Function at 0x14000684e
Capabilities:
Encode data using xor
Parse pe header
Print debug messages
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc0
movups xmmword [rsp + 0xb0], xmm6
mov rsi, rcx
xorps xmm6, xmm6
movups xmmword [rcx], xmm6
add rcx, 0x10
call fcn.140005606
mov dword [rsi + 0x20], 0x49
lea rdx, [rsi + 0x80]
movups xmm0, xmmword [0x140007a22]
movups xmmword [rsp + 0x6a], xmm0
movups xmm0, xmmword [0x140007a18]
movups xmmword [rsp + 0x60], xmm0
cmp word [rsp + 0x78], 0
je 0x1400068c3
xor eax, eax
mov ecx, eax
add ecx, 0x31
xor word [rsp + rax*2 + 0x60], cx
mov rcx, rax
inc rcx
mov rax, rcx
cmp rcx, 0xd
jne 0x1400068aa
lea rcx, [rsp + 0x60]
call fcn.140007fee
mov rdi, rax
mov qword [rsi + 0x78], rax
mov eax, dword [rsi + 0x80]
mov ebx, eax
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test rbx, rbx
je 0x14000691f
test al, al
je 0x14000691f
mov rax, rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x40]
test rax, rax
cmove rax, rdi
mov qword [rsp + 0x50], rax
mov rcx, qword [rsi + 0x78]
call fcn.1400083f6
mov qword [rsi + 0x88], rax
mov rbx, qword [rsi + 0x78]
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x1400069df
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x1400069df
add rax, rbx
movzx ecx, word [rax + 6]
mov r14d, ecx
test r14, r14
je 0x1400069df
movzx ecx, word [rax + 0x14]
lea r15, [rax + rcx]
add r15, 0x18
lea rdi, [0x14000798a]
xor r12d, r12d
lea r13, [r12 + r12*4]
lea rcx, [r15 + r13*8]
mov rdx, rdi
call sub.ntoskrnl.exe_strstr
test rax, rax
je 0x1400069d1
mov ecx, dword [r15 + r13*8 + 8]
cmp ecx, 2
je 0x1400069d1
mov eax, dword [r15 + r13*8 + 0xc]
add rax, rbx
add ecx, 0xfffffffe
mov rdx, rax
xor r8d, r8d
cmp byte [rax + r8], 0xff
jne 0x1400069b6
cmp byte [rax + r8 + 1], 0xe1
je 0x1400069c9
mov r9, r8
inc r9
inc rdx
mov r8, r9
cmp rcx, r9
jne 0x1400069a7
jmp 0x1400069d1
mov rax, rdx
test rdx, rdx
jne 0x1400069e1
mov rax, r12
inc rax
mov r12, rax
cmp rax, r14
jne 0x140006977
xor eax, eax
mov rdx, rax
mov qword [rsi + 0xa0], rax
mov byte [rsi + 0x98], 1
mov qword [rsi + 0x90], 0
mov r8, qword [rsi + 0x88]
movups xmm0, xmmword [0x140007a4f]
movups xmmword [rsp + 0x9d], xmm0
movups xmm0, xmmword [0x140007a42]
movups xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [0x140007a32]
movups xmmword [rsp + 0x80], xmm0
cmp byte [rsp + 0xac], 0
je 0x140006a5c
xor eax, eax
mov ecx, eax
mov r9b, al
lea ecx, [r9 + 0x31]
xor byte [rsp + rax + 0x80], cl
mov rcx, rax
inc rcx
mov rax, rcx
cmp rcx, 0x2d
jne 0x140006a3d
lea rcx, [rsp + 0x80]
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x68
xor ecx, ecx
mov r8d, 0x4b61766c
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsi], rax
test rax, rax
je 0x140006add
mov edx, 0x68
xor ecx, ecx
mov r8d, 0x4b61766c
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsi + 8], rax
test rax, rax
je 0x140006ad2
mov rcx, rax
mov qword [rsp + 0x20], 0
lea rdx, [0x140007740]
lea r8, [0x14000796e]
lea r9, [0x140007962]
call qword [sym.imp.ntoskrnl.exe_RtlInitializeGenericTableAvl]
mov rcx, qword [rsi]
call qword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
jmp 0x140006add
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140006b02
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140006b12
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, rsi
movups xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret