Function at 0x10011d9c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x178
xor r14d, r14d
xor ebp, ebp
test rcx, rcx
mov rax, r9
mov r15d, 0xdc
lea r12d, [r14 + 0x14]
mov qword [rsp + 0x50], rbp
je 0x10011e232
test rdx, rdx
je 0x10011e232
test r8, r8
je 0x10011e232
test rax, rax
je 0x10011e232
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbp + 8]
mov rcx, rax
mov r8d, 0x1b4
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r15, rax
jne 0x10011da52
mov ebx, 0x80000002
jmp 0x10011dd26
lea rdx, [rax + 0x60]
lea rsi, [0x100152d88]
mov rdi, r15
lea rax, [rdx + 0xa8]
mov ecx, 0x60
mov dword [rsp + 0x70], 0x123174bb
rep movsb byte [rdi], byte [rsi]
mov qword [r15], rdx
mov rsi, qword [0x100152d88]
mov qword [rsp + 0xe8], rax
lea rbp, [rax + 0x70]
mov rdi, rdx
mov edx, 8
lea rax, [rbp + 0x14]
mov ecx, 0xa8
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [r15]
mov qword [rsp + 0x50], rax
add rdi, 0x58
add rax, r12
mov rcx, rdx
mov qword [rsp + 0x120], rax
lea rsi, [rsp + 0xe8]
mov dword [rsp + 0x74], 0x86521ff8
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [r15]
mov rsi, qword [0x100152d88]
mov rdi, qword [rdi + 0x58]
mov rsi, qword [rsi + 0x58]
lea ecx, [rdx + 0x68]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r15]
mov rcx, rdx
mov rdi, qword [rax + 0x58]
xor edx, edx
lea rsi, [rsp + 0x120]
add rdi, 0x38
lea r8d, [rdx + 0x10]
mov dword [rsp + 0x78], 0x98d2438b
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r15]
mov dword [rsp + 0x7c], 0x7966ce12
mov rcx, qword [rax + 0x58]
mov dword [rsp + 0x80], 0xc5d92014
mov dword [rsp + 0xb8], ebx
mov rax, qword [rcx + 0x38]
lea rcx, [rsp + 0xbc]
mov qword [rsp + 0x40], rax
call sub.msvcrt.dll_memset
mov rdx, qword [0x100152d88]
mov rsi, qword [rdx + 0x58]
lea rdi, [rsp + 0xb8]
mov rcx, r12
mov rsi, qword [rsi + 0x38]
xor r8d, r8d
rep movsb byte [rdi], byte [rsi]
lea rsi, [rsp + 0xb8]
movabs rdi, 0xcccccccccccccccd
lea r9d, [r8 + 5]
mov rcx, r8
mov rax, rdi
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x70]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011db74
mov rdi, qword [rsp + 0x40]
lea rsi, [rsp + 0xb8]
mov rcx, r12
rep movsb byte [rdi], byte [rsi]
lea r8d, [r9 + 0x10]
lea rcx, [rsp + 0x10c]
xor edx, edx
mov qword [r15 + 8], rbp
mov dword [rsp + 0xa0], 0x123174bb
mov dword [rsp + 0xa4], 0x86521ff8
mov dword [rsp + 0xa8], 0x98d2438b
mov dword [rsp + 0xac], 0x7966ce12
mov dword [rsp + 0xb0], 0xc5d92014
mov dword [rsp + 0x108], ebx
call sub.msvcrt.dll_memset
mov rsi, qword [0x100152d90]
lea rdi, [rsp + 0x108]
mov rcx, r12
xor r8d, r8d
rep movsb byte [rdi], byte [rsi]
movabs r14, 0xcccccccccccccccd
lea rsi, [rsp + 0x108]
lea r9d, [r8 + 5]
mov rcx, r8
mov rax, r14
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0xa0]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011dc30
mov rdi, rbp
mov rbp, qword [rsp + 0x50]
lea rsi, [rsp + 0x108]
mov rcx, r12
lea r8d, [r9 + 0x10]
xor edx, edx
