Function at 0x1401e5640
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov rdi, rdx
mov eax, dword [0x1415cec90]
sub eax, dword [0x1415cec94]
mov r12, rcx
mov ecx, eax
and ecx, 0x362569e4
and eax, 0x20520a4
add eax, eax
sub ecx, eax
add ecx, 0x90479da2
cmp ecx, 0xe478754c
jbe 0x1401e56a0
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
nop word cs:[rax + rax]
mov eax, dword [0x1415cec98]
xor eax, dword [0x1415cec9c]
imul ecx, eax, 0x3c1ced32
mov eax, ecx
not eax
mov edx, ecx
and edx, 0xb4ea1b3a
and eax, 0x4b15e4c4
imul eax, edx
mov edx, ecx
and edx, 0x4b15e4c4
or ecx, 0x4b15e4c4
imul ecx, edx
add ecx, eax
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov r15, rsp
cmp ecx, 0xc79a5e02
ja 0x1401e56a0
mov eax, dword [0x1415ceca0]
sub eax, dword [0x1415ceca4]
mov ecx, eax
xor ecx, 0x81804012
xor eax, 0x3657bfed
or ecx, 0x7e7fb081
and ecx, eax
add ecx, 0x6a8364da
cmp ecx, 0xb6eb83b6
jb 0x1401e5747
sub rsp, 0x30
mov qword [rsp + 0x20], r15
xor esi, esi
mov rcx, rdi
mov edx, 0x3c
xor r8d, r8d
xor r9d, r9d
call fcn.14021c940
add rsp, 0x30
test sil, sil
je 0x1401e5769
sub rsp, 0x30
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov edx, 0x3c
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
jmp 0x1401e5720
mov r14d, eax
test eax, eax
js 0x1401e57e6
mov ecx, dword [0x1415cecf8]
mov edx, dword [0x1415cecfc]
mov eax, ecx
not eax
mov r8d, edx
not r8d
mov r9d, eax
and r9d, 0x54219320
and ecx, 0x8210004d
or ecx, r9d
or eax, r8d
and r8d, 0x54219320
and edx, 0x8210004d
or edx, r8d
xor edx, ecx
not eax
or eax, edx
mov ecx, eax
or ecx, 0x8424000
not eax
and eax, 0xc2308020
and ecx, 0x1c43534d
or ecx, eax
xor ecx, 0xd86540d7
add ecx, 0xfe0b270f
cmp ecx, 0x4037de8e
jbe 0x1401e5be2
jmp 0x1401e5c07
mov eax, dword [0x1415ceca8]
mov ecx, dword [0x1415cecac]
mov edx, ecx
and edx, eax
add eax, ecx
sub eax, edx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xa1d00855
and ecx, 0x5e2ff7aa
imul ecx, edx
mov edx, eax
and edx, 0x5e2ff7aa
or eax, 0x5e2ff7aa
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0x21fe845a
add ecx, ecx
sub eax, ecx
add eax, 0xa1fe845b
mov ecx, 0x8da7235d
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x5c950b15
nop word cs:[rax + rax]
mov eax, dword [0x1415cecb0]
mov ecx, dword [0x1415cecb4]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
and eax, 0x4bcf8bb0
add eax, 0xa4761c75
mov ecx, 0x90be1af3
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xbba9490e
ja 0x1401e5850
mov qword [rbp - 0x10], r12
mov eax, dword [0x1415cecb8]
mov ecx, dword [0x1415cecbc]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
add eax, 0x2af7ada8
mov ecx, eax
not ecx
or eax, 0xc67b1310
or ecx, 0x3984ecef
and ecx, eax
not ecx
imul eax, ecx, 0xc3c63d6b
cmp eax, 0xfd6154da
jbe 0x1401e5909
mov qword [rbp - 8], 0
sub rsp, 0x20
lea rdx, [rbp - 8]
xor ecx, ecx
call fcn.1402197f0
add rsp, 0x20
or r14d, 0x10000000
mov r12d, 0xc2a9cc13
lea rbx, [rbp - 8]
mov r13, qword [sym.imp.oleaut32.dll_GetErrorInfo]
nop word cs:[rax + rax]
mov esi, dword [0x1415cecc0]
mov eax, dword [str.CFth]
mov ecx, esi
not ecx
and esi, eax
not eax
or eax, ecx
not esi
and esi, eax
not esi
add esi, 0x2a9c2032
and esi, 0xaf1ae42d
imul rsi, r12
shr rsi, 0x3b
mov qword [rbp - 8], 0
sub rsp, 0x20
xor ecx, ecx
mov rdx, rbx
call r13
add rsp, 0x20
cmp esi, 0x40fe3ab0
je 0x1401e5930
mov rbx, qword [rbp - 8]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1401e5990
cmp r14d, 0xd0000004
mov r12, qword [rbp - 0x10]
jge 0x1401e59af
cmp r14d, 0x90000005
je 0x1401e59d0
jmp 0x1401e5a50
cmp r14d, 0xd0000023
jge 0x1401e59c7
cmp r14d, 0xd0000004
jne 0x1401e5a50
jmp 0x1401e59d0
jne 0x1401e5a50
nop dword [rax]
mov eax, dword [0x1415cece0]
mov ecx, dword [0x1415cece4]
mov edx, eax
and edx, ecx
add edx, edx
add eax, ecx
sub eax, edx
add eax, 0x54025687
cmp eax, 0x4fc7e94
jb 0x1401e59d0
test rbx, rbx
je 0x1401e5770
mov r14, qword [rbx]
mov eax, dword [0x1415cece8]
xor edx, edx
div dword [0x1415cecec]
add eax, 0xc3b5dd99
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x614f80f8
and ecx, 0x1eb07f07
imul ecx, edx
mov edx, eax
and edx, 0x1eb07f07
or eax, 0x1eb07f07
imul eax, edx
add eax, ecx
or eax, 0xba3ce576
cmp eax, 0x86e50e70
jne 0x1401e5b7a
jmp 0x1401e5bd1
mov ecx, dword [0x1415cecc8]
mov eax, dword [0x1415ceccc]
mov edx, ecx
not edx
or ecx, eax
not eax
and eax, edx
not eax
and eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xe51f46a5
and ecx, 0x1ae0b95a
imul ecx, edx
mov edx, eax
and edx, 0x1ae0b95a
or eax, 0x1ae0b95a
imul eax, edx
add eax, ecx
add eax, 0x57f791ea
cmp eax, 0x5420912a
ja 0x1401e5a50
nop dword [rax]
mov eax, dword [0x1415cecd0]
mov ecx, dword [0x1415cecd4]
add eax, ecx
add eax, 0x4934f42f
mov ecx, eax
xor ecx, 0xea0981f1
xor eax, 0x4245208
and eax, 0xe62d5368
mov edx, ecx
and edx, 0x19d2ac97
or edx, eax
xor edx, 0x34973723
and ecx, 0xd2ba644b
or ecx, edx
cmp ecx, 0x243945d1
je 0x1401e5aa0
test rbx, rbx
je 0x1401e5b24
nop word [rax + rax]
mov eax, dword [0x1415cecd8]
sub eax, dword [0x1415cecdc]
add eax, 0x32fca99b
imul rax, rax, 0x6439a0a9
shr rax, 0x3e
cmp eax, 0x270ec1cb
ja 0x1401e5af0
mov rax, qword [rbx]
sub rsp, 0x20
mov rcx, rbx
call qword [rax + 0x10]
add rsp, 0x20
mov qword [r12], 0
mov qword [r12 + 8], 8
mov qword [r12 + 0x10], 0
nop
mov eax, dword [0x1415ced58]
add eax, dword [0x1415ced5c]
xor eax, 0xfd3eb5bd
lea ecx, [rax + 0x60c3110a]
mov edx, ecx
and edx, 0x7573550
xor ecx, 0xf8a8caaf
add eax, ecx
add eax, 0x60c3110a
sub eax, edx
cmp eax, 0xa7092f6c
jb 0x1401e5b40
jmp 0x1401e5f70
mov eax, dword [0x1415cecf0]
mov ecx, dword [0x1415cecf4]
mov edx, eax
xor edx, ecx
not edx
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0x3f0beb9e
or ecx, 0x3f0beb9e
add ecx, eax
imul rsi, rcx, 0x70db9359
shr rsi, 0x3e
xor esi, 0xf02c34a7
neg esi
sub rsp, 0x20
mov rcx, rbx
call qword [r14 + 0x10]
add rsp, 0x20
cmp esi, 0xddd82d12
jbe 0x1401e5770
sub rsp, 0x20
mov rcx, rbx
call qword [r14 + 0x10]
add rsp, 0x20
jmp 0x1401e5b7a
mov eax, dword [0x1415ced00]
add eax, dword [0x1415ced04]
imul eax, eax, 0xcd5b5780
add eax, 0x75fcf69e
mov r14d, dword [r15]
mov dword [rbp + 4], r14d
cmp eax, 0x438c84c4
jae 0x1401e5c0f
mov eax, dword [r15]
mov dword [rbp + 4], eax
jmp 0x1401e5be2
mov r15d, r14d
shr r15d, 1
lea rdx, [r15*2 + 2]
movzx eax, byte [0x1415d3950]
sub rsp, 0x20
xor ecx, ecx
call fcn.1401b5e70
add rsp, 0x20
test rax, rax
je 0x1401e5d72
mov rbx, rax
sub rsp, 0x30
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov edx, 0x3c
mov r8, rbx
mov r9d, r14d
call fcn.14021c940
add rsp, 0x30
nop word cs:[rax + rax]
mov ecx, dword [0x1415ced08]
add ecx, dword [0x1415ced0c]
mov edx, ecx
and edx, 0x25a5a9dd
add edx, edx
sub ecx, edx
add ecx, 0xa5a5a9dd
mov edx, ecx
not edx
mov r8d, ecx
and r8d, 0x523dc7e1
and edx, 0xadc2381e
imul edx, r8d
mov r8d, ecx
and r8d, 0xadc2381e
or ecx, 0xadc2381e
imul ecx, r8d
add ecx, edx
or ecx, 0x1f91322
cmp ecx, 0xb9574027
je 0x1401e5c70
test eax, eax
js 0x1401e5d46
nop
mov eax, dword [0x1415ced30]
xor edx, edx
div dword [0x1415ced34]
add eax, 0xd483a229
mov ecx, eax
not ecx
or eax, 0xc26cbf38
or ecx, 0x3d9340c7
and ecx, eax
cmp ecx, 0x2caa847a
je 0x1401e5cd0
mov eax, dword [0x1415ced38]
mov ecx, dword [0x1415ced3c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
add eax, 0x2d3269c5
or eax, 0x88efc838
add eax, 0xa52d0a86
cmp eax, 0xbc9d8a51
jbe 0x1401e5e41
jmp 0x1401e5ebb
mov eax, dword [0x1415ced18]
xor edx, edx
div dword [0x1415ced1c]
imul rax, rax, 0x45bb5b2b
shr rax, 0x3c
xor eax, 0x98e97a5c
add eax, 0x1f5ff22b
cmp eax, 0x81eb563b
jae 0x1401e5dac
jmp 0x1401e5deb
ud2
mov eax, dword [0x1415ced20]
or eax, dword [0x1415ced24]
xor eax, 0x216e309d
imul esi, eax, 0x18615d36
and esi, 0xe87860b6
mov rcx, qword [0x1415d3918]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp esi, 0x909b4c44
jne 0x1401e5e06
mov rcx, qword [0x1415d3918]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call fcn.140219910
add rsp, 0x20
jmp 0x1401e5dac
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1401e5e10
mov eax, 0xbfbf68a3
nop dword [rax]
mov ecx, dword [0x1415ced28]
add ecx, dword [0x1415ced2c]
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x3fb1e2e5
je 0x1401e5e20
jmp 0x1401e5b24
mov eax, dword [0x1415ced40]
mov ecx, dword [0x1415ced44]
mov edi, eax
not edi
mov edx, ecx
not edx
mov r8d, edi
and r8d, 0x37a45518
and eax, 0xc85baae7
or eax, r8d
or edi, edx
and edx, 0x37a45518
and ecx, 0xc85baae7
or ecx, edx
xor ecx, eax
not edi
or edi, ecx
xor edi, 0xd1e4c6bc
mov eax, edi
and eax, 0xda12617a
or edi, 0xda12617a
add edi, eax
and edi, 0xc58960af
mov word [rbx + r15*2], 0
mov rdx, qword [rbx + 8]
sub rsp, 0x20
mov rcx, r12
call fcn.1401e4750
add rsp, 0x20
cmp edi, 0xaa23b0f8
jbe 0x1401e5edb
mov word [rbx + r15*2], 0
mov rdx, qword [rbx + 8]
sub rsp, 0x20
mov rcx, r12
call fcn.14021c810
add rsp, 0x20
jmp 0x1401e5e41
mov eax, dword [0x1415ced48]
xor edx, edx
div dword [0x1415ced4c]
add eax, 0x41d64ae5
or eax, 0x91690dcc
mov ecx, eax
xor ecx, 0xb7f81e56
and ecx, eax
cmp ecx, 0x3e9deaa6
jae 0x1401e5f1e
mov rcx, qword [0x1415d3918]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call fcn.140219910
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov edi, dword [0x1415ced50]
mov eax, dword [0x1415ced54]
mov ecx, eax
and ecx, edi
add edi, eax
sub edi, ecx
add edi, 0xeaed46c2
not edi
or edi, 0x131d1a4
mov rcx, qword [0x1415d3918]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call rsi
add rsp, 0x20
cmp edi, 0xc9c8f6e0
je 0x1401e5f30
mov eax, 0x9d3d0b4d
nop word cs:[rax + rax]
mov ecx, dword [0x1415ced60]
or ecx, dword [0x1415ced64]
add ecx, 0x20effffa
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x2036a092
ja 0x1401e5f80
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret