Function at 0x14005f790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r14, rcx
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x40]
mov rbx, 0xffffffffffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
test eax, eax
je 0x14005fad2
mov r8, qword [rbp + 0x38]
add r8, 0x1000
mov rdx, qword [rbp + 0x40]
add rdx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test eax, eax
je 0x14005fad2
lea rax, [rbp - 0x40]
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x60], 0xb2b4af90
mov dword [rbp - 0x5c], 0x8aaaa7b3
mov dword [rbp - 0x58], 0xc6ada5a9
movsd xmm0, qword [rbp - 0x60]
movsd qword [rbp - 0x50], xmm0
mov eax, dword [rbp - 0x58]
mov dword [rbp - 0x48], eax
lea edi, [rbx + 0xd]
mov rdx, qword [0x14013b6f0]
test rdx, rdx
jne 0x14005f863
mov ecx, edi
call fcn.140075634
mov rdx, rax
mov qword [0x14013b6f0], rax
mov rcx, rax
lea r9, [rbp - 0x50]
sub r9, rax
mov r8d, edi
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
xor al, 0xc6
mov byte [rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x14005f850
xor r15d, r15d
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], r15b
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], r15b
jne 0x14005f880
lea rcx, [rbp - 0x40]
call fcn.1400064d0
nop
mov dword [rbp - 0x50], 0x8a96818f
mov dword [rbp - 0x4c], 0xf6f78881
mov dword [rbp - 0x48], 0xa8a8a0ea
movsd xmm0, qword [rbp - 0x50]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [rbp - 0x48]
mov dword [rbp - 0x58], eax
mov byte [rbp - 0x54], 0xc4
mov esi, 0xd
mov r9, qword [0x14013bbf0]
test r9, r9
jne 0x14005f903
mov ecx, esi
call fcn.140075634
mov r9, rax
mov qword [0x14013bbf0], rax
mov rcx, rax
lea r8, [rbp - 0x60]
sub r8, rax
mov edx, esi
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor al, 0xc4
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14005f8f0
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov r8, rbx
inc r8
cmp byte [r9 + r8], 0
jne 0x14005f916
mov rdx, r9
lea rcx, [rbp - 0x20]
call fcn.1400064d0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14006f640
mov edx, 0x1000
mov rcx, r14
call rax
test eax, eax
je 0x14005f952
mov eax, 1
jmp 0x14005fad4
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
test eax, eax
je 0x14005fad2
mov r8, qword [rbp + 0x38]
add r8, 0x2000
mov rdx, qword [rbp + 0x40]
add rdx, 0x2000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test eax, eax
je 0x14005fad2
lea rax, [rbp - 0x20]
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x60], 0xbeb8a39c
mov dword [rbp - 0x5c], 0x86a6abbf
mov dword [rbp - 0x58], 0xcaa1a9a5
movsd xmm0, qword [rbp - 0x60]
movsd qword [rbp - 0x50], xmm0
mov eax, dword [rbp - 0x58]
mov dword [rbp - 0x48], eax
mov rdx, qword [0x14013b9b0]
test rdx, rdx
jne 0x14005fa03
mov rcx, rdi
call fcn.140075634
mov rdx, rax
mov qword [0x14013b9b0], rax
mov rcx, rax
lea r8, [rbp - 0x50]
sub r8, rax
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor al, 0xca
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x14005f9f0
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x14005fa16
lea rcx, [rbp - 0x20]
call fcn.1400064d0
nop
mov dword [rbp - 0x50], 0x869a8d83
mov dword [rbp - 0x4c], 0xfafb848d
mov dword [rbp - 0x48], 0xa4a4ace6
movsd xmm0, qword [rbp - 0x50]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [rbp - 0x48]
mov dword [rbp - 0x58], eax
mov byte [rbp - 0x54], 0xc8
mov rdx, qword [0x14013b5a0]
test rdx, rdx
jne 0x14005fa93
mov rcx, rsi
call fcn.140075634
mov rdx, rax
mov qword [0x14013b5a0], rax
mov rcx, rax
lea r8, [rbp - 0x60]
sub r8, rax
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor al, 0xc8
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rsi, 1
jne 0x14005fa80
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14005faa3
mov r8, rbx
lea rcx, [rbp - 0x40]
call fcn.1400064d0
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.14006f640
mov edx, 0x1000
mov rcx, r14
call rax
jmp 0x14005fad4
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret