Function at 0x140001580
Capabilities:
Encode data using xor
Encrypt data using aes
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x30
mov r15, r8
mov r9, rcx
test rcx, rcx
je 0x14000219f
test r8, r8
je 0x14000219f
lea eax, [rdx - 0x80]
test eax, 0xffffff3f
jne 0x140002193
cmp edx, 0x140
je 0x140002193
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x28], r12
cmp edx, 0x80
jne 0x1400015dc
mov dword [r8 + 0xf0], 0xa
jmp 0x1400015f6
cmp edx, 0xc0
mov eax, select
mov ecx, ntohs
cmove eax, ecx
mov dword [r8 + 0xf0], eax
movzx eax, byte [r9 + 1]
movzx esi, byte [r9]
shl esi, 8
xor esi, eax
mov qword [rsp + 0x20], r14
movzx eax, byte [r9 + 2]
shl esi, 8
xor esi, eax
movzx eax, byte [r9 + 3]
shl esi, 8
xor esi, eax
mov dword [r8], esi
movzx eax, byte [r9 + 5]
movzx r12d, byte [r9 + 4]
shl r12d, 8
xor r12d, eax
movzx eax, byte [r9 + 6]
shl r12d, 8
xor r12d, eax
movzx eax, byte [r9 + 7]
shl r12d, 8
xor r12d, eax
mov dword [r8 + 4], r12d
movzx eax, byte [r9 + 9]
movzx r11d, byte [r9 + 8]
shl r11d, 8
xor r11d, eax
movzx eax, byte [r9 + 0xa]
shl r11d, 8
xor r11d, eax
movzx eax, byte [r9 + 0xb]
shl r11d, 8
xor r11d, eax
mov dword [r8 + 8], r11d
movzx eax, byte [r9 + 0xd]
movzx ebx, byte [r9 + 0xc]
shl ebx, 8
xor ebx, eax
movzx eax, byte [r9 + 0xe]
shl ebx, 8
xor ebx, eax
movzx eax, byte [r9 + 0xf]
shl ebx, 8
xor ebx, eax
mov dword [r8 + 0xc], ebx
cmp edx, 0x80
jne 0x140001b23
lea r14, str.ccccwwww
mov eax, ebx
shr rax, 0x10
movzx ecx, al
mov eax, ebx
shr rax, 8
mov r8d, dword [r14 + rcx*4]
movzx ecx, al
btc r8d, 0x18
and r8d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r8d, eax
mov eax, ebx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r8d, eax
movzx eax, bl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, esi
xor r12d, r8d
mov dword [r15 + 0x10], r8d
xor r11d, r12d
mov dword [r15 + 0x14], r12d
mov eax, r11d
mov dword [r15 + 0x18], r11d
xor eax, ebx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0x1c], edx
mov r10d, dword [r14 + rcx*4]
movzx ecx, al
btc r10d, 0x19
and r10d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r10d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r10d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r10d, ecx
xor r10d, r8d
mov dword [r15 + 0x20], r10d
mov r8d, r10d
xor r8d, r12d
mov r9d, r8d
mov dword [r15 + 0x24], r8d
xor r9d, r11d
mov eax, r9d
mov dword [r15 + 0x28], r9d
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0x2c], edx
mov r11d, dword [r14 + rcx*4]
movzx ecx, al
btc r11d, 0x1a
and r11d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r11d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r11d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r11d, ecx
xor r11d, r10d
mov dword [r15 + 0x30], r11d
mov ebx, r11d
xor ebx, r8d
mov dword [r15 + 0x34], ebx
mov r8d, ebx
xor r8d, r9d
mov dword [r15 + 0x38], r8d
mov eax, r8d
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0x3c], edx
mov r10d, dword [r14 + rcx*4]
movzx ecx, al
btc r10d, 0x1b
and r10d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r10d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r10d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r10d, ecx
xor r10d, r11d
mov dword [r15 + 0x40], r10d
xor ebx, r10d
mov dword [r15 + 0x44], ebx
mov r9d, ebx
xor r9d, r8d
mov dword [r15 + 0x48], r9d
mov eax, r9d
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0x4c], edx
mov r11d, dword [r14 + rcx*4]
movzx ecx, al
btc r11d, 0x1c
and r11d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r11d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r11d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r11d, ecx
xor r11d, r10d
xor ebx, r11d
mov dword [r15 + 0x50], r11d
mov dword [r15 + 0x54], ebx
mov r8d, ebx
xor r8d, r9d
mov eax, r8d
mov dword [r15 + 0x58], r8d
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
mov dword [r15 + 0x5c], edx
mov r10d, dword [r14 + rcx*4]
btc r10d, 0x1d
and r10d, 0xff000000
shr rax, 8
movzx ecx, al
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r10d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r10d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r10d, ecx
xor r10d, r11d
mov dword [r15 + 0x60], r10d
xor ebx, r10d
mov dword [r15 + 0x64], ebx
mov r9d, ebx
xor r9d, r8d
mov dword [r15 + 0x68], r9d
mov eax, r9d
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0x6c], edx
mov r8d, dword [r14 + rcx*4]
movzx ecx, al
btc r8d, 0x1e
and r8d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, r10d
mov dword [r15 + 0x70], r8d
xor ebx, r8d
mov dword [r15 + 0x74], ebx
mov r10d, ebx
xor r10d, r9d
mov dword [r15 + 0x78], r10d
mov eax, r10d
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0x7c], edx
mov r9d, dword [r14 + rcx*4]
movzx ecx, al
xor r9d, 0x80ffffff
and r9d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r9d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r9d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r9d, ecx
xor r9d, r8d
xor ebx, r9d
mov dword [r15 + 0x80], r9d
mov dword [r15 + 0x84], ebx
mov r8d, ebx
xor r8d, r10d
mov eax, r8d
mov dword [r15 + 0x88], r8d
xor eax, edx
mov edx, eax
mov dword [r15 + 0x8c], edx
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov r10d, dword [r14 + rcx*4]
movzx ecx, al
xor r10d, 0x1b000000
and r10d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r10d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r10d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r10d, ecx
xor r10d, r9d
xor ebx, r10d
mov dword [r15 + 0x90], r10d
mov dword [r15 + 0x94], ebx
mov r9d, ebx
xor r9d, r8d
mov dword [r15 + 0x98], r9d
mov eax, r9d
xor eax, edx
mov r8d, eax
shr rax, 0x10
movzx ecx, al
mov eax, r8d
shr rax, 8
mov dword [r15 + 0x9c], r8d
mov edx, dword [r14 + rcx*4]
movzx ecx, al
xor edx, 0x36000000
and edx, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor edx, eax
mov eax, r8d
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor edx, eax
movzx eax, r8b
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor edx, ecx
xor edx, r10d
xor ebx, edx
mov dword [r15 + 0xa0], edx
mov dword [r15 + 0xa4], ebx
xor ebx, r9d
mov dword [r15 + 0xa8], ebx
xor ebx, r8d
mov dword [r15 + 0xac], ebx
xor eax, eax
jmp 0x140001fa7
movzx eax, byte [r9 + 0x11]
mov qword [rsp + 0x58], rdi
movzx edi, byte [r9 + 0x10]
shl edi, 8
xor edi, eax
movzx eax, byte [r9 + 0x12]
shl edi, 8
xor edi, eax
movzx eax, byte [r9 + 0x13]
shl edi, 8
xor edi, eax
mov dword [r8 + 0x10], edi
movzx eax, byte [r9 + 0x15]
movzx r10d, byte [r9 + 0x14]
shl r10d, 8
xor r10d, eax
movzx eax, byte [r9 + 0x16]
shl r10d, 8
xor r10d, eax
movzx eax, byte [r9 + 0x17]
shl r10d, 8
xor r10d, eax
mov dword [r8 + 0x14], r10d
cmp edx, 0xc0
jne 0x140001fc2
lea r14, str.ccccwwww
mov eax, r10d
shr rax, 0x10
movzx ecx, al
mov eax, r10d
shr rax, 8
mov qword [rsp + 0x48], rbp
mov r8d, dword [r14 + rcx*4]
movzx ecx, al
btc r8d, 0x18
and r8d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r8d, eax
mov eax, r10d
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r8d, eax
movzx eax, r10b
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, esi
xor r12d, r8d
mov dword [r15 + 0x18], r8d
xor r11d, r12d
mov dword [r15 + 0x1c], r12d
xor ebx, r11d
mov dword [r15 + 0x20], r11d
xor edi, ebx
mov dword [r15 + 0x24], ebx
mov dword [r15 + 0x28], edi
mov eax, edi
xor eax, r10d
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0x2c], edx
mov r10d, dword [r14 + rcx*4]
movzx ecx, al
btc r10d, 0x19
and r10d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r10d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r10d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r10d, ecx
xor r10d, r8d
mov dword [r15 + 0x30], r10d
xor r12d, r10d
mov dword [r15 + 0x34], r12d
mov r8d, r12d
xor r8d, r11d
mov dword [r15 + 0x38], r8d
mov r9d, r8d
xor r9d, ebx
xor edi, r9d
mov dword [r15 + 0x3c], r9d
xor edx, edi
mov dword [r15 + 0x40], edi
mov eax, edx
mov dword [r15 + 0x44], edx
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov r11d, dword [r14 + rcx*4]
movzx ecx, al
btc r11d, 0x1a
and r11d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r11d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r11d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r11d, ecx
xor r11d, r10d
mov dword [r15 + 0x48], r11d
xor r12d, r11d
mov dword [r15 + 0x4c], r12d
mov r10d, r12d
xor r10d, r8d
mov dword [r15 + 0x50], r10d
mov r8d, r10d
xor r8d, r9d
mov dword [r15 + 0x54], r8d
mov r9d, r8d
xor r9d, edi
mov eax, r9d
mov dword [r15 + 0x58], r9d
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0x5c], edx
mov ebx, dword [r14 + rcx*4]
movzx ecx, al
btc ebx, 0x1b
and ebx, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor ebx, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor ebx, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor ebx, ecx
xor ebx, r11d
mov dword [r15 + 0x60], ebx
xor r12d, ebx
mov dword [r15 + 0x64], r12d
mov r11d, r12d
xor r11d, r10d
mov dword [r15 + 0x68], r11d
mov r10d, r11d
xor r10d, r8d
mov r8d, r10d
mov dword [r15 + 0x6c], r10d
xor r8d, r9d
mov eax, r8d
mov dword [r15 + 0x70], r8d
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0x74], edx
mov r9d, dword [r14 + rcx*4]
movzx ecx, al
btc r9d, 0x1c
and r9d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r9d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r9d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r9d, ecx
xor r9d, ebx
mov dword [r15 + 0x78], r9d
xor r12d, r9d
mov dword [r15 + 0x7c], r12d
mov edi, r12d
xor edi, r11d
mov dword [r15 + 0x80], edi
mov esi, edi
xor esi, r10d
mov dword [r15 + 0x84], esi
mov ebp, esi
xor ebp, r8d
mov dword [r15 + 0x88], ebp
mov eax, ebp
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0x8c], edx
mov r8d, dword [r14 + rcx*4]
movzx ecx, al
btc r8d, 0x1d
and r8d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, r9d
mov dword [r15 + 0x90], r8d
xor r12d, r8d
mov dword [r15 + 0x94], r12d
xor edi, r12d
mov dword [r15 + 0x98], edi
xor esi, edi
mov dword [r15 + 0x9c], esi
xor ebp, esi
mov dword [r15 + 0xa0], ebp
mov eax, ebp
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0xa4], edx
mov ebx, dword [r14 + rcx*4]
movzx ecx, al
btc ebx, 0x1e
and ebx, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor ebx, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor ebx, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor ebx, ecx
xor ebx, r8d
mov dword [r15 + 0xa8], ebx
mov r9d, ebx
xor r9d, r12d
mov dword [r15 + 0xac], r9d
mov r10d, r9d
xor r10d, edi
mov r11d, r10d
mov dword [r15 + 0xb0], r10d
xor r11d, esi
mov eax, r11d
mov dword [r15 + 0xb4], r11d
xor eax, ebp
mov rbp, qword [rsp + 0x48]
mov dword [r15 + 0xb8], eax
xor eax, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov dword [r15 + 0xbc], edx
mov r8d, dword [r14 + rcx*4]
xor r8d, 0x80ffffff
movzx ecx, al
and r8d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, ebx
mov dword [r15 + 0xc0], r8d
xor r8d, r9d
mov dword [r15 + 0xc4], r8d
xor r8d, r10d
mov dword [r15 + 0xc8], r8d
xor r8d, r11d
mov dword [r15 + 0xcc], r8d
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x28]
add rsp, 0x30
pop r15
ret
movzx eax, byte [r9 + 0x19]
movzx ecx, byte [r9 + 0x18]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r9 + 0x1a]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r9 + 0x1b]
shl ecx, 8
xor ecx, eax
mov dword [r8 + 0x18], ecx
movzx eax, byte [r9 + 0x1d]
movzx ecx, byte [r9 + 0x1c]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r9 + 0x1e]
shl ecx, 8
xor ecx, eax
movzx eax, byte [r9 + 0x1f]
shl ecx, 8
xor ecx, eax
mov dword [r8 + 0x1c], ecx
cmp edx, 0x100
jne 0x14000218c
mov edx, ecx
lea r14, str.ccccwwww
mov eax, ecx
lea rdi, [0x1401180e4]
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov r8d, dword [r14 + rcx*4]
movzx ecx, al
btc r8d, 0x18
and r8d, 0xff000000
mov eax, dword [r14 + rcx*4]
and eax, 0xff0000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, esi
lea rsi, [0x1401180fc]
xor r12d, r8d
mov dword [r15 + 0x20], r8d
xor r11d, r12d
mov dword [r15 + 0x24], r12d
xor ebx, r11d
mov dword [r15 + 0x28], r11d
mov dword [r15 + 0x2c], ebx
lea rbx, [r15 + 0x30]
nop
mov edx, dword [rbx - 4]
mov eax, edx
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 8
mov r8d, dword [r14 + rcx*4]
and r8d, 0xff0000
movzx ecx, al
mov eax, dword [r14 + rcx*4]
and eax, 0xff00
xor r8d, eax
mov eax, edx
shr rax, 0x18
mov ecx, dword [r14 + rax*4]
and ecx, 0xff000000
movzx eax, dl
xor r8d, ecx
movzx ecx, byte [r14 + rax*4]
xor r8d, ecx
xor r8d, dword [rbx - 0x20]
mov dword [rbx], r8d
xor r8d, dword [rbx - 0x1c]
mov dword [rbx + 4], r8d
xor r8d, dword [rbx - 0x18]
mov dword [rbx + 8], r8d
xor r8d, dword [rbx - 0x14]
mov dword [rbx + 0xc], r8d
call fcn.1400308b0
mov edx, dword [rbx + 0xc]
lea rbx, [rbx + 0x20]
mov eax, edx
shr rax, 8
movzx ecx, al
mov eax, edx
shr rax, 0x10
mov r8d, dword [r14 + rcx*4]
and r8d, 0xff0000
movzx ecx, al
mov eax, dword [r14 + rcx*4]
and eax, 0xff000000
xor r8d, eax
mov eax, edx
shr rax, 0x18
movzx eax, byte [r14 + rax*4]
xor r8d, eax
movzx eax, dl
mov ecx, dword [r14 + rax*4]
and ecx, 0xff00
xor r8d, ecx
xor r8d, dword [rbx - 0x30]
xor r8d, dword [rdi]
add rdi, 4
mov dword [rbx - 0x10], r8d
xor r8d, dword [rbx - 0x2c]
mov dword [rbx - 0xc], r8d
xor r8d, dword [rbx - 0x28]
mov dword [rbx - 8], r8d
xor r8d, dword [rbx - 0x24]
mov dword [rbx - 4], r8d
cmp rdi, rsi
jne 0x1400020a0
xor eax, eax
jmp 0x140001fa2
mov eax, 0xfffffffe
add rsp, 0x30
pop r15
ret
mov eax, 0xffffffff
add rsp, 0x30
pop r15
ret