Function at 0x140066ce0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rdx
mov qword [rsp + 0x48], rcx
cmp rdx, 0x15
jae 0x140066d31
cmp rsi, 1
jbe 0x140067437
mov r8d, 1
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140067450
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140066d5d
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14006744c
mov rcx, rax
mov qword [0x14034bdf0], rax
movabs rax, 0x7ffffffffffffff8
lea r8, [rsi*4]
and r8, rax
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14006744c
mov r15, rax
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140066db2
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14006744c
mov rcx, rax
mov qword [0x14034bdf0], rax
mov r8d, pe_nt_image_headers64
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14006744c
mov r13, rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + 0xc]
mov qword [rsp + 0x68], rcx
lea rcx, [rax - 4]
mov qword [rsp + 0x60], rcx
add rax, 0xfffffffffffffff8
mov qword [rsp + 0x70], rax
mov eax, 0x10
mov qword [rsp + 0x58], rax
xor ebp, ebp
xor ebx, ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r15
jmp 0x140066e23
mov ebx, 1
mov rbp, qword [rsp + 0x38]
cmp rbp, rsi
jae 0x1400673fd
mov rax, rsi
sub rax, rbp
mov rcx, qword [rsp + 0x48]
lea rcx, [rcx + rbp*8]
cmp rax, 2
jae 0x140066ea0
mov r8, rax
lea rax, [r8 + rbp]
mov r12, rax
sub r12, rbp
jb 0x14006744c
cmp rax, rsi
ja 0x14006744c
jae 0x140066f30
cmp r8, 0xa
jae 0x140066f30
lea r12, [rbp + 0xa]
cmp r12, rsi
cmovae r12, rsi
mov qword [rsp + 0x38], r12
sub r12, rbp
jb 0x14006744c
cmp r8, 1
adc r8, 0
mov rdx, r12
call fcn.140067450
cmp rbx, qword [rsp + 0x58]
je 0x140066f3c
jmp 0x140066fb3
movzx edx, byte [rcx + 8]
cmp dl, byte [rcx]
jae 0x1400672d0
mov r8d, 2
cmp rax, 2
je 0x140066ed8
nop dword [rax + rax]
mov r9d, edx
movzx edx, byte [rcx + r8*8]
cmp dl, r9b
jae 0x140066ed8
inc r8
cmp rax, r8
jne 0x140066ec0
mov r8, rax
mov rax, r8
add rax, rbp
jb 0x14006744c
cmp rax, rsi
ja 0x14006744c
cmp r8, 2
jb 0x140066e3f
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rbx
mov rax, r8
shr rax, 1
lea rdx, [rcx + r8*8]
lea r9, [rax*8]
sub rdx, r9
cmp rax, 1
jne 0x140067308
xor r9d, r9d
jmp 0x1400673a7
mov qword [rsp + 0x38], rax
cmp rbx, qword [rsp + 0x58]
jne 0x140066fb3
mov rdi, r13
movzx eax, byte [0x14034be90]
mov rax, qword [0x14034bdf0]
test rax, rax
jne 0x140066f68
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14006744c
mov qword [0x14034bdf0], rax
mov r8, rbx
shl r8, 5
mov rcx, rax
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14006744c
mov r13, rax
lea rax, [rbx + rbx]
mov qword [rsp + 0x58], rax
mov r8, rbx
shl r8, 4
mov rcx, r13
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, rbx
shl rax, 4
mov qword [r13 + rax], r12
mov qword [r13 + rax + 8], rbp
inc rbx
mov rax, rbx
cmp rbx, 2
mov qword [rsp + 0x78], r13
jae 0x140067047
jmp 0x140066e15
mov r13, rbp
mov rdx, r15
mov rsi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x40]
sub r8, rdx
mov rcx, r13
call sub.VCRUNTIME140.dll_memcpy
add r12, rbx
mov qword [rdi], r12
mov rax, qword [rsp + 0x80]
mov qword [rdi + 8], rax
lea rdx, [r14 + 0x10]
mov rax, qword [rsp + 0x88]
not rax
mov r8, qword [rsp + 0x50]
add r8, rax
shl r8, 4
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov rax, qword [rsp + 0x90]
cmp rax, 1
mov r13, qword [rsp + 0x78]
jbe 0x140066e10
mov rbx, rax
lea r10, [rax - 1]
mov rcx, r10
shl rcx, 4
mov rax, qword [r13 + rcx]
mov rcx, qword [r13 + rcx + 8]
add rcx, rax
cmp rcx, rsi
je 0x1400670c0
mov rdx, rbx
shl rdx, 4
mov r8, qword [rdx + r13 - 0x20]
cmp r8, rax
jbe 0x1400670c0
cmp rbx, 2
jbe 0x1400672fe
lea r11, [rbx - 3]
mov rcx, r11
shl rcx, 4
mov rcx, qword [r13 + rcx]
lea r9, [r8 + rax]
cmp rcx, r9
jbe 0x1400670d6
cmp rbx, 3
jbe 0x1400673f3
add r8, rcx
cmp qword [rdx + r13 - 0x40], r8
jbe 0x1400670d6
jmp 0x140066e15
cmp rbx, 3
jb 0x1400670db
lea r11, [rbx - 3]
mov rcx, r11
shl rcx, 4
mov rcx, qword [r13 + rcx]
cmp rcx, rax
jb 0x1400670df
lea r11, [rbx - 2]
cmp rbx, r11
jbe 0x14006744c
lea rdi, [r11 + 1]
cmp rbx, rdi
jbe 0x14006744c
mov rax, r11
shl rax, 4
mov rcx, qword [r13 + rax + 8]
shl rdi, 4
mov r12, qword [r13 + rdi]
mov r14, qword [r13 + rdi + 8]
add r14, r12
mov r15, r14
sub r15, rcx
jb 0x14006744c
cmp r14, rsi
ja 0x14006744c
mov qword [rsp + 0x88], r11
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x50], rbx
lea rdx, [rax + r13]
mov qword [rsp + 0x40], rdx
mov rbx, qword [r13 + rax]
add rdi, r13
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rcx
lea r13, [rax + rcx*8]
lea rbp, [rbx*8]
add rbp, r13
mov rsi, r15
sub rsi, rbx
cmp rsi, rbx
jae 0x140067220
lea r8, [rsi*8]
mov r15, qword [rsp + 0x30]
mov rcx, r15
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcpy
lea r8, [r15 + rsi*8]
test rbx, rbx
jle 0x140066fe0
test rsi, rsi
jle 0x140066fe0
mov rax, qword [rsp + 0x70]
lea rax, [rax + r14*8]
mov rsi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x40]
nop dword [rax]
movzx ecx, byte [r8 - 8]
movzx edx, byte [rbp - 8]
cmp cl, dl
mov r9d, 0
sbb r9, r9
cmp cl, dl
mov r10d, 0
adc r10, 0xffffffffffffffff
cmp cl, dl
lea rbp, [rbp + r9*8]
lea r8, [r8 + r10*8]
mov rcx, r8
cmovb rcx, rbp
mov rcx, qword [rcx]
mov qword [rax], rcx
cmp rbp, r13
jbe 0x140067206
add rax, 0xfffffffffffffff8
cmp r8, r15
ja 0x1400671c0
mov r13, rbp
mov rdx, r15
jmp 0x140066ff0
lea r8, [rbx*8]
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rsi + rbx*8]
test rbx, rbx
jle 0x1400672b6
cmp r15, rbx
mov rsi, qword [rsp + 0x28]
jle 0x1400672c0
mov rax, qword [rsp + 0x48]
lea rax, [rax + r14*8]
mov r15, qword [rsp + 0x30]
mov rdx, r15
mov r14, qword [rsp + 0x40]
nop word cs:[rax + rax]
movzx r9d, byte [rbp]
xor r10d, r10d
xor ecx, ecx
cmp r9b, byte [rdx]
setae r10b
setb r9b
mov r11, rdx
cmovb r11, rbp
mov r11, qword [r11]
mov qword [r13], r11
add r13, 8
lea rdx, [rdx + r10*8]
cmp rdx, r8
jae 0x140066ff0
mov cl, r9b
lea rbp, [rbp + rcx*8]
cmp rbp, rax
jb 0x140067270
jmp 0x140066ff0
mov r15, qword [rsp + 0x30]
jmp 0x140066fe3
mov r15, qword [rsp + 0x30]
mov rdx, r15
jmp 0x140066feb
mov r8d, 2
cmp rax, 2
je 0x140066e3b
mov r9d, edx
movzx edx, byte [rcx + r8*8]
cmp dl, r9b
jb 0x140066e3b
inc r8
cmp rax, r8
jne 0x1400672e0
jmp 0x140066e38
mov ebx, 2
jmp 0x140066e15
movabs r9, 0x7ffffffffffffff8
lea r10, [r9 + 6]
and r10, rax
mov r9, qword [rsp + 0x68]
lea r11, [r9 + rbp*8]
mov r9, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x38]
lea rsi, [r9 + rsi*8]
xor r9d, r9d
nop word cs:[rax + rax]
movzx ebx, byte [r11 + r9*8 - 0xc]
mov edi, dword [r11 + r9*8 - 8]
movzx r14d, byte [rsi - 4]
mov r15d, dword [rsi]
mov byte [r11 + r9*8 - 0xc], r14b
mov dword [r11 + r9*8 - 8], r15d
mov byte [rsi - 4], bl
mov dword [rsi], edi
mov rdi, r9
movabs rbx, 0x1ffffffffffffffe
xor rdi, rbx
add rdi, rax
movzx ebx, byte [r11 + r9*8 - 4]
mov r14d, dword [r11 + r9*8]
movzx r15d, byte [rdx + rdi*8]
mov r12d, dword [rdx + rdi*8 + 4]
mov byte [r11 + r9*8 - 4], r15b
mov dword [r11 + r9*8], r12d
mov byte [rdx + rdi*8], bl
mov dword [rdx + rdi*8 + 4], r14d
add r9, 2
add rsi, 0xfffffffffffffff0
cmp r10, r9
jne 0x140067340
test r8b, 2
je 0x1400673da
mov r10, r9
not r10
add rax, r10
movzx r10d, byte [rcx + r9*8]
mov r11d, dword [rcx + r9*8 + 4]
movzx ebx, byte [rdx + rax*8]
mov esi, dword [rdx + rax*8 + 4]
mov byte [rcx + r9*8], bl
mov dword [rcx + r9*8 + 4], esi
mov byte [rdx + rax*8], r10b
mov dword [rdx + rax*8 + 4], r11d
mov rsi, qword [rsp + 0x28]
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
jmp 0x140066e3f
mov ebx, 3
jmp 0x140066e15
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, r13
mov rsi, qword [sym.imp.kernel32.dll_HeapFree]
call rsi
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, r15
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp rax
nop
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2