Function at 0x1401b7c30
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
nop
mov rax, qword [rcx + 8]
cmp qword [rax + 0x38], 0
je 0x1401b7c87
mov rdi, r8
cmp qword [r8 + 0x18], 0
je 0x1401b7c92
mov rbx, rdx
mov rax, rdx
shr rax, 0x2f
je 0x1401b7caa
mov r9d, 0x57
mov r8d, 0x72018f43
call fcn.1401b9dc0
xor eax, eax
jmp 0x1401b7d6b
cmp qword [rax + 0x48], 0
je 0x1401b7d2a
mov r9d, 0x57
mov r8d, 0x72018f43
call fcn.1401b9dc0
xor eax, eax
jmp 0x1401b7d6b
test rbx, rbx
je 0x1401b7d43
mov rsi, r9
mov r9d, 0x40
mov rcx, rbx
mov r8d, 0x21db2e75
call fcn.1401b9dc0
test eax, eax
jne 0x1401b7d2e
nop
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x1401b7d2e
nop
movsxd r14, dword [rbx + 0x3c]
add r14, rbx
mov r9d, 0x108
mov rcx, r14
mov r8d, 0x21db2e75
call fcn.1401b9dc0
test eax, eax
jne 0x1401b7d58
nop
cmp dword [r14], 0x4550
jne 0x1401b7d58
nop
mov r13d, dword [r14 + 0x90]
test r13, r13
je 0x1401b7d2a
mov eax, dword [r13 + rbx + 0xc]
test eax, eax
je 0x1401b7e95
add r13, rbx
lea r14, [rbp - 0x20]
lea r15, [rbp - 0x28]
jmp 0x1401b7da5
xor eax, eax
jmp 0x1401b7d6b
mov r9d, 0x57
mov r8d, 0x72018f43
call fcn.1401b9dc0
xor eax, eax
jmp 0x1401b7d6b
mov r9d, 0x57
mov r8d, 0x72018f43
call fcn.1401b9dc0
xor eax, eax
jmp 0x1401b7d6b
mov r9d, 0x57
mov r8d, 0x72018f43
call fcn.1401b9dc0
xor eax, eax
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140095520
test r12d, r12d
je 0x1401b7e4d
nop
mov eax, dword [r13 + 0x20]
add r13, 0x14
test eax, eax
je 0x1401b7e95
mov r12d, eax
add r12, rbx
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rcx, r12
call fcn.140095650
cmp rax, 0xf
jbe 0x1401b7ddd
mov rcx, r14
mov rdx, rax
mov r9, r12
call fcn.14008c3c0
jmp 0x1401b7df8
mov qword [rbp - 0x10], rax
mov rcx, r14
mov rdx, r12
mov r8, rax
mov r12, rax
call fcn.1405c4870
mov byte [rbp + r12 - 0x20], 0
lea rax, [0x1405e7948]
mov qword [rbp - 0x28], rax
mov rcx, rdi
mov rdx, r15
call fcn.1401b7fe0
mov r12d, eax
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x1401b7d8b
nop
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1401b7d86
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jb 0x1401b7d7c
jmp 0x1401b7ec9
cmp byte [0x140790498], 0
jne 0x1401b7ea2
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rsi + 8], rax
je 0x1401b7ea2
nop
mov r12, qword [rsi]
mov ecx, 0x18
call fcn.1400954c0
mov qword [rax + 0x10], r13
inc qword [rsi + 8]
mov rcx, qword [r12 + 8]
mov qword [rax], r12
mov qword [rax + 8], rcx
mov qword [r12 + 8], rax
mov qword [rcx], rax
jmp 0x1401b7d94
cmp qword [rsi + 8], 0
setne al
jmp 0x1401b7d6b
nop
movzx eax, byte [0x140729e9e]
cmp al, 0x66
je 0x1401b7f6f
mov cl, 7
mov al, 0xa7
lock cmpxchg byte [0x140729e9e], cl
je 0x1401b7ece
cmp al, 0x66
jne 0x1401b7eb4
jmp 0x1401b7f6f
call fcn.1400954e0
lea rcx, [0x1405ee570]
lea r8, [rcx + 0xaa83294]
add rcx, 0xaa83293
mov r9d, 0xaa83294
mov r10d, 0xaa83292
movabs r11, 0x4924924924924925
lea rsi, [0x140729e90]
mov rax, r9
shr rax, 1
mul r11
shr rdx, 1
imul rdi, rdx, 0xfffffffffffffff2
mov rax, r10
shr rax, 1
mul r11
shr rdx, 1
imul rax, rdx, 0xfffffffffffffff2
movzx edx, byte [r9 + rsi - 0xaa83294]
xor dl, byte [rcx + rax]
movzx eax, byte [r9 + rsi - 0xaa83293]
xor dl, 0xa
xor al, byte [r8 + rdi]
mov byte [r9 + rsi - 0xaa83294], dl
xor al, 0xa
mov byte [r9 + rsi - 0xaa83293], al
add r8, 2
add r9, 2
add rcx, 2
add r10, 2
cmp r9, 0xaa832a2
jne 0x1401b7f00
mov al, 0x66
xchg byte [0x140729e9e], al
lea rcx, [0x140729e90]
call fcn.140095530
int3