Function at 0x140002aa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push r14
push r15
sub rsp, 0x80
mov ecx, dword [rsp + 0xc8]
mov r11, r8
mov r10d, dword [rsp + 0xd8]
xor r8d, r8d
mov eax, ecx
mov dword [rsp + 0x20], r8d
shr eax, 3
mov r15, r9
cmp ecx, 0x2000
mov dword [rsp + 0x28], r8d
mov r9, rdx
mov dword [rsp + 0x2c], r8d
mov edx, ecx
mov ebx, 0x102
cmovb edx, eax
mov r14d, r8d
mov eax, 0x40
mov dword [rsp + 0x24], edx
cmovae eax, ebx
mov dword [rsp + 0x34], eax
lea eax, [rcx - 1]
cmp eax, 0x7fff
ja 0x1400031ac
lea edx, [rcx - 1]
mov dword [rsp + 0x38], edx
test ecx, edx
je 0x140002b3d
mov eax, 0x5a
add rsp, 0x80
pop r15
pop r14
pop rbx
ret
cmp r10d, ebx
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
cmovbe eax, r10d
mov dword [rsp + 0x30], eax
cmp r15, rbx
jae 0x14000319c
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov ecx, edx
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x40], rcx
nop dword [rax + rax]
mov rsi, rcx
lea rax, [r15 + 2]
and rsi, r15
mov r13d, r8d
mov edx, r8d
cmp rax, rbx
jae 0x140002bba
mov r10, qword [rsp + 0xb0]
movzx eax, byte [r15 + r10 + 1]
movzx edx, byte [r15 + r10 + 2]
shl edx, 4
xor edx, eax
movzx eax, byte [r15 + r10]
shl edx, 4
xor edx, eax
jmp 0x140002bf8
mov r9, rbx
sub r9, r15
je 0x140002be5
xor ecx, ecx
lea r10, [r15 + r11]
nop dword [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
shl eax, cl
add rcx, 8
xor edx, eax
cmp r8, r9
jne 0x140002bd0
mov r10, qword [rsp + 0xb0]
xor r8d, r8d
mov r9, qword [rsp + 0xa8]
movzx ebp, dx
test ebp, ebp
jne 0x140002c4d
test r14d, r14d
jne 0x140002c35
lea rdx, [r10 + r15]
lea rcx, [rdx + 0x102]
mov r14, rdx
lea rax, [rbx + r10]
cmp rcx, rax
cmova rcx, rax
cmp rdx, rcx
je 0x140002c30
cmp byte [r14], 0
jne 0x140002c30
inc r14
cmp r14, rcx
jne 0x140002c22
sub r14d, edx
jmp 0x140002c50
mov ecx, r14d
add rcx, r15
cmp rcx, rbx
ja 0x140002c48
cmp byte [rcx + r10 - 1], 0
je 0x140002c50
dec r14d
jmp 0x140002c50
mov r14d, r8d
mov rax, qword [r9 + 0x10]
mov dword [rax + rsi*4], ebp
mov rax, qword [r9]
mov ecx, dword [rax + rbp*4]
lea rdx, [rax + rbp*4]
cmp ecx, 0xffffffff
je 0x140002c6e
mov rax, qword [r9 + 8]
mov word [rax + rsi*2], cx
mov rax, qword [r9 + 0x28]
movzx ecx, r14w
mov dword [rdx], esi
mov word [rax + rsi*2], cx
mov rax, qword [r9 + 0x18]
lea rdx, [rax + rcx*4]
mov ecx, dword [rax + rcx*4]
cmp ecx, 0xffffffff
je 0x140002c94
mov rax, qword [r9 + 0x20]
mov word [rax + rsi*2], cx
mov rax, qword [r9 + 8]
mov r15d, r8d
mov dword [rdx], esi
mov r12d, r8d
mov rdx, qword [rsp + 0xb8]
mov edi, r8d
movzx r11d, word [rax + rsi*2]
lea rax, [rdx + 0x102]
cmp rbx, rax
cmovb rax, rbx
cmp dword [rsp + 0x24], 0
lea rbx, [rax + r10]
jbe 0x140002de6
mov r10d, r11d
mov eax, dword [rsp + 0xc8]