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xd4]
mov dword [rsp + 0x58], 0x123174bb
mov qword [r15 + 0x10], rbp
mov dword [rsp + 0x5c], 0x86521ff8
mov dword [rsp + 0x60], 0x98d2438b
mov dword [rsp + 0x64], 0x7966ce12
mov dword [rsp + 0x68], 0xc5d92014
mov dword [rsp + 0xd0], ebx
call sub.msvcrt.dll_memset
mov rsi, qword [0x100152d98]
xor r8d, r8d
lea rdi, [rsp + 0xd0]
mov rcx, r12
lea r9d, [r8 + 5]
rep movsb byte [rdi], byte [rsi]
xor r14d, r14d
movabs r13, 0xcccccccccccccccd
lea rsi, [rsp + 0xd0]
mov rcx, r8
mov rax, r13
mul r8
add r8, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x58]
xor dword [rsi], eax
add rsi, 4
sub r9, 1
jne 0x10011dce6
mov rdi, rbp
lea rsi, [rsp + 0xd0]
mov rcx, r12
mov rbp, r15
mov qword [rsp + 0x50], r15
rep movsb byte [rdi], byte [rsi]
test ebx, ebx
js 0x10011dfb5
xor edx, edx
lea rcx, [rsp + 0xf4]
mov dword [rsp + 0x88], 0x123174bb
lea r8d, [rdx + 0x10]
mov dword [rsp + 0x8c], 0x86521ff8
mov dword [rsp + 0x90], 0x98d2438b
mov dword [rsp + 0x94], 0x7966ce12
mov dword [rsp + 0x98], 0xc5d92014
mov dword [rsp + 0xf0], 0
call sub.msvcrt.dll_memset
lea rdi, [rsp + 0xf0]
lea rsi, [0x100152310]
mov rcx, r12
movabs r13, 0xcccccccccccccccd
rep movsb byte [rdi], byte [rsi]
xor esi, esi
lea rdi, [rsp + 0xf0]
lea r8d, [rsi + 5]
mov rcx, rsi
mov rax, r13
mul rsi
add rsi, 1
shr rdx, 2
lea rax, [rdx + rdx*4]
sub rcx, rax
mov eax, dword [rsp + rcx*4 + 0x88]
xor dword [rdi], eax
add rdi, 4
sub r8, 1
jne 0x10011ddaf
mov r13, qword [rsp + 0x1c0]
lea rdi, [rsp + 0x128]
lea rsi, [rsp + 0xf0]
lea rax, [r13 + 0x10]
mov rcx, r12
mov dword [r13], r8d
mov qword [r13 + 8], rax
rep movsb byte [rdi], byte [rsi]
mov dword [r13 + 4], 0x157c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15d, 0xdc
mov edx, 8
mov rcx, rax
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov r14, rax
jne 0x10011de3a
mov ebx, 0x80000002
jmp 0x10011dfbb
lea r15, [rax + 0x64]
mov rax, qword [rsp + 0x1c8]
lea rcx, [rsp + 0x140]
cmp rcx, rax
lea rsi, [r15 + 0x50]
mov qword [rsp + 0x1c0], rsi
je 0x10011de79
lea rdi, [rsp + 0x140]
mov rsi, rax
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1c0]
mov rax, qword [rbp]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov qword [rsp + 0x48], rax
je 0x10011df05
mov r9, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rsp + 0x140]
mov rcx, r12
mov edx, 5
mov qword [rsp + 0x20], r13
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1c0]
mov rcx, rax
mov r8, rsi
call fcn.1001258a4
mov rdi, qword [rsp + 0x48]
mov r11d, r12d
mov rax, rdi
mov byte [rax], 0
add rax, 1
add r11d, 0xffffffff
jne 0x10011dee4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov qword [rsp + 0x40], rax
je 0x10011df92
mov r9, qword [rsp + 0x48]
mov rdi, rax
lea rsi, [rsp + 0x154]
mov rcx, r12
mov edx, 5
mov qword [rsp + 0x20], r13
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1c0]
mov rcx, rax
lea r8, [rsi + 0x14]
call fcn.1001258a4
mov rdi, qword [rsp + 0x40]
mov r11d, r12d
mov rax, rdi
mov byte [rax], 0
add rax, 1
add r11d, 0xffffffff
jne 0x10011df71
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], r13
call fcn.100121534
test eax, eax
jne 0x10011e069
mov ebx, 0x800480d5
mov r15d, 0xdc
test rbp, rbp
mov edi, 0xffffffff
je 0x10011e017
mov rax, qword [rbp]
mov edx, r12d
mov rcx, qword [rax + 0x58]
mov rax, qword [rcx + 0x38]
mov byte [rax], 0
add rax, 1
add edx, edi
jne 0x10011dfd4
mov rax, qword [rbp + 8]
mov ecx, r12d
mov byte [rax], 0
add rax, 1
add ecx, edi
jne 0x10011dfe6
mov rax, qword [rbp + 0x10]
mov ecx, r12d
mov byte [rax], 0
add rax, 1
add ecx, edi
jne 0x10011dff8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x128]
mov byte [rax], 0
add rax, 1
add r12d, edi
jne 0x10011e01f
test r14, r14
je 0x10011e053
mov rax, r14
mov byte [rax], 0
add rax, 1
add r15d, edi
jne 0x10011e033
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rsp + 0x1d8]
mov rdx, qword [rsp + 0x1d0]
cmp rax, rdx
je 0x10011e093
mov rdi, rax
mov rsi, rdx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x1c0]
lea rdx, [r15 + 0x28]
mov r9, r13
mov r8, rbp
mov rcx, rax
call fcn.10011d67c
test eax, eax
je 0x10011dfb0
xor r9d, r9d
lea rcx, [rsp + 0x128]
mov rdx, r14
lea r8d, [r9 + 5]
mov qword [rsp + 0x20], r13
call fcn.100125fec
mov qword [rsp + 0x38], r13
mov edx, 4
lea rax, [r14 + 0x14]
mov qword [rsp + 0x30], rbp
lea rcx, [0x10015238c]
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 0x38]
mov r9, r14
mov qword [rsp + 0x20], 5
call fcn.100124adc
test eax, eax
je 0x10011dfb0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], r13
call fcn.100121534
test eax, eax
je 0x10011dfb0
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov qword [rsp + 0x30], rbp
lea edx, [r8 + 4]
mov r9, r14
mov rcx, rsi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 5
call fcn.100124adc
test eax, eax
je 0x10011dfb0
mov qword [rsp + 0x30], r13
lea r8, [r14 + 0x3c]
lea rdx, [r15 + 0x28]
mov r9d, 1
mov rcx, r15
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbp
call fcn.100121828
test eax, eax
je 0x10011dfb0
mov r8, qword [rbp]
lea rcx, [r14 + 0x14]
mov r9, r13
mov r8, qword [r8 + 0x58]
mov rdx, r15
call fcn.1001259f4
mov rdi, qword [rsp + 0x1d8]
mov rsi, r15
mov rcx, r12
mov r9, r13
mov rdx, r15
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp]
lea rcx, [r14 + 0x28]
mov r8, qword [r8 + 0x58]
call fcn.1001259f4
mov rdi, qword [rsp + 0x1d8]
mov rsi, r15
mov rcx, r12
add rdi, r12
mov r9, r13
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp]
lea rcx, [r14 + 0x3c]
mov r8, qword [r8 + 0x58]
mov rdx, r15
call fcn.1001259f4
mov rdi, qword [rsp + 0x1d8]
mov rsi, r15
mov rcx, r12
add rdi, 0x28
mov r9, r13
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp]
lea rcx, [r14 + 0x50]
mov r8, qword [r8 + 0x58]
mov rdx, r15
call fcn.1001259f4
mov rdi, qword [rsp + 0x1d8]
mov rsi, r15
add rdi, 0x3c
mov rcx, r12
rep movsb byte [rdi], byte [rsi]
jmp 0x10011dfb5
mov ebx, 0x80070057
jmp 0x10011dfbb