Function at 0x1400290d0
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push r12
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0xa8]
xor ebx, ebx
mov qword [rsp + 0x50], rax
mov r12, rdx
mov eax, 0x5a4d
mov qword [rsp + 0x40], rcx
mov r14, rcx
mov qword [rbp - 0x10], rbx
mov qword [rbp], rbx
cmp word [rdx], ax
je 0x140029121
mov esi, ebx
jmp 0x140029132
movsxd rsi, dword [rdx + 0x3c]
add rsi, r12
cmp dword [rsi], 0x4550
cmovne rsi, rbx
test rsi, rsi
jne 0x1400291e0
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0xb8a6b8d1
mov dword [rsp + 0x74], 0xb8adb8d1
mov dword [rsp + 0x78], 0xb8e1b8c7
mov dword [rsp + 0x7c], 0xb8f0b8e6
mov dword [rbp - 0x80], 0xb8fab8fe
mov dword [rbp - 0x7c], 0xb8b5b8f0
mov dword [rbp - 0x78], 0xb8f8b8f0
mov dword [rbp - 0x74], 0xb8f4b8ea
mov dword [rbp - 0x70], 0xb8efb8fb
mov dword [rbp - 0x6c], 0xb8f2b8bc
mov dword [rbp - 0x68], 0xb8bfb8f8
mov dword [rbp - 0x64], 0xb8e4b8f0
mov dword [rbp - 0x60], 0xb8cab882
mov dword [rbp - 0x5c], 0xb8c4b8c9
mov dword [rbp - 0x58], 0xb8c2b8c1
mov word [rbp - 0x54], bx
mov byte [rbp - 0x52], 1
call fcn.14001b330
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140023cc0
lea rdx, [0x140023ea0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
jmp 0x140029a14
mov eax, 0x20b
cmp word [rsi + 0x18], ax
je 0x140029373
movdqa xmm3, xmmword [0x14003a720]
mov ecx, 0xb893
movdqa xmm4, xmmword [0x14003a7d0]
mov dword [rsp + 0x70], 0xb8a0b8d7
mov dword [rsp + 0x74], 0xb8afb8d3
mov dword [rsp + 0x78], 0xb8fcb8d9
mov dword [rsp + 0x7c], 0xb8f4b8f3
mov dword [rbp - 0x80], 0xb8b5b8f1
mov dword [rbp - 0x7c], 0xb8e4b8ff
mov dword [rbp - 0x78], 0xb8f7b8b8
mov dword [rbp - 0x74], 0xb8efb8f5
mov dword [rbp - 0x70], 0xb8abb8bc
mov dword [rbp - 0x6c], 0xb8bfb8aa
mov dword [rbp - 0x68], 0xb8c8b8c2
mov dword [rbp - 0x64], 0xb8d6
mov byte [rbp - 0x60], 1
movd xmm1, dword [rsp + rbx*2 + 0x70]
lea rax, [rcx - 5]
xorps xmm0, xmm0
movq xmm2, rbx
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [rcx - 3]
movd dword [rsp + rbx*2 + 0x70], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rsp + rbx*2 + 0x74]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [rcx - 1]
movd dword [rsp + rbx*2 + 0x74], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rsp + rbx*2 + 0x78]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rcx
movd dword [rsp + rbx*2 + 0x78], xmm1
add rcx, 8
movd xmm1, dword [rsp + rbx*2 + 0x7c]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rbx*2 + 0x7c], xmm1
add rbx, 8
cmp rcx, 0xb8a3
jb 0x140029260
cmp rbx, 0x17
jae 0x140029365
mov edx, 0x4774
movzx eax, bx
sub ax, dx
xor word [rsp + rbx*2 + 0x70], ax
inc rbx
cmp rbx, 0x17
jb 0x140029351
mov byte [rbp - 0x60], 0
lea rdx, [rsp + 0x70]
jmp 0x1400291bd
mov qword [rsp + 0x170], rdi
xor ecx, ecx
mov edi, dword [rsi + 0x50]
mov r9d, 4
mov edx, edi
mov qword [rsp + 0x120], r15
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x140029a04
movzx eax, word [rsi + 0x14]
lea r8, [rbp - 0x18]
mov rcx, r14
mov qword [rsp + 0x128], r13
mov eax, dword [rax + rsi + 0x24]
sub edi, eax
mov dword [rbp - 0x20], eax
mov eax, edi
mov edx, edi
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x18], rbx
call fcn.1400288b0
mov qword [rsp + 0x58], rax
mov r13, rax
test rax, rax
jne 0x1400295e2
movdqa xmm3, xmmword [0x14003a720]
mov ecx, 0xb893
movdqa xmm4, xmmword [0x14003a7d0]
mov dword [rsp + 0x70], 0xb8a0b8d7
mov dword [rsp + 0x74], 0xb8afb8d3
mov dword [rsp + 0x78], 0xb8f0b8d6
mov dword [rsp + 0x7c], 0xb8ffb8fb
mov dword [rbp - 0x80], 0xb8f1b8f1
mov dword [rbp - 0x7c], 0xb8e3b8b6
mov dword [rbp - 0x78], 0xb8b9b8f7
mov dword [rbp - 0x74], 0xb8f7b8fb
mov dword [rbp - 0x70], 0xb8f2b8f0
mov dword [rbp - 0x6c], 0xb8feb8fd
mov dword [rbp - 0x68], 0xb8c4b8d4
mov dword [rbp - 0x64], 0xb8d1b882
mov dword [rbp - 0x60], 0xb8c8b8c1
mov dword [rbp - 0x5c], 0xb8d3b8c9
mov dword [rbp - 0x58], 0xb889b8cd
mov dword [rbp - 0x54], 0xb8c6b8c3
mov dword [rbp - 0x50], 0xb8cab8cd
mov dword [rbp - 0x4c], 0xb88fb8cb
mov dword [rbp - 0x48], 0xb8dfb8d9
mov dword [rbp - 0x44], 0xb8d8b892
mov dword [rbp - 0x40], 0xb8c7b8d1
mov dword [rbp - 0x3c], 0xb8d2b8d8
mov dword [rbp - 0x38], 0xb8d4
mov byte [rbp - 0x34], 1
nop word [rax + rax]
movd xmm1, dword [rsp + rbx*2 + 0x70]
lea rax, [rcx - 5]
xorps xmm0, xmm0
movq xmm2, rbx
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [rcx - 3]
movd dword [rsp + rbx*2 + 0x70], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rsp + rbx*2 + 0x74]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [rcx - 1]
movd dword [rsp + rbx*2 + 0x74], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rsp + rbx*2 + 0x78]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rcx
movd dword [rsp + rbx*2 + 0x78], xmm1
add rcx, 8
movd xmm1, dword [rsp + rbx*2 + 0x7c]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rbx*2 + 0x7c], xmm1
add rbx, 8
cmp rcx, 0xb8bb
jb 0x1400294b0
cmp rbx, 0x2d
jae 0x1400295b5
mov edx, 0x4774
movzx eax, bx
sub ax, dx
xor word [rsp + rbx*2 + 0x70], ax
inc rbx
cmp rbx, 0x2d
jb 0x1400295a1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rsp + 0x70]
mov byte [rbp - 0x34], 0
call fcn.140023cc0
lea rdx, [0x140023ea0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r12, r14
jmp 0x1400299dc
mov r8d, dword [rsi + 0x54]
mov rdx, r12
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx edi, word [rsi + 0x14]
mov r14d, ebx
add rdi, 0x28
cmp bx, word [rsi + 6]
jae 0x140029632
add rdi, rsi
test dword [rdi + 0x14], 0x80
ja 0x140029622
mov edx, dword [rdi + 4]
mov ecx, dword [rdi - 4]
add rdx, r12
mov r8d, dword [rdi]
add rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsi + 6]
inc r14d
add rdi, 0x28
cmp r14d, eax
jl 0x140029605
mov eax, dword [rbp - 0x20]
lea rcx, [rsp + 0x70]
mov r14, r13
mov rdx, r15
sub r13, rax
mov rdi, r13
sub rdi, qword [rsi + 0x30]
call fcn.14002ad00
mov rdx, rdi
mov rcx, rax
call fcn.140029b80
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.14002ae60
mov r12, qword [rsp + 0x40]
mov rdx, rax
mov rcx, r12
call fcn.140029c80
test al, al
jne 0x1400296ff
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0xb8a0b8d7
mov dword [rsp + 0x74], 0xb8afb8d3
mov dword [rsp + 0x78], 0xb8f0b8d6
mov dword [rsp + 0x7c], 0xb8ffb8fb
mov dword [rbp - 0x80], 0xb8f1b8f1
mov dword [rbp - 0x7c], 0xb8e3b8b6
mov dword [rbp - 0x78], 0xb8b9b8f7
mov dword [rbp - 0x74], 0xb8feb8e8
mov dword [rbp - 0x70], 0xb8f2b8ef
mov dword [rbp - 0x6c], 0xb8e9b8f2
mov dword [rbp - 0x68], 0xb881b8c5
mov dword [rbp - 0x64], 0xb8ceb8cb
mov dword [rbp - 0x60], 0xb8cab8d4
mov dword [rbp - 0x5c], 0xb8d3b8d4
mov dword [rbp - 0x58], 0xb8db
mov byte [rbp - 0x54], 1
call fcn.140029a30
jmp 0x1400299bd
mov eax, dword [rbp - 0x20]
add rax, r15
je 0x140029903
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x140029903
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x70]
mov qword [rbp - 0x80], rax
mov r9d, 0x28
lea rax, [rbp - 0x20]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x30], rax
mov edx, 0x80862007
mov dword [rsp + 0x28], ebx
mov rcx, r12
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x70], 0x33
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], rdi
mov dword [rbp - 0x20], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140029903
mov esi, dword [rsi + 0x28]
lea rdx, [rbp - 0x10]
mov rax, qword [rbp - 0x18]
lea rcx, [rbp]
mov r9, rdi
mov qword [rsp + 0x20], rax
mov r8, r14
add rsi, r13
call fcn.14002d370
test al, al
jne 0x14002982d
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0xb8a0b8d7
mov dword [rsp + 0x74], 0xb8afb8d3
mov dword [rsp + 0x78], 0xb8f0b8d3
mov dword [rsp + 0x7c], 0xb8ffb8fe
mov dword [rbp - 0x80], 0xb8f4b8f6
mov dword [rbp - 0x7c], 0xb8fcb8f5
mov dword [rbp - 0x78], 0xb8ebb8b8
mov dword [rbp - 0x74], 0xb8efb8ff
mov dword [rbp - 0x70], 0xb8efb8e9
mov dword [rbp - 0x6c], 0xb8ecb8f0
mov dword [rbp - 0x68], 0xb8c7b880
mov dword [rbp - 0x64], 0xb8cfb8c3
mov dword [rbp - 0x60], 0xb8c0b8d7
mov dword [rbp - 0x5c], 0xb887b88a
mov dword [rbp - 0x58], 0xb8c8b8ce
mov dword [rbp - 0x54], 0xb8c7b8c3
mov dword [rbp - 0x50], 0xb8c9b8c9
mov dword [rbp - 0x4c], 0xb88f
mov byte [rbp - 0x48], 1
call fcn.140028f80
jmp 0x1400299bd
mov rax, qword [rbp - 0x10]
lea rdx, [rbp - 0x1c]
mov r9, qword [rbp]
mov r8, rsi
mov rcx, r12
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x1c], ebx
call fcn.14002a000
test al, al
jne 0x1400298db
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0xb8a6b8d1
mov dword [rsp + 0x74], 0xb8adb8d1
mov dword [rsp + 0x78], 0xb8eeb8c8
mov dword [rsp + 0x7c], 0xb8fdb8f9
mov dword [rbp - 0x80], 0xb8f7b8f7
mov dword [rbp - 0x7c], 0xb8e1b8b4
mov dword [rbp - 0x78], 0xb8b7b8f9
mov dword [rbp - 0x74], 0xb8f8b8fb
mov dword [rbp - 0x70], 0xb8f7b8f6
mov dword [rbp - 0x6c], 0xb8f9b8bc
mov dword [rbp - 0x68], 0xb8f6b8ec
mov dword [rbp - 0x64], 0xb8c4b8d6
mov dword [rbp - 0x60], 0xb883b8d0
mov dword [rbp - 0x5c], 0xb8cbb8c1
mov dword [rbp - 0x58], 0xb8d5b8d2
mov dword [rbp - 0x54], 0xb8d1
mov byte [rbp - 0x50], 1
call fcn.14001ed90
jmp 0x1400299bd
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400298ea
mov ecx, dword [rbp - 0x1c]
mov dword [rax], ecx
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r14
jmp 0x1400299fc
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0xb8a6b8d1
mov dword [rsp + 0x74], 0xb8adb8d1
mov dword [rsp + 0x78], 0xb8eeb8c8
mov dword [rsp + 0x7c], 0xb8fdb8f9
mov dword [rbp - 0x80], 0xb8f7b8f7
mov dword [rbp - 0x7c], 0xb8e1b8b4
mov dword [rbp - 0x78], 0xb8b7b8f9
mov dword [rbp - 0x74], 0xb8ebb8ef
mov dword [rbp - 0x70], 0xb8efb8f3
mov dword [rbp - 0x6c], 0xb8bdb8f9
mov dword [rbp - 0x68], 0xb8f0b8f2
mov dword [rbp - 0x64], 0xb8c0b8c3
mov dword [rbp - 0x60], 0xb883b8ce
mov dword [rbp - 0x5c], 0xb8c8b8cd
mov dword [rbp - 0x58], 0xb8c0b8c7
mov dword [rbp - 0x54], 0xb889b8cd
mov dword [rbp - 0x50], 0xb8c4b8de
mov dword [rbp - 0x4c], 0xb8dfb88c
mov dword [rbp - 0x48], 0xb8c2b8cb
mov dword [rbp - 0x44], 0xb8c5b8df
mov dword [rbp - 0x40], 0xb893b8d7
mov dword [rbp - 0x3c], 0xb8d8b8dd
mov dword [rbp - 0x38], 0xb8d0b8d7
mov dword [rbp - 0x34], 0xb8dd
mov byte [rbp - 0x30], 1
call fcn.14001c870
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov rdx, rax
call fcn.140023cc0
lea rdx, [0x140023ea0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call fcn.14001d290
xor eax, eax
mov r13, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x170]
mov r15, qword [rsp + 0x120]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14002dc20
add rsp, 0x130
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret