Function at 0x291a0
Capabilities:
Encode data using xor
Get file attributes
Hash data with crc32
Hash data with md5
Read file on windows

Disassembly:
push r13
push r14
sub rsp, 0x2b8
xor r14b, r14b
call fcn.0001eb40
mov r13, rax
test rax, rax
jne 0x291c7
add rsp, 0x2b8
pop r14
pop r13
ret
xor eax, eax
mov qword [rsp + 0x2a0], r12
xor r12d, r12d
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea r9d, [r12 + 0x18]
mov rcx, r13
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
js 0x29538
mov qword [rsp + 0x2d0], rbx
mov rbx, qword [rsp + 0x68]
mov rax, rbx
shr rax, 0x20
test eax, eax
jne 0x29530
test rbx, rbx
je 0x29530
mov qword [rsp + 0x2b0], rsi
mov esi, dword [rsp + 0x68]
cmp esi, 0x200
jb 0x29528
lea ecx, [rax + 1]
mov rdx, rsi
mov qword [rsp + 0x2d8], rbp
mov qword [rsp + 0x2a8], rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x29518
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.0002b7b0
xor eax, eax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
setns al
test al, al
je 0x29510
cmp dword [rsp + 0x58], esi
jne 0x29510
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x29510
mov ecx, dword [rdi + 0x20]
test ecx, ecx
je 0x29510
add rbx, 0xfffffffffffffe00
mov rsi, rcx
cmp rcx, rbx
ja 0x29510
cmp dword [rcx + rdi + 4], 0xccb520be
lea r9, [rcx + rdi + 4]
jne 0x29510
mov ebp, dword [rcx + rdi + 0xc]
mov r11d, dword [rcx + rdi + 8]
lea eax, [r11 + rbp]
cmp eax, ecx
ja 0x29510
mov r10d, 0x1fc
or r8d, 0xffffffff
lea rbx, [0x0002e010]
nop
movzx ecx, byte [r9]
mov eax, r8d
inc r9
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [rbx + rdx*4]
xor r8d, eax
sub r10d, 1
jne 0x29350
not r8d
cmp r8d, dword [rsi + rdi]
jne 0x29510
lea r8d, [r10 + 0x54]
lea rcx, [rsp + 0x84]
xor edx, edx
mov rbx, r11
mov dword [rsp + 0x80], r12d
call fcn.0002b7b0
add rbx, rdi
je 0x29510
lea rcx, [rsp + 0x80]
mov r8d, ebp
mov rdx, rbx
mov dword [rsp + 0x94], r12d
mov dword [rsp + 0x90], r12d
mov dword [rsp + 0x80], 0x67452301
mov dword [rsp + 0x84], 0xefcdab89
mov dword [rsp + 0x88], 0x98badcfe
mov dword [rsp + 0x8c], 0x10325476
call fcn.00029890
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x1d0]
call fcn.000299a0
mov eax, dword [0x0002e450]
mov r9d, dword [rsi + rdi + 0x10]
lea ebp, [rax + 7]
shr ebp, 3
cmp r9d, ebp
ja 0x29510
lea rax, [0x0002e450]
lea r8, [rsi + rdi + 0x14]
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.0002a300
test eax, eax
jne 0x29510
cmp dword [rsp + 0x2e0], ebp
jne 0x29510
cmp byte [rsp + 0x80], r12b
jne 0x29510
cmp byte [rsp + 0x81], 1
jne 0x29510
lea edx, [rbp - 1]
mov ecx, 2
cmp edx, ecx
jbe 0x2949e
lea rax, [rsp + 0x82]
nop dword [rax]
cmp byte [rax], 0xff
jne 0x2949e
inc ecx
inc rax
cmp ecx, edx
jb 0x29490
mov eax, ecx
inc ecx
cmp byte [rsp + rax + 0x80], r12b
jne 0x29510
mov ebx, ebp
sub ebx, ecx
lea eax, [rbx + 0xb]
cmp eax, ebp
ja 0x29510
lea rdx, [rsp + rcx + 0x80]
mov eax, ecx
test rdx, rdx
je 0x294d6
lea rcx, [rsp + 0x100]
mov r8d, ebx
call fcn.0002b420
cmp ebx, 0x10
jne 0x29510
lea rax, [rsp + 0x100]
lea rcx, [rsp + 0x1d0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x29501
mov rdx, qword [rax + 8]
add rax, 8
cmp rdx, qword [rcx + 8]
je 0x29509
sbb eax, eax
sbb eax, 0xffffffff
mov r12d, eax
test r12d, r12d
sete r14b
mov rcx, rdi
call fcn.0002a2e0
mov rbp, qword [rsp + 0x2d8]
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b0]
mov rbx, qword [rsp + 0x2d0]
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r12, qword [rsp + 0x2a0]
mov al, r14b
add rsp, 0x2b8
pop r14
pop r13
ret