Function at 0x1403bbeb0
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov r14, rcx
mov dword [rbp + 0x77], 0x7216e5e3
lea rax, [rbp + 0x5f]
mov qword [rbp - 0x69], rax
mov rax, qword [rbp - 0x69]
and eax, 3
or eax, 0x81e91a1c
mov edx, dword [rbp + 0x77]
xor edx, eax
not edx
ror edx, 0x15
mov rdx, qword gs:[rdx]
mov rax, qword [rdx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rsi, qword [rax + 0x30]
xor ebx, ebx
test rsi, rsi
je 0x1403bc222
movsxd rax, dword [rsi + 0x3c]
mov r8d, dword [rax + rsi + 0x88]
add r8, rsi
cmp r8, rsi
je 0x1403bc222
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x19], rbx
mov r15d, ebx
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], rbx
lea rax, [rbp - 0x29]
mov qword [rbp - 0x49], rax
mov rax, qword [rdx + 0x30]
mov qword [rbp + 0x77], rax
mov qword [rbp - 0x41], rax
lea r9d, [rbx + 5]
mov r12d, dword [r8 + 0x18]
test r12d, r12d
je 0x1403bc222
dec r12d
test r9, r9
je 0x1403bbe4d
mov ecx, dword [r8 + 0x20]
add rcx, rsi
mov r13d, dword [rcx + r12*4]
add r13, rsi
movabs r10, 0xcbf29ce484222325
mov r11d, 1
movsx edi, byte [r13]
add r13, r11
lea eax, [rdi - 0x41]
mov ecx, edi
or ecx, 0x20
cmp al, 0x19
cmova ecx, edi
movsxd rax, ecx
xor r10, rax
movabs rcx, 0x100000001b3
imul r10, rcx
test dil, dil
jne 0x1403bbd19
movabs rax, 0xda498f09737f0d3
cmp r10, rax
je 0x1403bbe1b
movabs rax, 0x427d7d47e1b2ed67
cmp r10, rax
je 0x1403bbdfc
movabs rax, 0x60a03a1c45f286a8
cmp r10, rax
je 0x1403bbddd
movabs rax, 0xcec40ed11c9c7a88
cmp r10, rax
je 0x1403bbdbd
movabs rax, 0xda37feea60dfc2af
cmp r10, rax
jne 0x1403bbe3b
mov ecx, dword [r8 + 0x1c]
add rcx, rsi
mov eax, dword [r8 + 0x24]
add rax, rsi
movzx eax, word [rax + r12*2]
mov ecx, dword [rcx + rax*4]
add rcx, rsi
mov qword [rbp - 9], rcx
jmp 0x1403bbe38
mov ecx, dword [r8 + 0x1c]
add rcx, rsi
mov eax, dword [r8 + 0x24]
add rax, rsi
movzx eax, word [rax + r12*2]
mov r15d, dword [rcx + rax*4]
add r15, rsi
mov qword [rbp - 0x11], r15
jmp 0x1403bbe38
mov ecx, dword [r8 + 0x1c]
add rcx, rsi
mov eax, dword [r8 + 0x24]
add rax, rsi
movzx eax, word [rax + r12*2]
mov ecx, dword [rcx + rax*4]
add rcx, rsi
mov qword [rbp - 0x29], rcx
jmp 0x1403bbe38
mov ecx, dword [r8 + 0x1c]
add rcx, rsi
mov eax, dword [r8 + 0x24]
add rax, rsi
movzx eax, word [rax + r12*2]
mov ecx, dword [rcx + rax*4]
add rcx, rsi
mov qword [rbp - 0x21], rcx
jmp 0x1403bbe38
mov ecx, dword [r8 + 0x1c]
add rcx, rsi
mov eax, dword [r8 + 0x24]
add rax, rsi
movzx eax, word [rax + r12*2]
mov ecx, dword [rcx + rax*4]
add rcx, rsi
mov qword [rbp - 0x19], rcx
dec r9
test r12d, r12d
jne 0x1403bbcef
test r9, r9
jne 0x1403bc222
mov r8d, dword [r14 + 0x10]
lea rax, [rbp - 0x49]
mov qword [rbp - 0x61], rax
mov edi, 8
mov edx, edi
mov rcx, qword [rbp + 0x77]
call r15
mov qword [rbp - 0x59], rax
mov ecx, 0x104
lea r8, [rbp - 1]
lea rdx, [rbp + 0x7f]
