Function at 0x140196c14
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
xor ebx, ebx
mov r13, r9
mov rsi, rcx
cmp byte [rcx + 8], bl
jne 0x140196c4c
mov edi, 0xc004d101
mov ecx, edi
jmp 0x140196e64
mov rax, qword [rcx]
mov ebp, dword [rsp + 0xb0]
mov r12d, ebp
mov edi, dword [rax + 0x10]
sub r12d, edi
mov dword [rsp + 0xc0], edi
dec r12d
mov dword [rsp + 0x90], edi
mov dword [rsp + 0xb8], r12d
lea eax, [rdi + rdi]
cmp eax, edi
jb 0x140196e5d
lea eax, [r12 + rdi*2]
cmp r12d, eax
ja 0x140196e5d
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140196cb5
mov edi, 0x8007000e
jmp 0x140196c45
lea rcx, [rax + rdi]
mov r9, rbx
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0xc0]
mov rcx, qword [rsi]
lea r15, [rax + rdi*2]
mov rdx, rbx
call fcn.140196538
mov edi, eax
test eax, eax
jns 0x140196ce5
mov ecx, eax
jmp 0x140196e64
mov r14d, dword [rsp + 0xc0]
lea eax, [r14*2 + 2]
cmp r14d, eax
ja 0x140196e5d
cmp ebp, eax
jb 0x140196e5d
mov rdx, qword [rsp + 0x30]
lea eax, [r14 + 1]
mov rcx, qword [rsi]
lea r8, [rsp + 0x90]
add rax, r13
mov dword [rsp + 0x28], r14d
sub ebp, r14d
mov qword [rsp + 0x38], rax
mov r9, rax
lea r13d, [rbp - 1]
mov dword [rsp + 0x20], r13d
call fcn.1401965e0
mov edi, eax
test eax, eax
js 0x140196cde
mov edx, dword [rsp + 0x90]
cmp edx, r14d
ja 0x140196e5d
test edx, edx
je 0x140196d7e
mov r13, qword [rsp + 0xa8]
mov r8d, edx
mov rcx, qword [rsp + 0x30]
inc r13
sub r13, rcx
mov al, byte [rcx + r13]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140196d6b
lea r13d, [rbp - 1]
mov r9, qword [rsp + 0x30]
lea r8, [rsp + 0xb8]
mov rcx, qword [rsi]
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], edx
mov rdx, r15
call fcn.1401965e0
mov edi, eax
test eax, eax
js 0x140196cde
mov ebp, dword [rsp + 0xb8]
cmp ebp, r13d
ja 0x140196e5d
test r13d, r13d
je 0x140196ddb
mov r8, qword [rsp + 0x38]
mov rcx, r15
sub r8, r15
mov edx, r13d
mov al, byte [r8 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140196dcc
mov esi, r14d
cmp r14d, ebp
jae 0x140196df2
mov eax, esi
cmp byte [rax + r15], 0
jne 0x140196df2
inc esi
cmp esi, ebp
jb 0x140196de3
cmp esi, ebp
je 0x140196e53
mov eax, esi
cmp byte [rax + r15], 1
jne 0x140196e53
mov r8, r14
mov rdx, rbx
mov rcx, r15
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140196e53
mov rax, qword [rsp + 0xa8]
cmp byte [rax], 0
jne 0x140196e53
mov rcx, qword [rsp + 0xa0]
sub esi, r14d
sub ebp, esi
sub ebp, r14d
dec ebp
mov eax, dword [rcx]
mov dword [rcx], ebp
cmp eax, ebp
jb 0x140196e5d
mov rcx, qword [rsp + 0x98]
lea edx, [r14 + 1]
add edx, esi
mov r8d, ebp
add rdx, r15
call sub.msvcrt.dll_memcpy
jmp 0x140196e69
mov edi, 0xc004d210
jmp 0x140196c45
mov ecx, 0x8007006f
mov edi, ecx
call fcn.140079c40
mov ecx, edi
call fcn.140079c60
test rbx, rbx
je 0x140196e89
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret