Function at 0x1400713f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov edx, 0x367214e5
mov r8d, 0x8e100c3f
mov r9d, 0x627fbf3b
call fcn.1400ab8e0
mov ebx, eax
test al, al
je 0x140071d35
mov eax, dword [0x1405d05b8]
add eax, dword [rsi + 0x87c]
mov ecx, 0xf3dea1b
add ecx, dword [0x1405508c8]
xor ecx, eax
not ecx
test ecx, eax
je 0x140071494
mov r9d, dword [0x1405508c8]
mov eax, r9d
xor eax, 0x2afa8436
mov ecx, r9d
and ecx, 0x2afa8436
lea edx, [rax + rcx*2]
mov eax, r9d
xor eax, 0xcc142764
mov ecx, r9d
not ecx
and ecx, 0x33ebd89b
or ecx, eax
not ecx
lea r8d, [rax + rcx*2]
add r9d, 0x45e91a78
mov rcx, rsi
call fcn.1400ab2a0
mov eax, dword [0x1405cff93]
mov ecx, dword [0x1405508c8]
lea edx, [rcx + 0x103dea17]
add ecx, 0xf3dea16
mov r8d, ecx
xor r8d, ecx
not r8d
and r8d, edx
xor r8d, ecx
mov ecx, eax
not r8d
or r8d, eax
xor eax, 0x1000000
or ecx, 0x1000000
and ecx, eax
not r8d
or r8d, ecx
cmp r8d, 0xffffffff
je 0x1400714e3
mov byte [rsi + 0x884], 1
mov rcx, rsi
call fcn.1400710e0
lea rcx, [rsi + 0x230]
mov eax, dword [0x1405c3e7f]
mov edx, eax
not edx
mov r8d, edx
and r8d, 0x800
and eax, 0xfffff7ff
or eax, r8d
and edx, 0xfffff7ff
or edx, eax
cmp edx, 0xffffffff
setne dl
mov dword [rsp + 0x20], 0x4d1395e2
mov r8d, 0x11627d91
mov r9d, 0x98d5529e
call fcn.1400abf30
cmp qword [0x1405d3560], 0
jne 0x14007156b
mov ecx, 0x900
mov edx, 0x507d971f
mov r8d, 0xc5f7ed3f
call fcn.1400aaaf0
mov qword [rbp - 0x10], rax
mov rcx, rax
call fcn.140084cf0
mov rax, qword [rbp - 0x10]
mov qword [0x1405d3560], rax
mov r14, qword [0x1405d3560]
mov rax, qword [r14 + 0x2e0]
mov qword [rbp - 8], rax
lea rdi, [rsi + 0x10]
mov rdx, qword [rsi + 0x10]
lea r15, [rsi + 0x18]
cmp rdx, qword [rsi + 0x18]
je 0x140071598
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x1400715a5
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x2c0]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x1400715c1
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x1400715ce
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x2d0]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x1400715ea
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x1400715f7
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x2d8]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071613
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071620
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x510]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x14007163c
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071649
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x518]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071665
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071672
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x338]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x14007168e
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x14007169b
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov byte [rbp - 0x10], bl
mov eax, dword [0x1405d0514]
cmp eax, 0x56
jl 0x1400716ab
jmp 0x1400716d9
mov rax, qword [0x140550018]
movsxd rcx, dword [rax]
mov edx, dword [0x1405d0510]
mov r8d, dword [0x1405508c8]
neg r8d
add r8d, edx
add r8d, 0xf0c215e8
imul r8d, edx
test r8b, 1
je 0x1400716e4
mov rax, qword [0x140550018]
mov eax, dword [rax]
jmp 0x1400716ab
mov rdx, rcx
not rdx
mov r8, rax
not r8
mov r9, rcx
and r9, r8
and r8, rdx
and rdx, rax
or r9, rdx
xor rcx, rax
or r8, rcx
not r8
lea rax, [r9 + r8*2]
mov qword [rbp - 0x18], rax
mov eax, dword [0x1405d0514]
cmp eax, 0x52
jg 0x140071d80
jmp 0x140071d48
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x5b8]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x14007174d
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x14007175a
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x348]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071776
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071783
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x668]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x14007179f
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x1400717ac
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x670]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x1400717c8
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x1400717d5
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x678]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x1400717f1
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x1400717fe
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x680]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x14007181a
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071827
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x688]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071843
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071850
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x588]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x14007186c
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071879
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x6f0]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071895
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x1400718a2
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov eax, 0xf3dea18
lea rcx, [fcn.1400713f0]
add ecx, ecx
add ecx, 0x3d40
xor edx, edx
mov r8b, 1
nop dword [rax + rax]
mov r9d, dword [0x1405508c8]
add r9d, eax
test ecx, r9d
jne 0x1400718d3
test dl, dl
je 0x1400718da
test r8b, r8b
je 0x1400718c0
jmp 0x1400718cf
mov eax, dword [0x1405d04ac]
mov ecx, eax
xor ecx, 1
mov r12d, eax
and r12d, 1
add r12d, r12d
add r12d, ecx
mov dword [0x1405d04ac], r12d
and r12d, eax
je 0x140071903
xor r13d, r13d
jmp 0x14007192d
xor eax, eax
xor r13d, r13d
test ebx, ebx
jle 0x14007192d
mov rdx, qword [rbp - 0x18]
cdqe
xor r13, qword [rdx + rax]
mov ecx, eax
xor ecx, 8
not eax
and eax, 0x7ffffff7
or eax, ecx
not eax
lea eax, [rcx + rax*2]
cmp eax, ebx
jl 0x140071910
mov rax, qword [r14 + 0x6f8]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071949
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071956
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
movzx ebx, byte [rbp - 0x10]
mov rax, qword [r14 + 0x4d0]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071976
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071983
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x2a0]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x14007199f
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x1400719ac
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x2a8]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x1400719c8
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x1400719d5
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x2c8]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x1400719f1
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x1400719fe
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x2b0]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071a1a
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071a27
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x2b8]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071a43
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071a50
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x330]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071a6c
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071a79
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x5c0]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071a95
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071aa2
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x5c8]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071abe
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071acb
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x5d0]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071ae7
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071af4
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x5d8]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071b10
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071b1d
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x5e0]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071b39
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071b46
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x690]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
mov r8, qword [0x140489050]
xor r9d, r9d
test r12d, r12d
setne r9b
lea r10, [r9 - 1]
sub r8, r13
add r8, qword [0x1405508c0]
movabs rcx, 0x243c83c7e537ebba
add rcx, r8
neg r9
mov r8, r9
xor r8, r10
and r8, rcx
xor r8, r10
xor rcx, r9
and rcx, r9
or rcx, r8
mov r8, rcx
not r8
mov r9, qword [0x1405d0580]
xor rcx, r8
and rcx, r9
xor rcx, r8
and r8, r9
lea rcx, [rcx + r8*2]
cmp rdx, qword [r15]
mov qword [0x1405d0580], rcx
je 0x140071bca
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071bd7
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x590]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071bf3
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071c00
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x300]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071c1c
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071c29
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071c45
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071c52
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071c6e
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071c7b
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
sete cl
movzx r8d, byte [0x1405d05a8]
test r8b, cl
jne 0x140071caa
xor r8b, cl
jne 0x140071caa
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071cb7
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071cd3
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071ce0
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071cfc
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071d09
lea rcx, [rsi + 8]
lea r8, [rbp - 8]
call fcn.140085fc0
mov rax, qword [r14 + 0x420]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071d25
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071d35
add rsi, 8
lea r8, [rbp - 8]
mov rcx, rsi
call fcn.140085fc0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ebx, dword [0x14048905c]
mov eax, dword [0x1405d0514]
mov ecx, dword [0x1405508c8]
mov edx, ecx
xor edx, 0xf8bc9e1b
and ecx, 0x78bc9e1b
lea ecx, [rdx + rcx*2]
add ecx, 0x16814c23
cmp eax, ecx
jl 0x140071d93
nop word cs:[rax + rax]
mov eax, dword [0x14048905c]
mov eax, dword [0x1405d0514]
cmp eax, 0x46
jge 0x140071d80
jmp 0x140071d48
mov rax, qword [r14 + 0x5b0]
mov qword [rbp - 8], rax
mov rdx, qword [rdi]
cmp rdx, qword [r15]
je 0x140071724
mov qword [rdx], rax
add qword [rdi], 8
jmp 0x140071731