call qword [rbp - 0x21]
test eax, eax
js 0x1403bc219
mov r8d, dword [r14 + 0x1c]
lea rax, [rbp - 0x49]
mov qword [rbp - 0x39], rax
mov rax, qword [rbp - 0x49]
mov rax, qword [rax + 0x18]
mov edx, edi
mov rcx, qword [rbp - 0x41]
call rax
mov qword [rbp - 0x31], rax
mov ecx, dword [r14 + 0x1c]
lea rsi, [r14 + 0x20]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [r14 + 8]
imul rax, qword [r14]
mov qword [rbp - 0x69], rax
mov r10, rbx
cmp dword [r14 + 0x1c], ebx
jbe 0x1403bc1b0
mov al, byte [rbp - 0x62]
mov dword [rbp + 0x77], eax
mov bl, byte [rbp - 0x63]
mov r13b, byte [rbp - 0x64]
mov r9b, byte [rbp - 0x65]
mov r12b, byte [rbp - 0x66]
mov r15b, byte [rbp - 0x67]
mov r11b, byte [rbp - 0x68]
mov dl, byte [rbp - 0x69]
movzx edi, byte [r14 + 7]
shl rdi, 8
movzx eax, byte [r14 + 6]
or rdi, rax
shl rdi, 8
movzx eax, byte [r14 + 5]
or rdi, rax
shl rdi, 8
movzx eax, byte [r14 + 4]
or rdi, rax
shl rdi, 8
movzx eax, byte [r14 + 3]
or rdi, rax
shl rdi, 8
movzx eax, byte [r14 + 2]
or rdi, rax
shl rdi, 8
movzx eax, byte [r14 + 1]
or rdi, rax
shl rdi, 8
movzx eax, byte [r14]
or rdi, rax
movzx ecx, byte [r14 + 0xf]
shl rcx, 8
movzx eax, byte [r14 + 0xe]
or rcx, rax
shl rcx, 8
movzx eax, byte [r14 + 0xd]
or rcx, rax
shl rcx, 8
movzx eax, byte [r14 + 0xc]
or rcx, rax
shl rcx, 8
movzx eax, byte [r14 + 0xb]
or rcx, rax
shl rcx, 8
movzx eax, byte [r14 + 0xa]
or rcx, rax
shl rcx, 8
movzx eax, byte [r14 + 9]
or rcx, rax
shl rcx, 8
movzx eax, byte [r14 + 8]
or rcx, rax
movabs rax, 0x6c7967656e657261
mov r8, rdi
xor r8, rax
movabs rax, 0x646f72616e646f6d
mov rsi, rcx
xor rsi, rax
movabs rax, 0x736f6d6570736575
xor rdi, rax
movzx eax, byte [rbp + 0x77]
shl rax, 8
mov qword [rbp + 0x77], rax
movzx eax, bl
mov rbx, qword [rbp + 0x77]
or rbx, rax
shl rbx, 8
movzx eax, r13b
or rbx, rax
shl rbx, 8
movzx eax, r9b
or rbx, rax
shl rbx, 8
movzx eax, r12b
or rbx, rax
shl rbx, 8
movzx eax, r15b
or rbx, rax
shl rbx, 8
movzx eax, r11b
or rbx, rax
shl rbx, 8
movzx eax, dl
or rbx, rax
mov rdx, rbx
xor rdx, rcx
movabs rax, 0x7465646279746573
xor rdx, rax
mov r15d, 2
mov r9d, r15d
lea r11d, [r15 - 1]
add rdi, rsi
ror rsi, 0x33
xor rsi, rdi
add r8, rdx
ror rdx, 0x30
xor rdx, r8
ror rdi, 0x20
add rdi, rdx
ror rdx, 0x2b
xor rdx, rdi
add r8, rsi
ror rsi, 0x2f
xor rsi, r8
mov rcx, r8
shr rcx, 0x20
mov rax, r8
shl rax, 0x20
mov r8, rcx
or r8, rax
sub r9, r11
jne 0x1403bc03e
xor rdi, rbx
movabs rbx, 0x800000000000000
xor rdx, rbx
mov r9, r15
add rdi, rsi
ror rsi, 0x33
xor rsi, rdi
add r8, rdx
ror rdx, 0x30
xor rdx, r8
ror rdi, 0x20
add rdi, rdx
ror rdx, 0x2b
xor rdx, rdi
add r8, rsi
ror rsi, 0x2f
xor rsi, r8
mov rcx, r8
shr rcx, 0x20
mov rax, r8
shl rax, 0x20
mov r8, rcx
or r8, rax
sub r9, r11
jne 0x1403bc096
xor rdi, rbx
xor r8, 0xff
mov r9d, 4
add rdi, rsi
ror rsi, 0x33
xor rsi, rdi
add r8, rdx
ror rdx, 0x30
xor rdx, r8
ror rdi, 0x20
add rdi, rdx
ror rdx, 0x2b
xor rdx, rdi
add r8, rsi
ror rsi, 0x2f
xor rsi, r8
mov rcx, r8
shr rcx, 0x20
mov rax, r8
shl rax, 0x20
mov r8, rcx
or r8, rax
sub r9, r11
jne 0x1403bc0eb
xor rdx, r8
xor rdx, rsi
xor rdx, rdi
mov byte [rbp - 0x69], dl
mov r11d, edx
shr r11d, 8
mov byte [rbp - 0x68], r11b
mov r15d, edx
shr r15d, 0x10
mov byte [rbp - 0x67], r15b
mov r12d, edx
shr r12d, 0x18
mov byte [rbp - 0x66], r12b
mov r9, rdx
shr r9, 0x20
mov byte [rbp - 0x65], r9b
mov r13d, r9d
shr r13d, 8
mov byte [rbp - 0x64], r13b
mov ebx, r9d
shr ebx, 0x10
mov byte [rbp - 0x63], bl
mov eax, r9d
shr eax, 0x18
mov dword [rbp + 0x77], eax
mov byte [rbp - 0x62], al
mov rdi, qword [rbp - 0x31]
mov cl, byte [rdi + r10]
mov rax, r10
and eax, 7
xor cl, byte [rbp + rax - 0x69]
mov byte [rdi + r10], cl
inc r10
mov eax, dword [r14 + 0x1c]
cmp r10, rax
jb 0x1403bbee9
xor ebx, ebx
mov r8d, dword [rbp + 0x7f]
lea rax, [rbp - 0x49]
mov qword [rbp + 0xf], rax
mov rax, qword [rbp - 0x49]
mov rax, qword [rax + 0x18]
mov edx, 8
mov rcx, qword [rbp - 0x41]
call rax
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x77], ebx
mov edx, dword [r14 + 0x1c]
mov ecx, 0x104
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
mov r9, qword [rbp - 0x31]
mov r8d, dword [r14 + 0x10]
mov rdx, qword [rbp - 0x59]
call qword [rbp - 0x19]
nop
lea rcx, [rbp + 0xf]
test eax, eax
jns 0x1403bc23f
call fcn.1403bbc10
nop
lea rcx, [rbp - 0x39]
call fcn.1403bbc10
nop
lea rcx, [rbp - 0x61]
call fcn.1403bbc10
mov al, bl
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1403bbc10
nop
lea rcx, [rbp - 0x39]
call fcn.1403bbc10
mov eax, dword [r14 + 0x14]
mov qword [rbp + 7], rax
mov qword [rbp - 0x51], rbx
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp - 0x51]
or rcx, 0xffffffffffffffff
call qword [rbp - 0x29]
test eax, eax
js 0x1403bc219
mov rdi, qword [rbp - 0x51]
test rdi, rdi
je 0x1403bc219
mov r9, qword [rbp - 0x59]
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1403bc219
movsxd r8, dword [r9 + 0x3c]
add r8, r9
cmp dword [r8], 0x4550
jne 0x1403bc219
mov ecx, dword [r8 + 0x54]
mov rsi, r9
rep movsb byte [rdi], byte [rsi]
movzx r10d, bx
cmp bx, word [r8 + 6]
jae 0x1403bc309
mov r14d, 1
movzx eax, r10w
lea rdx, [rax + rax*4]
movzx ecx, word [r8 + 0x14]
add rcx, r8
lea rdx, [rcx + rdx*8]
mov eax, dword [rdx + 0x28]
cmp dword [rdx + 0x20], eax
sbb rax, rax
and rax, 0xfffffffffffffff8
mov ecx, dword [rax + rdx + 0x28]
mov esi, dword [rdx + 0x2c]
add rsi, r9
mov edi, dword [rdx + 0x24]
add rdi, qword [rbp - 0x51]
rep movsb byte [rdi], byte [rsi]
add r10w, r14w
cmp r10w, word [r8 + 6]
jb 0x1403bc2c6
mov r14, qword [rbp + 0x67]
mov eax, dword [r14 + 0x18]
mov rcx, qword [rbp - 0x51]
add rax, rcx
call rax
nop
lea rcx, [rbp - 0x61]
test al, al
je 0x1403bc21d
call fcn.1403bbc10
mov ebx, 1
jmp 0x1403bc222