Function at 0x14012eb00
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a30]
mov eax, 0x1b30
call fcn.140138d20
sub rsp, rax
mov rax, qword [0x140232100]
xor rax, rsp
mov qword [rbp + 0x1a20], rax
mov r13, rcx
mov qword [rsp + 0x38], rcx
mov r10, qword [rcx + 8]
mov rdx, qword [rcx]
cmp rdx, r10
je 0x14012f480
test rdx, rdx
je 0x14012f480
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14012f480
mov eax, dword [rdx + 0x3c]
mov qword [rsp + 0x50], rax
lea r8, [rdx + rax]
test r8, r8
je 0x14012f480
cmp dword [r8], 0x4550
jne 0x14012f480
xor ebx, ebx
mov dword [rsp + 0x5d], ebx
mov word [rsp + 0x61], bx
mov byte [rsp + 0x63], bl
mov dword [rsp + 0x6c], ebx
mov eax, dword [str..gst]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x140215a6c]
mov byte [rsp + 0x5c], al
lea r9, [r8 + 0x108]
test r9, r9
je 0x14012f480
mov r14d, dword [r9 + 8]
mov dword [rsp + 0x24], r14d
movzx eax, word [r8 + 6]
dec ax
movzx ecx, ax
mov word [rsp + 0x48], cx
lea r11, [rcx*4 + 0x21]
add r11, rcx
lea r11, [r8 + r11*8]
test r11, r11
je 0x14012f480
mov r8d, dword [r11 + 0xc]
add r8d, 0x1000
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x64], r8d
mov r15d, dword [r9 + 0x10]
mov qword [rbp - 0x80], r15
mov r12d, dword [r11 + 0x14]
add r12d, dword [r11 + 0x10]
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x6c], r12d
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], ebx
mov eax, dword [r9 + 0x24]
mov dword [rsp + 0x7c], eax
mov edi, dword [r9 + 0x14]
mov eax, r8d
sub eax, dword [r9 + 0xc]
mov dword [rsp + 0x2c], eax
mov rax, r10
sub rax, rdx
lea rcx, [r15 + rax]
cmp rcx, rax
jae 0x14012ec60
lea rax, [rdx + rcx]
mov qword [r13 + 8], rax
jmp 0x14012ec90
jbe 0x14012ec90
mov rax, qword [r13 + 0x10]
sub rax, rdx
cmp rcx, rax
jbe 0x14012ec7b
mov rdx, rcx
mov rcx, r13
call fcn.14012fc50
jmp 0x14012ec90
lea rbx, [r15 + r10]
mov r8, r15
xor edx, edx
mov rcx, r10
call fcn.140172380
mov qword [r13 + 8], rbx
mov rax, qword [r13]
mov qword [rbp - 0x60], rdi
mov ebx, r12d
mov r8, r14
lea rdx, [rdi + rax]
lea rcx, [rax + r12]
call fcn.140171ce0
mov rcx, qword [r13]
add rcx, rdi
mov r8, r15
xor edx, edx
call fcn.140172380
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rbp + 0x670]
call fcn.1401695b0
mov rsi, qword [r13]
add rsi, rbx
xor ebx, ebx
mov dword [rbp + 0x620], ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0x630], xmm0
movups xmmword [rbp + 0x640], xmm0
movups xmmword [rbp + 0x650], xmm0
movups xmmword [rbp + 0x660], xmm0
mov dword [rbp + 0x630], ebx
mov qword [rbp + 0x638], rbx
mov qword [rbp + 0x640], rbx
lea ecx, [rbx + 0x28]
call fcn.140138180
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x638], rax
mov qword [rbp + 0x648], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x650], xmm0
mov qword [rbp + 0x660], 7
mov qword [rbp + 0x668], 8
mov dword [rbp + 0x630], 0x3f800000
