Function at 0x1401b6b30
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rax, qword [rcx + 8]
mov rcx, qword [0x1404eebb0]
add rcx, qword [rax + 0x38]
je 0x1401b6c7b
mov rdi, r8
cmp qword [r8 + 0x18], 0
je 0x1401b6c82
mov rbx, rdx
mov rax, rdx
shr rax, 0x2f
jne 0x1401b6c82
test rbx, rbx
je 0x1401b6c82
mov rsi, r9
mov edx, 0x40
mov rcx, rbx
call fcn.1401b6e80
test eax, eax
jne 0x1401b6c82
mov r15, qword [0x1404a6538]
movsxd r12, dword [r15]
mov r13d, dword [0x1403c027c]
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x1401b6c82
movsxd rax, dword [rbx + 0x3c]
mov rcx, rax
xor rcx, rbx
and rax, rbx
lea r14, [rcx + rax*2]
mov edx, 0x108
mov rcx, r14
call fcn.1401b6e80
test eax, eax
jne 0x1401b6c82
cmp dword [r14], 0x4550
jne 0x1401b6c82
mov eax, dword [r14 + 0x90]
test rax, rax
je 0x1401b6c8c
lea rcx, [rax + rbx]
mov qword [rbp - 8], rcx
mov eax, dword [rax + rbx + 0xc]
test eax, eax
je 0x1401b6e04
add r12, r15
mov ecx, dword [0x1404a6530]
lea edx, [rcx + 1]
mov dword [0x1404a6530], edx
xor ecx, edx
not ecx
xor r14d, r14d
mov r15d, 0
mov qword [rbp - 0x40], rcx
mov dword [rbp - 0xc], edx
test ecx, edx
jne 0x1401b6d31
xor ecx, ecx
mov r14d, 0
mov r15d, 0
test r13d, r13d
jle 0x1401b6d31
xor r14d, r14d
xor r15d, r15d
movsxd rcx, ecx
xor r15, qword [r12 + rcx + 8]
xor r14, qword [r12 + rcx]
add ecx, 0x10
cmp ecx, r13d
jl 0x1401b6c62
jmp 0x1401b6d31
cmp qword [rax + 0x48], 0
je 0x1401b6c8c
mov ecx, 0x57
call fcn.140199fe0
xor eax, eax
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
mov rdx, qword [0x1403c0288]
mov r9, qword [0x1403c0280]
xor r10d, r10d
test dword [rbp - 0x40], r11d
setne r10b
add r10, 0xffffffffffffffff
mov r11d, 0
adc r11, 0xffffffffffffffff
sub r9, r14
sbb rdx, r15
and r9, r10
and rdx, r11
or rdx, r9
setne dl
or dl, byte [0x1404eeca0]
and dl, 1
mov byte [0x1404eeca0], dl
cmp rcx, 0x20
jae 0x1401b6e11
add rax, 0x28
mov rdx, rax
mov rcx, r8
mov r8d, 0x37d39d
call fcn.140084c10
test r13d, r13d
je 0x1401b6df3
mov rax, qword [rbp - 8]
lea rcx, [rax + 0x14]
mov qword [rbp - 8], rcx
mov eax, dword [rax + 0x20]
test eax, eax
je 0x1401b6e04
mov ecx, eax
xor rcx, rbx
mov edx, ebx
and edx, eax
lea r13, [rcx + rdx*2]
test r13, r13
lea rax, [0x1403b9d28]
cmove r13, rax
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rcx, r13
mov edx, 0xcdd305a5
call fcn.1400856f0
mov r12, rax
cmp rax, 0xf
jbe 0x1401b6d87
lea rcx, [rbp - 0x30]
mov rdx, r12
mov r9, r13
call fcn.140072260
jmp 0x1401b6da0
mov qword [rbp - 0x20], r12
lea rcx, [rbp - 0x30]
mov rdx, r13
mov r8, r12
call fcn.14039e2f0
mov byte [rbp + r12 - 0x30], 0
lea rax, [0x1403b9448]
mov qword [rbp - 0x38], rax
mov rcx, rdi
lea rdx, [rbp - 0x38]
call fcn.1401b6f10
mov r11d, dword [rbp - 0xc]
mov r13d, eax
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x1401b6d11
mov rcx, qword [rbp - 0x30]
cmp byte [0x1404eeca0], 0
jne 0x1401b6c9f
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1401b6d06
jmp 0x1401b6c9f
mov rcx, rsi
lea rdx, [rbp - 8]
call fcn.1401b7250
jmp 0x1401b6d1a
cmp qword [rsi + 8], 0
setne al
jmp 0x1401b6c8e
call fcn.140356a3c
int3