Function at 0x29170
Capabilities:
Encode data using xor
Get file attributes
Hash data with crc32
Hash data with md5
Read file on windows

Disassembly:
push r13
push r14
sub rsp, 0x2b8
xor r14b, r14b
call fcn.0001eb40
mov r13, rax
test rax, rax
jne 0x29197
add rsp, 0x2b8
pop r14
pop r13
ret
xor eax, eax
mov qword [rsp + 0x2a0], r12
xor r12d, r12d
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea r9d, [r12 + 0x18]
mov rcx, r13
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
js 0x29508
mov qword [rsp + 0x2d0], rbx
mov rbx, qword [rsp + 0x68]
mov rax, rbx
shr rax, 0x20
test eax, eax
jne 0x29500
test rbx, rbx
je 0x29500
mov qword [rsp + 0x2b0], rsi
mov esi, dword [rsp + 0x68]
cmp esi, 0x200
jb 0x294f8
lea ecx, [rax + 1]
mov rdx, rsi
mov qword [rsp + 0x2d8], rbp
mov qword [rsp + 0x2a8], rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x294e8
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.0002b780
xor eax, eax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
setns al
test al, al
je 0x294e0
cmp dword [rsp + 0x58], esi
jne 0x294e0
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x294e0
mov ecx, dword [rdi + 0x20]
test ecx, ecx
je 0x294e0
add rbx, 0xfffffffffffffe00
mov rsi, rcx
cmp rcx, rbx
ja 0x294e0
cmp dword [rcx + rdi + 4], 0xccb520be
lea r9, [rcx + rdi + 4]
jne 0x294e0
mov ebp, dword [rcx + rdi + 0xc]
mov r11d, dword [rcx + rdi + 8]
lea eax, [r11 + rbp]
cmp eax, ecx
ja 0x294e0
mov r10d, 0x1fc
or r8d, 0xffffffff
lea rbx, [0x0002e010]
nop
movzx ecx, byte [r9]
mov eax, r8d
inc r9
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r8d, dword [rbx + rdx*4]
xor r8d, eax
sub r10d, 1
jne 0x29320
not r8d
cmp r8d, dword [rsi + rdi]
jne 0x294e0
lea r8d, [r10 + 0x54]
lea rcx, [rsp + 0x84]
xor edx, edx
mov rbx, r11
mov dword [rsp + 0x80], r12d
call fcn.0002b780
add rbx, rdi
je 0x294e0
lea rcx, [rsp + 0x80]
mov r8d, ebp
mov rdx, rbx
mov dword [rsp + 0x94], r12d
mov dword [rsp + 0x90], r12d
mov dword [rsp + 0x80], 0x67452301
mov dword [rsp + 0x84], 0xefcdab89
mov dword [rsp + 0x88], 0x98badcfe
mov dword [rsp + 0x8c], 0x10325476
call fcn.00029860
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x1d0]
call fcn.00029970
mov eax, dword [0x0002e450]
mov r9d, dword [rsi + rdi + 0x10]
lea ebp, [rax + 7]
shr ebp, 3
cmp r9d, ebp
ja 0x294e0
lea rax, [0x0002e450]
lea r8, [rsi + rdi + 0x14]
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.0002a2d0
test eax, eax
jne 0x294e0
cmp dword [rsp + 0x2e0], ebp
jne 0x294e0
cmp byte [rsp + 0x80], r12b
jne 0x294e0
cmp byte [rsp + 0x81], 1
jne 0x294e0
lea edx, [rbp - 1]
mov ecx, 2
cmp edx, ecx
jbe 0x2946e
lea rax, [rsp + 0x82]
nop dword [rax]
cmp byte [rax], 0xff
jne 0x2946e
inc ecx
inc rax
cmp ecx, edx
jb 0x29460
mov eax, ecx
inc ecx
cmp byte [rsp + rax + 0x80], r12b
jne 0x294e0
mov ebx, ebp
sub ebx, ecx
lea eax, [rbx + 0xb]
cmp eax, ebp
ja 0x294e0
lea rdx, [rsp + rcx + 0x80]
mov eax, ecx
test rdx, rdx
je 0x294a6
lea rcx, [rsp + 0x100]
mov r8d, ebx
call fcn.0002b3f0
cmp ebx, 0x10
jne 0x294e0
lea rax, [rsp + 0x100]
lea rcx, [rsp + 0x1d0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x294d1
mov rdx, qword [rax + 8]
add rax, 8
cmp rdx, qword [rcx + 8]
je 0x294d9
sbb eax, eax
sbb eax, 0xffffffff
mov r12d, eax
test r12d, r12d
sete r14b
mov rcx, rdi
call fcn.0002a2b0
mov rbp, qword [rsp + 0x2d8]
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b0]
mov rbx, qword [rsp + 0x2d0]
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r12, qword [rsp + 0x2a0]
mov al, r14b
add rsp, 0x2b8
pop r14
pop r13
ret