Function at 0x14002f380
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r9
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [r9]
xor r13d, r13d
mov rcx, r8
cmp word [rax + 2], r13w
lea edi, [r13 + 0x7c]
mov r14, r8
mov edx, edi
setne byte [rsp + 0x48]
call qword [sym.imp.SHLWAPI.dll_StrChrW]
lea r15d, [r13 + 0x2b]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, r13
jne 0x14002f417
lea rcx, [rsp + 0x40]
mov rdx, r14
call fcn.1400668e8
lea rcx, [rsp + 0x40]
call fcn.140063ef8
cmp al, r13b
jle 0x14002f408
mov edx, r15d
mov rcx, r14
mov di, r15w
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
call fcn.140053e80
mov rbx, qword [rsp + 0x50]
or rsi, 0xffffffffffffffff
mov rbp, r13
mov r12, rsi
cmp rbx, r13
je 0x14002f47b
mov word [rbx], r13w
add qword [rsp + 0x50], 2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], r13
call fcn.140061d58
mov rax, qword [rsp + 0x50]
movsxd rbp, dword [rsp + 0x40]
mov rcx, r13
mov qword [rsp + 0x40], rcx
cmp di, word [rax]
jne 0x14002f478
add rax, 2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
call fcn.140061d58
mov rcx, qword [rsp + 0x40]
movsxd r12, ecx
lea rcx, [rsp + 0x58]
mov rdx, r14
call fcn.1400668e8
cmp rbx, r13
je 0x14002f491
mov word [rbx], r15w
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x78], r13d
call fcn.140063d94
mov r15d, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
lea rdx, [rsp + 0x58]
xor r8d, r8d
sar r15d, 0x10
mov dil, al
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
call fcn.14000394c
mov qword [rsp + 0x40], r13
mov ebx, 0x80000000
cmp dil, r13b
je 0x14002f51b
mov rcx, qword [rsp + 0x58]
call fcn.140006500
cmp eax, r13d
je 0x14002f51b
mov rcx, qword [rsp + 0x58]
mov r8d, 7
mov rdx, rbx
call fcn.14001b76c
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, r13
jne 0x14002f558
mov ebx, 0x80000000
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
lea rcx, [rsp + 0x40]
mov r9d, 7
mov r8d, ebx
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r13
call fcn.1400037b4
mov rbx, qword [rsp + 0x40]
cmp rbx, r13
je 0x14002f951
mov rcx, rbx
cmp dil, r13b
je 0x14002f56d
mov dl, dil
call fcn.140059964
mov rdi, rax
jmp 0x14002f582
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rdi, qword [rsp + 0x40]
cmp rdi, r13
jle 0x14002f93e
cmp rdi, rbp
jl 0x14002f93e
cmp rbp, r13
jle 0x14002f59c
sub rdi, rbp
mov eax, 0x10000000
cmp rdi, rax
cmovg rdi, rax
cmp r12, r13
jle 0x14002f5b4
cmp rdi, r12
cmovg rdi, r12
lea eax, [rdi + 0x10]
lea rcx, [rsp + 0x60]
movsxd r12, eax
mov rdx, r12
call fcn.14005ba78
mov r13, qword [rsp + 0x60]
xor eax, eax
cmp r13, rax
jne 0x14002f5f2
cmp rbx, rax
je 0x14002f5e6
cmp rbx, rsi
je 0x14002f5e6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x108]
jmp 0x14002f951
mov qword [rsp + 0x70], r12
xor r12d, r12d
movsxd rax, edi
cmp rbp, r12
mov qword [rsp + 0x68], rax
jle 0x14002f619
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, r13
mov rcx, rbx
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, dword [rsp + 0x40]
cmp ebp, r12d
cmovl ebp, r12d
xor edx, edx
movsxd rdi, ebp
lea r8d, [rdx + 0x10]
lea rcx, [rdi + r13]
call fcn.1400df2a0
cmp rbx, r12
je 0x14002f667
cmp rbx, rsi
je 0x14002f667
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xf8]
mov rdx, r14
mov rcx, rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
call fcn.14005bdb0
lea rdx, [0x1400ff098]
mov rcx, rbx
call fcn.14005bdb0
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov edx, ebp
call fcn.140057bf4
movzx esi, r15w
mov r14d, 1
movzx ecx, sil
mov bpl, al
mov ebx, ecx
shl ebx, 8
or ebx, ecx
mov rcx, qword [rsp + 0x60]
cmp al, r12b
je 0x14002f73f
mov qword [rsp + 0x80], rcx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
mov r8d, esi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], rdi
call fcn.1400609d8
mov rcx, qword [rsp + 0x80]
call fcn.140053e64
mov ecx, dword [rsp + 0x108]
movsx r11d, bpl
movzx eax, cx
mov edi, ebx
shl edi, 0x10
or edi, eax
or edi, r11d
or r11d, ecx
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x108], r11d
call fcn.140053e80
jmp 0x14002f779
mov eax, 0xfeff
cmp ax, word [rcx]
je 0x14002f753
mov eax, 0xfffe
cmp ax, word [rcx]
jne 0x14002f755
mov ebx, esi
lea rax, [rdi + 1]
shr rax, 1
jmp 0x14002f765
xor word [rcx], bx
add rcx, 2
sub eax, r14d
jns 0x14002f75e
movzx eax, word [rsp + 0x108]
mov edi, ebx
shl edi, 0x10
or edi, eax
or edi, 3
lea rcx, [rsp + 0x60]
mov edx, edi
call fcn.1400cb778
mov r8, qword [rsp + 0x60]
movzx edx, bx
mov rcx, r8
call fcn.14001935c
movsxd r13, eax
lea eax, [r13 + r13]
cmp ebx, esi
je 0x14002f7c2
mov rcx, r13
xor bx, r15w
sub rcx, r14
js 0x14002f7c2
xor word [r8], bx
add r8, 2
sub rcx, r14
jns 0x14002f7b0
mov r8, qword [rsp + 0x60]
mov r14, qword [rsp + 0x100]
movsxd rbx, eax
mov rcx, r8
movzx r12d, word [r14 + 0x88]
lea rdx, [rbx + 0x23]
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x68], r13
call fcn.14005b878
xor ebp, ebp
lea rcx, [rbx + rax]
mov qword [rsp + 0x60], rax
lea eax, [rbp + 0xf]
mov word [rcx + 0x20], bp
mov word [rcx + rax*2], r15w
sub rax, 1
jns 0x14002f7fd
mov rsi, qword [rsp + 0x60]
mov r8b, byte [rsp + 0x48]
mov rcx, r14
mov rdx, rsi
call fcn.14002314c
cmp word [rsi], r12w
jne 0x14002f82a
mov esi, ebp
jmp 0x14002f951
mov r15, qword [rsp + 0xe0]
cmp qword [r15], rbp
je 0x14002f847
mov rcx, qword [r15]
movzx edx, r12w
call fcn.14001935c
mov ebx, eax
jmp 0x14002f849
mov ebx, ebp
movzx eax, word [r14 + 0x90]
mov rcx, qword [r15]
cmp word [rsi + r13*2 - 2], ax
mov eax, 1
cmovne ebp, eax
lea eax, [rbp + rbx]
lea edx, [rax + r13 + 0x10]
movsxd rdx, edx
lea rdx, [rdx + rdx + 2]
call fcn.14005b878
mov edx, dword [rsp + 0xe8]
cmp edx, ebx
mov qword [r15], rax
cmovg edx, ebx
cmp ebx, edx
movsxd rcx, edx
mov dword [rsp + 0xe8], edx
lea r10, [rax + rcx*2]
jle 0x14002f8b4
mov eax, ebx
sub eax, edx
mov rdx, r10
add eax, eax
movsxd r8, eax
movsxd rax, ebp
add rax, r13
lea rcx, [r10 + rax*2]
call fcn.14001b6a0
xor eax, eax
cmp ebp, eax
je 0x14002f8c7
movzx eax, word [r14 + 0x90]
mov word [r10 + r13*2], ax
lea r8, [r13 + r13]
mov rdx, rsi
mov rcx, r10
call fcn.14001b6e8
movsxd rcx, ebp
movsxd r8, ebx
lea rax, [r13 + rcx]
add r8, rax
mov rax, qword [r15]
mov word [rax + r8*2], r12w
mov rcx, qword [rsp + 0x60]
call fcn.140053e64
mov edi, dword [rsp + 0x108]
mov r9, qword [rsp + 0xf8]
mov edx, dword [rsp + 0xe8]
mov r8d, r13d
mov rcx, r15
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
call fcn.14002efd8
movzx ebx, ax
lea rcx, [rsp + 0x60]
or ebx, edi
call fcn.140053e80
lea rcx, [rsp + 0x58]
call fcn.140053e80
mov eax, ebx
jmp 0x14002f967
cmp rbx, r13
je 0x14002f951
cmp rbx, rsi
je 0x14002f951
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x60]
call fcn.140053e80
lea rcx, [rsp + 0x58]
call fcn.140053e80
mov eax, esi
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret