Function at 0x14009dfd0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
mov qword [rsp + 0x78], r8
mov r12, rcx
mov rsi, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r13, qword [rsp + 0x2a0]
mov rax, qword [0x14019d040]
xor rax, rsp
mov qword [rsp + 0x220], rax
cmp r13, rdx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r9
je 0x14009e032
lea rax, [r9 + rdx]
cmp rax, r13
jbe 0x14009e032
lea rax, [rsi + r13]
cmp rax, rdx
ja 0x14009e77e
mov r14, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x298]
mov r15, qword [rsp + 0x290]
mov rcx, qword [r12]
mov rax, qword [rcx + 0x20]
test rax, rax
jne 0x14009e682
movzx r8d, byte [r12 + 0x240]
sub rsi, r8
jb 0x14009e719
cmp r9, rsi
jb 0x14009e737
lea r10, [rsi + r13]
cmp r13, rdx
mov qword [rsp + 0x50], rsi
je 0x14009e09e
cmp r10, rdx
jbe 0x14009e09e
lea rax, [rsi + rdx]
cmp rax, r13
ja 0x14009e6c2
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x14009e6e0
lea rcx, [0x14013aff0]
cmp rax, rcx
jne 0x14009e86e
mov qword [rsp + 0x80], r10
mov qword [rsp + 0x88], r8
movaps xmm0, xmmword [0x140171db0]
movaps xmmword [rsp + 0x210], xmm0
test rdi, rdi
je 0x14009e7f4
lea rax, [r12 + 8]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x90]
mov r8d, 0x180
xor edx, edx
call fcn.1400f5e20
lea rdx, [r12 + 0x100]
lea rsi, [rsp + 0xe0]
mov r8d, 0x120
mov rcx, rsi
call fcn.1400f5780
mov rbp, qword [rsi + 0x100]
xorps xmm0, xmm0
movaps xmmword [rsi - 0x50], xmm0
movaps xmmword [rsi - 0x20], xmm0
movaps xmmword [rsi - 0x10], xmm0
cmp rdi, 0xc
jne 0x14009e5cd
mov eax, dword [r15 + 8]
mov dword [rsp + 0x98], eax
mov rax, qword [r15]
mov qword [rsp + 0x90], rax
mov byte [rsp + 0x9f], 1
mov esi, 2
lea rdx, [rsp + 0xb0]
mov rax, qword [rdx + 0x140]
lea r15, [rsp + 0x90]
mov rcx, r15
mov r8, qword [rsp + 0x58]
call qword [0x1401904a0]
bswap esi
mov dword [r15 + 0xc], esi
xor edi, edi
cmp qword [r15 + 0x38], 0
jne 0x14009e547
mov rcx, qword [rsp + 0xc0]
add rcx, r14
setb al
movabs rdx, 0x2000000000000000
cmp rcx, rdx
ja 0x14009e547
test al, al
jne 0x14009e547
mov rax, qword [rsp + 0x1e0]
mov r15, qword [rsp + 0x1e8]
mov qword [rsp + 0xc0], rcx
mov edx, dword [rsp + 0x204]
test edx, edx
jne 0x14009e4f6
mov rsi, r14
mov rbp, rsi
and rbp, 0xfffffffffffffff0
jne 0x14009e844
test rsi, rsi
je 0x14009e67b
xor eax, eax
mov cl, byte [rbx + rax]
xor byte [rsp + rax + 0xd0], cl
inc rax
cmp rsi, rax
jne 0x14009e206
mov edx, esi
mov dword [rsp + 0x204], edx
mov r15, qword [r12 + 0x220]
test r15, r15
je 0x14009e7b4
mov rax, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0x50]
add rax, rsi
setb cl
movabs r8, 0xfffffffe0
cmp rax, r8
lea r12, [rsp + 0xe0]
ja 0x14009e4ac
test cl, cl
jne 0x14009e4ac
mov rbp, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1e8]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0xc8], rax
test edx, edx
je 0x14009e2aa
lea rbx, [rsp + 0xd0]
mov rcx, rbx
mov rdx, r12
mov rax, rbp
call qword [0x1401904a0]
mov dword [rbx + 0x134], 0
mov eax, dword [rsp + 0x200]
test eax, eax
jne 0x14009e55e
mov rbx, qword [rsp + 0x60]
mov r14, rsi
test byte [rsp + 0x1f8], 1
je 0x14009e30b
test r14, r14
je 0x14009e30b
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, r13
mov rdx, rbx
mov r8, r14
mov r9, qword [rsp + 0x58]
call fcn.14000cba0
add r13, rax
add rbx, rax
sub r14, rax
mov esi, dword [rsp + 0x9c]
bswap esi
cmp r14, 0xc00
jae 0x14009e8a2
mov rbp, r14
and rbp, 0xff0
je 0x14009e398
mov r12, r14
shr r12, 4
lea rdi, [rsp + 0xd0]
mov rcx, rdi
lea rdx, [rsp + 0xe0]
mov r8, r13
mov r9, rbp
mov rax, qword [rsp + 0x70]
call qword [0x1401904a0]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, r13
mov rdx, rbx
mov r8, r12
mov r9, qword [rsp + 0x58]
mov rax, r15
call qword [0x1401904a0]
add esi, r12d
lea r12, [rsp + 0xe0]
mov eax, esi
bswap eax
mov dword [rdi - 0x34], eax
add rbx, rbp
add r13, rbp
and r14d, 0xf
test r14, r14
je 0x14009e4ef
lea rdx, [rsp + 0xa0]
mov rax, qword [rdx + 0x150]
lea rdi, [rsp + 0x90]
mov rcx, rdi
mov r8, qword [rsp + 0x58]
call qword [0x1401904a0]
inc esi
bswap esi
mov dword [rdi + 0xc], esi
xor eax, eax
mov ecx, eax
mov dl, byte [r13 + rcx]
xor byte [rsp + rcx + 0xd0], dl
xor dl, byte [rsp + rcx + 0xa0]
mov byte [rbx + rcx], dl
inc rax
cmp r14, rax
jne 0x14009e3cf
mov dword [rsp + 0x200], eax
mov rdi, qword [rsp + 0x1e0]
or eax, dword [rsp + 0x204]
mov rbx, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
je 0x14009e42b
lea rcx, [rsp + 0xd0]
mov rdx, r12
mov rax, rdi
call qword [0x1401904a0]
lea rsi, [rsp + 0xd0]
mov rax, qword [rsi - 0x10]
shl rax, 3
bswap rax
mov rcx, qword [rsi - 8]
shl rcx, 3
bswap rcx
xor qword [rsi], rax
xor qword [rsi + 8], rcx
mov rcx, rsi
mov rdx, r12
mov rax, rdi
call qword [0x1401904a0]
mov rax, qword [rsi - 0x20]
mov rcx, qword [rsi - 0x18]
xor qword [rsi], rax
xor qword [rsi + 8], rcx
test rbx, rbx
je 0x14009e487
cmp bl, 0x10
jb 0x14009e79c
movaps xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x210], xmm0
lea rcx, [rsp + 0x210]
mov rdx, r14
mov r8, rbx
call fcn.1400a4c10
mov edi, 1
test eax, eax
mov rsi, qword [rsp + 0x50]
jne 0x14009e81c
mov eax, 1
test edi, edi
je 0x14009e701
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rsi
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
cmp rcx, qword [0x14019d040]
je 0x14009e4db
call fcn.1400c6de0
int3
add rsp, 0x228
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x14009e3ef
test r14, r14
je 0x14009e21a
lea rcx, [rsp + 0xd0]
mov r8b, byte [rbx]
mov r9d, edx
xor byte [rsp + r9 + 0xd0], r8b
inc rbx
lea rsi, [r14 - 1]
inc edx
and edx, 0xf
je 0x14009e52c
cmp r14, 1
mov r14, rsi
jne 0x14009e507
test edx, edx
jne 0x14009e21a
lea rdx, [rsp + 0xe0]
call qword [0x1401904a0]
jmp 0x14009e1ee
mov rsi, qword [rsp + 0x50]
jmp 0x14009e4ac
lea r12, [rsp + 0xe0]
jmp 0x14009e3ef
test rsi, rsi
je 0x14009e551
lea rcx, [rsp + 0xd0]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov r8b, byte [r13]
inc r13
mov r9d, eax
mov r10b, byte [rsp + r9 + 0xa0]
xor r10b, r8b
mov byte [rbx], r10b
xor byte [rsp + r9 + 0xd0], r8b
inc rbx
lea r14, [rdx - 1]
inc eax
and eax, 0xf
je 0x14009e5ac
cmp rdx, 1
mov rdx, r14
jne 0x14009e575
test eax, eax
lea r12, [rsp + 0xe0]
jne 0x14009e3ef
mov rdx, r12
mov rax, rbp
call qword [0x1401904a0]
jmp 0x14009e2c1
mov rsi, rdi
cmp rdi, 0x10
jb 0x14009e619
mov rax, qword [r15]
xor qword [rsp + 0x90], rax
mov rax, qword [r15 + 8]
xor qword [rsp + 0x98], rax
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xe0]
mov rax, rbp
call qword [0x1401904a0]
add r15, 0x10
add rsi, 0xfffffffffffffff0
cmp rsi, 0xf
ja 0x14009e5d6
test rsi, rsi
je 0x14009e647
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x90], cl
inc rax
cmp rsi, rax
jne 0x14009e61b
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xe0]
mov rax, rbp
call qword [0x1401904a0]
shl rdi, 3
bswap rdi
lea r15, [rsp + 0x90]
xor qword [r15 + 8], rdi
mov rcx, r15
lea rdx, [rsp + 0xe0]
mov rax, rbp
call qword [0x1401904a0]
mov esi, dword [r15 + 0xc]
bswap esi
inc esi
jmp 0x14009e163
xor edx, edx
jmp 0x14009e21a
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
mov rcx, r12
mov r8, qword [rsp + 0x78]
call qword [0x1401904a0]
mov ecx, eax
mov eax, 1
test ecx, ecx
jne 0x14009e4c1
jmp 0x14009e758
mov dword [rsp + 0x20], 0xee
lea r9, str....._third_party_boringssl_srccrypto_fipsmodulecipher_aead.c.inc
mov ecx, 0x1e
xor edx, edx
mov r8d, 0x73
jmp 0x14009e6fc
mov dword [rsp + 0x20], 0xf3
lea r9, str....._third_party_boringssl_srccrypto_fipsmodulecipher_aead.c.inc
mov ecx, 0x1e
xor edx, edx
mov r8d, 0x68
call fcn.1401484b0
test rsi, rsi
je 0x14009e758
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov r8, qword [rsp + 0x50]
call fcn.1400f5e20
jmp 0x14009e758
mov dword [rsp + 0x20], 0xd0
lea r9, str....._third_party_boringssl_srccrypto_fipsmodulecipher_aead.c.inc
mov ecx, 0x1e
xor edx, edx
mov r8d, 0x65
jmp 0x14009e753
mov dword [rsp + 0x20], 0xd6
lea r9, str....._third_party_boringssl_srccrypto_fipsmodulecipher_aead.c.inc
mov ecx, 0x1e
xor edx, edx
mov r8d, 0x67
call fcn.1401484b0
cmp qword [rsp + 0x68], 0
je 0x14009e77a
xor esi, esi
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov r8, qword [rsp + 0x68]
call fcn.1400f5e20
xor eax, eax
jmp 0x14009e4b9
xor esi, esi
jmp 0x14009e773
mov dword [rsp + 0x20], 0xbf
lea r9, str....._third_party_boringssl_srccrypto_fipsmodulecipher_aead.c.inc
mov ecx, 0x1e
xor edx, edx
mov r8d, 0x73
jmp 0x14009e753
lea rcx, [rsp + 0x210]
mov rdx, rsi
mov r8, rbx
call fcn.1400f5780
jmp 0x14009e487
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x90]
mov rdx, qword [rsp + 0x58]
mov r8, r13
mov r9, qword [rsp + 0x60]
call fcn.140136c60
test eax, eax
lea r12, [rsp + 0xe0]
je 0x14009e4ac
mov eax, dword [rsp + 0x200]
jmp 0x14009e3f6
mov dword [rsp + 0x20], 0x408
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduleciphere_aes.c.inc
mov ecx, 0x1e
xor edx, edx
mov r8d, 0x6f
call fcn.1401484b0
xor edi, edi
jmp 0x14009e4ac
mov dword [rsp + 0x20], 0x429
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduleciphere_aes.c.inc
xor edi, edi
mov ecx, 0x1e
xor edx, edx
mov r8d, 0x65
call fcn.1401484b0
jmp 0x14009e4ac
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0xe0]
mov r8, rbx
mov r9, rbp
mov rax, r15
call qword [0x1401904a0]
add rbx, rbp
and esi, 0xf
jmp 0x14009e1fb
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
mov rcx, r12
mov r8, r15
mov r9, rdi
call qword [0x1401904a0]
mov edi, eax
jmp 0x14009e4ac
lea rbp, [rsp + 0xd0]
mov edi, 0xc00
mov r9d, 0xc00
mov rcx, rbp
mov rdx, r12
mov r8, r13
mov rax, qword [rsp + 0x70]
call qword [0x1401904a0]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r8d, 0xc0
mov rcx, r13
mov rdx, rbx
mov r9, qword [rsp + 0x58]
mov rax, r15
call qword [0x1401904a0]
add esi, 0xc0
mov eax, esi
bswap eax
mov dword [rsp + 0x9c], eax
add rbx, rdi
add r13, rdi
add r14, 0xfffffffffffff400
cmp r14, 0xbff
jbe 0x14009e321
jmp 0x14009e8af