Function at 0x140016540
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
nop word [rax + rax]
mov eax, dword [str._zjsh]
sub eax, dword [0x14020eebc]
mov ecx, eax
not ecx
or ecx, 0xe0a74d1
xor ecx, 0x58e3784
and eax, 0x1840304
add eax, eax
sub eax, ecx
and eax, 0x3ffdff3e
xor eax, 0xea84f90a
cmp eax, 0x87955cb3
jb 0x140016550
movzx eax, byte [rsi]
nop dword [rax]
mov ecx, dword [0x14020eec0]
add ecx, dword [0x14020eec4]
mov edx, ecx
xor edx, 0xc400044
and edx, ecx
and edx, 0xdc05a6d
imul ecx, edx, 0x9563103
cmp ecx, 0x521d283c
je 0x140016590
cmp rax, 0x12
je 0x140016640
cmp eax, 0x13
je case.0x1400165e5.0
cmp rax, 0x10
ja case.default.0x1400165e5
lea rcx, [0x140207c70]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov eax, dword [0x14020ef08]
imul eax, dword [0x14020ef0c]
or eax, 0x4faddcc5
mov ecx, eax
xor ecx, 0x3c0e9c72
xor eax, 0x80400000
and eax, 0xac4e8c62
mov edx, ecx
and edx, 0x1111231c
or edx, eax
xor edx, 0x88c6b563
and ecx, 0x62206180
or ecx, edx
cmp ecx, 0x594066de
je case.0x1400165e5.6
jmp case.0x1400165e5.10
mov eax, dword [0x14020eed0]
xor edx, edx
div dword [0x14020eed4]
xor eax, 0x828010c
or eax, 0xe1973e93
imul rax, rax, 0x58662679
shr rax, 0x3e
cmp eax, 0x46505e11
je 0x140016640
nop word [rax + rax]
mov eax, dword [0x14020eed8]
add eax, dword [0x14020eedc]
mov ecx, eax
or ecx, 0x80444
not eax
and eax, 0x8600492a
and ecx, 0x511db444
or ecx, eax
mov eax, ecx
xor eax, 0xdefe90c2
xor ecx, 0x2108
and ecx, 0x4000b108
mov edx, eax
and edx, 0x9f974c26
imul edx, ecx
mov ecx, eax
and ecx, 0x4060b188
or eax, 0x4060b188
imul eax, ecx
add eax, edx
cmp eax, 0xe6a3c5d3
je 0x140016670
mov eax, dword [0x14020eee0]
imul eax, dword [0x14020eee4]
mov rsi, qword [rsi + 8]
imul eax, eax, 0x46824ce6
add eax, 0xe82658ed
cmp eax, 0x6e6ce18d
jbe 0x1400166f6
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
mov edi, 0xc36a751d
nop dword [rax + rax]
mov eax, dword [0x14020eee8]
and eax, dword [0x14020eeec]
imul rbx, rax, 0xcb5910d
shr rbx, 0x3b
xor ebx, 0x8b9e7941
imul rbx, rdi
shr rbx, 0x3e
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
cmp ebx, 0x5ad2b5cf
ja 0x140016700
nop word cs:[rax + rax]
mov eax, dword [0x14020eec8]
or eax, dword [0x14020eecc]
imul eax, eax, 0x7780a02a
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x808f3fda
and ecx, 0x7f70c024
imul ecx, edx
mov edx, eax
and edx, 0x7f70c024
or eax, 0x7f70c024
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0x8bbb863f
and eax, 0x8bbb8638
or eax, ecx
cmp eax, 0x55c187ed
jb case.0x1400165e5.0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov eax, dword [0x14020ef20]
mov ecx, dword [0x14020ef24]
xor ecx, eax
not ecx
and ecx, eax
imul eax, ecx, 0x8b779de4
add eax, 0xf2ac0c54
cmp eax, 0xd009ad14
jb case.0x1400165e5.12
mov edi, 0x10
cmp qword [rsi + 8], 0
jne 0x14001698c
jmp case.0x1400165e5.0
mov eax, dword [0x14020ef28]
imul eax, dword [0x14020ef2c]
and eax, 0xc002c08a
add eax, 0x492cc3f
cmp eax, 0xfa951932
ja case.0x1400165e5.13
mov eax, 0x88fb6249
nop word cs:[rax + rax]
mov ecx, dword [0x14020ef30]
or ecx, dword [0x14020ef34]
mov edx, ecx
and edx, 0xb48a262
add edx, edx
neg edx
add ecx, edx
add ecx, 0xb48a262
mov edx, ecx
xor edx, 0xb61b6c36
and edx, ecx
shr edx, 1
imul rdx, rax
shr rdx, 0x3e
cmp edx, 0x3a14606b
ja 0x140016810
mov rax, qword [rsi + 0x10]
mov ecx, dword [0x14020ef38]
mov edx, dword [0x14020ef3c]
mov r8d, ecx
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, ecx
imul r9d, r8d
mov r8d, ecx
and r8d, edx
or ecx, edx
imul ecx, r8d
add ecx, r9d
imul rcx, rcx, 0x14a72d97
shr rcx, 0x3a
add ecx, 0xba3ae71b
cmp ecx, 0xfa1cb89
jb 0x140016850
mov edi, 8
jmp 0x140016983
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400168b0
mov rax, qword [rsi + 8]
mov ecx, 0x8756375f
nop dword [rax]
mov edx, dword [0x14020eef4]
mov r8d, edx
xor r8d, r8d
not r8d
and r8d, dword [0x14020eef0]
xor r8d, edx
and r8d, 0x7c64fc82
add r8d, 0xde52c745
imul r8, rcx
shr r8, 0x3f
cmp r8d, 0xe7a1a2ce
ja 0x1400168c0
jmp 0x14001697e
mov rax, qword [rsi + 8]
mov ecx, 0x9e3e4ba1
nop word cs:[rax + rax]
mov edx, dword [0x14020ef10]
or edx, dword [0x14020ef14]
mov r8d, edx
xor r8d, 0x490b2e7c
add r8d, edx
and edx, 0xb6f4d183
sub r8d, edx
xor r8d, 0x1bb27671
imul r8, rcx
shr r8, 0x3f
cmp r8d, 0x71e1796c
ja 0x140016910
nop word [rax + rax]
mov ecx, dword [0x14020ef18]
xor ecx, dword [0x14020ef1c]
imul rdx, rcx, 0x13c7267
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
imul ecx, ecx, 0xfea7974e
cmp ecx, 0xc29cdeea
je 0x140016950
mov edi, 0x10
test rax, rax
je case.0x1400165e5.0
mov eax, dword [0x14020eef8]
sub eax, dword [str.0_63]
not eax
or eax, 0xc15d90cb
xor eax, 0x94e0e2e5
add eax, 0xb3affece
cmp eax, 0xf2635ff3
jb 0x140016a15
mov eax, dword [0x14020ef04]
mov ebx, eax
xor ebx, eax
not ebx
and ebx, dword [0x14020ef00]
xor ebx, eax
add ebx, 0x7fdd6380
mov eax, ebx
or eax, 0x75965832
mov ecx, ebx
not ecx
and ecx, 0x82006c5
mov edx, eax
and edx, 0xc7cfe10a
imul edx, ecx
and eax, 0x38301ef5
or ebx, 0x7db65ef7
imul ebx, eax
add ebx, edx
mov r8, qword [rsi + rdi]
mov rcx, qword [0x14022cb48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xc4fe5eb0
jne case.0x1400165e5.0
mov r8, qword [rsi + rdi]
mov rcx, qword [0x14022cb48]
xor edx, edx
call fcn.14014eed0
jmp 0x1400169b0