Function at 0x140002b70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
lea rax, [0x14004c7ab]
lea r8, [rsp + 0x90]
mov r9b, 0x7e
mov r10, qword [rsp + 0xe0]
mov byte [rsp + 0xdd], 0xa8
mov qword [rsp + 0xd0], 0x5a4d0884
mov dword [rsp + 0xcc], 0x11c5f71b
mov r11b, byte [rsp + 0xdd]
mov bl, 0x2c
mov qword [rsp + 0x68], rax
mov al, r11b
mul bl
mov byte [rsp + 0xdc], al
mov al, r11b
xor al, 0x90
mov byte [rsp + 0xdc], r11b
mov byte [rsp + 0x75], al
sub r9b, byte [rsp + 0xdd]
mov byte [rsp + 0x77], r9b
mov qword [rsp + 0xe0], 0x7ba6fcfd
mov esi, dword [rsp + 0xd8]
mov edi, esi
and edi, 0x14b1fc75
mov dword [rsp + 0xd8], edi
mov edi, dword [rsp + 0xcc]
xor edi, 0x11c5f715
mov qword [rsp + 0x60], rcx
mov rcx, r8
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x58], rdx
mov rdx, r14
mov qword [rsp + 0x50], r8
mov r8d, edi
mov dword [rsp + 0x4c], esi
mov byte [rsp + 0x4b], r11b
mov qword [rsp + 0x40], r10
call fcn.140004dc0
mov bp, word [rsp + 0xde]
mov r15w, bp
add r15w, 0x8175
mov word [rsp + 0xde], r15w
mov rcx, qword [rsp + 0x50]
mov word [rsp + 0x3e], bp
call fcn.140003e80
mov qword [rsp + 0x78], 0
mov bp, word [rsp + 0x3e]
and bp, 0xcee5
mov word [rsp + 0xde], bp
cmp rax, 0
mov qword [rsp + 0x30], rax
je 0x140002f37
mov al, byte [rsp + 0x75]
mov cl, byte [rsp + 0xdd]
xor cl, 0xea
cmp al, cl
je 0x140002ca4
xor eax, eax
mov ecx, eax
mov eax, 0x5a4d7884
mov edx, eax
mov eax, 0x11c6071b
mov r8, qword [rsp + 0x40]
xor r8, 0x5a74fe52
mov qword [rsp + 0xe0], r8
mov r9d, dword [rsp + 0xcc]
sub eax, dword [rsp + 0xcc]
mov r10b, byte [rsp + 0x4b]
mov dword [rsp + 0x2c], eax
mov al, r10b
mul r10b
add r9d, 0xee3a0925
mov byte [rsp + 0xdc], al
mov r8, qword [rsp + 0xd0]
mov r11w, word [rsp + 0x3e]
or r11w, 0xe7af
sub rdx, r8
mov word [rsp + 0xde], r11w
mov r8d, dword [rsp + 0x2c]
mov rsi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x80], rax
mov r8d, dword [rsp + 0x4c]
mov dword [rsp + 0xd8], r8d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xe0], 0xffffffffef9446d1
mov qword [rsp + 0x78], 0
cmp rax, 0
je 0x140002f37
jmp 0x140002e9c
mov eax, dword [rsp + 0x4c]
or eax, 0x70581400
mov cl, byte [rsp + 0xdd]
add cl, 6
mov dword [rsp + 0xd8], eax
mov dl, byte [rsp + 0xdd]
add dl, 0x28
mov byte [rsp + 0x76], cl
mov cl, byte [rsp + 0x76]
mov dword [rsp + 0xd8], 0x3e34ad3c
mov r8, qword [rsp + 0x60]
add r8, 0xf0
mov qword [rsp + 0xb8], r8
cmp dl, cl
jbe 0x140002e03
jmp 0x140002e03
mov eax, dword [rsp + 0xcc]
xor eax, 0x49f1efa8
mov cl, byte [rsp + 0x4b]
sub cl, cl
mov byte [rsp + 0xdc], cl
mov rdx, qword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov ecx, eax
call rdx
xor ecx, ecx
mov edx, ecx
mov dword [rsp + 0x28], eax
mov rax, rdx
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
add rax, 0x2973
mov qword [rsp + 0x78], rax
jmp 0x140002f37
mov al, 0x55
mov cl, byte [rsp + 0xdd]
xor cl, 0xd
mov edx, dword [rsp + 0x4c]
mov dword [rsp + 0xd8], edx
mov byte [rsp + 0x8f], cl
mov r8w, word [rsp + 0x3e]
xor r8w, r8w
mov word [rsp + 0xde], r8w
mov r9, qword [rsp + 0x80]
sub al, byte [rsp + 0xdd]
mov cl, byte [rsp + 0x8f]
mov r10, qword [rsp + 0x60]
mov qword [r10 + 0x20], r9
mov r11b, byte [rsp + 0x4b]
or r11b, 0xb9
mov byte [rsp + 0xdc], r11b
cmp cl, al
jbe 0x140002d73
jmp 0x140002dc4
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x58]
call fcn.1400045b0
movabs rcx, 0xffffffff1a4d0884
mov al, 0x8a
mov r8w, word [rsp + 0x3e]
xor r8w, 0xd91b
mov word [rsp + 0xde], r8w
sub al, byte [rsp + 0xdd]
mov rdx, qword [rsp + 0x40]
or rdx, 0x43f75d97
sub rcx, qword [rsp + 0xd0]
mov r9, qword [rsp + 0x80]
mov qword [rsp + 0xe0], rdx
add r9, rcx
mov word [rsp + 0xde], 0x5887
mov qword [rsp + 0xc0], r9
mov r10b, byte [rsp + 0x77]
mov r8w, word [rsp + 0x3e]
xor r8w, 0xfd42
mov word [rsp + 0xde], r8w
cmp r10b, al
jb 0x140002e2e
jmp 0x140002dc4
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
and rcx, 0x6579cef4
mov qword [rsp + 0xe0], rcx
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret