Function at 0x14009c654
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1080
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1070], rax
xor r14d, r14d
mov bpl, cl
cmp byte [0x140185261], r14b
je 0x14009c6a3
cmp dl, r14b
je 0x14009cb52
or r12, 0xffffffffffffffff
cmp dword [0x140130004], r14d
je 0x14009c701
mov r9, r14
mov rcx, r14
lea rdi, str.8g30w1_5r7_2ta
lea ebx, [r12 + 2]
mov r8d, 0x480
xor byte [r9 + rdi], cl
movabs rax, 0xaaaaaaaaaaaaaaab
add r9, rbx
mul rcx
shr rdx, 1
lea rcx, [rdx + rcx + 3]
and ecx, 0xffffff
cmp r9, r8
jb 0x14009c6c8
cmp dword [0x140130004], r14d
je 0x14009c7a1
jmp 0x14009c797
mov ecx, 0x4f8
call fcn.14005fad0
mov ebx, 1
cmp word [rax], 0x23
mov rsi, rax
jne 0x14009c737
cmp word [rax + 2], 0x23
jne 0x14009c737
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
cmp rcx, 0x64
jae 0x14009c73e
mov rsi, qword [str.0C69__259Yrbtmee_fon_Okskcift._kckgvgfa:_Ipitvdg8RBTMEEiambhj_rdgf_gmuqqexvhvbfvftrmhl8_U_vdjltfeuqug8_B7:_FUG9__1hwrq___waqj_f_ajm_Hnpndleq__hflbubad9_Nslssgb_WAQJ_Fndngoocwcbe_cxtnp_dpdvtkjn__Wfpfhjrdgswwe___F]
mov edi, 0x1000
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8, rdi
call fcn.1400ea880
lea rcx, [rsi + 4]
lea rdx, [rsp + 0x70]
mov r8, rdi
call fcn.14006885c
xor eax, eax
lea rdi, [rsp + 0x70]
mov rcx, r12
lea rdx, [rsp + 0x70]
repne scasb al, byte [rdi]
lea rdi, str.8g30w1_5r7_2ta
not rcx
sub rcx, rbx
mov r8, rcx
mov rcx, rdi
call fcn.14009c1b8
cmp al, r14b
jne 0x14009c7a1
mov r8d, 0x480
xor edx, edx
mov rcx, rdi
call fcn.1400ea880
cmp byte [0x1401410a0], r14b
jne 0x14009c7bf
mov eax, dword [0x1401571d4]
cmp eax, 0x28
jg 0x14009c7ba
cmp eax, r14d
jge 0x14009c7bf
mov sil, bl
jmp 0x14009c7c2
mov sil, r14b
cmp bpl, r14b
je 0x14009cb1e
call fcn.140044e3c
cmp eax, 0x501
ja 0x14009c7e5
bt dword [0x140130000], 9
jae 0x14009cb52
cmp byte [0x140130370], r14b
je 0x14009cb52
mov byte [0x14013011b], r14b
mov byte [0x14013021f], r14b
mov byte [0x14013046f], r14b
cmp sil, r14b
jne 0x14009c824
mov al, byte [0x140130000]
and al, 0x80
neg al
sbb eax, eax
and eax, dword [0x140130008]
mov dword [0x140130008], eax
mov dil, r14b
mov r15d, 0x100
lea r12, [0x140130370]
lea rbp, str.InterfaceMisc
cmp dword [0x140130018], r14d
jbe 0x14009c896
cmp byte [0x1401410a0], r14b
jne 0x14009c896
lea rdx, str.RemShown
xor r8d, r8d
mov rcx, rbp
call fcn.14009b870
cmp eax, dword [0x140130018]
jae 0x14009c896
lea r8d, [rax + 1]
lea rdx, str.RemShown
mov rcx, rbp
call fcn.14009b808
mov dil, bl
cmp byte [0x14013001c], r14b
je 0x14009c943
lea rdx, [0x14013001c]
jmp 0x14009c938
cmp dword [0x14013011c], r14d
jbe 0x14009c8e6
cmp sil, r14b
je 0x14009c8e6
lea rdx, str.ExpRemShown
xor r8d, r8d
mov rcx, rbp
call fcn.14009b870
cmp eax, dword [0x14013011c]
jae 0x14009c8e6
lea r8d, [rax + 1]
lea rdx, str.ExpRemShown
mov rcx, rbp
call fcn.14009b808
mov dil, bl
cmp byte [0x140130120], r14b
