Function at 0x180042030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
lea eax, [rcx - 0xd]
mov r10, r8
mov dword [rbp + 3], eax
mov rbx, rdx
mov r13d, ecx
cmp ecx, eax
jbe case.0x1800420a7.264
mov rsi, qword [rbp - 0x21]
mov rdi, qword [rbp - 0x29]
mov r15d, dword [rbp + 0x67]
mov r14d, dword [rbp + 0x67]
mov r12, qword [rbp - 0x31]
lea eax, [r13 - 0xef]
lea rdx, [0x180000000]
cmp eax, 0x1b
ja case.0x1800420a7.241
mov ecx, dword [rdx + rax*4 + 0x423ec]
add rcx, rdx
jmp rcx
mov ecx, 0x200000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rsi
sub rsi, 4
mov qword [rbp - 0x31], rax
mov r12, rax
mov qword [rbp - 0x21], rsi
test rcx, rcx
je case.0x1800420a7.247
mov rcx, rdi
sub rdi, 4
mov qword [rbp - 0x29], rdi
test rcx, rcx
je case.0x1800420a7.247
test rax, rax
jne case.0x1800420a7.241
mov r13d, 0xf7
jmp case.0x1800420a7.241
xor ecx, ecx
mov qword [rbp + 7], rcx
jmp case.0x1800420a7.241
mov ecx, 0x800000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, 0x800000
mov qword [rbp - 0x21], rax
mov rsi, rax
mov qword [rbp + 7], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
mov qword [rbp - 0x29], rax
mov qword [rbp + 0xf], rax
jmp case.0x1800420a7.241
mov rax, qword [rbp - 0x31]
mov r12d, r15d
and r12d, 1
mov r13d, r14d
mov ebx, 0x100000
and r13d, 1
mov qword [rax], 0
nop dword [rax]
mov edx, 0xf9
mov dword [rbp - 0x49], ebx
lea rcx, [rbp - 0x49]
call fcn.18006e390
cmp eax, r12d
jne 0x18004216c
add rsi, 4
mov dword [rsi], ebx
mov edx, 0xf9
mov dword [rbp - 0x49], ebx
lea rcx, [rbp - 0x49]
call fcn.18006e390
cmp eax, r13d
jne 0x180042188
add rdi, 4
mov dword [rdi], ebx
sub ebx, 1
jns 0x180042150
mov r12, qword [rbp + 7]
mov ebx, 4
mov qword [rbp - 0x29], rdi
mov rdi, qword [rbp + 0xf]
mov qword [rbp - 0x21], rsi
shr r15d, 1
lea r9, [rbp - 0x21]
mov eax, r15d
lea r8, [rbp - 0x49]
and eax, 1
mov edx, 0x41
mov rcx, r12
mov dword [rbp - 0x49], eax
call fcn.180068800
shr r14d, 1
lea r9, [rbp - 0x29]
mov eax, r14d
lea r8, [rbp - 0x49]
and eax, 1
mov edx, 0x41
mov rcx, rdi
mov dword [rbp - 0x49], eax
call fcn.180068800
sub rbx, 1
jne 0x1800421a2
mov rbx, qword [rbp + 0x6f]
mov r9, r12
mov rsi, qword [rbp - 0x21]
mov r12, qword [rbp - 0x31]
mov qword [rsp + 0x48], rsi
mov r8, r12
mov ecx, dword [rbx]
mov eax, ecx
movzx edx, byte [rbx + 2]
and ecx, 0xff00
shl eax, 0x10
or edx, eax
mov qword [rsp + 0x40], rdi
mov rdi, qword [rbp - 0x29]
or edx, ecx
mov dword [rsp + 0x38], 0x32
lea rcx, [rbp - 0x39]
mov dword [rbx], edx
mov dword [rbp - 0x11], ILRemoveLastID
lea eax, [rdx + rdx]
mov dword [rbp - 9], r14d
mov dword [rbp - 0x49], eax
mov rdx, rdi
lea rax, [rbp - 0x49]
mov dword [rbp - 0x39], r15d
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
call fcn.18007ebb0
mov r13d, dword [rbp + 0x67]
jmp case.0x1800420a7.241
lea rax, [rbp - 1]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0xdc
mov rcx, rbx
call fcn.180034bd0
test al, al
jne case.0x1800420a7.241
mov byte [rbp - 0x19], 0
mov rax, qword [rbp - 0x19]
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp qword [r10 + 0x28], 0
je 0x180042292
cmp qword [r10 + 0x30], 0
je 0x180042292
cmp qword [r10 + 0x38], 0
jne case.0x1800420a7.241
mov ebx, ILFindLastID
nop dword [rax]
mov eax, ebx
sub eax, 0xb
je case.0x1800420a7.264
cmp eax, 1
jne 0x1800422f3
xor eax, eax
lea rcx, [rbp - 0x41]
mov word [rbp - 0x41], ax
mov byte [rbp - 0x3f], al
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov byte [rbp - 0x19], 0
dec ebx
cmp ebx, 0xa
ja 0x1800422d0
mov rbx, qword [rbp + 0x6f]
jmp case.0x1800420a7.241
mov r9d, dword [r10]
xor edi, edi
mov qword [rbp - 0x29], rdi
xor r14d, r14d
mov qword [rbp + 0xf], 0
mov r8d, 0x1f
nop dword [rax]
mov ecx, r8d
lea eax, [r15 + r15]
xor ecx, 0x18
mov edx, r9d
shr edx, cl
and edx, 1
mov r15d, edx
or r15d, eax
sub r8d, 2
jns 0x180042320
mov r8d, 0x1e
nop dword [rax]
nop dword [rax + rax]
mov ecx, r8d
lea eax, [r14 + r14]
xor ecx, 0x18
mov edx, r9d
shr edx, cl
and edx, 1
mov r14d, edx
or r14d, eax
sub r8d, 2
jns 0x180042350
jmp case.0x1800420a7.241
movzx eax, word [r9]
lea rcx, [rbp - 0x39]
mov word [rbp + 0x67], ax
lea r9, [rbp + 0x67]
mov eax, dword [rbp - 1]
mov r8, r10
mov edx, 0xce
mov dword [rbp - 0x39], eax
call fcn.180044440
mov byte [rbp - 0x19], al
jmp case.0x1800420a7.241
xor esi, esi
mov qword [rbp - 0x21], rsi
xor r15d, r15d
dec r13d
mov dword [rbp + 0x67], r13d
cmp r13d, dword [rbp + 3]
jbe case.0x1800420a7.264
mov r10, qword [rbp + 0x77]
mov r9, qword [rbp + 0x7f]
jmp 0x180042086
cmp qword [r10 + 0x20], 0
setne byte [rbp - 0x19]
jmp case.0x1800420a7.264
mov rcx, qword [rbp + 7]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, r12
jmp 0x18004229a