Function at 0x140117ee0
Capabilities:
Check for debugger via api
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
call sub.KERNEL32.dll_FreeConsole
lea rsi, [rsp + 0x108]
mov rcx, rsi
call fcn.140118c20
mov rcx, rsi
call fcn.140118ee0
mov rcx, rsi
call fcn.140118f30
mov r12, qword [rax + 0x18]
test r12, r12
je 0x140118664
mov rdi, qword [rax]
lea rbx, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb esi, xmm0
not esi
lea r14, str._b___
xor eax, eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x3c], 0
jmp 0x140117f65
mov qword [rsp + 0x48], r15
mov eax, r15d
mov dword [rsp + 0x3c], eax
test r12, r12
je 0x14011866b
test si, si
jne 0x140117f8d
nop word [rax + rax]
movdqa xmm0, xmmword [rbx]
pmovmskb esi, xmm0
add rdi, 0xffffffffffffea80
add rbx, 0x10
cmp esi, 0xffff
je 0x140117f70
not esi
mov qword [rsp + 0x80], r12
mov r13d, esi
tzcnt eax, r13d
neg rax
imul r15, rax, 0x158
lea rcx, [rdi + r15]
add rcx, 0xfffffffffffffeb0
call fcn.140119090
mov r8, rdx
lea rcx, [rsp + 0x88]
mov rdx, rax
call fcn.14014e840
mov rbp, qword [rsp + 0x88]
mov r8, qword [rsp + 0x98]
mov qword [rsp + 0x20], 4
lea rcx, [rsp + 0xa0]
mov rdx, rbp
lea r9, str..exe
call fcn.1401598d0
mov r9, qword [rsp + 0xb0]
cmp qword [rsp + 0xa0], 0
mov rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r13
je 0x140118220
mov r12, qword [rsp + 0xd0]
test r12, r12
je 0x14011822e
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rsi, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
cmp qword [rsp + 0xd8], 0xffffffffffffffff
mov r8, qword [rsp + 0xb8]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x30], rbp
je 0x140118236
mov r15, qword [rsp + 0xe0]
mov r10, r9
neg r10
mov qword [rsp + 0x58], r10
mov r8, r12
sub r8, rax
cmp r8, rdx
jae 0x140118360
mov r11, r12
sub r11, qword [rsp + 0x50]
mov qword [rsp + 0x60], r11
add r10, r12
mov qword [rsp + 0x68], r10
mov r10, r12
cmp r12, r10
jne 0x140118360
movzx r10d, byte [rcx + r8]
mov r11, qword [rsp + 0x40]
bt r11, r10
jae 0x140118140
mov rbp, r8
cmp r9, r15
mov r10, r15
cmovb r10, r9
dec r10
lea r8, [rcx + rbp]
nop word cs:[rax + rax]
cmp r10, 0xffffffffffffffff
je 0x140118180
cmp r10, rax
jae 0x140118b9c
lea r11, [r10 + rbp]
cmp r11, rdx
jae 0x140118b8b
movzx r13d, byte [rsi + r10]
lea r11, [r10 - 1]
cmp r13b, byte [r8 + r10]
mov r10, r11
je 0x1401180f0
mov r8, qword [rsp + 0x68]
lea r10, [r8 + r11]
inc r10
mov r15, rax
jmp 0x1401181c7
mov rbp, r8
sub rbp, rax
cmp rbp, rdx
jae 0x140118574
nop
cmp r12, r8
jne 0x140118574
movzx r10d, byte [rcx + rbp]
mov r11, qword [rsp + 0x40]
bt r11, r10
jb 0x1401181e0
sub rbp, rax
sub r8, rax
cmp rbp, rdx
jb 0x140118150
jmp 0x140118574
mov r10, r9