je 0x14009c943
lea rdx, [0x140130120]
jmp 0x14009c938
cmp dword [0x140130220], r14d
jbe 0x14009c943
cmp byte [0x1401410a0], r14b
je 0x14009c943
lea rdx, str.RegRemShown
xor r8d, r8d
mov rcx, rbp
call fcn.14009b870
cmp eax, dword [0x140130220]
jae 0x14009c943
lea r8d, [rax + 1]
lea rdx, str.RegRemShown
mov rcx, rbp
call fcn.14009b808
mov dil, bl
cmp byte [0x140130224], r14b
je 0x14009c943
lea rdx, [0x140130224]
mov r8, r15
mov rcx, r12
call fcn.140065cfc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov eax, edx
shr eax, 6
cmp byte [0x1401410a0], r14b
je 0x14009c979
mov ecx, dword [0x140130014]
cmp ecx, r14d
jbe 0x14009c9ad
xor edx, edx
div ecx
cmp edx, r14d
jne 0x14009c9ad
mov dil, bl
jmp 0x14009c9ad
cmp sil, r14b
jne 0x14009c994
mov ecx, dword [0x14013000c]
cmp ecx, r14d
jbe 0x14009c9ad
xor edx, edx
div ecx
cmp edx, r14d
jne 0x14009c9ad
jmp 0x14009c9b6
mov ecx, dword [0x140130010]
cmp ecx, r14d
jbe 0x14009c9ad
xor edx, edx
movzx edi, dil
div ecx
cmp edx, r14d
cmove edi, ebx
cmp dil, r14b
je 0x14009cb52
test byte [0x140130000], 2
mov ebp, 0x16c80000
mov eax, 0x16cc0000
cmove ebp, eax
test byte [0x140130000], 8
jne 0x14009c9d9
or ebp, 0x30000
mov edi, 0x80000000
mov esi, edi
mov r12d, edi
mov r13d, edi
cmp dword [0x140130328], r14d
je 0x14009ca8b
cmp dword [0x140130324], r14d
je 0x14009ca8b
mov ecx, 0x21
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 4
mov edi, eax
lea esi, [rdi + rdi]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
add esi, eax
mov eax, dword [0x140130000]
add esi, dword [0x140130328]
test al, 0x40
jne 0x14009ca33
bt eax, 8
jb 0x14009ca36
add esi, 0x1e
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [0x140130324]
xor edx, edx
lea edi, [rcx + rax*2]
lea r8, [rsp + 0x60]
lea ecx, [rdx + 0x30]
xor r9d, r9d
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [rsp + 0x68]
cmp edi, eax
mov r12d, eax
cmovl r12d, edi
sub eax, r12d
cdq
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [rsp + 0x6c]
cmp esi, eax
mov r13d, eax
cmovl r13d, esi
sub eax, r13d
cdq
sub eax, edx
sar eax, 1
mov esi, eax
lea rcx, [0x140130370]
mov rdx, r15
call fcn.14009bf4c
mov rcx, qword [0x140149ef0]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r12d
lea r8, [0x14010d518]
lea rdx, str.RarReminder
mov r9d, ebp
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExW]
test byte [0x140130000], bl
je 0x14009cb0d
mov dword [rsp + 0x30], 3
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp qword [0x140157270], r14
je 0x14009cb52
mov byte [0x140185261], bl
jmp 0x14009cb52
cmp sil, r14b
je 0x14009cb52
mov byte [0x140185261], bl
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, qword [0x140149ef8]
lea r9, [0x1400c6388]
lea rdx, str.REMINDER
mov r8, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.1400e9d00
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret