Function at 0x140006c80
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
movups xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
imul eax, dword [0x1401efb60], 0x513c7795
imul ecx, dword [0x1401efb64], 0xf7b236fd
add eax, ecx
add eax, 0x5edd5d09
shl rax, 4
lea rax, [rax + rax*2]
call fcn.14004ff50
sub rsp, rax
mov r15, rsp
imul eax, dword [0x1401efb68], 0x5d38281c
imul ecx, dword [0x1401efb6c], 0x612aeb83
add eax, ecx
add eax, 0xc183c961
shl rax, 4
lea rax, [rax + rax*2]
call fcn.14004ff50
sub rsp, rax
mov rdi, rsp
imul eax, dword [0x1401efb70], 0x938ca47a
imul ecx, dword [0x1401efb74], 0x906aaf70
add eax, ecx
add eax, 0x631cc973
lea rax, [rax + rax*2]
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.14004ff50
sub rsp, rax
mov qword [rbp - 0x20], rsp
imul eax, dword [0x1401efb78], 0x96cf2a25
imul ecx, dword [0x1401efb7c], 0xe8f5f756
add eax, ecx
add eax, 0x7770160f
imul rax, rax, 0x1388
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14004ff50
sub rsp, rax
mov r12, rsp
mov ebx, dword [0x140211f48]
sub rsp, 0x20
call fcn.14003ec80
add rsp, 0x20
mov eax, dword [0x1401efb80]
mov ecx, dword [0x1401efb84]
shrd ecx, eax, 0x18
xor ecx, 0x8a43f27c
cmp ebx, ecx
je 0x140007542
cmp qword [0x140211f28], 0
jne 0x140007542
xorps xmm0, xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
mov rax, qword [0x1401efb88]
mov rcx, qword [0x1401efb90]
shrd rcx, rax, 0x1e
movups xmmword [rdi], xmm0
movabs r8, 0x4de711c9e0376262
xor r8, rcx
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
add rsp, 0x20
mov rbx, rax
sub rsp, 0x20
call fcn.14003ecf0
add rsp, 0x20
movabs rax, 0x1b274a7a914a39b1
imul rax, qword [0x1401efb98]
movabs rcx, 0xabc4badf83f6583d
imul rcx, qword [0x1401efba0]
add rcx, rax
movabs r13, 0x7305f6fcb9bd38d4
add r13, rcx
mov r14d, dword [rdi + 0x28]
sub rsp, 0x20
call fcn.14003ed60
add rsp, 0x20
cdqe
lea rcx, [0x14005f5b4]
cmp r14d, dword [rcx + rax*4]
sete al
cmp rbx, r13
mov ecx, 0
mov cl, al
movzx eax, byte [0x1402121c2]
cmovne eax, ecx
test al, 1
je 0x140007542
mov r13d, dword [0x140211f48]
sub rsp, 0x20
call fcn.14003ede0
add rsp, 0x20
cdqe
lea rcx, [0x14005f5c0]
mov eax, dword [rcx + rax*4]
mov dword [rbp - 0x28], eax
mov edi, dword [rdi + 0x24]
sub rsp, 0x20
call fcn.14003ee50
add rsp, 0x20
cdqe
lea rcx, [0x14005f5cc]
mov ebx, dword [rcx + rax*4]
xor ebx, edi
sub rsp, 0x20
call fcn.14003eee0
add rsp, 0x20
cdqe
lea rcx, [0x14005f5d8]
mov r14d, dword [rcx + rax*4]
and r14d, edi
sub rsp, 0x20
call fcn.14003ef60
add rsp, 0x20
imul eax, dword [0x1401efba8], 0x83fe4316
imul ecx, dword [0x1401efbac], 0x46c5170a
add eax, ecx
add eax, 0xceaa2002
cmp r14d, eax
jne 0x1400070bc
sub rsp, 0x20
call fcn.14003efe0
add rsp, 0x20
cdqe
lea rcx, [0x14005f5e4]
mov r14d, dword [rcx + rax*4]
and r14d, ebx
sub rsp, 0x20
call fcn.14003f070
add rsp, 0x20
cdqe
lea rcx, [0x14005f5f0]
mov eax, dword [rcx + rax*4]
and eax, edi
mov qword [rbp - 0x38], r15
mov r15d, eax
or r15d, r14d
sub rsp, 0x20
call fcn.14003f0f0
add rsp, 0x20
cdqe
lea rcx, [0x14005f5fc]
mov dword [rbp - 0x2c], r13d
mov r13d, dword [rcx + rax*4]
xor r13d, r15d
sub rsp, 0x20
call fcn.14003f170
add rsp, 0x20
cdqe
lea rcx, [0x14005f608]
mov r14d, dword [rcx + rax*4]
and r14d, r13d
sub rsp, 0x20
call fcn.14003f1f0
add rsp, 0x20
cdqe
lea rcx, [0x14005f614]
and r15d, dword [rcx + rax*4]
or r15d, r14d
sub rsp, 0x20
call fcn.14003f280
add rsp, 0x20
cdqe
lea rcx, [0x14005f620]
xor r15d, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.14003f310
add rsp, 0x20
cdqe
lea rcx, [0x14005f62c]
and r13d, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.14003f390
add rsp, 0x20
cdqe
lea rcx, [0x14005f638]
xor r13d, dword [rcx + rax*4]
or r13d, r15d
mov r15, qword [rbp - 0x38]
sub rsp, 0x20
call fcn.14003f420
add rsp, 0x20
cdqe
lea rcx, [0x14005f644]
cmp r13d, dword [rcx + rax*4]
mov r14d, dword [rbp - 0x2c]
jne 0x1400070bc
sub rsp, 0x20
call fcn.14003f4b0
add rsp, 0x20
cdqe
lea rcx, [0x14005f650]
and ebx, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.14003f530
add rsp, 0x20
cdqe
lea rcx, [0x14005f65c]
mov eax, dword [rcx + rax*4]
and eax, edi
or eax, ebx
imul ecx, dword [0x1401efbb0], 0x59ac4b39
imul edx, dword [0x1401efbb4], 0xe9eb67b3
mov r8d, dword [0x1401efbb8]
mov r9d, dword [0x1401efbbc]
shrd r9d, r8d, 6
xor r9d, 0xab7fe369
cmp r14d, dword [rbp - 0x28]
lea ecx, [rcx + rdx - 0x29b7334f]
cmovne ecx, r9d
xor ecx, eax
mov ebx, ecx
and ebx, edi
sub rsp, 0x20
call fcn.14003f5c0
add rsp, 0x20
imul eax, dword [0x1401efbc0], 0x431ea387
imul ecx, dword [0x1401efbc4], 0xb0707b8f
add eax, ecx
add eax, 0xeaebe22f
cmp ebx, eax
je 0x140007542
mov rbx, r15
mov rdi, qword [rbp - 0x20]
mov qword [rbp - 0x28], r12
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add rsp, 0x20
mov r14, rax
xorps xmm6, xmm6
movups xmmword [rdi], xmm6
mov qword [rbp - 0x20], rdi
mov qword [rdi + 0x10], 0
movabs rdi, 0xcda2a11b693fc3af
movabs r13, 0x7bd3fedf392e043a
xor r15d, r15d
jmp 0x140007169
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmm2, xmmword [rbx + 0x20]
movups xmmword [rdx + 0x20], xmm2
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
add rdx, 0x30
mov qword [rcx + 8], rdx
nop word cs:[rax + rax]
sub rsp, 0x20
call fcn.14003fba0
call fcn.14003fc30
call fcn.14003fcb0
call fcn.14003fd20
add rsp, 0x20
mov rax, r15
add rax, qword [rbx + 0x18]
mov r15, rax
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jae 0x1400072bd
movups xmmword [rbx + 0x20], xmm6
movups xmmword [rbx + 0x10], xmm6
movups xmmword [rbx], xmm6
mov rax, qword [0x1401efbc8]
mov rcx, qword [0x1401efbd0]
shrd rcx, rax, 0x33
mov r9, rcx
xor r9, rdi
sub rsp, 0x20
mov rcx, r14
mov rdx, r15
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
add rsp, 0x20
mov r12, rax
sub rsp, 0x20
call fcn.14003f640
add rsp, 0x20
mov rax, qword [0x1401efbd8]
movabs rcx, 0xe14f361d5f12ec80
imul rax, rcx
mov rcx, qword [0x1401efbe0]
movabs rdx, 0xdedfbc0255fc8dbe
imul rcx, rdx
add rcx, rax
add rcx, r13
cmp r12, rcx
je 0x1400072bd
sub rsp, 0x20
call fcn.14003f6b0
call fcn.14003f740
call fcn.14003f7c0
call fcn.14003f840
add rsp, 0x20
mov eax, dword [rbx + 0x24]
cmp eax, 0x20
jge 0x140007220
cmp eax, 4
jne 0x140007130
jmp 0x14000722e
cmp eax, 0x40
jge 0x140007228
cmp eax, 0x20
jne 0x140007130
mov r12d, dword [rbx + 0x28]
sub rsp, 0x20
call fcn.14003f8b0
add rsp, 0x20
cdqe
lea rcx, [0x14005f68c]
and r12d, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.14003f920
add rsp, 0x20
mov eax, dword [0x1401efbf0]
mov ecx, dword [0x1401efbf4]
shrd ecx, eax, 0x13
xor ecx, 0x2d71af32
cmp r12d, ecx
je 0x140007130
sub rsp, 0x20
call fcn.14003f9a0
call fcn.14003fa10
call fcn.14003fa90
call fcn.14003fb10
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
jne 0x140007103
nop
sub rsp, 0x20
mov r8, rbx
call fcn.140016b00
add rsp, 0x20
nop
jmp 0x140007130
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rdi]
sub rsp, 0x20
call fcn.14003fda0
call fcn.14003fe10
call fcn.14003fe80
call fcn.14003ff10
add rsp, 0x20
mov rax, qword [rdi + 8]
cmp rbx, rax
mov rdi, qword [rbp - 0x28]
je 0x140007557
mov rcx, rbx
jmp 0x140007313
mov rdx, rcx
add rdx, 0x30
mov rcx, rdx
cmp rdx, rax
je 0x140007557
mov rdx, qword [rcx]
cmp rdx, rsi
jae 0x140007300
mov r8, qword [rcx + 0x18]
lea r9, [r8 + rdx]
cmp r9, rsi
jbe 0x140007300
mov qword [0x140211f28], rdx
mov qword [0x140211f30], r8
sub rsp, 0x20
call fcn.14003ffa0
add rsp, 0x20
movzx eax, byte [0x1401efc10]
movzx ecx, byte [0x1401efc11]
shr cl, 5
shl al, 3
or al, cl
xor al, 0x37
mov byte [0x140211f38], al
nop
sub rsp, 0x20
call fcn.1400501e0
add rsp, 0x20
nop
mov r13d, eax
sub rsp, 0x20
call fcn.140040020
add rsp, 0x20
cdqe
lea rcx, [0x14005f704]
mov eax, dword [rcx + rax*4]
mov dword [rdi + 0x1384], eax
mov dword [rdi + 4], r13d
lea rbx, [0x14005f71c]
lea r14, [0x14005f730]
lea r15, [0x14005f750]
mov r12d, 1
mov eax, r13d
mov rsi, rdi
nop word [rax + rax]
mov r13d, eax
sub rsp, 0x20
call fcn.1400400b0
add rsp, 0x20
cdqe
lea rcx, [0x14005f710]
movzx ecx, byte [rcx + rax*4]
mov edi, r13d
shr edi, cl
xor edi, r13d
sub rsp, 0x20
call fcn.140040130
add rsp, 0x20
cdqe
imul edi, dword [rbx + rax*4]
mov eax, r12d
mov ecx, edi
lea edi, [rax + rcx]
mov dword [rsi + r12*4 + 4], edi
sub rsp, 0x20
call fcn.1400401c0
add rsp, 0x20
cdqe
mov r13, r12
add r13, qword [r14 + rax*8]
sub rsp, 0x20
call fcn.140040250
add rsp, 0x20
movsxd rcx, eax
mov r12, r13
mov eax, edi
cmp r13, qword [r15 + rcx*8]
jne 0x1400073c0
sub rsp, 0x20
call fcn.1400402e0
add rsp, 0x20
cdqe
lea rcx, [0x14005f768]
mov eax, dword [rcx + rax*4]
mov dword [rsi], eax
nop
sub rsp, 0x20
mov rcx, rsi
call fcn.1400173f0
add rsp, 0x20
nop
mov dword [0x140211f3c], eax
sub rsp, 0x20
call fcn.140040360
call fcn.1400403e0
call fcn.140040460
call fcn.1400404f0
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov rbx, qword [rax]
test rbx, rbx
je 0x140007542
mov rsi, qword [rax + 0x10]
sub rsi, rbx
sub rsp, 0x20
call fcn.140040570
add rsp, 0x20
cdqe
lea rcx, [0x14005f7a0]
cmp rsi, qword [rcx + rax*8]
jbe 0x14000751b
mov rdi, qword [rbx - 8]
sub rsp, 0x20
call fcn.1400405e0
add rsp, 0x20
cdqe
lea rcx, [0x14005f7c0]
add rbx, qword [rcx + rax*8]
sub rbx, rdi
sub rsp, 0x20
call fcn.140040670
add rsp, 0x20
cdqe
lea rcx, [0x14005f7e0]
cmp rbx, qword [rcx + rax*8]
jae 0x14000757d
sub rsp, 0x20
call fcn.1400406f0
add rsp, 0x20
cdqe
lea rcx, [0x14005f800]
add rsi, qword [rcx + rax*8]
mov rdx, rsi
mov rcx, rdi
jmp 0x140007521
mov rdx, rsi
mov rcx, rbx
sub rsp, 0x20
call fcn.14004ff08
call fcn.140040760
call fcn.1400407d0
call fcn.140040840
call fcn.1400408b0
add rsp, 0x20
movups xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
imul eax, dword [0x1401efc24], 0xd2cdc192
imul ecx, dword [0x1401efc28], 0xfd9c0f75
add ecx, eax
add ecx, 0xf8687745
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_ExitProcess]
sub rsp, 0x20
call fcn.140052af4
int3