Function at 0x14011b440
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [rcx]
test rax, rax
je 0x14011c0da
mov rsi, rcx
cmp eax, 1
jne 0x14011bd92
mov eax, 0xb4616cb5
lea rcx, [rsi + 8]
mov qword [rsp + 0x30], rcx
nop word cs:[rax + rax]
mov ecx, dword [0x140227a28]
imul ecx, dword [0x140227a2c]
add ecx, 0x2b676a86
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x8fbaed65
ja 0x14011b480
mov rbp, qword [rsi + 8]
test rbp, rbp
je 0x14011b9f0
lea r8, [rsi + 0x10]
mov rax, qword [rsi + 0x18]
nop dword [rax + rax]
mov ecx, dword [0x140227a30]
add ecx, dword [0x140227a34]
imul rcx, rcx, 0x98bf479
shr rcx, 0x38
mov edx, ecx
not edx
or edx, 0xeec400b1
add ecx, edx
add ecx, 0x796aa1b0
cmp ecx, 0xf8896967
ja 0x14011b4c0
mov qword [rsp + 0x28], r8
nop word cs:[rax + rax]
mov ecx, dword [str.Mv7cQ]
mov edx, dword [0x140227a3c]
add ecx, edx
add ecx, 0xac427e14
mov edx, ecx
and edx, 0x386f87f3
and ecx, 0x106f06d1
xor edx, 0x506f7edd
lea ecx, [rdx + rcx*2]
cmp ecx, 0x8da1a69c
jbe 0x14011b560
mov rcx, qword [rbp + 0x18]
lea rdx, [rcx + 0x20]
test rcx, rcx
cmove rdx, r8
mov qword [rsi + 8], rcx
mov qword [rdx], 0
lea rcx, [rax - 1]
mov qword [rsi + 0x18], rcx
nop word cs:[rax + rax]
mov ecx, dword [0x140227a40]
imul ecx, dword [0x140227a44]
xor ecx, 0x5cd47b72
mov edx, ecx
and edx, 0x3cacf23e
add edx, edx
neg edx
add ecx, edx
add ecx, 0x3f5b7d74
mov rdi, qword [rbp + 0x18]
lea rdx, [rdi + 0x20]
test rdi, rdi
cmove rdx, r8
lea r14, [rax - 1]
mov qword [rsi + 8], rdi
mov qword [rdx], 0
mov qword [rsi + 0x18], r14
cmp ecx, 0x6c75f0d6
jb 0x14011b560
mov rbx, qword [rbp + 8]
mov r15, qword [rbp + 0x10]
test r15, r15
je 0x14011b6a8
xor r13d, r13d
nop word cs:[rax + rax]
mov eax, dword [0x140227a48]
mov ecx, dword [0x140227a4c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
xor eax, 0x183f097e
shr eax, 1
mov ecx, 0x8b31e18d
imul rax, rcx
shr rax, 0x3e
cmp eax, 0x961fb86b
jne 0x14011b630
imul rcx, r13, 0x158
add rcx, rbx
call fcn.140150d70
nop word cs:[rax + rax]
mov eax, dword [0x140227a50]
mov ecx, dword [0x140227a54]
mov edx, eax
xor edx, ecx
not edx
and edx, ecx
add edx, edx
sub ecx, edx
add eax, ecx
add eax, 0x9040f072
not eax
or eax, 0x57708e9e
mov r12d, eax
not r12d
mov ecx, r12d
and ecx, 0x28876120
and eax, 0x97789651
imul eax, ecx
mov ecx, r12d
and ecx, 0x80081041
or r12d, 0x97789651
imul r12d, ecx
add r12d, eax
imul rcx, r13, 0x158
add rcx, rbx
call fcn.140114c90
cmp r12d, 0xc87b6b7d
ja 0x14011b630
inc r13
cmp r13, r15
jne 0x14011b5d0
mov eax, dword [0x140227a58]
mov ecx, dword [0x140227a5c]
mov edx, eax
and edx, ecx
not eax
not ecx
or ecx, eax
not ecx
or ecx, edx
mov eax, ecx
xor eax, 0x9f75cf05
add eax, ecx
and ecx, 0x608a30fa
sub eax, ecx
mov ecx, eax
not ecx
and ecx, 0xd8909f9a
mov edx, eax
and edx, 0x276f6065
imul edx, ecx
mov ecx, eax
and ecx, 0xd8909f9a
or eax, 0xd8909f9a
imul eax, ecx
add eax, edx
cmp eax, 0xff3c2b0c
je 0x14011b6a8
mov rax, qword [rbp]
xor ecx, ecx
mov r12d, 0x8ef80a05
test cl, cl
jne 0x14011b70d
nop word cs:[rax + rax]
test cl, cl
jne 0x14011b720
test rax, rax
je 0x14011b895
mov eax, dword [0x140227a60]
mov ecx, dword [0x140227a64]
mov edx, eax
not edx
and edx, ecx
not ecx
and ecx, eax
sub ecx, edx
xor ecx, 0x64c9ab66
add ecx, 0x89cf1e1c
cmp ecx, 0xf6676d31
ja 0x14011b7f0
nop dword [rax]
mov eax, dword [0x140227a68]
xor edx, edx
div dword [0x140227a6c]
or eax, 0x5545b97f
and eax, 0xfd65f97f
mov r13, qword [0x14022cb48]
cmp eax, 0xd7652d34
ja 0x14011b7f0
mov eax, dword [0x140227a70]
mov ecx, dword [0x140227a74]
mov edx, eax
not edx
and edx, ecx
not edx
not ecx
and ecx, eax
not ecx
and ecx, edx
not ecx
and ecx, 0x61d352b3
mov eax, ecx
xor eax, 0x71c46e65
xor ecx, 0x8a0b911a
and ecx, 0xcb8bd33b
mov edx, eax
and edx, 0x205000c4
imul edx, ecx
mov ecx, eax
and ecx, 0x51877e33
or eax, 0xdb8fff3b
imul eax, ecx
add eax, edx
cmp eax, 0x6e9f7e8d
jae 0x14011b800
jmp 0x14011b9d0
mov rax, qword [0x14022cb48]
jmp 0x14011b760
mov eax, dword [0x140227a78]
mov ecx, dword [0x140227a7c]
mov r15d, eax
not r15d
mov edx, ecx
not edx
mov r8d, r15d
and r8d, 0x11100008
and eax, 0x6283f610
or eax, r8d
or r15d, edx
and edx, 0x11100008
and ecx, 0x6283f610
or ecx, edx
xor ecx, eax
not r15d
or r15d, ecx
and r15d, 0x7393f618
add r15d, 0xa80a8ffc
mov eax, r15d
not eax
and eax, 0x20934e5a
mov ecx, r15d
and ecx, 0xdb0cb1a0
imul ecx, eax
mov eax, r15d
and eax, 0x20934e5c
or r15d, 0x20934e5e
imul r15d, eax
add r15d, ecx
mov rcx, r13
xor edx, edx
mov r8, rbx
call fcn.14014eed0
cmp r15d, 0xd61aea43
je 0x14011b9d0
mov eax, dword [0x140227a80]
or eax, dword [0x140227a84]
add eax, 0xa5ba2364
mov ecx, 0x9985bc49
imul rax, rcx
shr rax, 0x3e
or eax, 0x2467a614
cmp eax, 0xa3326613
jbe 0x14011b8d0
mov rax, qword [0x14022cb48]
nop word cs:[rax + rax]
mov eax, dword [0x140227a88]
and eax, dword [str.1_f1]
xor eax, 0x687c25c1
add eax, 0xbea42865
imul rax, r12
shr rax, 0x3e
mov rbx, qword [0x14022cb48]
cmp eax, 0xdccf084b
ja 0x14011b8d0
mov eax, dword [0x140227a94]
add eax, dword [0x140227a90]
xor eax, 0x80824142
or eax, 0x5829aebd
cmp eax, 0x30d9414b
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
jne 0x14011b930
mov rcx, rbx
xor edx, edx
mov r8, rbp
call r12
nop dword [rax + rax]
mov eax, dword [0x140227a98]
imul eax, dword [0x140227a9c]
imul r15d, eax, 0x44a69521
xor r15d, 0x5400c90
or r15d, 0xfa0df16f
mov rcx, rbx
xor edx, edx
mov r8, rbp
call r12
cmp r15d, 0x30996e95
je 0x14011b930
mov r9d, 0xb6cbb189
nop dword [rax]
mov eax, dword [0x140227aa0]
mov ecx, dword [0x140227aa4]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
imul rax, r9
shr rax, 0x3f
imul eax, eax, 0x944e510e
cmp eax, 0x498e26e1
je 0x14011b970
mov rbp, rdi
mov rax, r14
test rdi, rdi
mov r8, qword [rsp + 0x28]
jne 0x14011b500
jmp 0x14011b9f0
mov rcx, r13
xor edx, edx
mov r8, rbx
call fcn.14014eed0
jmp 0x14011b800
mov eax, dword [0x140227aa8]
mov ecx, dword [0x140227aac]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
mov ecx, eax
or ecx, 0x40c81aab
not eax
and ecx, 0x4ac81aab
and eax, 0x80000450
or eax, ecx
cmp eax, 0xa95172b4
jb 0x14011b9f0
nop word cs:[rax + rax]
mov eax, dword [0x140227ab0]
xor eax, dword [0x140227ab4]
imul eax, eax, 0x3e260553
add eax, 0xcff992a
mov ecx, eax
not ecx
and ecx, 0x8ec671f8
mov edx, eax
and edx, 0x71398e07
imul edx, ecx
mov ecx, eax
and ecx, 0x8ec671f8
or eax, 0x8ec671f8
imul eax, ecx
add eax, edx
cmp eax, 0xffc5fa5e
ja 0x14011ba30
nop word cs:[rax + rax]
mov eax, dword [0x140227ab8]
sub eax, dword [0x140227abc]
or eax, 0x4362ca13
xor eax, 0xc2d3e5ea
imul rax, rax, 0x3fa7880f
shr rax, 0x3c
cmp eax, 0x32daa020
ja 0x14011ba80
mov rdi, qword [rsi + 0x20]
test rdi, rdi
je 0x14011c0da
mov rcx, qword [rsi + 0x30]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rdi + 0x18]
mov qword [rsi + 0x20], rbp
test rbp, rbp
mov rax, rbp
cmove rax, qword [rsp + 0x30]
mov qword [rax + 0x20], 0
dec rcx
mov qword [rsp + 0x28], rcx
mov qword [rsi + 0x30], rcx
mov rbx, qword [rdi + 8]
mov r13, qword [rdi + 0x10]
test r13, r13
je 0x14011bb17
mov r14, rbx
xor r12d, r12d
nop dword [rax + rax]
inc r12
mov rcx, r14
call fcn.140114c90
add r14, 0x158
dec r13
jne 0x14011bb00
mov rax, qword [rdi]
mov ecx, dword [0x140227ac0]
xor ecx, dword [0x140227ac4]
mov edx, ecx
not edx
or edx, 0x20424048
and edx, 0x3bf779dc
and ecx, 0x80000402
add ecx, edx
add ecx, 0x77ba8e06
cmp ecx, 0x3051a329
ja 0x14011bb1a
test rax, rax
je 0x14011bc98
mov eax, dword [0x140227ac8]
mov ecx, dword [0x140227acc]
mov edx, eax
and edx, ecx
or eax, ecx
add eax, edx
add eax, 0xff6b7b1
mov ecx, eax
and ecx, 0x47688a99
add ecx, ecx
sub eax, ecx
add eax, 0x2ff9d14a
cmp eax, 0x76084814
ja 0x14011bc40
nop word [rax + rax]
mov eax, dword [0x140227ad0]
mov ecx, dword [0x140227ad4]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
mov ecx, eax
xor ecx, 0x62102a84
xor eax, 0xd2f857b
mov edx, eax
and edx, 0x91cf5073
and ecx, 0x6e30af8c
imul ecx, edx
mov edx, eax
and edx, 0x6e30af8c
or eax, 0x6e30af8c
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0xe113d9cc
or eax, 0xe113d9cd
add eax, ecx
mov r14, qword [0x14022cb48]
cmp eax, 0x95306a5
jb 0x14011bc40
mov eax, dword [0x140227ad8]
mov ecx, dword [0x140227adc]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
or eax, 0x658c79a8
add eax, 0xe09fad1c
mov ecx, 0xf15455e5
imul rax, rcx
shr rax, 0x3e
cmp eax, 0xde9ecff5
jne 0x14011bc50
jmp 0x14011bd80
mov rax, qword [0x14022cb48]
jmp 0x14011bb90
mov eax, dword [0x140227ae4]
mov ecx, eax
xor ecx, eax
not ecx
and ecx, dword [0x140227ae0]
xor ecx, eax
imul eax, ecx, 0x707c897b
or eax, 0x1fd6eb8a
mov ecx, eax
and ecx, 0xb6056f0
xor eax, 0x8b6056f0
lea r12d, [rax + rcx*2]
mov rcx, r14
xor edx, edx
mov r8, rbx
call r15
cmp r12d, 0x6287a780
je 0x14011bd80
mov rbx, qword [0x14022cb48]
mov eax, dword [0x140227ae8]
mov ecx, dword [0x140227aec]
mov edx, eax
and edx, ecx
not eax
not ecx
or ecx, eax
not ecx
or ecx, edx
imul eax, ecx, 0xb50d82cc
mov ecx, eax
not ecx
or ecx, 0xc0844430
and ecx, 0xe8af673c
and eax, 0x4401000
sub eax, ecx
cmp eax, 0x6b709d57
jbe 0x14011bcf0
mov rcx, rbx
xor edx, edx
mov r8, rdi
call r15
nop dword [rax + rax]
mov eax, dword [0x140227af0]
mov ecx, dword [0x140227af4]
mov edx, eax
xor edx, ecx
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
imul r14d, ecx, 0x4aacb503
xor r14d, 0x54a32099
add r14d, 0xb6425f49
mov rcx, rbx
xor edx, edx
mov r8, rdi
call fcn.14014eed0
cmp r14d, 0xb3021399
ja 0x14011bcf0
nop word cs:[rax + rax]
mov eax, dword [0x140227af8]
or eax, dword [0x140227afc]
and eax, 0xdeed698d
imul eax, eax, 0xc3607101
add eax, 0xc475ac03
cmp eax, 0x60fb9f7d
jb 0x14011bd40
mov rdi, rbp
test rbp, rbp
mov rcx, qword [rsp + 0x28]
jne 0x14011bac0
jmp 0x14011c0da
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.14014eed0
jmp 0x14011bc50
mov rdi, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
mov rbx, qword [rsi]
nop dword [rax]
mov eax, dword [0x1402279d8]
sub eax, dword [0x1402279dc]
shr eax, 3
imul rax, rax, 0x249a77bf
shr rax, 0x3a
add eax, 0x8c2ae399
mov ecx, eax
not ecx
and ecx, 0x851805
mov edx, eax
and edx, 0x84288012
imul edx, ecx
mov ecx, eax
and ecx, 0x8026389
or eax, 0x8877b8d
imul eax, ecx
add eax, edx
cmp eax, 0xf505ccb7
ja 0x14011bda0
test rbx, rbx
je 0x14011bea4
mov eax, dword [0x1402279e0]
add eax, dword [0x1402279e4]
mov ecx, eax
and ecx, 0xbe5e20f7
and eax, 0x20402090
add eax, eax
sub ecx, eax
add ecx, 0xe1e1ee90
xor ecx, 0xa776e9d3
cmp ecx, 0x2864283e
jae 0x14011be30
mov rcx, rdi
call rbx
nop dword [rax]
mov ebp, dword [0x1402279e8]
sub ebp, dword [0x1402279ec]
and ebp, 0x2a799d
mov rcx, rdi
call rbx
cmp ebp, 0xa475b169
je 0x14011be30
nop
mov eax, dword [0x1402279f0]
xor edx, edx
div dword [0x1402279f4]
mov ecx, eax
and ecx, 0x30290305
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x30290305
mov ecx, eax
not ecx
and ecx, 0x1f7a78d2
mov edx, eax
and edx, 0xe085872d
imul edx, ecx
mov ecx, eax
and ecx, 0x1f7a78d2
or eax, 0x1f7a78d2
imul eax, ecx
add eax, edx
or eax, 0x7c28e428
cmp eax, 0xfef2623a
ja 0x14011be50
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x14011beb0
mov r8, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov eax, dword [0x1402279f8]
xor edx, edx
div dword [0x1402279fc]
nop word [rax + rax]
mov eax, dword [0x140227a00]
mov edx, dword [0x140227a04]
mov r9d, eax
not r9d
and r9d, edx
not edx
and edx, eax
sub edx, r9d
add edx, 0xa4a7470b
mov eax, edx
or eax, 0x5a4d399e
not edx
and edx, 0x21924001
mov r9d, eax
and r9d, 0x94688778
or r9d, edx
xor r9d, 0x8c8000a3
and eax, 0xe7177824
or eax, r9d
cmp eax, 0xc171ecc2
jb 0x14011bed0
test r8, r8
je 0x14011c0da
nop dword [rax]
mov eax, dword [0x140227a08]
mov edx, dword [0x140227a0c]
mov r8d, eax
and r8d, edx
add r8d, r8d
add eax, edx
sub eax, r8d
mov edx, eax
and edx, 0x37d77fa9
add edx, edx
neg edx
add eax, edx
add eax, 0x37d77fa9
mov edx, eax
xor edx, 0x14200c1a
xor eax, 0x6adff1c5
or edx, 0xe31e9264
and edx, eax
cmp edx, 0xe0c57773
ja 0x14011bf30
nop word [rax + rax]
mov eax, dword [0x140227a10]
xor edx, edx
div dword [0x140227a14]
add eax, 0x3a534b9c
mov edx, eax
not edx
mov r8d, eax
and r8d, 0xcc35d053
and edx, 0x33ca2fac
imul edx, r8d
mov r8d, eax
and r8d, 0x33ca2fac
or eax, 0x33ca2fac
imul eax, r8d
add eax, edx
mov edx, eax
not edx
or edx, 0x2e81a14b
add eax, edx
inc eax
cmp eax, 0xa8bd28ee
ja 0x14011bf80
cmp rcx, 0x11
jb 0x14011c0b9
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x14011bff0
nop word cs:[rax + rax]
mov eax, dword [0x140227a18]
mov ecx, dword [0x140227a1c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
xor eax, 0x922b3813
imul rcx, rax, 0x1c8de935
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0x61c55c87
cmp eax, 0x9faf796e
ja 0x14011c000
mov rdi, qword [rdi - 8]
mov eax, 0x94cbf1ad
nop word [rax + rax]
mov ecx, dword [0x140227a20]
mov edx, dword [0x140227a24]
mov r8d, ecx
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, ecx
imul r9d, r8d
mov r8d, ecx
and r8d, edx
or ecx, edx
imul ecx, r8d
add ecx, r9d
mov edx, ecx
and edx, 0x1dec6791
add edx, edx
sub ecx, edx
add ecx, 0xddec6791
or ecx, 0xa98cc33f
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0xb19d11e0
ja 0x14011c060
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rdi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14014eed0
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret