Function at 0x140001310
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [r11 + 8], rbx
lea rcx, [rsp + 0x20]
mov qword [r11 + 0x20], rdi
xor r14d, r14d
xor edx, edx
mov qword [r11 - 0x18], r15
mov r8d, 0x100
mov ebx, r14d
mov edi, r14d
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8, rax
mov ecx, r14d
movsxd rax, dword [rax + 0x3c]
mov r10d, dword [rax + r8 + 0x98]
movzx r9d, word [r10 + r8 + 0xe]
lea r11, [r10 + r8]
movzx eax, word [r11 + 0xc]
add r9, rax
je 0x1400013d4
mov eax, dword [r11 + rcx*8 + 0x14]
test eax, eax
jns 0x1400013d4
btr eax, 0x1f
add rax, r10
mov edx, dword [rax + r8 + 0x14]
test edx, edx
jns 0x1400013a5
cmp word [rax + r8 + 0x10], 0x65
je 0x1400013af
inc rcx
cmp rcx, r9
jb 0x140001383
jmp 0x1400013d4
btr edx, 0x1f
add rdx, r10
mov eax, dword [rdx + r8 + 0x14]
btr eax, 0x1f
add rax, r10
mov ebx, dword [rax + r8]
mov edi, dword [rax + r8 + 4]
add rbx, r8
je 0x1400013d4
test edi, edi
jne 0x1400013f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x65
lea rcx, str.____GetResourceData_Failed_To_Fetch_Resource_Section_Payload_Of_Id_0x___0.8X_From_Module_0x___p_main.c:158__n
mov r8, rax
call fcn.140001010
lea r15, [rbx + 0x30]
add edi, 0xffffffd0
mov r8d, edi
lea rcx, str.___Payload_Is_At_0x_p_Of_Size__d__n
mov rdx, r15
call fcn.140001010
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x120]
movups xmm1, xmmword [rbx + 0x10]
lea rcx, [rsp + 0x130]
movups xmmword [rsp + 0x130], xmm0
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rsp + 0x140], xmm1
movups xmmword [rsp + 0x120], xmm0
call fcn.140001070
lea rcx, str.____The_Decrypted_Key_Bytes:__
call fcn.140001010
mov rbx, r14
movzx edx, byte [rsp + rbx + 0x130]
lea rcx, str._02X
call fcn.140001010
inc rbx
cmp rbx, 0x20
jb 0x140001450
lea rcx, [0x140004330]
call fcn.140001010
lea rcx, str.____The_Decrypted_Iv_Bytes:__
call fcn.140001010
mov rbx, r14
nop dword [rax + rax]
movzx edx, byte [rsp + rbx + 0x120]
lea rcx, str._02X
call fcn.140001010
inc rbx
cmp rbx, 0x10
jb 0x140001490
lea rcx, [0x140004330]
mov qword [rsp + 0x198], rbp
call fcn.140001010
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
call fcn.1400022e0
mov ebx, edi
movups xmm2, xmmword [rsp + 0x120]
movups xmmword [rsp + 0x110], xmm2
test dil, 0xf
jne 0x1400015f2
mov ebp, ebx
shr rbp, 4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x1400015f2
mov rbx, rax
test rbp, rbp
je 0x1400015fe
mov qword [rsp + 0x1a0], rsi
lea rdi, [rsp + 0x110]
mov qword [rsp + 0x178], r12
sub rdi, rax
mov r12, rax
movaps xmmword [rsp + 0x160], xmm6
sub r12, r15
add r12, 0xf
sub r15, rax
nop dword [rax]
nop dword [rax + rax]
movups xmm6, xmmword [rbx + r15]
lea rsi, [rbx + r15]
mov r8, rbx
mov r9, rsi
lea rcx, [rsp + 0x20]
call fcn.140002600
lea rax, [rsp + 0x11f]
cmp rbx, rax
ja 0x1400015b2
lea rax, [rsi + r12]
lea rcx, [rsp + 0x110]
cmp rax, rcx
jb 0x1400015b2
mov rax, rbx
mov edx, 0x10
nop
movzx ecx, byte [rax + rdi]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400015a0
jmp 0x1400015c2
movdqu xmm0, xmmword [rbx]
xorps xmm0, xmmword [rsp + 0x110]
movdqu xmmword [rbx], xmm0
add rbx, 0x10
movups xmmword [rsp + 0x110], xmm6
sub rdi, 0x10
sub rbp, 1
jne 0x140001560
movaps xmm6, xmmword [rsp + 0x160]
mov r12, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x1a0]
jmp 0x1400015fe
lea rcx, str.____AES256_CBC_decrypt_Failed__main.c:219__n
call fcn.140001010
mov rdx, r14
lea rcx, str.___Decrypted_Payload_At_:_0x_p__n
call fcn.140001010
movsxd rax, dword [r14 + 0x3c]
mov r15, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x1a8]
mov rbp, qword [rsp + 0x198]
cmp dword [rax + r14], 0x4550
mov rbx, qword [rsp + 0x190]
je 0x140001647
lea rcx, str.The_PE_File_is_Not_valid
call fcn.140001010
lea rcx, str.The_PE_File_is_Valid
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140002990
add rsp, 0x180
pop r14
ret