mov dword [rdi + 0x70], 0x41c00010
lea r8, [rbp + 0x2d8]
mov qword [rdi + 0x98], r15
lea rdx, [rbp + 0x2dc]
mov qword [rdi + 0xa8], r15
lea rcx, [rdi + 0x74]
mov byte [rdi + 0xa0], r15b
mov qword [rdi + 0x8c], r15
mov dword [rdi + 0xb8], r15d
mov dword [rdi + 0x88], r15d
mov byte [rdi + 0x84], r15b
call fcn.18009318c
mov eax, dword [rdi + 0x74]
movzx ecx, word [rbp + 0x2dc]
mov dword [rdi + 0x78], eax
mov dword [rdi + 0x7c], eax
movzx eax, word [rbp + 0x2d8]
shl ecx, 0x10
or ecx, eax
mov dword [rdi + 0x80], ecx
lea rdx, [0x1802b182b]
mov qword [rbp + 0x2c0], r15
lea rcx, [rbp - 0x78]
call fcn.18022a5b0
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x320]
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp + 0xa8]
call fcn.180221200
mov qword [rsp + 0x58], rax
test r13b, r13b
je 0x180096bd4
lea rdx, [0x1802b4074]
lea rcx, [rbp + 0xa8]
call fcn.18022a510
mov r13d, 1
add qword [rsp + 0x58], r13
jmp 0x180096bda
mov r13d, 1
lea rdx, [0x1802b182b]
lea rcx, [rbp + 0x1ac]
call fcn.18022a5b0
mov eax, dword [rdi + 0x80]
mov dword [rsp + 0x48], eax
mov eax, 8
mov qword [rbp + 0xa0], r15
mov qword [rsp + 0x70], r15
mov dword [rbp + 0x2b0], r13d
lea r8d, [rax + 1]
mov dword [rbp + 0x2b8], r15d
mov word [rsp + 0x7a], r15w
mov dword [rsp + 0x40], 0x140b17
mov dword [rsp + 0x4c], r15d
mov word [rsp + 0x44], ax
cmp qword [rdi], r15
je 0x180096c44
cmp esi, 4
je 0x180096c44
mov eax, r8d
mov word [rsp + 0x44], ax
mov word [rsp + 0x7c], ax
mov word [rsp + 0x46], r14w
test r14d, r14d
jne 0x180096c68
mov ecx, dword [rdi + 0x88]
test ecx, ecx
js 0x180096c68
lea eax, [rcx + r12]
mov dword [rsp + 0x50], eax
jmp 0x180096c73
mov ecx, dword [rdi + 0x88]
mov dword [rsp + 0x50], r15d
mov eax, dword [rdi + 0x70]
mov edx, dword [rdi + 0x7c]
mov dword [rbp - 0x80], eax
mov eax, dword [rdi + 0x20]
add eax, dword [rdi + 0x28]
mov dword [rbp - 0x7c], eax
lea rax, [rbp + 0x2e0]
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x308]
mov qword [rbp + 0x98], rax
mov al, byte [rdi + 0x78]
mov byte [rbp + 0x2e5], al
mov dword [rsp + 0x54], ecx
mov ecx, dword [rdi + 0x78]
mov eax, ecx
sar eax, 8
mov byte [rbp + 0x2e6], al
mov eax, ecx
sar eax, 0x10
mov byte [rbp + 0x2e7], al
mov al, byte [rdi + 0x74]
mov byte [rbp + 0x2e9], al
sar ecx, 0x18
mov byte [rbp + 0x2e8], cl
mov ecx, dword [rdi + 0x74]
mov eax, ecx
sar eax, 8
mov byte [rbp + 0x2ea], al
mov eax, ecx
sar eax, 0x10
mov byte [rbp + 0x2eb], al
mov al, byte [rdi + 0x7c]
mov byte [rbp + 0x2ed], al
mov eax, edx
sar eax, 8
mov byte [rbp + 0x2ee], al
mov eax, edx
sar edx, 0x18
sar ecx, 0x18
mov byte [rbp + 0x2f0], dl
lea rdx, [rbp + 0x2e0]
mov byte [rbp + 0x2ec], cl
lea rcx, [rbp + 0x308]
sar eax, 0x10
mov word [rsp + 0x78], r15w
mov qword [rsp + 0x60], 0x11
mov qword [rsp + 0x68], r8
mov dword [rbp + 0x2e0], 0xd5455
mov byte [rbp + 0x2e4], 7
mov byte [rbp + 0x2ef], al
call fcn.18021af70
mov rax, qword [rbp + 0x98]
lea rcx, [rsp + 0x40]
mov r8, rdi
mov byte [rax + 2], 5
call fcn.180095588
test eax, eax
je 0x180096d89
mov rcx, rdi
call fcn.180096448
mov eax, 0x400
jmp 0x1800972f5
mov ecx, dword [rsp + 0x58]
add ecx, 0x1e
add ecx, dword [rsp + 0x60]
add dword [rdi + 0x28], ecx
cmp dword [rdi + 0x24], r15d
je 0x180096dad
mov rcx, rdi
call fcn.180096448
mov eax, dword [rdi + 0x24]
jmp 0x1800972f5
mov dword [rdi + 0x44], 0x12345678
lea r9, [0x1802b3280]
mov dword [rdi + 0x48], 0x23456789
mov dword [rdi + 0x4c], 0x34567890
mov r8, qword [rdi]
test r8, r8
je 0x180096e1d
cmp byte [r8], r15b
je 0x180096e1d
movsx rax, byte [r8]
mov edx, dword [rdi + 0x44]
mov ecx, edx
xor rcx, rax
shr edx, 8
movzx eax, cl
xor edx, dword [r9 + rax*4]
movzx eax, dl
add eax, dword [rdi + 0x48]
imul ecx, eax, 0x8088405
mov dword [rdi + 0x44], edx
mov edx, dword [rdi + 0x4c]
add ecx, r13d
mov dword [rdi + 0x48], ecx
movzx eax, byte [rdi + 0x4b]
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [r9 + rcx*4]
mov dword [rdi + 0x4c], edx
add r8, r13
jne 0x180096dd1
cmp byte [0x1802f65f8], r15b
jne 0x180096e3e
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
call fcn.18022a380
mov rbx, r15
call fcn.18022a354
sar eax, 7
mov byte [rbp + rbx + 0x2f8], al
add rbx, r13
cmp rbx, 0xc
jl 0x180096e41
mov eax, dword [rsp + 0x48]
lea r11, [0x1802b3280]
shr eax, 8
mov r10, r15
mov byte [rbp + 0x303], al
movsx rax, byte [rbp + r10 + 0x2f8]
mov r8d, dword [rdi + 0x4c]
mov edx, dword [rdi + 0x44]
mov r9d, r8d
mov ecx, edx
and r9d, 0xfffd
xor rcx, rax
shr edx, 8
movzx eax, cl
or r9d, 2
xor edx, dword [r11 + rax*4]
movzx eax, dl
add eax, dword [rdi + 0x48]
imul ecx, eax, 0x8088405
mov dword [rdi + 0x44], edx
add ecx, r13d
mov dword [rdi + 0x48], ecx
movzx eax, byte [rdi + 0x4b]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov eax, r9d
xor eax, r13d
imul eax, r9d
xor r8d, dword [r11 + rcx*4]
mov dword [rdi + 0x4c], r8d
shr eax, 8
xor byte [rbp + r10 + 0x2f8], al
add r10, r13
cmp r10, 0xc
jl 0x180096e70
mov rax, qword [rdi]
test rax, rax
je 0x180096f10
cmp esi, 4
je 0x180096f10
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, [rbp + 0x2f8]
mov rcx, rdi
call fcn.18009606c
add dword [rdi + 0x28], 0xc
mov rax, qword [rdi]
mov ebx, r15d
test rax, rax
je 0x180096f20
mov al, r13b
cmp esi, 4
jne 0x180096f23
mov al, r15b
mov byte [rdi + 0x41], al
cmp esi, 4
je 0x180096fa4
mov eax, 8
cmp r14d, eax
jne 0x180096f46
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1800964ac
mov ebx, eax
jmp 0x180096fab
test r14d, r14d
jne 0x180096fab
lea r13, [rdi + 0xbc]
jmp 0x180096f6e
cmp ebx, 0xffffffff
je 0x180096f85
mov r8d, ebx
mov rdx, r13
mov rcx, rdi
call fcn.18009606c
cmp eax, ebx
jne 0x180096f9a
add r15d, ebx
mov r8d, 0x4000
mov rdx, r13
mov rcx, rdi
call fcn.18009635c
mov ebx, eax
test eax, eax
jne 0x180096f54
mov dword [rdi + 0xb8], r15d
xor r15d, r15d
mov ebx, r15d
mov r13d, 1
jmp 0x180096fab
mov ebx, 0x60000
xor r15d, r15d
jmp 0x180096f92
mov dword [rdi + 0xb8], r15d
mov rcx, rdi
mov byte [rdi + 0x41], r15b
call fcn.180096448
mov ecx, dword [rdi + 0xb8]
add dword [rdi + 0x28], ecx
mov eax, dword [rdi + 0x24]
test eax, eax
jne 0x1800972f5
test ebx, ebx
jne 0x180096d7f
mov eax, dword [rdi + 0x90]
add ecx, r12d
cmp dword [rsp + 0x50], ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rdi + 0x88]
sete dl
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x54], eax
cmp byte [rdi + 0x2c], r15b
je 0x18009706b
cmp qword [rdi], r15
je 0x180097005
cmp esi, 4
jne 0x18009706b
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x46], r14w
test r13b, al
jne 0x180097022
mov ecx, 0xfff7
and ax, cx
mov word [rsp + 0x44], ax
mov edx, dword [rbp - 0x7c]
mov rcx, rdi
sub edx, dword [rdi + 0x20]
mov word [rsp + 0x7c], ax
call fcn.1800961e4
test al, al
je 0x180097061
mov r8, rdi
lea rcx, [rsp + 0x40]
call fcn.180095588
test eax, eax
jne 0x180096d7f
mov edx, dword [rdi + 0x28]
mov rcx, rdi
call fcn.1800961e4
test al, al
jne 0x180097265
mov eax, 0x2000000
jmp 0x1800972f5
cmp word [rsp + 0x46], r14w
jne 0x1800972e9
test r14d, r14d
jne 0x180097084
test dl, dl
je 0x1800972e9
mov r8d, r13d
mov byte [rbp + 0x2d0], 0x50
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call fcn.18009606c
mov r8d, r13d
mov byte [rbp + 0x2d0], 0x4b
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call fcn.18009606c
mov r8d, r13d
mov byte [rbp + 0x2d1], 7
lea rdx, [rbp + 0x2d1]
mov rcx, rdi
call fcn.18009606c
mov eax, 8
lea rdx, [rbp + 0x2d1]
mov r8d, r13d
mov byte [rbp + 0x2d1], al
mov rcx, rdi
call fcn.18009606c
mov al, byte [rsp + 0x4c]
lea rdx, [rbp + 0x2d2]
mov r8d, r13d
mov byte [rbp + 0x2d2], al
mov rcx, rdi
call fcn.18009606c
mov eax, dword [rsp + 0x4c]
lea rdx, [rbp + 0x2d2]
shr eax, 8
mov r8d, r13d
mov rcx, rdi
mov byte [rbp + 0x2d2], al
call fcn.18009606c
mov eax, dword [rsp + 0x4c]
lea rdx, [rbp + 0x2d3]
shr eax, 0x10
mov r8d, r13d
mov rcx, rdi
mov byte [rbp + 0x2d3], al
call fcn.18009606c
mov eax, dword [rsp + 0x4c]
lea rdx, [rbp + 0x2d3]
shr eax, 0x18
mov r8d, r13d
mov rcx, rdi
mov byte [rbp + 0x2d3], al
call fcn.18009606c
mov al, byte [rsp + 0x50]
lea rdx, [rbp + 0x2d4]
mov r8d, r13d
mov byte [rbp + 0x2d4], al
mov rcx, rdi
call fcn.18009606c
mov eax, dword [rsp + 0x50]
lea rdx, [rbp + 0x2d4]
shr eax, 8
mov r8d, r13d
mov rcx, rdi
mov byte [rbp + 0x2d4], al
call fcn.18009606c
mov eax, dword [rsp + 0x50]
lea rdx, [rbp + 0x2d5]
shr eax, 0x10
mov r8d, r13d
mov rcx, rdi
mov byte [rbp + 0x2d5], al
call fcn.18009606c
mov eax, dword [rsp + 0x50]
lea rdx, [rbp + 0x2d5]
shr eax, 0x18
mov r8d, r13d
mov rcx, rdi
mov byte [rbp + 0x2d5], al
call fcn.18009606c
mov al, byte [rsp + 0x54]
lea rdx, [rbp + 0x2d8]
mov r8d, r13d
mov byte [rbp + 0x2d8], al
mov rcx, rdi
call fcn.18009606c
mov eax, dword [rsp + 0x54]
lea rdx, [rbp + 0x2d8]
shr eax, 8
mov r8d, r13d
mov rcx, rdi
mov byte [rbp + 0x2d8], al
call fcn.18009606c
mov eax, dword [rsp + 0x54]
lea rdx, [rbp + 0x2dc]
shr eax, 0x10
mov r8d, r13d
mov rcx, rdi
mov byte [rbp + 0x2dc], al
call fcn.18009606c
mov eax, dword [rsp + 0x54]
lea rdx, [rbp + 0x2dc]
shr eax, 0x18
mov r8d, r13d
mov rcx, rdi
mov byte [rbp + 0x2dc], al
call fcn.18009606c
movzx eax, word [rsp + 0x7c]
add dword [rdi + 0x28], 0x10
mov word [rsp + 0x44], ax
mov eax, dword [rdi + 0x24]
test eax, eax
jne 0x1800972f5
mov rcx, qword [rsp + 0x68]
call fcn.180098cc0
mov r8, qword [rsp + 0x68]
mov rcx, rax
mov rdx, qword [rbp + 0x98]
mov rbx, rax
call fcn.18021af70
mov esi, 0x388
mov qword [rbp + 0x98], rbx
mov ecx, esi
call fcn.180098c70
mov r8d, esi
lea rdx, [rsp + 0x40]
mov rcx, rax
mov rbx, rax
call fcn.18021af70
mov rcx, qword [rdi + 0x60]
test rcx, rcx
jne 0x1800972c6
mov qword [rdi + 0x60], rbx
jmp 0x1800972e5
mov rax, qword [rcx + 0x380]
jmp 0x1800972d9
mov rcx, rax
mov rax, qword [rax + 0x380]
test rax, rax
jne 0x1800972cf
mov qword [rcx + 0x380], rbx
xor eax, eax
jmp 0x1800972f5
mov eax, 0x4000000
jmp 0x1800972f5
mov eax, 0x10000
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.180218af0
mov rbx, qword [rsp + 0x698]
add rsp, 0x640
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret