Function at 0x14026de1c
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x18], rax
mov eax, dword [rcx + 0x84]
mov rdi, rcx
neg eax
mov qword [rbp - 0x68], rcx
sbb r13b, r13b
xor ecx, ecx
and r13b, 0x3f
add r13b, 0xc0
mov byte [rsp + 0x51], r13b
call qword [sym.imp.USER32.dll_GetDC]
nop dword [rax + rax]
xor r15d, r15d
mov qword [rbp - 0x50], rax
test rax, rax
jne 0x14026de95
call fcn.140020b4c
mov ebx, eax
test eax, eax
js 0x14026e78e
mov eax, dword [rdi + 0x80]
lea r14, [rdi + 0xf0]
mov r12d, dword [rdi + 0x74]
mov ebx, 1
mov dword [rsp + 0x74], eax
mov eax, dword [rdi + 0xfc]
sub eax, dword [rdi + 0x20]
mov dword [rsp + 0x6c], eax
mov eax, dword [rdi + 0xf8]
sub eax, dword [rdi + 0x1c]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x64], r12d
xor eax, eax
lock cmpxchg dword [0x14038b0f0], ebx
jne 0x14026dece
mov eax, dword [0x140389de8]
lea rsi, [0x14038a340]
test eax, eax
jne 0x14026e4ac
mov rbx, r15
mov dword [rsp + 0x5c], r15d
mov ecx, 0x338
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x60], r15d
mov qword [rbp - 0x80], r15
mov dword [rsp + 0x54], r15d
call fcn.140091688
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14026e40a
xor r13d, r13d
lea r12, [rax + 7]
or ecx, 0xffffffff
lea rsi, [0x140319602]
xor r14d, r14d
lea edi, [r13 + 0x67]
lea r15d, [r13 + 1]
movzx eax, byte [rsi - 1]
movzx r11d, byte [rsi - 2]
movzx r10d, byte [rsi + 2]
shl r11d, 8
or r11d, eax
shl r10d, 8
movzx eax, byte [rsi]
lea rsi, [rsi + 8]
shl r11d, 8
or r11d, eax
movzx eax, byte [rsi - 7]
shl r11d, 8
or r11d, eax
movzx eax, byte [rsi - 5]
or r10d, eax
xor r14d, r11d
movzx eax, byte [rsi - 4]
shl r10d, 8
or r10d, eax
movzx eax, byte [rsi - 3]
shl r10d, 8
or r10d, eax
mov r9d, r10d
xor r9d, r13d
xor r9d, r14d
xor r9d, 0xac987321
lea eax, [r9 + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, r9d
rol eax, 0xa
add edx, eax
xor r14d, edx
lea eax, [r14 + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, r14d
rol eax, 2
sub edx, eax
xor r9d, edx
imul edx, r9d, 0x605e
mov eax, r9d
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor r14d, edx
mov eax, r14d
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor r9d, edx
mov edx, r9d
xor edx, 0xab69605e
sub eax, edx
xor r14d, eax
mov eax, r14d
mov r8d, r14d
xor eax, 0x137f
ror r8d, 6
imul edx, eax, 0xab69
xor r8d, edx
xor r9d, r8d
lea eax, [r9 + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, r9d
rol eax, 2
add edx, eax
xor r14d, edx
lea eax, [r14 + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 8
sub edx, eax
xor r9d, edx
mov eax, r9d
mov r8d, 0xab69605e
xor eax, r8d
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, r9d
ror eax, 0xa
xor edx, eax
xor r14d, edx
mov eax, r14d
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, r14d
shr eax, 0xa
xor edx, eax
xor edx, r9d
mov r9d, 0x605e
mov eax, edx
not eax
ror eax, 5
add eax, r9d
imul eax, eax, 0x7f1
xor r14d, eax
lea r13d, [r14 - 0x7f1]
xor r13d, edx
xor r13d, r8d
mov eax, r13d
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, r13d
shr eax, 2
add edx, eax
xor r14d, edx
lea eax, [r14 - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, r14d
rol eax, 7
add edx, eax
xor r13d, edx
mov eax, r13d
mov r8d, r13d
xor eax, 0x137f
ror r8d, 9
imul edx, eax, 0x605e
add r8d, edx
xor r14d, r8d
mov eax, r14d
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 7
add edx, eax
xor r13d, edx
xor r14d, r13d
xor r14d, 0xac987321
mov eax, r14d
ror eax, 3
imul edx, eax, 0x137f
sub edx, 0xd0dd417
xor r13d, edx
lea eax, [r13 - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, r13d
ror eax, 6
sub edx, eax
xor r14d, edx
lea eax, [r14 - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, r14d
rol eax, 0xe
add edx, eax
xor r13d, edx
lea eax, [r13 - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, r13d
ror eax, 0xe
sub edx, eax
xor r14d, edx
mov eax, r14d
xor eax, r9d
imul edx, eax, 0xab69
mov eax, r14d
shr eax, 3
xor edx, eax
xor r13d, edx
mov eax, r13d
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, r13d
xor r13d, ecx
rol eax, 2
mov byte [r12], r13b
mov ecx, r10d
ror r13d, 8
mov byte [r12 - 1], r13b
lea r12, [r12 + 8]
ror r13d, 8
xor edx, eax
xor edx, ebx
mov byte [r12 - 0xa], r13b
xor r14d, edx
ror r13d, 8
mov byte [r12 - 0xc], r14b
mov ebx, r11d
ror r14d, 8
mov byte [r12 - 0xd], r14b
ror r14d, 8
mov byte [r12 - 0xe], r14b
ror r14d, 8
mov byte [r12 - 0xf], r14b
mov byte [r12 - 0xb], r13b
ror r14d, 8
ror r13d, 8
sub rdi, r15
jne 0x14026df3d
mov rdi, qword [rbp - 0x68]
xor eax, eax
mov r15, qword [rbp - 0x60]
mov cl, al
mov r12d, dword [rsp + 0x64]
mov ebx, eax
mov r13b, byte [rsp + 0x51]
mov esi, eax
lea r14, [rdi + 0xf0]
mov edx, 0x338
xor cl, byte [rax + r15]
inc rax
cmp rax, rdx
jb 0x14026e262
movzx eax, cl
cmp rax, qword [0x140319938]
je 0x14026e284
mov dword [rsp + 0x54], 0xc004d501
jmp 0x14026e293
mov rbx, r15
mov qword [rbp - 0x80], rdx
mov qword [rsp + 0x78], rbx
xor r15d, r15d
test r15, r15
je 0x14026e2a0
mov rcx, r15
call fcn.14009447c
cmp dword [rsp + 0x54], esi
jl 0x14026e40a
mov rax, qword [rbp - 0x80]
lea r15, [0x14038a340]
xor edx, edx
mov rcx, r15
mov byte [rax + rbx - 1], sil
lea r8d, [rdx + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor r8d, r8d
cmp byte [rbx], r8b
je 0x14026e40f
mov rdx, rbx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r8w
jne 0x14026e2db
lea rbx, [rbx + rax*2]
mov eax, dword [rsp + 0x60]
lea rcx, [rax + rax*2]
lea r15, [r15 + rcx*8]
xor ecx, ecx
mov r8, r15
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
nop dword [rax + rax]
xor r8d, r8d
test eax, eax
je 0x14026e405
mov rax, qword [r15]
mov ecx, 0x5a4d
mov esi, r8d
cmp word [rax], cx
je 0x14026e328
mov esi, 0xc000007b
jmp 0x14026e373
movsxd rcx, dword [rax + 0x3c]
cmp ecx, 0x10000000
jae 0x14026e321
add rcx, qword [r15]
cmp rcx, qword [r15]
jb 0x14026e321
cmp dword [rcx], 0x4550
jne 0x14026e321
movzx eax, word [rcx + 0x18]
mov edx, 0x10b
sub ax, dx
mov edx, 0xfeff
test dx, ax
je 0x14026e361
mov esi, 0xc000000d
jmp 0x14026e373
mov rax, qword [rcx + 0x88]
mov qword [r15 + 0xc], rax
mov eax, dword [rcx + 0x50]
mov dword [r15 + 8], eax
mov eax, dword [rbx + 2]
mov ecx, r8d
add rbx, 6
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x54], ecx
test eax, eax
je 0x14026e3e4
mov rdx, rbx
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r8b
jne 0x14026e390
inc rbx
add rbx, rax
test esi, esi
js 0x14026e3cd
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
xor r8d, r8d
test rax, rax
je 0x14026e3fe
mov ecx, dword [rsp + 0x5c]
lea rdx, section..data
mov qword [rdx + rcx*8], rax
mov ecx, dword [rsp + 0x54]
mov eax, 1
add dword [rsp + 0x5c], eax
add ecx, eax
mov dword [rsp + 0x54], ecx
cmp ecx, dword [rsp + 0x64]
jb 0x14026e389
jmp 0x14026e3e9
mov eax, 1
add dword [rsp + 0x60], eax
cmp byte [rbx], r8b
je 0x14026e3fe
lea r15, [0x14038a340]
jmp 0x14026e2d4
mov rbx, qword [rsp + 0x78]
jmp 0x14026e40f
mov rbx, qword [rsp + 0x78]
mov esi, 0xc000007a
xor r15d, r15d
test rbx, rbx
je 0x14026e437
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test esi, esi
jns 0x14026e49a
lea rbx, [0x14038a340]
mov esi, 4
mov rcx, qword [rbx]
test rcx, rcx
je 0x14026e45b
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
add rbx, 0x18
sub rsi, 1
jne 0x14026e447
lea r8d, [rsi + 0x60]
xor edx, edx
lea rsi, [0x14038a340]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x170
lea rdx, [0x1402fbd30]
lea rcx, section..data
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ebx, 1
jmp 0x14026e4b4
mov eax, dword [0x140389de8]
lea rsi, [0x14038a340]
mov ebx, 1
add eax, ebx
mov dword [0x140389de8], eax
mov eax, r15d
xchg dword [0x14038b0f0], eax
sub r12d, 1
je 0x14026e650
sub r12d, 1
je 0x14026e578
cmp r12d, 1
jne 0x14026e654
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x10], rax
mov edx, ebx
mov rax, qword [method.4.virtual_56]
xor ecx, ecx
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
call qword [case.0x14006b68f.0]
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], PathIsExe
mov rcx, rax
mov rax, qword [method.4.virtual_56]
call qword [case.0x14006b68f.0]
test eax, eax
je 0x14026e654
mov rax, qword [method.4.virtual_56]
lea rdx, [rbp + 4]
xor ecx, ecx
call qword [case.0x14006b68f.0]
mov rax, qword [method.4.virtual_56]
lea rdx, [rbp + 0xc]
xor ecx, ecx
call qword [case.0x14006b68f.0]
mov eax, dword [rbp + 0xc]
sub eax, dword [rsp + 0x68]
imul ecx, eax, 0x32
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov rcx, qword [rbp + 0xc]
shr rcx, 0x20
sub ecx, dword [rsp + 0x6c]
imul ecx, ecx, 0x32
mov dword [r14], edx
jmp 0x14026e639
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x18], rax
mov edx, ebx
mov rax, qword [method.4.virtual_56]
xor ecx, ecx
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
call qword [case.0x14006b68f.0]
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x38], PathIsExe
mov rcx, rax
mov rax, qword [method.4.virtual_56]
call qword [case.0x14006b68f.0]
test eax, eax
je 0x14026e654
mov rax, qword [method.4.virtual_56]
lea rdx, [rbp - 0x24]
xor ecx, ecx
call qword [case.0x14006b68f.0]
mov rax, qword [method.4.virtual_56]
lea rdx, [rbp - 0x1c]
xor ecx, ecx
call qword [case.0x14006b68f.0]
movups xmm0, xmmword [rbp - 0x24]
mov eax, dword [rbp - 0x1c]
movdqu xmmword [rbp - 0x48], xmm0
cmp dword [rsp + 0x74], r15d
je 0x14026e60f
lea ecx, [rax + rax*4]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
add edx, dword [rbp - 0x24]
jmp 0x14026e627
sub eax, dword [rsp + 0x68]
imul ecx, eax, 0x5f
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [r14], edx
mov rax, qword [rbp - 0x40]
shr rax, 0x20
sub eax, dword [rsp + 0x6c]
imul ecx, eax, 0x5f
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [r14 + 4], edx
jmp 0x14026e654
and qword [r14], 0
xor eax, eax
lock cmpxchg dword [0x14038b0f0], ebx
jne 0x14026e654
mov eax, dword [0x140389de8]
test eax, eax
jle 0x14026e6cf
sub eax, ebx
mov dword [0x140389de8], eax
jne 0x14026e6cf
mov rbx, rsi
mov esi, 4
lea eax, [rsi - 3]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14026e698
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov eax, 1
add rbx, 0x18
sub rsi, rax
jne 0x14026e67f
xor edx, edx
lea r8d, [rsi + 0x60]
lea rcx, [0x14038a340]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x170
lea rdx, [0x1402fbd30]
lea rcx, section..data
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
lea ebx, [rsi + 1]
mov rsi, qword [rbp - 0x50]
lea r9, [rbp - 0x78]
mov dword [rsp + 0x40], 2
mov eax, r15d
xchg dword [0x14038b0f0], eax
mov eax, dword [rdi + 0x20]
mov r8, r14
sub dword [rdi + 0xf4], eax
mov rdx, rsi
mov eax, dword [rdi + 0xf8]
mov ecx, dword [rdi + 0x1c]
sub dword [r14], ecx
mov rcx, qword [rdi + 0x28]
and word [rsp + 0x58], 0
mov dword [rbp - 0x78], eax
mov eax, dword [rdi + 0xfc]
mov dword [rbp - 0x74], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x58]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x58], r15
mov byte [rsp + 0x5a], r13b
mov byte [rsp + 0x5b], bl
call qword [sym.imp.USER32.dll_UpdateLayeredWindow]
nop dword [rax + rax]
test eax, eax
je 0x14026e75c
mov ebx, r15d
jmp 0x14026e763
call fcn.140020b4c
mov ebx, eax
mov rcx, qword [rdi + 0x28]
mov edx, 4
call qword [sym.imp.USER32.dll_ShowWindowAsync]
nop dword [rax + rax]
test rsi, rsi
je 0x14026e78e
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret