Function at 0x14000346c
Capabilities:
Encode data using xor

Disassembly:
lea rdx, [0x1400040d1]
mov r8d, 0xe
lea rax, [rsp + 0x70]
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xbf], 0xe5
mov rcx, qword [rsp + 0xb0]
call sym.ReAgent.dll_WinReHashWimFile
mov rcx, qword [rsp + 0xb0]
call fcn.1400025f0
xor r8d, r8d
mov ecx, r8d
mov r9w, word [rsp + 0x4e]
or r9w, 0x47eb
mov word [rsp + 0xce], r9w
mov r8d, dword [rsp + 0xb8]
mov r10d, dword [rsp + 0xb8]
mov eax, 0x44000000
mov bl, byte [rsp + 0xbf]
mov qword [rsp + 0x40], rax
mov al, r11b
mul byte [rsp + 0xbf]
mov esi, dword [rsp + 0x60]
add r8d, 0xe7fd3184
add r10d, 0xe7fd4180
mov byte [rsp + 0xbf], al
mov esi, esi
mov edx, esi
mov dword [rsp + 0x3c], r8d
mov r8d, r10d
mov r9d, dword [rsp + 0x3c]
mov rdi, qword [rsp + 0x40]
call rdi
mov r8d, 0x1802ce80
mov qword [rsp + 0xa0], rax
mov bx, word [rsp + 0x4e]
imul bp, bx, 0xfccd
mov r9d, dword [rsp + 0xb8]
mov word [rsp + 0xce], bp
xor bx, 0xffff
sub r8d, r9d
mov word [rsp + 0xce], bx
mov qword [rsp + 0x68], 0
mov dword [rsp + 0xac], r8d
mov bx, word [rsp + 0x4e]
add bx, 0x305a
mov word [rsp + 0xce], bx
jmp 0x140003413
xor eax, eax
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], 0x2a10
mov dx, word [rsp + 0x4e]
imul r8w, dx, 0xe51f
mov word [rsp + 0xce], r8w
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rax, section..data
mov ecx, dword [rsp + 0xac]
mov dl, byte [rsp + 0xbf]
xor dl, 0xff
mov byte [rsp + 0xbf], dl
mov r8, qword [rsp + 0x68]
imul r9, r8, 0x68
mov r10, rax
add r10, r9
add r10, 4
mov r11d, dword [r10]
mov si, word [rsp + 0x4e]
xor si, 0xffff
mov word [rsp + 0xce], si
imul r9, r8, 0x68
mov r10, rax
add r10, r9
add r10, 0x60
mov edi, dword [rsp + 0xc8]
add byte [rax], al
or edi, dword [rsp + 0xc8]
mov rdx, qword [r10]
mov dword [rsp + 0xc8], edi
imul r9, r8, 0x68
add rax, r9
mov edi, dword [rax]
mov dword [rsp + 0xc8], 0x10242e80
xor edi, r11d
mov r11d, ecx
mov eax, r11d
mov r9, qword [rsp + 0xa0]
mov dword [rsp + 0xc8], 0x762859b
mov r11d, edi
mov r10d, r11d
add r9, rax
mov dword [rsp + 0x38], ecx
mov rcx, r9
mov qword [rsp + 0x30], r8
mov r8, r10
mov dword [rsp + 0x2c], edi
call fcn.140002ca0
mov bl, byte [rsp + 0xbf]
xor bl, 0x5b
mov byte [rsp + 0xbf], bl
mov r11d, dword [rsp + 0x2c]
mov edi, dword [rsp + 0x38]
add r11d, edi
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xac], r11d
cmp rax, 0x54
jne 0x140003413
mov rax, qword [rsp + 0xa0]
mov r8d, dword [rsp + 0x60]
mov rcx, rax
mov rdx, rax
call fcn.1400014e0
inc dword [rcx - 0x48]
invalid
jne 0x1400034c3
jne 0x140003570
mov eax, eax
mov dword [rsp + 0xc8], 0x479703f9
mov r9w, word [rsp + 0x4e]
add r9w, 0xb75
mov rcx, qword [rsp + 0xa0]
mov word [rsp + 0xce], r9w
mov r10b, byte [rsp + 0xbf]
sub rax, qword [rsp + 0xd0]
add rcx, 0x36da
mov rdx, qword [rsp + 0x98]
mov byte [rsp + 0xbf], r10b
mov r11, qword [rsp + 0x50]
mov qword [r11], rcx
mov qword [rsp + 0xc0], 0x36c9803f
mov qword [r11 + 8], rax
mov rax, qword [rsp + 0xa0]
mov dword [rsp + 0xc8], 0xf64d2b0
add rax, 0x592
mov qword [r11 + 0x10], rax
cmp rdx, 0x78089fad
jbe 0x1400033e4
jmp 0x140003636
lea rax, section..data
mov rcx, qword [rsp + 0x58]
mov edx, dword [rsp + 0xc8]
mov r8d, dword [rsp + 0xc8]
mov r9d, dword [rsp + 0x64]
add edx, r8d
mov dword [rsp + 0xc8], edx
imul r10, rcx, 0x68
mov r11, rax
add r11, r10
add r11, 4
imul r10, rcx, 0x68
add rax, r10
mov edx, dword [rax]
xor edx, dword [r11]
add edx, r9d
mov rax, qword [rsp + 0xd0]
add rax, 0xffffffff8a6cf2f1
mov dword [rsp + 0x60], edx
and al, 0x60
and al, 0x60
add rcx, 1
mov qword [rsp + 0x58], rcx
mov edx, dword [rsp + 0x60]
mov dword [rsp + 0x64], edx
cmp rcx, rax
je 0x1400032d9
jmp 0x1400035c1
call fcn.140001550
nop
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
ret