Function at 0x10011e244
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x168
xor r15d, r15d
xor r12d, r12d
test rcx, rcx
mov rax, r8
mov rsi, rdx
mov r13, rcx
lea ebx, [r15 + 0x14]
mov qword [rsp + 0x48], r12
mov r14d, 0xb4
je 0x10011ea3d
test rdx, rdx
je 0x10011ea3d
test rax, rax
je 0x10011ea3d
test r9, r9
je 0x10011ea3d
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbx - 0xc]
mov rcx, rax
mov r8d, 0x1b4
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
jne 0x10011e2d9
mov ebp, 0x80000002
jmp 0x10011e5be
lea rdx, [rax + 0x60]
lea rsi, [0x100152d88]
mov rdi, r14
lea rax, [rdx + 0xa8]
mov ecx, 0x60
mov dword [rsp + 0x80], 0x123174bb
rep movsb byte [rdi], byte [rsi]
mov qword [r14], rdx
mov rsi, qword [0x100152d88]
mov qword [rsp + 0xe0], rax
add rax, 0x70
mov rdi, rdx
mov edx, 8
lea r12, [rax + 0x14]
mov qword [rsp + 0x40], rax
lea rax, [r12 + 0x14]
mov ecx, 0xa8
mov dword [rsp + 0x84], 0x86521ff8
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [r14]
mov qword [rsp + 0xe8], rax
add rdi, 0x58
mov rcx, rdx
lea rsi, [rsp + 0xe0]
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [r14]
mov rsi, qword [0x100152d88]
mov rdi, qword [rdi + 0x58]
mov rsi, qword [rsi + 0x58]
lea ecx, [rdx + 0x68]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r14]
mov rcx, rdx
mov rdi, qword [rax + 0x58]
xor edx, edx
lea rsi, [rsp + 0xe8]
add rdi, 0x38
lea r8d, [rdx + 0x10]
mov dword [rsp + 0x88], 0x98d2438b
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r14]
mov dword [rsp + 0x8c], 0x7966ce12
mov rcx, qword [rax + 0x58]
mov dword [rsp + 0x90], 0xc5d92014
mov dword [rsp + 0x98], ebp
mov rax, qword [rcx + 0x38]
lea rcx, [rsp + 0x9c]
mov qword [rsp + 0x48], rax
call sub.msvcrt.dll_memset
mov rdx, qword [0x100152d88]
mov rsi, qword [rdx + 0x58]
lea rdi, [rsp + 0x98]
mov rcx, rbx
mov rsi, qword [rsi + 0x38]
xor r8d, r8d
movabs r15, 0xcccccccccccccccd
rep movsb byte [rdi], byte [rsi]
lea rsi, [rsp + 0x98]
lea r9d, [r8 + 5]
mov rcx, r8
mov rax, r15
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x80]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011e409
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
lea rsi, [rsp + 0x98]
mov rcx, rbx
lea r8d, [r9 + 0x10]
xor edx, edx
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xb4]
mov dword [rsp + 0x50], 0x123174bb
mov qword [r14 + 8], rax
mov dword [rsp + 0x54], 0x86521ff8
mov dword [rsp + 0x58], 0x98d2438b
mov dword [rsp + 0x5c], 0x7966ce12
mov dword [rsp + 0x60], 0xc5d92014
mov dword [rsp + 0xb0], ebp
call sub.msvcrt.dll_memset
mov rsi, qword [0x100152d90]
xor r8d, r8d
lea rdi, [rsp + 0xb0]
mov rcx, rbx
lea r9d, [r8 + 5]
rep movsb byte [rdi], byte [rsi]
lea rsi, [rsp + 0xb0]
movabs rdi, 0xcccccccccccccccd
xor r15d, r15d
mov rcx, r8
mov rax, rdi
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x50]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011e4c1
mov rdi, qword [rsp + 0x40]
lea rsi, [rsp + 0xb0]
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
lea r8d, [r9 + 0x10]
lea rcx, [rsp + 0xcc]
xor edx, edx
mov qword [r14 + 0x10], r12
mov dword [rsp + 0x68], 0x123174bb
mov dword [rsp + 0x6c], 0x86521ff8
mov dword [rsp + 0x70], 0x98d2438b
mov dword [rsp + 0x74], 0x7966ce12
mov dword [rsp + 0x78], 0xc5d92014
mov dword [rsp + 0xc8], ebp
call sub.msvcrt.dll_memset
mov rsi, qword [0x100152d98]
lea rdi, [rsp + 0xc8]
mov rcx, rbx
xor r8d, r8d
rep movsb byte [rdi], byte [rsi]
movabs r13, 0xcccccccccccccccd
lea rsi, [rsp + 0xc8]
lea r9d, [r8 + 5]
mov rcx, r8
mov rax, r13
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x68]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011e56e
mov r13, qword [rsp + 0x1b0]
mov rdi, r12
lea rsi, [rsp + 0xc8]
mov rcx, rbx
mov r12, r14
mov qword [rsp + 0x48], r14
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1b8]
test ebp, ebp
js 0x10011e8a8
lea rax, [r13 + 0x10]
mov dword [r13], 0
mov dword [r13 + 4], 0x157c
mov qword [r13 + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0xb4
mov r8, r14
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r15, rax
jne 0x10011e60d
mov ebp, 0x80000002
jmp 0x10011e8ae
add rax, 0x3c
lea rcx, [rsp + 0xf0]
cmp rcx, rsi
mov qword [rsp + 0x1b0], rax
je 0x10011e633
lea rdi, [rsp + 0xf0]
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
lea rsi, [rsp + 0xf0]
mov rdi, r15
mov rcx, rbx
mov edx, ebx
lea rax, [rsp + 0xf0]
rep movsb byte [rdi], byte [rsi]
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011e64d
mov rsi, qword [rsp + 0x1c0]
lea rax, [rsp + 0x110]
cmp rax, rsi
je 0x10011e67b
lea rdi, [rsp + 0x110]
lea ecx, [rdx + 0x50]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r12]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
je 0x10011e6f7
mov r9, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rsp + 0x110]
mov rcx, rbx
lea r8, [r15 + 0x14]
mov edx, 5
rep movsb byte [rdi], byte [rsi]
mov rcx, rax
mov qword [rsp + 0x20], r13
call fcn.1001258a4
mov edx, ebx
mov rax, r14
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011e6d7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [r12]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
je 0x10011e773
mov r9, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rsp + 0x124]
mov rcx, rbx
lea r8, [r15 + 0x28]
mov edx, 5
rep movsb byte [rdi], byte [rsi]
mov rcx, rax
mov qword [rsp + 0x20], r13
call fcn.1001258a4
mov edx, ebx
mov rax, r14
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011e753
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [r12]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
je 0x10011e7f8
mov r9, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rsp + 0x138]
mov rcx, rbx
mov edx, 5
mov qword [rsp + 0x20], r13
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1b0]
mov rcx, rax
mov r8, rsi
call fcn.1001258a4
mov edx, ebx
mov rax, r14
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011e7d6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10011e800
mov rsi, qword [rsp + 0x1b0]
mov rax, qword [r12]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
je 0x10011e884
mov r9, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rsp + 0x14c]
mov rcx, rbx
mov edx, 5
mov qword [rsp + 0x20], r13
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1b0]
mov rcx, rax
lea r8, [rsi + 0x14]
call fcn.1001258a4
mov edx, ebx
mov rax, r14
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011e864
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [r15 + 0x14]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], r13
call fcn.100121534
test eax, eax
jne 0x10011e949
mov ebp, 0x800480d5
mov r14d, 0xb4
test r12, r12
je 0x10011e905
mov rax, qword [r12]
mov edx, ebx
mov rcx, qword [rax + 0x58]
mov rax, qword [rcx + 0x38]
mov byte [rax], 0
add rax, 1
add edx, 0xffffffff
jne 0x10011e8c1
mov rax, qword [r12 + 8]
mov ecx, ebx
mov byte [rax], 0
add rax, 1
add ecx, 0xffffffff
jne 0x10011e8d4
mov rax, qword [r12 + 0x10]
mov byte [rax], 0
add rax, 1
add ebx, 0xffffffff
jne 0x10011e8e5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r13, r13
je 0x10011e933
test r15, r15
je 0x10011e933
mov rax, r15
mov byte [rax], 0
add rax, 1
add r14d, 0xffffffff
jne 0x10011e912
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebp
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov qword [rsp + 0x30], r12
lea r14, [rsi + 0x28]
lea rcx, [r15 + 0x14]
lea edx, [r8 + 4]
mov r9, r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 5
call fcn.1001240e8
test eax, eax
je 0x10011e8a3
mov qword [rsp + 0x30], r13
lea rdi, [r14 + 0x28]
mov r9d, 0xffffffff
mov rdx, r14
mov rcx, rsi
mov r8, rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r12
call fcn.100121828
test eax, eax
je 0x10011e8a3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
je 0x10011e8a3
mov r8, qword [r12]
lea rsi, [rax + 0x14]
mov r9, r13
mov r8, qword [r8 + 0x58]
mov rdx, rsi
mov rcx, rdi
call fcn.1001259f4
mov rdi, r14
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [rsp + 0x1c8]
cmp rdi, r14
je 0x10011ea10
mov rsi, r14
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, r14
mov ecx, 0x28
mov byte [rax], 0
add rax, 1
add ecx, 0xffffffff
jne 0x10011ea18
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10011e8a8
mov ebp, 0x80070057
jmp 0x10011e8ae