Function at 0x140079ef0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rbx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
push rdi
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
mov rbp, rsp
sub rsp, 0x60
xchg rsi, r14
mov r14, rdx
xchg rsi, r14
xchg rdi, r15
mov rdi, rcx
xchg r15, rdi
xor edi, edi
mov dword [rbp + 0x30], edi
lea rax, [rbp + 0x30]
xchg r12, rax
mov qword [rsp + 0x20], r12
xchg r12, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 5]
call fcn.1400781d0
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x14007a31c
neg eax
add eax, 0xfffff000
neg eax
mov dword [rbp + 0x30], eax
mov ebx, eax
mov ecx, eax
call fcn.1401fcb08
xchg r12, rax
mov r14, r12
xchg r12, rax
test rax, rax
je 0x140079f91
mov r8d, ebx
xor edx, edx
xchg r13, rax
mov rcx, r13
xchg r13, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x140079f94
mov r14, rdi
mov qword [rbp + 0x48], r14
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x30]
xchg r14, r15
mov r8, r15
xchg r15, r14
mov edx, 0x39ad7604
add edx, 0x2d1a24bc
sub edx, 0xcdb4956
add edx, 0x16511129
sub edx, 0x1da14ce7
xor edx, 0x529c15a9
mov rcx, r15
call fcn.1400781d0
test eax, eax
js 0x14007a2f0
mov dword [rbp - 0x30], 0x505bad2a
add dword [rbp - 0x30], 0x1d4246d
sub dword [rbp - 0x30], 0x45f97e19
xor dword [rbp - 0x30], 0xc2d1282
add dword [rbp - 0x30], 0x76447fa6
xor dword [rbp - 0x30], 0x80a93754
mov dword [rbp - 0x24], 0x37853ec4
sub dword [rbp - 0x24], 0x8167e02
xor dword [rbp - 0x24], 0x3f652d0e
add dword [rbp - 0x24], 0x29aaad91
add dword [rbp - 0x24], 0x192abc25
add dword [rbp - 0x24], 0x142f5353
add dword [rbp - 0x24], 0x98635499
mov dword [rbp - 0x20], 0x2dad53c7
sub dword [rbp - 0x20], 0x78e368e
xor dword [rbp - 0x20], 0x6aa15e0c
xor dword [rbp - 0x20], 0x135478a6
sub dword [rbp - 0x20], 0x2fde6c50
sub dword [rbp - 0x20], 0x11ca38a8
xor dword [rbp - 0x20], 0x3c11a73
xor dword [rbp - 0x20], 0xe2ed7395
mov dword [rbp - 0x2c], 0x4d717ae8
sub dword [rbp - 0x2c], 0x226dff12
sub dword [rbp - 0x2c], 0x74aa297
add dword [rbp - 0x2c], 0x145825ca
sub dword [rbp - 0x2c], 0x14a03597
add dword [rbp - 0x2c], 0x1564e0d9
xor dword [rbp - 0x2c], 0x3c18df96
add dword [rbp - 0x2c], 0xf2298119
mov dword [rbp - 0x1c], 0x7a7ba290
sub dword [rbp - 0x1c], 0xbb6cb5e
sub dword [rbp - 0x1c], 0x1032eb89
sub dword [rbp - 0x1c], 0x52168168
xor dword [rbp - 0x1c], 0x4e0937bb
add dword [rbp - 0x1c], 0x187c27c0
add dword [rbp - 0x1c], 0xa48e79bf
mov dword [rbp - 0x18], 0x38fbc07
add dword [rbp - 0x18], 0x6d0fd544
sub dword [rbp - 0x18], 0x19c07523
sub dword [rbp - 0x18], 0x54ea2191
add dword [rbp - 0x18], 0x70ca9ca0
add dword [rbp - 0x18], 0x8c796837
mov word [rbp - 0x28], 0x2ea8
add word [rbp - 0x28], 0x1c85
xor word [rbp - 0x28], 0x3343
xor word [rbp - 0x28], 0x7f55
add word [rbp - 0x28], 0x5203
sub word [rbp - 0x28], 0x4932
add word [rbp - 0x28], 0x343c
add word [rbp - 0x28], 0x2c47
add word [rbp - 0x28], 0x8667
mov dword [rbp - 0x14], 0x3c785e3a
add dword [rbp - 0x14], 0x1526976b
xor dword [rbp - 0x14], 0x2456aa7c
xor dword [rbp - 0x14], 0x131b5af5
xor dword [rbp - 0x14], 0x7294caf0
xor dword [rbp - 0x14], 0x4975e260
add dword [rbp - 0x14], 0xa250d1b3
mov byte [rbp - 0x26], 0x76
xor byte [rbp - 0x26], 3
sub byte [rbp - 0x26], 0x1e
sub byte [rbp - 0x26], 0x34
sub byte [rbp - 0x26], 0xe
add byte [rbp - 0x26], 0x31
add byte [rbp - 0x26], 0x2d
xor byte [rbp - 0x26], 0x85
mov dword [rbp - 0x10], 0x127b5666
add dword [rbp - 0x10], 0x2941da28
add dword [rbp - 0x10], 0x39d7f4ef
sub dword [rbp - 0x10], 0xc51c953
sub dword [rbp - 0x10], 0x2c218683
sub dword [rbp - 0x10], 0x330f9ce5
add dword [rbp - 0x10], 0x7e6e1a
xor dword [rbp - 0x10], 0xa9059b3
xchg r9, rdi
mov rdx, r9
xchg rdi, r9
nop dword [rax]
movzx eax, word [rbp + rdx*2 - 0x24]
movzx ecx, byte [rbp + rdx - 0x30]
add cx, ax
mov word [rbp + rdx*2 - 0x24], cx
mov byte [rbp + rdx - 0x30], 0x50
add byte [rbp + rdx - 0x30], 2
sub byte [rbp + rdx - 0x30], 0x3d
add byte [rbp + rdx - 0x30], 0x62
sub byte [rbp + rdx - 0x30], 0x21
xor byte [rbp + rdx - 0x30], 0x7b
add byte [rbp + rdx - 0x30], 0x4b
sub byte [rbp + rdx - 0x30], 0x26
sub byte [rbp + rdx - 0x30], 0x52
inc rdx
cmp rdx, 0xb
jb 0x14007a1d6
xchg r10, r14
mov rbx, r10
xchg r10, r14
cmp word [rbx + 0x38], 0
je 0x14007a2b3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
cmp qword [rbx + 0x50], rax
je 0x14007a2b3
cmp word [rbx + 0x38], 0x16
jne 0x14007a2b3
xchg r15, rdx
mov r15, qword [rbx + 0x40]
xchg rdx, r15
lea rcx, [rbp - 0x24]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14007a2b3
mov eax, dword [rbx + 0x50]
mov dword [rbp + 0x40], eax
xchg rbp, rdx
mov rbp, qword [rsi + 8]
xchg rbp, rdx
cmp rdx, qword [rsi + 0x10]
je 0x14007a2a1
mov dword [rdx], eax
nop
add qword [rsi + 8], 0x297c1b10
sub qword [rsi + 8], 0x297c1b0c
jmp 0x14007a2b3
lea r8, [rbp + 0x40]
xchg rcx, rsi
mov rsi, rcx
xchg rcx, rsi
call fcn.140077d00
mov eax, dword [rbx]
test eax, eax
je 0x14007a2c5
add rbx, rax
jmp 0x14007a22b
mov byte [rbp + rdi - 0x24], 0x1e
add byte [rbp + rdi - 0x24], 0x2b
sub byte [rbp + rdi - 0x24], 0x3b
add byte [rbp + rdi - 0x24], 0x1c
add byte [rbp + rdi - 0x24], 0x44
xor byte [rbp + rdi - 0x24], 0x6e
inc rdi
cmp rdi, 0x16
jb 0x14007a2c5
mov r8d, dword [rbp + 0x30]
xor edx, edx
xchg r14, rcx
mov r14, rcx
xchg r14, rcx
call sub.VCRUNTIME140.dll_memset
nop
test r14, r14
je 0x14007a31c
xchg r11, r14
mov rcx, r11
xchg r11, r14
call fcn.1401fcb00
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
push rcx
push rax
push rax
push rdx
push rbx
push rcx
push rdx
xchg qword [rsp + 0x38], r15
add rsp, 0x40
nop
xchg qword [rsp], r14
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
push rax
xchg qword [rsp + 8], rbp
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]