inc r13d
mov r9d, esi
sub r9d, r11d
add eax, r9d
cmp r10, rsi
cmova r9d, eax
cmp r9d, edi
jb 0x140002dd3
mov edi, r9d
test r9d, r9d
je 0x140002d7c
mov rax, qword [rsp + 0xb0]
mov r8, rdx
mov ecx, r9d
add rax, rdx
sub r8, rcx
add r8, qword [rsp + 0xb0]
cmp r14d, 3
jb 0x140002d49
mov rcx, qword [rsp + 0xa8]
mov rcx, qword [rcx + 0x28]
movzx edx, word [rcx + r10*2]
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
mov rdx, qword [rsp + 0xb8]
add r8, rcx
add rax, rcx
cmp rax, rbx
je 0x140002d62
sub r8, rax
movzx ecx, byte [rax]
cmp byte [r8 + rax], cl
jne 0x140002d62
inc rax
cmp rax, rbx
jne 0x140002d51
sub eax, edx
sub eax, dword [rsp + 0xb0]
cmp eax, r15d
jbe 0x140002d7c
mov r15d, eax
mov r12d, r9d
cmp eax, dword [rsp + 0x30]
jae 0x140002dd3
mov r9, qword [rsp + 0xa8]
mov rax, qword [r9 + 8]
movzx ecx, word [rax + r10*2]
cmp r11d, ecx
je 0x140002ddb
cmp r14d, 3
jb 0x140002db7
cmp r15d, r14d
jbe 0x140002db7
mov rax, qword [r9 + 0x20]
movzx r11d, word [rax + r10*2]
mov rax, qword [r9 + 0x28]
mov r10d, r11d
movzx ecx, word [rax + r11*2]
cmp ecx, r14d
jmp 0x140002dc4
mov rax, qword [r9 + 0x10]
mov r11, rcx
mov r10, rcx
cmp dword [rax + rcx*4], ebp
jne 0x140002ddb
cmp r13d, dword [rsp + 0x24]
jb 0x140002cd0
jmp 0x140002ddb
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
xor r8d, r8d
cmp dword [rsp + 0xe0], 0
je 0x140002f15
cmp dword [rsp + 0x20], 0
jne 0x140002e70
cmp r15d, 3
jb 0x14000310b
cmp r15d, dword [rsp + 0x34]
ja 0x140002f1f
cmp r15d, 0x102
jae 0x140002f1f
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x2c], r12d
mov r15, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
inc r15
xor r8d, r8d
mov qword [rsp + 0xb8], r15
cmp r15, rbx
jae 0x140003183
mov r9, qword [rsp + 0xa8]
mov r11, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x40]
jmp 0x140002b80
mov dword [rsp + 0x20], r8d
test rdx, rdx
je 0x14000316d
mov ecx, dword [rsp + 0x28]
lea eax, [rcx + 1]
cmp r15d, eax
jbe 0x140002eea
mov r13, qword [rsp + 0xa0]
movzx ebp, byte [rdx + r10 - 1]
mov rdi, qword [r13 + 8]
mov rbx, qword [r13 + 0x10]
inc rdi
lea rsi, [rdi*4]
cmp rsi, rbx
jbe 0x140002edc
mov rcx, qword [r13]
shr rbx, 1
add rbx, rsi
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14000317d
mov r10, qword [rsp + 0xb0]
mov qword [r13 + 0x10], rbx
mov qword [r13], rax
mov rax, qword [r13]
mov qword [r13 + 8], rdi
mov dword [rsi + rax - 4], ebp
jmp 0x140002f15
mov rax, qword [r9]
mov r15d, ecx
mov r12d, dword [rsp + 0x2c]
dec rdx
mov ecx, r14d
mov qword [rsp + 0xb8], rdx
mov dword [rax + rbp*4], 0xffffffff
mov rax, qword [r9 + 0x18]
mov dword [rax + rcx*4], 0xffffffff
cmp r15d, 3
jb 0x14000310b
cmp r12d, dword [rsp + 0xc8]
ja 0x140003175
cmp r15d, dword [rsp + 0xd0]
jb 0x14000310b
cmp r15d, 3
jne 0x140002f4e