nop word cs:[rax + rax]
cmp r10, r15
jae 0x1401181f0
cmp r10, rax
jae 0x140118bb0
lea r11, [r10 + rbp]
cmp r11, rdx
jae 0x140118bcb
movzx r11d, byte [rsi + r10]
lea r13, [r10 + 1]
cmp r11b, byte [r8 + r10]
mov r10, r13
je 0x140118190
mov r10, qword [rsp + 0x60]
mov r15, qword [rsp + 0x50]
mov r8, r10
sub r8, rax
cmp r8, rdx
mov rbp, qword [rsp + 0x30]
jb 0x1401180b4
jmp 0x140118360
mov r15, rax
jmp 0x1401180d0
mov r12, rbp
mov r15, rax
mov r13d, 0
test rbp, rbp
mov rbp, qword [rsp + 0x30]
mov r10, qword [rsp + 0x58]
jne 0x14011808d
jmp 0x140118580
cmp byte [rsp + 0xba], 0
je 0x140118368
xor r13d, r13d
jmp 0x140118580
lea r10, [r9 - 1]
cmp r10, rax
jae 0x14011842e
lea r8, [r9 + rsi]
dec r8
mov qword [rsp + 0x68], r8
lea r8, [r9 - 1]
mov qword [rsp + 0x60], r8
jmp 0x140118277
mov r12, r8
mov r13d, 0
test r8, r8
mov rbp, qword [rsp + 0x30]
je 0x140118580
mov r10, r12
sub r10, rax
cmp r10, rdx
jae 0x140118360
mov r8, r12
sub r8, qword [rsp + 0x50]
mov qword [rsp + 0x58], r8
mov r8, r12
jmp 0x1401182af
mov r10, r8
sub r10, rax
cmp r10, rdx
jae 0x140118360
mov r11, r8
cmp r12, r8
jne 0x140118360
mov r8, r10
movzx r10d, byte [rcx + r10]
mov r11, qword [rsp + 0x40]
bt r11, r10
jae 0x1401182a0
mov r10, qword [rsp + 0x60]
lea r11, [r10 + r8]
mov r10, qword [rsp + 0x68]
xor ebp, ebp
nop
cmp r9, rbp
je 0x140118310
cmp r11, rdx
jae 0x140118b8b
movzx r15d, byte [r10]
inc rbp
dec r10
lea r13, [r11 - 1]
cmp r15b, byte [rcx + r11]
mov r11, r13
je 0x1401182e0
mov r8, r12
sub r8, rbp
jmp 0x14011834c
lea rbp, [r9 + r8]
mov r10, r9
nop word [rax + rax]
cmp rax, r10
je 0x140118260
cmp rbp, rdx
jae 0x140118bd5
movzx r11d, byte [rsi + r10]
inc r10
lea r15, [rbp + 1]
cmp r11b, byte [rcx + rbp]
mov rbp, r15
je 0x140118320
mov r8, qword [rsp + 0x58]
mov r10, r8
sub r10, rax
cmp r10, rdx
mov rbp, qword [rsp + 0x30]
jb 0x1401182af
mov r13, r12
jmp 0x140118580
movzx eax, byte [rsp + 0xb9]
test r9, r9
jne 0x1401183a6
test al, al
je 0x14011822e
nop dword [rax]
xor al, 1
jne 0x140118380
jmp 0x14011822e
and r10d, 0x1f
shl r10d, 6
and r8d, 0x3f
or r8d, r10d
mov r10d, eax
xor r10b, 1
test al, al
mov eax, r10d
je 0x140118416
cmp r9, rdx
jae 0x1401183c0
cmp byte [rcx + r9], 0xc0
jge 0x1401183c6
jmp 0x140118be6
jne 0x140118be6
movzx r8d, byte [rcx + r9 - 1]
movzx r8d, r8b
test r8b, r8b
jns 0x140118398
movzx r10d, byte [rcx + r9 - 2]
cmp r10b, 0xbf
jg 0x140118389
movzx r11d, byte [rcx + r9 - 3]
cmp r11b, 0xbf
jg 0x140118402
movzx esi, byte [rcx + r9 - 4]
and esi, 7
shl esi, 6
and r11d, 0x3f
or r11d, esi
jmp 0x140118406
and r11d, 0xf
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
jmp 0x14011838d
cmp r8d, 0x110000
mov eax, 0
cmove r9, rax
mov r13, r9
jmp 0x140118580
test r9, r9
je 0x140118472
mov r8, r12
sub r8, rax
cmp r8, rdx
jae 0x140118360
xor r9d, r9d
test r9, r9
jne 0x140118360
movzx r11d, byte [rcx + r8]
mov rsi, qword [rsp + 0x40]
bt rsi, r11
jb 0x140118b9c
sub r8, rax
add r9, rax
cmp r8, rdx
jb 0x140118445
jmp 0x140118360
mov r9, r12
sub r9, rax
cmp r9, rdx
jae 0x140118360
mov r8, r12
sub r8, qword [rsp + 0x50]
mov r10, r8
sub r10, rax
cmp r10, rdx
jae 0x140118500
mov r11, r12
cmp r12, r11
jne 0x140118360
movzx r11d, byte [rcx + r9]
mov r15, qword [rsp + 0x40]
bt r15, r11
jae 0x1401184ea
mov rbp, r9
xor r11d, r11d
cmp rax, r11
je 0x14011855b
cmp rbp, rdx
jae 0x140118bd5
movzx r15d, byte [rsi + r11]
inc r11
lea r13, [rbp + 1]
cmp r15b, byte [rcx + rbp]
mov rbp, r13
je 0x1401184b6
mov r11, r8
mov r9, r10
mov rbp, qword [rsp + 0x30]
jmp 0x140118497
mov r11, r9
mov r15, r9
sub r15, rax
mov r9, r15
cmp r15, rdx
jb 0x140118497
jmp 0x140118360
lea r8, [rcx + r9]
mov rbp, r9
xor r10d, r10d
test r10, r10
jne 0x140118574
movzx r11d, byte [r8 + r10]
mov r15, qword [rsp + 0x40]
bt r15, r11
jb 0x140118530
sub r10, rax
lea r11, [r9 + r10]
sub rbp, rax
cmp r11, rdx
jb 0x14011850a
jmp 0x140118574
add r9, r10
xor r8d, r8d
cmp rax, r8
je 0x14011855b
cmp rbp, rdx
jae 0x140118bd5
movzx r10d, byte [rsi + r8]
inc r8
lea r11, [rbp + 1]
cmp r10b, byte [rcx + rbp]
mov rbp, r11
je 0x140118536
jmp 0x140118574
mov r12, r9
mov r13d, 0
test r9, r9
mov rbp, qword [rsp + 0x30]
jne 0x140118475
jmp 0x140118580
mov r13, r12
mov rbp, qword [rsp + 0x30]
nop dword [rax]
mov rax, qword [rsp + 0x78]
lea esi, [rax - 1]
and esi, eax
add qword [rsp + 0x70], rdi
mov r12, qword [rsp + 0x80]
dec r12
mov r15d, 8
jmp 0x1401185c1
add r15, 0x10
cmp r15, 0x228
je 0x140118640
cmp qword [r15 + r14], r13
jne 0x1401185b0
mov rcx, qword [r15 + r14 - 8]
mov rdx, rbp
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1401185b0
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x1401185f6
mov r8d, 1
mov rcx, rbp
call fcn.140001420
mov eax, dword [rsp + 0x3c]
inc eax
mov r15d, eax
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax - 0x158]
lea rcx, [rsp + 0x108]
call fcn.140118f40
test rax, rax
je 0x140117f50
mov rcx, rax
call fcn.140119070
xor ecx, ecx
test al, al
sete cl
lea eax, [rcx + rcx*8]
add r15d, eax
inc r15d
jmp 0x140117f50
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x140117f5c
mov r8d, 1
mov rcx, rbp
call fcn.140001420
jmp 0x140117f5c
xor eax, eax
mov qword [rsp + 0x48], rax
mov r9, qword [rsp + 0x150]
test r9, r9
je 0x140118911
mov rdi, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x160]
test rsi, rsi
je 0x1401188e0
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
lea r14, [rdi + 0x10]
jmp 0x1401186c0
lea eax, [r15 - 1]
and eax, r15d
dec rsi
je 0x1401188d0
test ax, ax
jne 0x1401186ed
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rdi, 0xffffffffffffea80
add r14, 0x10
cmp eax, 0xffff
je 0x1401186d0
not eax
mov r15d, eax
tzcnt eax, r15d
neg rax
imul rax, rax, 0x158
lea r12, [rdi + rax]
mov rdx, qword [rdi + rax - 0xd0]
test rdx, rdx
je 0x140118723
mov rcx, qword [r12 - 0xd8]
mov r8d, 1
call fcn.140001420
mov rbx, qword [r12 - 0xc0]
mov r13, qword [r12 - 0xb0]
test r13, r13
je 0x140118770
lea rbp, [rbx + 8]
jmp 0x140118749
add rbp, 0x18
dec r13
je 0x140118770
mov rdx, qword [rbp]
test rdx, rdx
je 0x140118740
mov rcx, qword [rbp - 8]
mov r8d, 1
call fcn.140001420
jmp 0x140118740
mov rax, qword [r12 - 0xb8]
test rax, rax
je 0x140118793
shl rax, 3
lea rdx, [rax + rax*2]
mov r8d, 8
mov rcx, rbx
call fcn.140001420
cmp byte [r12 - 0x120], 2
je 0x1401187be
mov rdx, qword [r12 - 0x130]
test rdx, rdx
je 0x1401187be
mov rcx, qword [r12 - 0x138]
mov r8d, 1
call fcn.140001420
mov rcx, qword [r12 - 0x88]
test rcx, rcx
je 0x1401187e0
mov rdx, qword [r12 - 0x80]
test rdx, rdx
je 0x1401187e0
mov r8d, 1
call fcn.140001420
mov rbx, qword [r12 - 0xa8]
mov r13, qword [r12 - 0x98]
test r13, r13
je 0x140118830
lea rbp, [rbx + 8]
jmp 0x140118809
add rbp, 0x18
dec r13
je 0x140118830
mov rdx, qword [rbp]
test rdx, rdx
je 0x140118800
mov rcx, qword [rbp - 8]
mov r8d, 1
call fcn.140001420
jmp 0x140118800
mov rax, qword [r12 - 0xa0]
test rax, rax
je 0x140118853
shl rax, 3
lea rdx, [rax + rax*2]
mov r8d, 8
mov rcx, rbx
call fcn.140001420
cmp byte [r12 - 0x100], 2
je 0x14011887e
mov rdx, qword [r12 - 0x110]
test rdx, rdx
je 0x14011887e
mov rcx, qword [r12 - 0x118]
mov r8d, 1
call fcn.140001420
cmp byte [r12 - 0xe0], 2
je 0x1401188a9
mov rdx, qword [r12 - 0xf0]
test rdx, rdx
je 0x1401188a9
mov rcx, qword [r12 - 0xf8]
mov r8d, 1
call fcn.140001420
mov rax, qword [r12 - 0x60]
test rax, rax
je 0x1401186b0
lock dec qword [rax]
jne 0x1401186b0
mov rcx, qword [r12 - 0x60]
call fcn.140117ea0
jmp 0x1401186b0
mov rdi, qword [rsp + 0x148]
mov r9, qword [rsp + 0x150]
lea rax, [r9 + 1]
mov ecx, 0x158
mul rcx
add rax, 0xf
and rax, 0xfffffffffffffff0
add r9, rax
add r9, 0x11
je 0x140118911
sub rdi, rax
mov r8d, 0x10
mov rcx, rdi
mov rdx, r9
call fcn.140001420
mov rdx, qword [rsp + 0x1a0]
test rdx, rdx
je 0x140118931
mov rcx, qword [rsp + 0x198]
mov r8d, 1
call fcn.140001420
mov rcx, qword [rsp + 0x1e0]
test rcx, rcx
je 0x140118956
mov rdx, qword [rsp + 0x1e8]
test rdx, rdx
je 0x140118956
mov r8d, 1
call fcn.140001420
mov rdx, qword [rsp + 0x1b8]
test rdx, rdx
je 0x140118976
mov rcx, qword [rsp + 0x1b0]
mov r8d, 1
call fcn.140001420
mov rdx, qword [rsp + 0x1d0]
test rdx, rdx
je 0x140118996
mov rcx, qword [rsp + 0x1c8]
mov r8d, 1
call fcn.140001420
mov rdi, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x218]
test rsi, rsi
je 0x140118a2f
lea rbx, [rdi + 0x50]
jmp 0x1401189c9
add rbx, 0x70
dec rsi
je 0x140118a2f
mov rdx, qword [rbx - 0x48]
test rdx, rdx
je 0x1401189e1
mov rcx, qword [rbx - 0x50]
mov r8d, 1
call fcn.140001420
mov rcx, qword [rbx - 8]
test rcx, rcx
je 0x1401189fd
mov rdx, qword [rbx]
test rdx, rdx
je 0x1401189fd
mov r8d, 1
call fcn.140001420
mov rdx, qword [rbx - 0x30]
test rdx, rdx
je 0x140118a15
mov rcx, qword [rbx - 0x38]
mov r8d, 1
call fcn.140001420
mov rdx, qword [rbx - 0x18]
test rdx, rdx
je 0x1401189c0
mov rcx, qword [rbx - 0x20]
mov r8d, 1
call fcn.140001420
jmp 0x1401189c0
mov rax, qword [rsp + 0x210]
test rax, rax
je 0x140118a4e
imul rdx, rax, 0x70
mov r8d, 8
mov rcx, rdi
call fcn.140001420
cmp qword [rsp + 0x108], 0
mov rsi, qword [rsp + 0x48]
je 0x140118b47
lea rcx, [rsp + 0x108]
call fcn.140119130
mov rdi, qword [rsp + 0x110]
test rdi, rdi
je 0x140118b47
mov rbx, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x120]
test rsi, rsi
je 0x140118b1a
movdqa xmm0, xmmword [rbx]
pmovmskb r12d, xmm0
not r12d
lea r14, [rbx + 0x10]
mov r15, rbx
jmp 0x140118ac0
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
dec rsi
je 0x140118b1a
test r12w, r12w
jne 0x140118af1
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add r15, 0xfffffffffffffe00
add r14, 0x10
cmp r12d, 0xffff
je 0x140118ad0
not r12d
tzcnt ecx, r12d
shl rcx, 5
mov rax, r15
sub rax, rcx
mov rdx, qword [rax - 0x18]
test rdx, rdx
je 0x140118ab0
mov rcx, qword [rax - 0x20]
mov r8d, 1
call fcn.140001420
jmp 0x140118ab0
mov rax, rdi
shl rax, 5
add rdi, rax
add rdi, 0x31
mov rsi, qword [rsp + 0x48]
je 0x140118b47
sub rbx, rax
add rbx, 0xffffffffffffffe0
mov r8d, 0x10
mov rcx, rbx
mov rdx, rdi
call fcn.140001420
mov dword [rsp + 0x108], 1
call sub.KERNEL32.dll_GetCurrentProcess
lea rdx, [rsp + 0x108]
mov rcx, rax
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
cmp dword [rsp + 0x108], 1
je 0x140118bfc
mov eax, esi
add rsp, 0x228
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x140215cd8]
mov rcx, r11
call fcn.140168c60
ud2
lea r8, [0x140215cc0]
mov rcx, r10
mov rdx, rax
call fcn.140168c60
ud2
cmp r9, rax
mov rcx, rax
cmova rcx, r9
lea r8, [0x140215c90]
mov rdx, rax
call fcn.140168c60
ud2
add rbp, r9
cmp rdx, rbp
cmova rbp, rdx
lea r8, [0x140215ca8]
mov rcx, rbp
call fcn.140168c60
ud2
lea rax, [0x140215cf0]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.1401692d0
ud2
mov ecx, 0x100
call fcn.1401356d0
ud2