Function at 0x14002ffd0
Capabilities:
Encode data using xor
Hash data using sha1
Hash data using sha256
Hash data using sha384

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov r9d, dword [rcx + 0x17c]
mov edx, r9d
mov r11, qword [rbx + 0xd8]
and edx, 2
mov r8, qword [rbx + 0xf0]
mov eax, edx
or rax, 1
lea rdi, [r11 + rax*4]
lea rax, [rdx*4]
or rax, 7
cmp rax, r8
ja 0x14002fd78
movzx eax, byte [rdi]
movzx r10d, byte [rdi + 1]
test r9b, 2
je 0x14002fd2e
mov edx, 0x101
sub edx, eax
mov eax, pe_nt_image_headers64
sub eax, r10d
cmp r10d, 0xff
lea r9d, [rax + 1]
cmovne r9d, eax
jmp 0x14002fd33
mov edx, eax
mov r9d, r10d
cmp edx, 3
jl 0x14002ff77
cmp r9d, 2
jl 0x14002ff77
movzx eax, byte [rcx + 0x178]
cmp edx, eax
jg 0x14002ff77
movzx eax, byte [rcx + 0x179]
cmp r9d, eax
jg 0x14002ff77
movzx ebp, byte [rdi + 2]
add rdi, 3
sub r8, rdi
add r8, r11
cmp r8, rbp
jge 0x14002fdbb
test rcx, rcx
je 0x14002fdb1
mov rax, qword [rbx + 0x160]
mov dl, 1
mov dword [rbx + 0x168], 0x15
mov rcx, rbx
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], 0x32
call fcn.14000f210
mov eax, 0xffff8680
jmp 0x14002ffb5
mov rcx, qword [rbx + 0x70]
mov rcx, qword [rcx + 0x3b0]
call fcn.14004f7d8
mov rdx, rbp
mov ecx, 1
call fcn.14004f6f4
mov rcx, qword [rbx + 0x70]
mov qword [rcx + 0x3b0], rax
mov rax, qword [rbx + 0x70]
mov rcx, qword [rax + 0x3b0]
test rcx, rcx
jne 0x14002fdfd
mov eax, 0xffff8100
jmp 0x14002ffb5
mov r8, rbp
mov rdx, rdi
call fcn.14004e150
mov rax, qword [rbx + 0x70]
xor ecx, ecx
mov byte [rax + 0x3b8], bpl
mov rax, qword [rbx + 0x70]
mov dword [rbx + 8], 1
mov qword [rax + 0x484], rcx
mov dword [rax + 0x48c], 0x67452301
mov dword [rax + 0x490], 0xefcdab89
mov dword [rax + 0x494], 0x98badcfe
mov dword [rax + 0x498], 0x10325476
mov rax, qword [rbx + 0x70]
add rax, 0x4dc
mov qword [rax], rcx
mov dword [rax + 8], 0x67452301
mov dword [rax + 0xc], 0xefcdab89
mov dword [rax + 0x10], 0x98badcfe
mov dword [rax + 0x14], 0x10325476
mov dword [rax + 0x18], 0xc3d2e1f0
mov rax, qword [rbx + 0x70]
add rax, 0x538
mov qword [rax], rcx
mov dword [rax + 0x68], ecx
mov dword [rax + 8], 0x6a09e667
mov dword [rax + 0xc], 0xbb67ae85
mov dword [rax + 0x10], 0x3c6ef372
mov dword [rax + 0x14], 0xa54ff53a
mov dword [rax + 0x18], 0x510e527f
mov dword [rax + 0x1c], 0x9b05688c
mov dword [rax + 0x20], 0x1f83d9ab
mov dword [rax + 0x24], 0x5be0cd19
mov rax, qword [rbx + 0x70]
mov qword [rax + 0x5a8], rcx
mov qword [rax + 0x5b0], rcx
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax + 0x5b8], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 0x5c0], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x5c8], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x5d0], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x5d8], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x5e0], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x5e8], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x5f0], rcx
mov rcx, rbx
mov dword [rax + 0x678], 1
call fcn.14000ee90