cmp r12d, 0x1000
ja 0x14000310b
mov rcx, qword [rsp + 0xa0]
mov r8d, r12d
mov edx, r15d
call fcn.140002630
cmp r15d, 1
jbe 0x140002e2f
mov r9, qword [rsp + 0xa8]
lea ebx, [r15 - 1]
mov r10, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
mov ebp, dword [rsp + 0x38]
add r10, rdx
mov rdi, qword [r9 + 0x10]
mov rsi, qword [r9]
mov r12, qword [r9 + 0x28]
mov r13, qword [r9 + 0x18]
mov r15, qword [rsp + 0xb8]
jmp 0x140002fb8
mov rdx, qword [rsp + 0xb0]
inc r10
inc r15
xor ecx, ecx
mov rax, r10
sub rax, rdx
mov r11, rbp
add rax, 2
and r11, r15
mov r8d, ecx
cmp rax, qword [rsp + 0xc0]
jae 0x140002ffb
movzx eax, byte [r10 + 1]
movzx r8d, byte [r10 + 2]
shl r8d, 4
xor r8d, eax
movzx eax, byte [r10]
shl r8d, 4
xor r8d, eax
jmp 0x140003048
mov rax, qword [rsp + 0xc0]
cmp r15, rax
jae 0x140003051
mov r9, rax
mov rdx, rcx
sub r9, r15
je 0x140003038
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r10]
inc rdx
shl eax, cl
add rcx, 8
xor r8d, eax
cmp rdx, r9
jne 0x140003020
xor ecx, ecx
mov rdx, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xa8]
movzx r8d, r8w
test r8d, r8d
jne 0x1400030b4
test r14d, r14d
jne 0x140003098
mov rcx, qword [rsp + 0xc0]
lea rax, [r10 + 0x102]
add rcx, qword [rsp + 0xb0]
lea rdx, [r10 + 0x102]
cmp rax, rcx
mov rax, r10
cmova rdx, rcx
cmp r10, rdx
je 0x140003090
cmp byte [rax], 0
jne 0x140003090
inc rax
cmp rax, rdx
jne 0x140003083
sub eax, r10d
mov r14d, eax
jmp 0x1400030b7
mov ecx, r14d
add rcx, r15
cmp rcx, qword [rsp + 0xc0]
ja 0x1400030af
cmp byte [rcx + rdx - 1], 0
je 0x1400030b7
dec r14d
jmp 0x1400030b7
mov r14d, ecx
mov eax, r8d
lea rdx, [rsi + rax*4]
mov dword [rdi + r11*4], r8d
mov ecx, dword [rdx]
cmp ecx, 0xffffffff
je 0x1400030d2
mov rax, qword [r9 + 8]
mov word [rax + r11*2], cx
mov dword [rdx], r11d
movzx eax, r14w
mov word [r12 + r11*2], ax
lea rdx, [rax*4]
mov ecx, dword [rdx + r13]
cmp ecx, 0xffffffff
je 0x1400030f8
mov rax, qword [r9 + 0x20]
mov word [rax + r11*2], cx
mov dword [rdx + r13], r11d
sub rbx, 1
jne 0x140002fb0
jmp 0x140002e37
mov r12, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xb8]
mov rdi, qword [r12 + 8]
mov rbx, qword [r12 + 0x10]
inc rdi
movzx ebp, byte [r15 + r10]
lea rsi, [rdi*4]
cmp rsi, rbx
jbe 0x14000315b
mov rcx, qword [r12]
shr rbx, 1
add rbx, rsi
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14000317d
mov qword [r12 + 0x10], rbx
mov qword [r12], rax
mov rax, qword [r12]
mov qword [r12 + 8], rdi
mov dword [rsi + rax - 4], ebp
jmp 0x140002e37
mov r8d, 0x51
jmp 0x140003183
mov r8d, 0x56
jmp 0x140003183
mov r8d, 0x53
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov r13, qword [rsp + 0x58]
mov eax, r8d
add rsp, 0x80
pop r15
pop r14
pop rbx
ret
mov eax, 0x3c
add rsp, 0x80
pop r15
pop r14
pop rbx
ret