Function at 0x1400b76d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dd11a8]
or eax, dword [0x141dd11ac]
or eax, 0x7bbdbdfe
shr eax, 1
imul rax, rax, 0x85cd985
shr rax, 0x3a
cmp eax, 0xd2174522
ja 0x1400b76f0
mov r14, qword [rsi]
lea rdi, [r14 + 0x10]
xor eax, eax
nop
test al, al
jne 0x1400b7720
mov rax, qword [r14 + 0x18]
mov rbx, qword [r14 + 0x20]
test rax, rax
setne bpl
test rbx, rbx
setne r15b
test rax, rax
je 0x1400b792e
mov ecx, 0xc9695809
nop dword [rax + rax]
mov eax, dword [0x141dd11b0]
xor edx, edx
div dword [0x141dd11b4]
imul rax, rcx
shr rax, 0x3a
and eax, 0xfffffff2
add eax, 0xb3dae6aa
cmp eax, 0x8a442a4
jb 0x1400b7750
mov r12, qword [r14 + 0x28]
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400b7780
test rbx, rbx
je 0x1400b792e
mov rax, qword [r12]
test rax, rax
je 0x1400b77b8
mov rcx, rbx
call rax
nop dword [rax + rax]
mov eax, dword [0x141dd11b8]
or eax, dword [0x141dd11bc]
and eax, 0xe3298775
cmp eax, 0x760fb0c6
je 0x1400b77a0
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400b77c0
mov rax, qword [r12 + 8]
nop dword [rax]
mov ecx, dword [0x141dd11c0]
or ecx, dword [0x141dd11c4]
or ecx, 0x4000020
xor ecx, 0x90009010
and ecx, 0x9408d030
cmp ecx, 0x5e9dfeba
ja 0x1400b77d0
test rax, rax
je 0x1400b792e
mov rax, qword [r12 + 0x10]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd11c8]
and ecx, dword [0x141dd11cc]
imul ecx, ecx, 0x58bb092a
xor ecx, 0xddd67a7f
add ecx, 0x24626169
cmp ecx, 0x189bdf0b
jb 0x1400b7810
cmp rax, 0x11
jb 0x1400b78a3
mov eax, dword [0x141dd11d0]
xor edx, edx
div dword [0x141dd11d4]
nop word [rax + rax]
mov eax, dword [0x141dd11d8]
xor edx, edx
div dword [0x141dd11dc]
xor eax, 0x60680a01
and eax, 0xe0681f4b
xor eax, 0x6bccc5f3
cmp eax, 0x71017503
ja 0x1400b7850
mov rbx, qword [rbx - 8]
nop dword [rax + rax]
mov eax, dword [0x141dd11e0]
xor eax, dword [0x141dd11e4]
xor eax, 0xa940376d
imul eax, eax, 0x9862970d
xor eax, 0x54beef94
cmp eax, 0xbb46e9ab
ja 0x1400b7880
mov eax, dword [0x141dd11e8]
sub eax, dword [0x141dd11ec]
imul eax, eax, 0x8918f424
mov ecx, 0xf8b19777
imul rcx, rax
shr rcx, 0x3e
or ecx, 0xdc85d5c9
cmp ecx, 0x50b1714
jae 0x1400b78e2
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dd11f0]
imul eax, dword [0x141dd11f4]
imul r13, rax, 0x3d41eeb3
shr r13, 0x3d
xor r13d, 0x7b17e73f
add r13d, 0x6d48d134
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rbx
call r12
cmp r13d, 0x3fc686f5
jb 0x1400b78f0
and bpl, r15b
mov qword [r14 + 0x18], 0
mov rax, qword [r14 + 0x10]
nop dword [rax]
mov ecx, dword [0x141dd11f8]
add ecx, dword [0x141dd11fc]
or ecx, 0xfbf6ffff
cmp ecx, 0x8a3065c6
je 0x1400b7940
test rax, rax
je 0x1400b7e50
test bpl, bpl
je 0x1400b79af
xor ecx, ecx
test cl, cl
je 0x1400b7980
mov byte [rax + 0x20], 1
nop word cs:[rax + rax]
mov ecx, dword [0x141dd1218]
sub ecx, dword [0x141dd121c]
imul rcx, rcx, 0x5140097b
shr rcx, 0x3e
or ecx, 0x493386d6
xor ecx, 0xa7ddf794
mov byte [rax + 0x20], 1
cmp ecx, 0xbb3500bd
jb 0x1400b7980
mov ecx, dword [0x141dd1200]
xor ecx, dword [0x141dd1204]
add ecx, 0xef6bdd7f
xor ecx, 0x37161de7
cmp ecx, 0xe4efed88
jbe 0x1400b79d4
lock dec qword [rax + 0x18]
mov edx, 0x9c3dad51
nop dword [rax]
mov r8d, dword [0x141dd1208]
imul r8d, dword [0x141dd120c]
add r8d, 0x1abef326
imul r8, rdx
shr r8, 0x3f
mov rcx, 0xffffffffffffffff
lock xadd qword [rax + 0x18], rcx
cmp r8d, 0x1eb50a4b
je 0x1400b79e0
nop word cs:[rax + rax]
mov edx, dword [0x141dd1210]
imul edx, dword [0x141dd1214]
imul edx, edx, 0x446b7225
xor edx, 0x8c2cf617
imul rdx, rdx, 0x1ef59525
shr rdx, 0x3c
cmp edx, 0xfb242d72
ja 0x1400b7a20
cmp rcx, 1
jne 0x1400b7b7f
mov ecx, dword [0x141dd1220]
sub ecx, dword [0x141dd1224]
imul ecx, ecx, 0xfd2f64a7
add ecx, 0x23d78433
xor ecx, 0x2fcb13f6
cmp ecx, 0x1c1c7141
jb 0x1400b7aab
mov ecx, dword [0x141dd1228]
sub ecx, dword [0x141dd122c]
add ecx, 0x88a2b06d
or ecx, 0x8fcca3f8
imul edx, ecx, 0x3aeb192a
mov rbx, qword [rax + 0x10]
mov cl, 1
xchg byte [rbx + 0x30], cl
cmp edx, 0xaa1daa2e
jne 0x1400b7ab6
mov rcx, qword [rax + 0x10]
mov dl, 1
xchg byte [rcx + 0x30], dl
jmp 0x1400b7a7c
add rbx, 0x30
nop word [rax + rax]
mov eax, dword [0x141dd1230]
and eax, dword [0x141dd1234]
imul eax, eax, 0xed2c596e
add eax, 0x3e569b6
xor eax, 0x36d34f34
cmp eax, 0xbbd67027
ja 0x1400b7ac0
cmp cl, 0xff
jne 0x1400b7b7f
mov eax, dword [0x141dd1238]
xor edx, edx
div dword [0x141dd123c]
mov ecx, 0xb96993f5
imul rcx, rax
shr rcx, 0x3e
imul eax, ecx, 0x87e69a24
add eax, 0x80bde044
cmp eax, 0x75c54de8
jb 0x1400b7b46
mov eax, dword [0x141dd1240]
xor edx, edx
div dword [0x141dd1244]
mov ebp, eax
add ebp, 0xde1f341a
or ebp, 0x90b03d70
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
cmp ebp, 0x735c0bec
jne 0x1400b7b60
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
jmp 0x1400b7b19
mov eax, dword [0x141dd1248]
imul eax, dword [0x141dd124c]
or eax, 0x489103f7
imul eax, eax, 0xc9819331
cmp eax, 0x627e7141
je 0x1400b7b60
mov rax, qword [rdi]
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x1400b7b90
test rax, rax
je 0x1400b7c49
lock dec qword [rax]
jne 0x1400b7c49
mov eax, dword [0x141dd1250]
add eax, dword [0x141dd1254]
or eax, 0xeca98b20
xor eax, 0x88514917
add eax, 0x7ba45c1b
cmp eax, 0xf7b1ad7f
ja 0x1400b7bec
mov eax, dword [0x141dd1258]
sub eax, dword [0x141dd125c]
imul eax, eax, 0x6554f8c7
or eax, 0x7d4b4cd1
add eax, 0x1db9fa88
cmp eax, 0x5881b97a
jbe 0x1400b7bee
jmp 0x1400b7bc9
mov eax, dword [0x141dd1260]
imul eax, dword [0x141dd1264]
xor eax, 0x33503e2b
add eax, 0x77c1d19c
or eax, 0x1dc94684
cmp eax, 0xb311e7bb
jne 0x1400b7c20
mov rcx, rdi
call fcn.140074f20
nop dword [rax]
mov ebx, dword [0x141dd1268]
imul ebx, dword [0x141dd126c]
add ebx, 0x926ad76
xor ebx, 0x326aa409
mov rcx, rdi
call fcn.140074f20
cmp ebx, 0xe122d076
ja 0x1400b7c20
mov rax, qword [r14 + 0x18]
nop dword [rax]
mov ecx, dword [0x141dd1270]
imul ecx, dword [0x141dd1274]
xor ecx, 0x6c9f374d
imul ecx, ecx, 0x461ed314
cmp ecx, 0xfcef32fe
je 0x1400b7c50
test rax, rax
je 0x1400b7e50
mov eax, dword [0x141dd1278]
xor edx, edx
div dword [0x141dd127c]
nop dword [rax + rax]
mov eax, dword [0x141dd1280]
xor eax, dword [0x141dd1284]
or eax, 0x303b4f20
and eax, 0xb13b4f26
cmp eax, 0x8953e669
jb 0x1400b7c90
mov rdi, qword [r14 + 0x20]
test rdi, rdi
je 0x1400b7e50
mov rbx, qword [r14 + 0x28]
nop
mov eax, dword [0x141dd1288]
xor eax, dword [0x141dd128c]
xor eax, 0x2000002
or eax, 0x5218608
and eax, 0x779970a
cmp eax, 0x1ab8d02d
ja 0x1400b7cc0
nop word cs:[rax + rax]
mov eax, dword [0x141dd1290]
xor eax, dword [0x141dd1294]
imul eax, eax, 0x4337b970
imul rax, rax, 0x23816fa9
shr rax, 0x3d
cmp eax, 0xf4d8a7b1
ja 0x1400b7cf0
mov r14, qword [rbx]
test r14, r14
je 0x1400b7d7c
mov eax, dword [0x141dd1298]
imul eax, dword [0x141dd129c]
imul rax, rax, 0x6f27f355
shr rax, 0x3e
imul eax, eax, 0x6b31d095
cmp eax, 0x78e93116
jne 0x1400b7d50
mov rcx, rdi
call r14
nop word [rax + rax]
mov ebp, dword [0x141dd12a0]
or ebp, dword [0x141dd12a4]
add ebp, 0xc3d6a828
or ebp, 0x3df61585
add ebp, 0x8a2b89dc
mov rcx, rdi
call r14
cmp ebp, 0x1129738d
jb 0x1400b7d50
mov rcx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
nop word cs:[rax + rax]
mov edx, dword [0x141dd12a8]
add edx, dword [0x141dd12ac]
or edx, 0x1a357cd9
imul edx, edx, 0x3e2896cb
cmp edx, 0xb782a9fe
je 0x1400b7d90
mov edx, dword [0x141dd12b0]
and edx, dword [0x141dd12b4]
add edx, 0xdf358ea2
xor edx, 0x41cbea0a
cmp edx, 0x3eb4ab4b
ja 0x1400b7db0
test rcx, rcx
je 0x1400b7e50
xor ecx, ecx
nop word [rax + rax]
test cl, cl
jne 0x1400b7de0
cmp rax, 0x11
jb 0x1400b7e34
nop word [rax + rax]
mov eax, dword [0x141dd12b8]
xor eax, dword [0x141dd12bc]
and eax, 0x7abf089d
xor eax, 0x53ce7cd5
cmp eax, 0x6ab2a125
jb 0x1400b7df0
nop dword [rax]
mov eax, dword [0x141dd12c0]
xor edx, edx
div dword [0x141dd12c4]
imul eax, eax, 0x9fa1bdca
add eax, 0xc8006afd
cmp eax, 0xb9ee138b
jb 0x1400b7e10
mov rdi, qword [rdi - 8]
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dd12c8]
sub eax, dword [0x141dd12cc]
xor eax, 0x359a7fc
shr eax, 1
imul rax, rax, 0x24e25f25
shr rax, 0x39
cmp eax, 0xbcd602e3
je 0x1400b7e50
mov r8, qword [rsi]
nop dword [rax + rax]
mov eax, dword [0x141dd12d0]
or eax, dword [0x141dd12d4]
or eax, 0x1dd6afec
add eax, 0x53295e39
and eax, 0x83280a0e
cmp eax, 0xcaefcc62
ja 0x1400b7e80
cmp r8, 0xffffffffffffffff
je 0x1400b7f5e
lock dec qword [r8 + 8]
sete cl
mov r9d, 0xc5c22d2d
nop word [rax + rax]
mov eax, dword [0x141dd12d8]
xor edx, edx
div dword [0x141dd12dc]
add eax, 0xdd001dfc
imul rax, r9
shr rax, 0x39
or eax, 0xab8c61d0
cmp eax, 0xacd920e0
ja 0x1400b7ec0
test cl, cl
je 0x1400b7f5e
mov eax, dword [0x141dd12e0]
and eax, dword [0x141dd12e4]
imul eax, eax, 0x5142ff2e
add eax, 0x9b6e94
cmp eax, 0xa910f8ea
ja 0x1400b7f2c
mov eax, dword [0x141dd12e8]
sub eax, dword [0x141dd12ec]
imul eax, eax, 0x87008b5a
add eax, 0x651b0dd4
and eax, 0xa9f2b596
cmp eax, 0xcc4a1f8f
jbe 0x1400b7f2e
jmp 0x1400b7f09
mov rcx, qword [0x141dd7fe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dd12f0]
imul eax, dword [0x141dd12f4]
xor eax, 0x4b65489
add eax, 0x2dda8f53
cmp eax, 0x7c43ac5e
ja 0x1400b7f40
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret