Function at 0x1400c0eb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
mov ebp, edx
mov rsi, rcx
lea rdi, [rcx + 0x90]
cmp qword [rcx + 0x90], 0
mov byte [rsp + 0x27], dl
jne 0x1400c154e
nop dword [rax]
mov eax, dword [0x141dd4798]
or eax, dword [0x141dd479c]
add eax, 0x677165e5
or eax, 0x65e5c489
xor eax, 0x18f33a8
cmp eax, 0xf1783eb4
ja 0x1400c0ef0
mov eax, dword [0x141dd47a0]
xor edx, edx
div dword [0x141dd47a4]
imul rcx, rax, 0x8a5f2b7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0x21f7b4c0
cmp eax, 0x375a54dd
je 0x1400c0f80
mov ebx, dword [0x141dd47a8]
imul ebx, dword [0x141dd47ac]
xor ebx, 0x73bb78
add ebx, 0xd18028ee
and ebx, 0x366999ea
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.pdh.dll_PdhOpenQueryA]
cmp ebx, 0x8a7162d6
jne 0x1400c0f9a
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x28]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.pdh.dll_PdhOpenQueryA]
jmp 0x1400c0f41
mov ebp, eax
nop dword [rax]
mov eax, dword [0x141dd47b0]
xor edx, edx
div dword [0x141dd47b4]
imul eax, eax, 0x7435b51
cmp eax, 0xea303267
je 0x1400c0fa0
test ebp, ebp
je 0x1400c0fc6
xor edx, edx
jmp 0x1400c11ac
mov r14, qword [rsp + 0x28]
mov eax, dword [0x141dda6bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x70], 0
je 0x1400c1060
mov eax, dword [0x141dda6bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x78]
mov eax, dword [str.UJ_]
xor edx, edx
div dword [0x141dd47dc]
nop
mov eax, dword [0x141dd47e0]
add eax, dword [0x141dd47e4]
xor eax, 0xc0935300
and eax, 0xe9935312
add eax, 0xef683d8f
cmp eax, 0xe384d364
ja 0x1400c1010
mov eax, dword [0x141dda6bc]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov rax, qword [rax + 0x80]
jmp 0x1400c1186
mov eax, dword [0x141dd47b8]
sub eax, dword [0x141dd47bc]
imul rax, rax, 0xcf215b1
shr rax, 0x39
add eax, 0x870ec29a
cmp eax, 0x93a3e70b
ja 0x1400c1060
mov eax, dword [0x141dd47c0]
add eax, dword [0x141dd47c4]
imul eax, eax, 0x5b3ad93
add eax, 0x9c815722
and eax, 0x8309a1da
cmp eax, 0x2caa4f6b
je 0x1400c1113
mov eax, dword [0x141dd47c8]
add eax, dword [0x141dd47cc]
xor eax, 0x75fa389c
imul rbx, rax, 0x459f8f65
shr rbx, 0x3e
or ebx, 0x9bb56848
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
mov edx, 0x10
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x141dda6bc]
mov rdx, qword gs:[0x58]
mov rdx, qword [rdx + rax*8]
mov rax, qword [rsp + 0x48]
mov byte [rdx + 0x70], 1
mov qword [rdx + 0x80], rax
cmp ebx, 0x52cd038f
jae 0x1400c1160
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
mov edx, 0x10
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov rax, qword [rsp + 0x48]
mov ecx, dword [0x141dda6bc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov byte [rcx + 0x70], 1
mov qword [rcx + 0x80], rax
jmp 0x1400c10a6
mov edx, dword [0x141dd47d0]
xor edx, dword [0x141dd47d4]
or edx, 0x10912d49
imul edx, edx, 0x854fa6b2
or edx, 0xcc5f4132
cmp edx, 0x9a233e9c
jb 0x1400c1160
lea rdx, [rcx + 1]
mov r8d, dword [0x141dda6bc]
mov r9, qword gs:[0x58]
mov r8, qword [r9 + r8*8]
mov qword [r8 + 0x78], rdx
lea rdx, [0x141db8ae0]
mov r8d, dword [0x141dd47e8]
imul r8d, dword [0x141dd47ec]
add r8d, 0x76daff04
and r8d, 0x84400ea0
cmp r8d, 0x4378f95a
ja 0x1400c122c
mov r8d, dword [0x141dd47f0]
and r8d, dword [0x141dd47f4]
add r8d, 0x574d4d23
mov qword [rsi + 0x90], rdx
xorps xmm0, xmm0
movups xmmword [rsi + 0x98], xmm0
mov qword [rsi + 0xa8], 0
mov qword [rsi + 0xb0], rcx
mov qword [rsi + 0xb8], rax
mov qword [rsi + 0xc0], r14
mov qword [rsi + 0xc8], 0
cmp r8d, 0x1df63ac9
jae 0x1400c126d
mov qword [rsi + 0x90], rdx
xorps xmm0, xmm0
movups xmmword [rsi + 0x98], xmm0
mov qword [rsi + 0xa8], 0
mov qword [rsi + 0xb0], rcx
mov qword [rsi + 0xb8], rax
mov qword [rsi + 0xc0], r14
mov qword [rsi + 0xc8], 0
jmp 0x1400c11d2
test ebp, ebp
jne 0x1400c14e0
nop word cs:[rax + rax]
mov eax, dword [0x141dd4808]
xor eax, dword [0x141dd480c]
and eax, 0xdb8bc40e
imul rcx, rax, 0x14905e75
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
or eax, 0x4710792
cmp eax, 0x768c1fdb
ja 0x1400c1280
movzx eax, byte [0x141dda6b8]
mov edx, 0x1e
xor ecx, ecx
call fcn.1400bf230
mov r14, rax
nop word [rax + rax]
mov eax, dword [0x141dd4810]
xor edx, edx
div dword [0x141dd4814]
cmp eax, 0xc49382ab
je 0x1400c12d0
test r14, r14
movzx ebp, byte [rsp + 0x27]
je 0x1400c1447
movups xmm0, xmmword [0x141db8c0e]
movups xmmword [r14 + 0xe], xmm0
movups xmm0, xmmword [0x141db8c00]
movups xmmword [r14], xmm0
mov eax, dword [0x141dd4820]
imul eax, dword [0x141dd4824]
mov qword [rsp + 0x28], 0x1e
add eax, 0x7f760e4b
or eax, 0xf968f29b
cmp eax, 0x25580fd7
jae 0x1400c1360
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0x1e
movzx eax, byte [0x141dda6b8]
mov edx, 5
xor ecx, ecx
call fcn.1400bf230
nop word cs:[rax + rax]
mov eax, dword [0x141dd4828]
imul eax, dword [0x141dd482c]
imul ebx, eax, 0x3097773f
add ebx, 0xd2420162
xor ebx, 0x6c8a07f6
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0x1e
movzx eax, byte [0x141dda6b8]
mov edx, 5
xor ecx, ecx
call fcn.1400bf230
cmp ebx, 0x91cc1603
jb 0x1400c1360
test rax, rax
je 0x1400c1480
xor ecx, ecx
test cl, cl
je 0x1400c13cf
mov byte [rax + 4], 0x30
mov dword [rax], 0x5f746f74
mov qword [rsp + 0x40], 5
mov qword [rsp + 0x48], rax
lea r15, [rsi + 0x18]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd4840]
and ecx, dword [0x141dd4844]
and ecx, 0x2df3676e
imul ecx, ecx, 0x33e44022
mov byte [rax + 4], 0x30
mov dword [rax], 0x5f746f74
mov qword [rsp + 0x40], 5
mov qword [rsp + 0x48], rax
cmp ecx, 0x31fab0a0
je 0x1400c13e0
mov eax, dword [0x141dd4848]
sub eax, dword [0x141dd484c]
mov qword [rsp + 0x50], 5
or eax, 0x145f5d3a
xor eax, 0x253dc07f
cmp eax, 0x964d8ed
jae 0x1400c1af0
jmp 0x1400c1b35
ud2
mov eax, dword [0x141dd4830]
add eax, dword [0x141dd4834]
imul eax, eax, 0xfb1ea880
mov ecx, 0xca1b09a3
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0xfa2088b1
jbe 0x1400c14a9
ud2
mov eax, dword [0x141dd4838]
add eax, dword [0x141dd483c]
and eax, 0xa02800a4
or eax, 0x43877f59
imul rax, rax, 0x52ab5d7d
shr rax, 0x3e
ud2
mov eax, dword [str._rnH_tE]
imul eax, dword [0x141dd47fc]
or eax, 0x982114c9
xor eax, 0x59d2c54e
imul rax, rax, 0x740f13d7
shr rax, 0x3e
cmp eax, 0xb658e82b
je 0x1400c14e0
mov rcx, qword [rdi]
movzx ebp, byte [rsp + 0x27]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4800]
xor edx, edx
div dword [0x141dd4804]
imul eax, eax, 0xc09de32e
add eax, 0xa2de892e
or eax, 0x18d7eca5
cmp eax, 0x65f74c72
ja 0x1400c1520
test rcx, rcx
je 0x1400c1aae
mov eax, dword [0x141dd4868]
imul eax, dword [0x141dd486c]
add eax, 0x45aa17a4
mov ecx, 0x84ee3625
imul rcx, rax
shr rcx, 0x3d
imul eax, ecx, 0x91670615
cmp eax, 0x8ae951ec
jb 0x1400c15ad
mov ebx, dword [0x141dd4870]
xor ebx, dword [0x141dd4874]
xor ebx, 0x44941b4c
or ebx, 0xaa4b84a3
add ebx, 0x22b78069
mov rcx, qword [rsi + 0xc0]
call qword [sym.imp.pdh.dll_PdhCollectQueryData]
cmp ebx, 0x3ba9e95a
jbe 0x1400c15bc
mov rcx, qword [rsi + 0xc0]
call qword [sym.imp.pdh.dll_PdhCollectQueryData]
jmp 0x1400c157a
xor eax, eax
nop
test al, al
jne 0x1400c15c0
movabs rcx, 0x8000000000000000
nop
mov eax, dword [0x141dd4878]
and eax, dword [0x141dd487c]
and eax, 0xe8d00fdb
cmp eax, 0xe28f0d63
je 0x1400c15d0
cmp qword [rsi + 0x18], rcx
je 0x1400c1648
mov rdx, qword [rsi + 0x20]
mov r8, qword [rsi + 0x28]
mov rcx, rdi
call fcn.1400da010
test eax, eax
je 0x1400c1aca
movss xmm1, dword [0x140101d90]
subss xmm1, xmm0
nop word cs:[rax + rax]
mov eax, dword [0x141dd4888]
or eax, dword [0x141dd488c]
imul eax, eax, 0x562d1b46
or eax, 0x78066535
xor eax, 0x15da8818
cmp eax, 0x54d7ad29
jb 0x1400c1620
movss dword [rsi + 0x30], xmm1
mov eax, dword [0x141dd4890]
sub eax, dword [0x141dd4894]
imul eax, eax, 0xb756b908
shr eax, 3
imul rax, rax, 0x156a9fdd
shr rax, 0x36
and eax, 5
cmp eax, 0xf202e4cd
jbe 0x1400c167c
mov rcx, rsi
mov edx, ebp
call fcn.1400c46a0
mov ebx, 0x98017d61
nop word cs:[rax + rax]
mov eax, dword [0x141dd4898]
xor edx, edx
div dword [0x141dd489c]
mov r14d, eax
and r14d, 0x882002a0
or r14d, 0x675a554e
imul r14, rbx
shr r14, 0x3d
mov rcx, rsi
mov edx, ebp
call fcn.1400c46a0
cmp r14d, 0xa815d984
ja 0x1400c1690
mov rbx, qword [rsi + 8]
mov r14, qword [rsi + 0x10]
imul r15, r14, 0x70
add r15, rbx
test r14, r14
movabs rcx, 0x8000000000000000
je 0x1400c18a0
mov r13d, 0xd173072d
movss xmm6, dword [0x140101d90]
mov r12, rbx
nop dword [rax]
cmp qword [r12 + 0x48], rcx
je 0x1400c17a7
nop dword [rax + rax]
mov eax, dword [0x141dd48e8]
or eax, dword [0x141dd48ec]
add eax, 0x14e11cd9
and eax, 0xe3a49d95
cmp eax, 0xca85e57e
ja 0x1400c1710
mov eax, dword [0x141dd48f0]
xor eax, dword [0x141dd48f4]
imul eax, eax, 0xe21fd557
cmp eax, 0x3ba8102d
jne 0x1400c1800
jmp 0x1400c1830
movabs rcx, 0x8000000000000000
mov eax, dword [0x141dd4910]
imul eax, dword [0x141dd4914]
imul rax, r13
shr rax, 0x3a
cmp eax, 0x501ab91d
je 0x1400c175a
movaps xmm1, xmm6
subss xmm1, xmm0
mov eax, dword [0x141dd4918]
and eax, dword [0x141dd491c]
imul eax, eax, 0xddb6eb63
add eax, 0x53a5f0a6
or eax, 0x1727421
cmp eax, 0x29c2f721
jb 0x1400c177d
movss dword [r12 + 0x60], xmm1
add r12, 0x70
mov eax, dword [str.__e]
imul eax, dword [0x141dd4924]
imul eax, eax, 0x12b5f84a
add eax, 0x38795f3f
cmp eax, 0x29544bca
jb 0x1400c17ab
nop word [rax + rax]
mov eax, dword [0x141dd4928]
imul eax, dword [0x141dd492c]
imul eax, eax, 0x47833b03
add eax, 0xf3693152
cmp eax, 0x5b98b82f
jb 0x1400c17d0
cmp r12, r15
jne 0x1400c1700
jmp 0x1400c18a0
mov eax, dword [0x141dd48f8]
xor edx, edx
div dword [0x141dd48fc]
mov ebp, eax
add ebp, 0x2031376a
mov rdx, qword [r12 + 0x50]
mov r8, qword [r12 + 0x58]
mov rcx, rdi
call fcn.1400da010
cmp ebp, 0x5048be1c
jbe 0x1400c1850
mov rdx, qword [r12 + 0x50]
mov r8, qword [r12 + 0x58]
mov rcx, rdi
call fcn.1400da010
jmp 0x1400c1800
test eax, eax
jne 0x1400c1750
mov eax, dword [0x141dd4900]
sub eax, dword [0x141dd4904]
or eax, 0xaf5d6b3
add eax, 0xd68424b4
or eax, 0xe2f2a935
cmp eax, 0xe3b88d5a
jne 0x1400c1880
ud2
mov eax, dword [0x141dd4908]
or eax, dword [0x141dd490c]
and eax, 0x86fb82da
ud2
mov eax, dword [0x141dd48a0]
xor eax, dword [0x141dd48a4]
imul rcx, rax, 0x37f627af
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1b
and eax, 6
cmp eax, 0xff75acd8
ja 0x1400c18a0
cmp byte [rsp + 0x27], 0
je 0x1400c1aae
mov eax, dword [0x141dd48a8]
xor edx, edx
div dword [0x141dd48ac]
nop word cs:[rax + rax]
mov eax, dword [0x141dd48b0]
imul eax, dword [0x141dd48b4]
xor eax, 0x20231020
or eax, 0x9f98a8db
cmp eax, 0x8f8b93e
jb 0x1400c18f0
movzx eax, byte [rsi + 0x38]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd48b8]
imul ecx, dword [0x141dd48bc]
xor ecx, 0x20030001
or ecx, 0x5fdcfffe
cmp ecx, 0x8741eec4
ja 0x1400c1920
test al, al
jne 0x1400c1aae
mov eax, dword [0x141dd48c0]
sub eax, dword [0x141dd48c4]
cmp eax, 0xb8a836a
jne 0x1400c1969
lea rcx, [rsp + 0x40]
mov rdx, r14
call fcn.1400d7c90
lea rdi, [rsp + 0x40]
nop
mov eax, dword [0x141dd48c8]
add eax, dword [0x141dd48cc]
imul rax, rax, 0x6215e16b
shr rax, 0x3c
xor eax, 0xbf148e69
imul ebp, eax, 0xe0399f18
mov rcx, rdi
mov rdx, r14
call fcn.1400d7c90
cmp ebp, 0x40a7e943
je 0x1400c1970
nop word cs:[rax + rax]
test r14, r14
sete al
mov r8d, dword [0x141dd48d0]
and r8d, dword [0x141dd48d4]
add r8d, 0x25145c3
or r8d, 0xc5edd4e6
mov rcx, qword [rsp + 0x50]
test rcx, rcx
sete dl
cmp r8d, 0x5d6932dc
jb 0x1400c19b0
or al, dl
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
jne 0x1400c1a6c
lea rcx, [r8 + rcx*8]
xor edx, edx
mov r9, r8
nop dword [rax]
mov r10d, dword [0x141dd48e0]
xor r10d, dword [0x141dd48e4]
and r10d, 0x7f5953ab
imul r10d, r10d, 0xf49fbc94
add r10d, 0x1796d68
cmp r10d, 0x257a2329
jae 0x1400c1a40
mov r10, qword [r9]
mov qword [rbx + 0x68], r10
nop word cs:[rax + rax]
lea r10, [rbx + 0x70]
lea r11, [r9 + 8]
mov rdi, qword [r9]
mov qword [rbx + 0x68], rdi
cmp r10, r15
sete dil
cmp r11, rcx
sete bpl
test dl, dl
jne 0x1400c1a40
or dil, bpl
mov r9, r11
mov rbx, r10
je 0x1400c1a00
test rax, rax
je 0x1400c1a80
mov rcx, qword [0x141dda6a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [rsi + 0x38], 1
nop word cs:[rax + rax]
mov eax, dword [0x141dd48d8]
sub eax, dword [0x141dd48dc]
imul eax, eax, 0x90d7a40
add eax, 0x9fd798ac
cmp eax, 0xa93533b9
jae 0x1400c1a90
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
mov eax, dword [0x141dd4850]
imul eax, dword [0x141dd4854]
or eax, 0x72eda6e4
imul ebx, eax, 0x4f316b7c
or ebx, 0xb615da46
lea rcx, [rsp + 0x28]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov r8, r15
call fcn.1400d86f0
mov rcx, rsi
mov edx, ebp
call fcn.1400c46a0
cmp ebx, 0x9ffe7b3b
jne 0x1400c1b56
lea rcx, [rsp + 0x28]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov r8, r15
call fcn.1400d86f0
mov rcx, rsi
mov edx, ebp
call fcn.1400c46a0
jmp 0x1400c1af0
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400c14e0
mov r15, qword [rsi + 8]
nop word [rax + rax]
mov ecx, dword [0x141dd4858]
or ecx, dword [0x141dd485c]
xor ecx, 0x440efa58
imul rcx, rcx, 0x707dd51d
shr rcx, 0x3e
imul ecx, ecx, 0x3e460f61
cmp ecx, 0x297ae35b
jb 0x1400c1b70
nop dword [rax + rax]
mov ecx, dword [0x141dd4860]
or ecx, dword [0x141dd4864]
imul ecx, ecx, 0x87000e2e
add ecx, 0xc21053f8
or ecx, 0x48a5a86a
cmp ecx, 0x8eef5941
ja 0x1400c1ba0
add r15, 0x48
imul rbx, rax, 0x70
xor r12d, r12d
nop word cs:[rax + rax]
mov qword [rsp + 0x78], r12
inc r12
lea r13, [rsp + 0x78]
mov qword [rsp + 0x28], r13
lea rbp, [0x140054720]
mov qword [rsp + 0x30], rbp
lea rax, [0x141db8c38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rcx, [rsp + 0x80]
mov r14, rdi
lea rdi, [rsp + 0x40]
mov rdx, rdi
call fcn.140038da0
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rbp
lea rax, [0x141db8c60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea r13, [rsp + 0x98]
mov rcx, r13
mov rdx, rdi
mov rdi, r14
call fcn.140038da0
lea rcx, [rsp + 0x80]
mov rdx, r14
mov r8, r15
mov r9, r13
call fcn.1400d86f0
add r15, 0x70
add rbx, 0xffffffffffffff90
jne 0x1400c1be0
jmp 0x1400c14e0