Function at 0x14002c3f0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, qword [rsp + 0x2c0]
mov rbx, rcx
mov r13, r8
mov r12d, edx
lea rcx, [rsp + 0x51]
mov r8d, 0x1ff
xor edx, edx
mov edi, 3
mov byte [rsp + 0x50], 0
call fcn.14000cbf0
xor eax, eax
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 0x200
mov rcx, rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002c4bb
test rsi, rsi
je 0x14002c6a3
mov rax, qword [rsi + 8]
test rax, rax
je 0x14002c492
mov rcx, qword [rsi]
lea edx, [rdi + 0x16]
lea r8d, [rdi - 1]
mov r9d, 0x346
call rax
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14002c6a3
mov rcx, qword [rsi]
lea r8, str.Not_able_to_read_message_from_license_service
mov r9d, 0x347
mov edx, reloc.WS2_32.dll_inet_ntoa
call rax
jmp 0x14002c6a3
mov ebp, dword [rsp + 0x30]
mov edi, 4
lea r14d, [rbp + 3]
mov edx, edi
shr r14d, 2
mov ecx, r14d
mov ebx, r14d
call fcn.140022b68
mov rsi, rax
test rax, rax
je 0x14002c69e
lea rdx, [rsp + 0x50]
mov r8d, ebp
mov rcx, rax
call fcn.14000da10
imul ecx, r12d, 0x19660d
add ecx, 0x3c6ef35f
imul r12d, ecx, 0x19660d
add r12d, 0x3c6ef35f
mov r8d, r12d
test r14d, r14d
je 0x14002c536
mov rdx, rsi
nop dword [rax + rax]
mov ecx, dword [rdx]
lea rdx, [rdx + 4]
mov eax, ecx
xor eax, r8d
mov r8d, ecx
mov dword [rdx - 4], eax
dec rbx
jne 0x14002c520
xor r8d, r8d
xor eax, eax
xor r10b, r10b
test ebp, ebp
je 0x14002c576
lea r9, [rsp + 0x50]
nop word [rax + rax]
mov edx, dword [rsi + rax*4]
movzx ecx, r10b
inc r8d
and ecx, 0x1f
mov eax, r8d
add r10b, 8
shr edx, cl
shr eax, 2
lea r9, [r9 + 1]
mov byte [r9 - 1], dl
cmp r8d, ebp
jb 0x14002c550
mov rcx, rsi
call fcn.1400108e4
cmp rbp, 0x200
jae 0x14002c6d0
mov byte [rsp + rbp + 0x50], 0
mov rax, qword [rsp + 0x50]
cmp rax, qword [str.___VMAttrs]
jne 0x14002c6a3
mov eax, dword [rsp + 0x58]
cmp eax, dword [0x14010e8d8]
jne 0x14002c6a3
movzx eax, byte [rsp + 0x5c]
cmp al, byte [reloc.WS2_32.dll_WSAStartup]
jne 0x14002c6a3
cmp byte [rsp + 0x5d], 0
je 0x14002c6a3
lea rcx, [rsp + 0x5d]
mov edx, reloc.WS2_32.dll_inet_ntoa
call fcn.14000d684
mov rbx, rax
test rax, rax
je 0x14002c6a3
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x5d]
mov r8d, 0xa
mov byte [rax], 0
call fcn.140018cac
mov rcx, qword [rsp + 0x38]
cmp byte [rcx], 0
jne 0x14002c6a3
inc rbx
je 0x14002c6a3
cmp eax, 1
je 0x14002c624
mov edi, 6
jmp 0x14002c6a3
cmp byte [rbx], 0
je 0x14002c6a3
mov edx, reloc.WS2_32.dll_inet_ntoa
mov rcx, rbx
call fcn.14000d684
mov rsi, rax
test rax, rax
je 0x14002c6a3
lea rdx, [rsp + 0x40]
mov r8d, 0xa
mov rcx, rbx
mov byte [rax], 0
call fcn.140018cac
mov rcx, qword [rsp + 0x40]
cmp byte [rcx], 0
jne 0x14002c6a3
lea r8, [rsi + 1]
test r8, r8
je 0x14002c6a3
cmp eax, r12d
je 0x14002c673
mov edi, 2
jmp 0x14002c6a3
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r8 + rax], 0
jne 0x14002c680
mov r9d, eax
mov edx, 0x200
mov rcx, r13
call fcn.14001b220
xor edi, edi
jmp 0x14002c6a3
mov edi, 5
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14000c9f0
mov rbx, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000d948
int3