Function at 0x1804a27b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x128
lea rbp, [rsp + 0x80]
mov r13, rdx
mov rsi, rcx
mov eax, 0x20
call fcn.180698e80
sub rsp, rax
mov r15, rsp
mov eax, 0x30
call fcn.180698e80
sub rsp, rax
mov r12, rsp
mov eax, 0x20
call fcn.180698e80
sub rsp, rax
mov rdi, rsp
mov eax, 0x20
call fcn.180698e80
sub rsp, rax
mov qword [rbp + 0x28], rsp
mov eax, 0x20
call fcn.180698e80
sub rsp, rax
mov qword [rbp + 0x30], rsp
mov eax, 0x30
call fcn.180698e80
sub rsp, rax
mov qword [rbp + 0x78], rsp
mov eax, 0x20
call fcn.180698e80
sub rsp, rax
mov r14, rsp
sub rsp, 0x20
mov rcx, r14
mov rdx, r13
call fcn.18065ea20
add rsp, 0x20
mov cl, byte [r14]
cmp cl, 0x12
jne 0x1804a3926
mov qword [rbp + 0x48], rdi
mov eax, dword [0x1807aa420]
imul eax, dword [0x1807aa424]
xor eax, 0x64699251
add eax, 0xfe308e31
imul eax, eax, 0xc8f903eb
cmp eax, 0xafb36582
jae 0x1804a39dc
jmp 0x1804a2891
mov ecx, dword [0x1807aa428]
or ecx, dword [0x1807aa42c]
sub ecx, 0xdcf49c2c
and ecx, 0xb333c778
xor ecx, 0x655f1224
mov rdi, qword [r14 + 8]
mov rax, r14
add rax, 0x10
cmp ecx, 0x733d8319
jbe 0x1804a2891
mov qword [rbp + 0x68], r15
jmp 0x1804a28c8
mov rcx, qword [rax]
mov rax, qword [r14 + 0x18]
mov qword [rbp + 0x18], rax
imul rax, rax, 0x18
mov qword [rbp + 0x40], rcx
add rcx, rax
mov qword [rbp - 0x38], rcx
sub rsp, 0x20
call fcn.18066a300
add rsp, 0x20
mov r15, rax
cmp qword [r15], 0
sete cl
mov eax, dword [0x1807aa430]
add eax, dword [0x1807aa434]
mov r8d, 0x4d4716b0
xor edx, edx
div r8d
xor eax, 0x61e6268c
or eax, 0x6385d7d7
cmp eax, 0x3b252bc5
je 0x1804a39ed
jmp 0x1804a2927
mov eax, dword [0x1807aa438]
xor eax, dword [0x1807aa43c]
add eax, 0x9146ac02
xor eax, 0x56d411e7
mov r8d, 0xe424d3bd
xor edx, edx
div r8d
cmp eax, 0x9ca7213f
je 0x1804a2927
test cl, 1
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x20], r13
jne 0x1804a297d
jmp 0x1804a2969
mov r13, r15
add r13, 8
mov r12, qword [r15 + 8]
mov rdi, qword [r15 + 0x10]
jmp 0x1804a2a85
mov eax, dword [0x1807aa440]
xor edx, edx
div dword [0x1807aa444]
or eax, 0xb64677fc
mov ecx, 0x63d17f66
xor edx, edx
div ecx
or eax, 0x4f15d7d0
cmp eax, 0x9d055ca4
je 0x1804a39fa
mov eax, dword [0x1807aa448]
xor edx, edx
div dword [0x1807aa44c]
imul eax, eax, 0x28fb34a6
mov ecx, 0x8c777a8
xor edx, edx
div ecx
mov ecx, 0xbe7a3066
xor edx, edx
div ecx
mov r14d, eax
mov rcx, rbp
sub rsp, 0x20
xor edx, edx
mov r8d, 0x10
call fcn.1806a7aa0
add rsp, 0x20
mov rcx, rbp
sub rsp, 0x20
mov edx, 0x10
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
add rsp, 0x20
mov r12, qword [rbp]
mov rdi, qword [rbp + 8]
mov r13, r15
add r13, 8
mov qword [r15], 1
cmp r14d, 0x35f5054
jae 0x1804a39fa
jmp 0x1804a2a25
mov qword [r13], r12
add r15, 0x10
mov eax, dword [0x1807aa450]
add eax, dword [0x1807aa454]
sub eax, 0xdfded0f
or eax, 0xdfcdee43
imul eax, eax, 0x8821087a
cmp eax, 0xaeb5350a
je 0x1804a3a3c
mov eax, dword [0x1807aa458]
imul eax, dword [0x1807aa45c]
mov ecx, 0x8b933d16
xor edx, edx
div ecx
imul eax, eax, 0x1b64871
sub eax, 0x4818d90
mov qword [r15], rdi
cmp eax, 0x72355889
jb 0x1804a3a3c
jmp 0x1804a2a85
mov eax, dword [0x1807aa460]
and eax, dword [0x1807aa464]
and eax, 0xf1f70efa
sub eax, 0x7b097cbd
mov ecx, 0x2f37f4d9
xor edx, edx
div ecx
cmp eax, 0x59c4b21
mov r15, qword [rbp + 0x78]
jae 0x1804a3a50
mov eax, dword [0x1807aa468]
sub eax, dword [0x1807aa46c]
mov ecx, 0x8e99ad28
xor edx, edx
div ecx
mov ecx, 0x18c3454f
xor edx, edx
div ecx
mov ecx, 0x1140587d
xor edx, edx
div ecx
mov r14d, eax
mov rax, r12
add rax, 1
mov qword [r13], rax
lea rax, [0x1806c9d60]
mov qword [r15], rax
mov rbx, r15
add rbx, 8
mov rsi, r15
add rsi, 0x18
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8d, 0x18
call fcn.1806a7aa0
add rsp, 0x20
mov qword [r15 + 0x20], r12
mov qword [r15 + 0x28], rdi
lea r10, [rbp - 0x80]
add r10, 8
mov r8, qword [rbp + 0x70]
add r8, 8
mov rcx, qword [rbp + 0x48]
add rcx, 8
mov rax, qword [rbp + 0x30]
mov rdx, rax
add rdx, 8
mov r9, rax
add r9, 9
mov r11, rax
add r11, 0x10
cmp qword [rbp + 0x18], 0
sete al
cmp r14d, 0xbfaa17f8
jae 0x1804a3a50
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x30], rsi
mov byte [rbp + 0xa6], al
test al, 1
mov rsi, qword [rbp + 0x88]
jne 0x1804a3745
jmp 0x1804a2b85
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x20], rdx
mov qword [rbp + 0x80], rcx
mov eax, dword [0x1807aa470]
imul eax, dword [str.6jMZ]
imul eax, eax, 0x580f7337
or eax, 0xade918d7
xor eax, 0x43197935
cmp eax, 0x391f8021
mov rcx, qword [rbp + 0x70]
jbe 0x1804a3a96
mov eax, dword [0x1807aa478]
add eax, dword [0x1807aa47c]
add eax, 0xd7e0b3ee
or eax, 0xd71115a
or eax, 0x8c5b2a6c
mov r12, rcx
add r12, 0x10
mov r9, rcx
add r9, 0x18
cmp eax, 0xd987889a
jbe 0x1804a3a96
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
jmp 0x1804a2bfe
mov rax, rdx
add rax, 8
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x58], r9
mov eax, dword [0x1807aa480]
xor eax, dword [0x1807aa484]
xor eax, 0xf7ec4469
or eax, 0x46aa8bf9
imul eax, eax, 0xe3eb26ee
cmp eax, 0x97959196
je 0x1804a3aa3
jmp 0x1804a2c36
mov eax, dword [0x1807aa488]
add eax, dword [0x1807aa48c]
or eax, 0x6e50ab59
sub eax, 0xac7c226f
xor eax, 0xfad03cbb
mov r14, rdx
add r14, 0x10
mov r13, rcx
add r13, 0x10
cmp eax, 0x3baf5c8d
jb 0x1804a2c36
mov rdx, qword [rbp + 0x40]
jmp 0x1804a2c6c
mov eax, dword [0x1807aa5f0]
imul eax, dword [0x1807aa5f4]
mov r8d, 0x8f73924a
xor edx, edx
div r8d
or eax, 0xbf2f3261
or eax, 0x2555b1ae
cmp eax, 0xdf5a632
je 0x1804a3ceb
jmp 0x1804a3955
mov eax, dword [0x1807aa5f8]
sub eax, dword [0x1807aa5fc]
mov r8d, 0x6c92ef59
xor edx, edx
div r8d
imul eax, eax, 0xd07ff7e0
imul r8d, eax, 0xc527585e
mov eax, dword [r14 + 1]
mov dword [rsi + 9], eax
mov ax, word [r14 + 5]
mov word [rsi + 0xd], ax
mov al, byte [r14 + 7]
mov byte [rsi + 0xf], al
mov rdx, qword [r14 + 8]
mov r9, qword [r14 + 0x10]
mov rax, qword [r14 + 0x18]
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r9
mov rdx, rsi
add rdx, 0x20
cmp r8d, 0x81eaaf0c
jae 0x1804a3955
clc
or al, 0xaf
invalid
jmp 0x1804a39b6
mov qword [rdx], rax
mov byte [rsi + 8], cl
mov qword [rsi], 0
jmp 0x1804a39c5
jb 0x1804a39ad
invalid
invalid
sub dword [rcx + 0x4b], esp
movabs al, byte [0x48e98948f4e418b4]
sub esp, 0x20
xor edx, edx
mov r8d, 0x10
call fcn.1806a7aa0
add rsp, 0x20
mov rcx, rbp
sub rsp, 0x20
mov edx, 0x10
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
add rsp, 0x20
mov qword [r15], 1
jmp 0x1804a29a9
fimul dword [rbx]
or al, 0x7b
xchg ebx, eax
in eax, 0xb7
invalid
jbe 0x1804a3aba
cmp edi, esi
sub al, 0xac
shr byte [rbp + 0x4c], 1
mov eax, esp
add rax, 1
mov qword [r13], rax
lea rax, [0x1806c9d60]
mov qword [r15], rax
mov rcx, r15
add rcx, 8
sub rsp, 0x20
xor edx, edx
mov r8d, 0x18
call fcn.1806a7aa0
add rsp, 0x20
mov qword [r15 + 0x20], r12
mov qword [r15 + 0x28], rdi
jmp 0x1804a2ab3
retf 0xe231
popfq
insb byte [rdi], dx
sbb ecx, dword [rbx]
cmp byte [r10 + r10*4], dil
jmp 0x1804a2c34
ret
invalid