xor eax, eax
jmp 0x14002ffb5
test rcx, rcx
je 0x14002ffb0
mov rax, qword [rbx + 0x160]
mov dl, 1
mov dword [rbx + 0x168], 0x15
mov rcx, rbx
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], 0x46
call fcn.14000f210
mov eax, 0xffff9180
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
push rbx
push r13
sub rsp, 0x38
xor r13d, r13d
mov rbx, rcx
lea edx, [r13 + 1]
call fcn.14000fca0
test eax, eax
jne 0x1400302e6
cmp dword [rbx + 0xe8], 0x16
mov qword [rsp + 0x68], rdi
mov rdi, qword [rbx + 0xd8]
je 0x14003008e
cmp dword [rbx + 0xc], 1
jne 0x140030043
mov ecx, dword [rbx + 0x10]
mov rax, qword [rbx]
inc ecx
mov dword [rbx + 0x10], ecx
mov edx, dword [rax + 0x164]
test edx, edx
js 0x140030027
cmp ecx, edx
jg 0x14003007c
mov rdi, qword [rsp + 0x68]
mov eax, 0xffff9500
mov dword [rbx + 0x12c], 1
add rsp, 0x38
pop r13
pop rbx
ret
cmp qword [rbx], r13
je 0x14003007c
mov rax, qword [rbx + 0x160]
mov dl, 1
mov dword [rbx + 0x168], 0x15
mov rcx, rbx
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], 0xa
call fcn.14000f210
mov rdi, qword [rsp + 0x68]
mov eax, 0xffff8900
add rsp, 0x38
pop r13
pop rbx
ret
mov rax, qword [rbx]
mov rcx, rax
test byte [rax + 0x17c], 2
je 0x1400300e2
cmp byte [rdi], 3
jne 0x1400300b6
mov rcx, rbx
mov rdi, qword [rsp + 0x68]
add rsp, 0x38
pop r13
pop rbx
jmp 0x14002fcb0
mov rcx, qword [rbx + 0x70]
mov rcx, qword [rcx + 0x3b0]
call fcn.14004f7d8
mov rax, qword [rbx + 0x70]
mov qword [rax + 0x3b0], r13
mov rax, qword [rbx + 0x70]
mov byte [rax + 0x3b8], r13b
mov rax, qword [rbx]
mov rcx, rax
mov edx, dword [rax + 0x17c]
mov r9d, 0x32
mov r8d, edx
mov eax, r9d
and r8d, 2
mov r11d, 0x2a
cmove eax, r11d
cmp qword [rbx + 0x120], rax
jb 0x140030a2d
cmp byte [rdi], 2
jne 0x140030a2d
and edx, 2
mov qword [rsp + 0x20], r15
or rdx, 1
movzx eax, byte [rdi + rdx*4]
lea r15, [rdi + rdx*4]
test r8d, r8d
je 0x14003015f
mov r8d, 0x101
mov edx, pe_nt_image_headers64
sub r8d, eax
mov dword [rbx + 0x14], r8d
movzx eax, byte [r15 + 1]
sub edx, eax
mov dword [rbx + 0x18], edx
cmp edx, 1
jne 0x14003016d
mov dword [rbx + 0x18], 2
lea edx, [r9 - 0x30]
jmp 0x14003016d
mov dword [rbx + 0x14], eax
mov r8d, eax
movzx edx, byte [r15 + 1]
mov dword [rbx + 0x18], edx
movzx eax, byte [rcx + 0x17a]
cmp r8d, eax
jl 0x1400309dd
movzx eax, byte [rcx + 0x17b]
cmp edx, eax
jl 0x1400309dd
movzx eax, byte [rcx + 0x178]
cmp r8d, eax
jg 0x1400309dd
movzx eax, byte [rcx + 0x179]
cmp edx, eax
jg 0x1400309dd
mov rax, qword [rbx + 0x70]
movups xmm0, xmmword [r15 + 2]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x60], rsi
movups xmmword [rax + 0x6d0], xmm0
mov qword [rsp + 0x30], r12
movups xmm1, xmmword [r15 + 0x12]
mov qword [rsp + 0x28], r14
movups xmmword [rax + 0x6e0], xmm1
movzx r14d, byte [r15 + 0x22]
cmp r14, 0x20
jbe 0x14003021e
cmp qword [rbx], r13
je 0x1400302c3
mov rax, qword [rbx + 0x160]
mov dword [rbx + 0x168], 0x15
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], r9b
jmp 0x1400302b9
mov rcx, qword [rbx]
mov eax, 0x33
mov r8, qword [rbx + 0x120]
mov r10d, 0x2b
mov edx, dword [rcx + 0x17c]
and edx, 2
cmove eax, r10d
add rax, r14
cmp r8, rax
jbe 0x1400302ee
movzx eax, byte [r14 + r15 + 0x27]
movzx r9d, byte [r14 + r15 + 0x26]
shl r9, 8
or r9, rax
mov qword [rsp + 0x58], r9
lea rax, [r9 - 1]
cmp rax, 2
jbe 0x14003028a
test edx, edx
mov eax, 0x34
mov r10d, 0x2c
cmove eax, r10d
add rax, r9
add rax, r14
cmp r8, rax
je 0x140030301
test rcx, rcx
je 0x1400302c3
mov rax, qword [rbx + 0x160]
mov dword [rbx + 0x168], 0x15
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], 0x32
mov dl, 1
mov rcx, rbx
call fcn.14000f210
mov eax, 0xffff8680
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x68]
add rsp, 0x38
pop r13
pop rbx
ret
test edx, edx
cmove r9, r11
add r9, r14
cmp r8, r9
jne 0x14003028a
mov qword [rsp + 0x58], r13
movzx ebp, byte [r14 + r15 + 0x23]
lea r12, [r14 + r15]
movzx eax, byte [r12 + 0x24]
shl ebp, 8
or ebp, eax
cmp byte [r12 + 0x25], r13b
je 0x140030360
test rcx, rcx
je 0x140030356
mov rax, qword [rbx + 0x160]
mov dl, 1
mov dword [rbx + 0x168], 0x15
mov rcx, rbx
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], 0x2f
call fcn.14000f210
mov eax, 0xffff8f80
jmp 0x1400302c8
lea rdi, [0x140068c00]
mov esi, 0xcca8
mov rcx, rdi
mov eax, esi
cmp eax, ebp
je 0x140030383
mov eax, dword [rcx + 0x30]
add rcx, 0x30
test eax, eax
jne 0x140030371
mov rcx, r13
mov rax, qword [rbx + 0x70]
mov qword [rax + 0x6a0], rcx
mov rdx, qword [rbx + 0x70]
mov rcx, qword [rdx + 0x6a0]
test rcx, rcx
jne 0x1400303e1
cmp qword [rbx], r13
je 0x1400303d7
mov rax, qword [rbx + 0x160]
mov dl, 1
mov dword [rbx + 0x168], 0x15
mov rcx, rbx
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], 0x50
call fcn.14000f210
mov eax, 0xffff8f00
jmp 0x1400302c8
cmp dword [rbx + 0x18], 3
jge 0x1400303f0
lea rax, [0x14000a090]
jmp 0x140030406
cmp dword [rcx + 0x14], 7
lea rax, [0x14000a0e0]
lea r8, [0x14000a0f0]
cmove rax, r8
mov qword [rdx + 0x680], rax
mov r13, qword [rbx + 0x70]
cmp dword [r13 + 0xb14], 0
je 0x1400304b5
test r14, r14
je 0x1400304b5
cmp dword [rbx + 0xc], 0
jne 0x1400304b5
mov rcx, qword [rbx + 0x68]
cmp dword [rcx + 8], ebp
jne 0x1400304b5
cmp dword [rcx + 0xc], 0
jne 0x1400304b5
cmp qword [rcx + 0x10], r14
jne 0x1400304b5
lea rdx, [r15 + 0x23]
add rcx, 0x18
mov r8, r14
call fcn.14005dd10
test eax, eax
jne 0x1400304b5
mov rcx, rbx
mov dword [rbx + 8], 0xc
call fcn.140008fb0
mov ebp, eax
test eax, eax
je 0x1400304ff
cmp qword [rbx], 0
je 0x1400304ae
mov rcx, qword [rbx + 0x160]
mov dl, 1
mov dword [rbx + 0x168], 0x15
mov qword [rbx + 0x170], 2
mov byte [rcx], 2
mov rcx, qword [rbx + 0x160]
mov byte [rcx + 1], 0x50
mov rcx, rbx
call fcn.14000f210
mov eax, ebp
jmp 0x1400302c8
inc dword [rbx + 8]
xor ecx, ecx
mov dword [r13 + 0xb14], 0
call fcn.140052828
mov rcx, qword [rbx + 0x68]
lea rdx, [r15 + 0x23]
mov r8, r14
mov qword [rcx], rax
mov rax, qword [rbx + 0x68]
mov dword [rax + 8], ebp
xor ebp, ebp
mov rax, qword [rbx + 0x68]
mov dword [rax + 0xc], ebp
mov rax, qword [rbx + 0x68]
mov qword [rax + 0x10], r14
mov rcx, qword [rbx + 0x68]
add rcx, 0x18
call fcn.14004e150
jmp 0x140030501
xor ebp, ebp
movsxd r10, dword [rbx + 0x18]
mov r8, qword [rbx]
mov rdx, qword [r8 + r10*8]
cmp dword [rdx], 0
je 0x140030532
mov r11, qword [rbx + 0x68]
mov rcx, rbp
mov r9d, dword [r11 + 8]
nop dword [rax]
mov eax, dword [rdx + rcx]
lea rcx, [rcx + 4]
cmp eax, r9d
je 0x140030570
cmp dword [rdx + rcx], 0
jne 0x140030520
test r8, r8
je 0x1400302c3
mov rax, qword [rbx + 0x160]
mov dword [rbx + 0x168], 0x15
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], 0x2f
jmp 0x1400302b9
cmp esi, r9d
je 0x140030582
mov esi, dword [rdi + 0x30]
add rdi, 0x30
test esi, esi
jne 0x140030570
jmp 0x140030532
test rdi, rdi
je 0x140030532
cmp dword [rdi + 0x20], r10d
jg 0x140030532
cmp dword [rdi + 0x28], r10d
jl 0x140030532
mov eax, dword [r8 + 0x17c]
test al, 2
je 0x1400305a4
test byte [rdi + 0x2c], 4
jne 0x140030532
test al, 0x40
je 0x1400305ae
cmp dword [rdi + 0x10], 0x2a
je 0x140030532
mov eax, dword [rdi + 0x18]
add eax, 0xfffffffb
cmp eax, 3
ja 0x1400305f1
cmp qword [r8 + 0x140], 0
je 0x140030532
cmp qword [r8 + 0x148], 0
je 0x140030532
cmp qword [r8 + 0x130], 0
je 0x140030532
cmp qword [r8 + 0x138], 0
je 0x140030532
mov rdi, qword [rsp + 0x58]
add r12, 0x28
mov dword [r11 + 0xc], ebp
test rdi, rdi
je 0x140030975
nop word [rax + rax]
movzx edx, byte [r12 + 2]
movzx eax, byte [r12 + 3]
shl edx, 8
or edx, eax
lea esi, [rdx + 4]
cmp rsi, rdi
ja 0x1400309a8
movzx ecx, byte [r12]
movzx eax, byte [r12 + 1]
shl ecx, 8
or ecx, eax
cmp ecx, 0x16
ja 0x14003079d
je 0x140030765
sub ecx, 1
je 0x140030738
sub ecx, 3
je 0x14003070a
sub ecx, 7
je 0x140030689
cmp ecx, 5
jne 0x140030958
mov r8d, edx
mov rcx, rbx
lea rdx, [r12 + 4]
call fcn.14002fb00
test eax, eax
jne 0x1400302c8
jmp 0x140030958
mov r8d, edx
test edx, edx
je 0x1400309a8
movzx ecx, byte [r12 + 4]
lea rax, [rcx + 1]
cmp rax, r8
jne 0x1400309a8
lea rax, [r12 + 5]
test rcx, rcx
je 0x1400306c2
movzx edx, byte [rax]
cmp dl, 2
jb 0x1400306fb
inc rax
sub rcx, 1
jne 0x1400306b1
cmp qword [rbx], 0
je 0x1400302c3
mov rax, qword [rbx + 0x160]
mov dword [rbx + 0x168], 0x15
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], 0x28
jmp 0x1400302b9
mov rax, qword [rbx + 0x70]
mov dword [rax + 0x2b8], edx
jmp 0x140030958
mov rax, qword [rbx]
test dword [rax + 0x17c], 0x8000
je 0x1400309b1
test edx, edx
jne 0x1400309b1
mov rax, qword [rbx + 0x68]
mov dword [rax + 0x90], 1
jmp 0x140030958
mov r8, qword [rbx]
mov ecx, dword [r8 + 0x17c]
shr ecx, 7
and ecx, 7
je 0x14003075d
cmp edx, 1
jne 0x14003075d
movzx eax, byte [r12 + 4]
cmp eax, ecx
je 0x140030958
test r8, r8
jmp 0x1400306c6
mov rax, qword [rbx]
test dword [rax + 0x17c], 0x400
je 0x1400309b1
cmp dword [rbx + 0x18], 0
je 0x1400309b1
test edx, edx
jne 0x1400309b1
mov rax, qword [rbx + 0x68]
mov dword [rax + 0x94], 1
jmp 0x140030958
cmp ecx, 0x17
je 0x140030931
cmp ecx, 0x23
je 0x140030906
cmp ecx, 0xff01
jne 0x140030958
cmp dword [rbx + 0xc], 0
mov ebp, 1
mov ecx, edx
je 0x1400308f1
mov rax, qword [rbx + 0x1b8]
lea rdx, [rax + rax]
lea rax, [rdx + 1]
cmp rcx, rax
jne 0x1400308b4
movzx eax, byte [r12 + 4]
cmp rax, rdx
jne 0x1400308b4
cmp qword [rbx + 0x1b8], 0
lea r8, [r12 + 5]
lea r9, [rbx + 0x1c0]
mov byte [rsp + 0x58], 0
jbe 0x140030847
mov rdx, r9
sub r8, r9
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
movzx ecx, byte [rdx]
inc rdx
xor cl, al
movzx eax, byte [rsp + 0x58]
or cl, al
mov rax, rdx
sub rax, r9
mov byte [rsp + 0x58], cl
cmp rax, qword [rbx + 0x1b8]
jb 0x140030820
movzx eax, byte [rsp + 0x58]
test al, al
jne 0x1400308b4
mov r8, qword [rbx + 0x1b8]
lea r9, [rbx + 0x1cc]
add r8, 5
mov byte [rsp + 0x58], al
add r8, r12
cmp qword [rbx + 0x1b8], 0
jbe 0x1400308a7
mov rdx, r9
sub r8, r9
nop dword [rax]
movzx eax, byte [r8 + rdx]
movzx ecx, byte [rdx]
inc rdx
xor cl, al
movzx eax, byte [rsp + 0x58]
or cl, al
mov rax, rdx
sub rax, r9
mov byte [rsp + 0x58], cl
cmp rax, qword [rbx + 0x1b8]
jb 0x140030880
movzx eax, byte [rsp + 0x58]
test al, al
je 0x140030958
cmp qword [rbx], 0
je 0x1400302c3
mov rax, qword [rbx + 0x160]
movzx edx, bpl
mov dword [rbx + 0x168], 0x15
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], 0x28
jmp 0x1400302bb
cmp rcx, rbp
jne 0x1400308b4
cmp byte [r12 + 4], 0
jne 0x1400308b4
mov dword [rbx + 0x1b0], ebp
jmp 0x140030958
mov rax, qword [rbx]
test dword [rax + 0x17c], 0x10000
je 0x1400309b1
test edx, edx
jne 0x1400309b1
mov rax, qword [rbx + 0x70]
mov dword [rax + 0xb24], 1
jmp 0x140030958
mov rax, qword [rbx]
test dword [rax + 0x17c], 0x800
je 0x1400309b1
cmp dword [rbx + 0x18], 0
je 0x1400309b1
test edx, edx
jne 0x1400309b1
mov rax, qword [rbx + 0x70]
mov dword [rax + 0xb28], 1
sub rdi, rsi
add r12, rsi
lea rax, [rdi - 1]
cmp rax, 2
jbe 0x1400302c3
test rdi, rdi
jne 0x140030610
mov edx, dword [rbx + 0x1b0]
test edx, edx
jne 0x14003098e
mov rcx, qword [rbx]
mov eax, dword [rcx + 0x17c]
and al, 0x30
cmp al, 0x20
je 0x1400309ce
cmp dword [rbx + 0xc], 1
jne 0x1400309d6
cmp edx, 1
jne 0x1400309b9
test ebp, ebp
jne 0x1400309d6
mov rcx, qword [rbx]
test rcx, rcx
jmp 0x1400306c6
cmp qword [rbx], 0
jmp 0x14003028d
test rax, rax
jmp 0x1400306c6
test edx, edx
jne 0x1400309d6
mov rcx, qword [rbx]
test byte [rcx + 0x17c], 0x30
je 0x1400309ce
cmp ebp, 1
jne 0x1400309d6
test rcx, rcx
jmp 0x1400306c6
xor eax, eax
jmp 0x1400302c8
test rcx, rcx
je 0x140030a16
mov rax, qword [rbx + 0x160]
mov dl, 1
mov dword [rbx + 0x168], 0x15
mov rcx, rbx
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], 0x46
call fcn.14000f210
mov r15, qword [rsp + 0x20]
mov eax, 0xffff9180
mov rdi, qword [rsp + 0x68]
add rsp, 0x38
pop r13
pop rbx
ret
mov rax, qword [rbx + 0x160]
mov dl, 1
mov dword [rbx + 0x168], 0x15
mov rcx, rbx
mov qword [rbx + 0x170], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x160]
mov byte [rax + 1], r9b
call fcn.14000f210
mov rdi, qword [rsp + 0x68]
mov eax, 0xffff8680
add rsp, 0x38
pop r13
pop rbx
ret