mov r8, rax
lea edx, [rbx + 0x10]
lea rcx, [rbp + 0x648]
call fcn.140035ab0
nop
call fcn.14016b54c
mov edx, eax
movabs rax, 0x5555555555555555
mov qword [rbp + 0x1a18], rax
mov qword [rbp + 0x698], rdx
lea ecx, [rbx + 1]
movabs r8, 0x5851f42d4c957f2d
nop word [rax + rax]
mov rax, rdx
shr rax, 0x3e
xor rdx, rax
imul rdx, r8
add rdx, rcx
mov qword [rbp + rcx*8 + 0x698], rdx
inc rcx
cmp rcx, 0x138
jb 0x14012eda0
mov dword [rbp + 0x690], 0x138
mov r15d, ebx
mov dword [rsp + 0x20], ebx
mov eax, r12d
sub eax, edi
mov dword [rsp + 0x44], eax
mov r8d, r14d
sub r8d, dword [rbp + 0x620]
lea r9, [rbp + 0x40]
mov rdx, rsi
lea rcx, [rbp + 0x670]
call fcn.1401694e0
shr eax, 0x1f
not eax
test al, 1
je 0x14012f15d
mov ebx, 0x40
mov edi, 0x8000
jmp 0x14012ee25
mov r13, qword [rsp + 0x38]
mov rax, rsi
sub rax, qword [r13]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x690]
call fcn.14012fd90
mov rcx, rax
mov eax, 8
mul rcx
mov r15, rax
xor eax, eax
mov qword [rbp - 0x68], rax
test bl, bl
je 0x14012ee6f
cmp bl, 0x40
jb 0x14012ee68
movzx ecx, bl
and ecx, 0x3f
mov r15, rdx
shr r15, cl
jmp 0x14012ee6f
movzx ecx, bl
shrd r15, rdx, cl
add r15w, di
add r15b, 3
mov qword [rbp - 0x70], r15
movzx r14d, r15b
mov ecx, r14d
call fcn.1401456d0
mov rdi, rax
mov byte [rax], 0xeb
lea ecx, [r15 - 2]
mov byte [rax + 1], cl
movzx eax, r15b
mov dword [rbp + 0x624], eax
mov ebx, 2
mov r12d, eax
cmp rbx, rax
je 0x14012ef01
lea r13d, [rbx + 0x3e]
mov r15d, 0x8000
nop word [rax + rax]
lea rcx, [rbp + 0x690]
call fcn.14012fd90
mov rcx, rax
mov eax, 0x100
mul rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov ecx, r13d
and ecx, 0x3f
mov rax, rdx
shr rax, cl
add ax, r15w
mov byte [rdi + rbx], al
inc rbx
cmp rbx, r12
jne 0x14012eec0
mov r15, qword [rbp - 0x70]
mov r13, qword [rsp + 0x38]
mov rdx, qword [r13]
mov rbx, qword [rsp + 0x30]
add rdx, rbx
mov r9, r14
mov r8, rdi
mov rcx, r13
call fcn.14012fa10
mov rcx, rdi
call fcn.1401456bc
test byte [rbp + 0x470], 0x80
je 0x14012f074
cmp dword [rbp + 0x51c], 1
jne 0x14012f074
cmp byte [r14 + rsi], 0xeb
jne 0x14012ef93
mov r12b, 5
mov ecx, 5
call fcn.1401456d0
mov rdi, rax
mov byte [rax], 0xe9
movzx ecx, byte [rbp + 0x48]
add rcx, r14
cmp byte [rcx + rsi - 1], 0x7f
ja 0x14012ef7b
xor eax, eax
mov dword [rdi + 1], eax
movzx ecx, byte [rbp + 0x48]
add rcx, r14
movzx eax, byte [rcx + rsi - 1]
mov byte [rdi + 1], al
jmp 0x14012efdb
mov dword [rax + 1], 0xffffffff
movzx eax, byte [rbp + 0x48]
add rax, r14
movzx eax, byte [rax + rsi - 1]
mov byte [rdi + 1], al
jmp 0x14012efdb
mov r12b, 6
mov ecx, 6
call fcn.1401456d0
mov rdi, rax
mov byte [rax], 0xf
movzx eax, byte [r14 + rsi]
add al, 0x10
mov byte [rdi + 1], al
movzx eax, byte [rbp + 0x48]
add rax, r14
cmp byte [rax + rsi - 1], 0x7f
ja 0x14012efc5
xor eax, eax
mov dword [rdi + 2], eax
jmp 0x14012efcc
mov dword [rdi + 2], 0xffffffff
movzx eax, byte [rbp + 0x48]
add rax, r14
movzx eax, byte [rax + rsi - 1]
mov byte [rdi + 2], al
mov rcx, qword [r13]
add rcx, rbx
movzx edx, byte [rbp + 0x48]
lea rsi, [rcx + r14]
add rdx, rcx
add rdx, r14
cmp rsi, rdx
je 0x14012f014
mov rbx, qword [r13 + 8]
sub rbx, rdx
mov r8, rbx
mov rcx, rsi
call fcn.140171ce0
lea rax, [rbx + rsi]
mov qword [r13 + 8], rax
mov rbx, qword [rsp + 0x30]
movzx r9d, r12b
mov rdx, qword [r13]
add rdx, r14
add rdx, rbx
mov r8, rdi
mov rcx, r13
call fcn.14012fa10
mov rcx, rdi
call fcn.1401456bc
lea r8, [rbp + 0x620]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
movzx eax, byte [rbp + 0x48]
mov byte [rcx + 0x20], al
lea r8, [rbp + 0x620]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
mov byte [rcx + 0x1c], r12b
mov rax, qword [r13]
mov r13, qword [rbp - 0x60]
add r13, rax
mov r12d, dword [rbp - 0x80]
add r12, r13
movzx esi, byte [rbp + 0x48]
add rsi, r14
add rsi, rax
add rsi, rbx
mov ebx, dword [rsp + 0x20]
add ebx, dword [rbp + 0x624]
mov dword [rsp + 0x20], ebx
lea r8, [rbp + 0x620]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
mov byte [rcx + 0x18], r15b
lea r8, [rbp + 0x620]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
movzx edx, byte [rcx + 0x1c]
test dl, dl
je 0x14012f0f3
sub dl, byte [rbp + 0x48]
movzx eax, dl
add rsi, rax
movzx eax, dl
add ebx, eax
mov dword [rsp + 0x20], ebx
lea r8, [rbp + 0x620]
lea rdx, [rbp]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
mov dword [rcx + 0x14], ebx
movzx eax, byte [rbp + 0x48]
mov ecx, dword [rbp + 0x620]
add ecx, eax
mov dword [rbp + 0x620], ecx
mov r8d, dword [rsp + 0x24]
sub r8d, ecx
lea r9, [rbp + 0x40]
mov rdx, rsi
lea rcx, [rbp + 0x670]
call fcn.1401694e0
shr eax, 0x1f
not eax
test al, 1
mov ebx, 0x40
mov edi, 0x8000
jne 0x14012ee20
mov r15d, dword [rsp + 0x20]
xor ebx, ebx
jmp 0x14012f167
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x620], ebx
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0x30]
lea rdx, [rbp]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov r14, qword [rsp + 0x38]
mov rdx, qword [r14]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rax]
movzx edi, byte [rax + 0x18]
add rdi, rcx
add rdi, rdx
lea rsi, [rcx + rdx]
mov r8d, dword [rsp + 0x24]
sub r8d, dword [rbp + 0x620]
lea r9, [rbp + 0x40]
mov rdx, rdi
lea rcx, [rbp + 0x670]
call fcn.1401694e0
shr eax, 0x1f
not eax
test al, 1
je 0x14012f3cb
mov r15d, dword [rsp + 0x24]
mov r14d, dword [rsp + 0x2c]
nop dword [rax]
test byte [rbp + 0x470], 0x80
je 0x14012f2ee
movzx eax, byte [rbp + 0x601]
movzx ecx, byte [rbp + 0x5e9]
add rax, rdi
movsxd rax, dword [rcx + rax]
movzx ebx, byte [rbp + 0x48]
add rax, rdi
add rbx, rax
lea r8, [rbp + 0x620]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
mov eax, dword [rcx + 0x14]
mov rcx, rbx
sub rcx, rax
mov eax, dword [rsp + 0x44]
sub rcx, rax
cmp rcx, r13
jb 0x14012f2a8
cmp rcx, r12
jae 0x14012f2a8
lea r8, [rbp + 0x620]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
sub ebx, esi
sub ebx, dword [rcx + 0x14]
mov dword [rbp + 0x624], ebx
lea r8, [rbp + 0x624]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
movzx eax, byte [rbp + 0x48]
mov edx, esi
sub edx, eax
sub edx, edi
add edx, dword [rcx + 0x14]
add edx, dword [rbp + 0x624]
movzx eax, byte [rbp + 0x601]
movzx ecx, byte [rbp + 0x5e9]
add rax, rdi
mov dword [rcx + rax], edx
jmp 0x14012f2ee
movzx eax, byte [rbp + 0x58]
test al, al
jne 0x14012f2b6
lea rdx, [rbp - 0x40]
jmp 0x14012f2c8
imul rcx, rax, 0x68
cmp dword [rbp + rcx + 0x24], 0xcb
je 0x14012f2ee
lea rdx, [rbp - 0x50]
lea r8, [rbp + 0x620]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rax, qword [rax]
mov ecx, dword [rax + 0x14]
movzx edx, byte [rbp + 0x5e9]
add ecx, r14d
sub dword [rdx + rdi], ecx
lea r8, [rbp + 0x620]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
lea r8, [rbp + 0x620]
cmp byte [rcx + 0x20], 0
lea rcx, [rbp + 0x630]
jne 0x14012f33e
movzx eax, byte [rbp + 0x48]
add dword [rbp + 0x620], eax
lea rdx, [rbp - 0x70]
call fcn.14012f5a0
mov rcx, qword [rax]
movzx edx, byte [rcx + 0x18]
movzx eax, byte [rbp + 0x48]
add eax, edx
jmp 0x14012f394
lea rdx, [rbp + 0x20]
call fcn.14012f5a0
mov rcx, qword [rax]
movsx ebx, byte [rcx + 0x1c]
lea r8, [rbp + 0x620]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
movzx eax, byte [rcx + 0x20]
add dword [rbp + 0x620], eax
lea r8, [rbp + 0x620]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
movzx eax, byte [rcx + 0x18]
add eax, ebx
cdqe
add rdi, rax
mov r8d, r15d
sub r8d, dword [rbp + 0x620]
lea r9, [rbp + 0x40]
mov rdx, rdi
lea rcx, [rbp + 0x670]
call fcn.1401694e0
shr eax, 0x1f
not eax
test al, 1
jne 0x14012f1e0
mov r14, qword [rsp + 0x38]
mov r15d, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
add eax, r15d
mov dword [rsp + 0x60], eax
mov rdi, qword [rbp - 0x80]
add edi, r15d
mov dword [rsp + 0x68], edi
movzx eax, word [rsp + 0x48]
lea rcx, [rax + rax*4]
mov rsi, qword [rsp + 0x50]
lea rdx, [rsi + rcx*8]
mov rax, qword [r14]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rdx + rax + 0x130], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rdx + rax + 0x140], xmm1
movsd xmm0, qword [rsp + 0x78]
movsd qword [rdx + rax + 0x150], xmm0
mov rbx, qword [r14]
inc word [rsi + rbx + 6]
mov ecx, dword [rsp + 0x2c]
add ecx, dword [rsi + rbx + 0x28]
mov dword [rsi + rbx + 0x28], ecx
sub ecx, dword [rsp + 0x28]
mov dword [rsp + 0x28], ecx
lea r8, [rsp + 0x28]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x630]
call fcn.14012f5a0
mov rcx, qword [rax]
mov ecx, dword [rcx + 0x14]
add dword [rsi + rbx + 0x28], ecx
mov ecx, dword [rsi + rbx + 0x50]
add ecx, 0xfff
add ecx, edi
and ecx, 0xfffff000
mov dword [rsi + rbx + 0x50], ecx
lea rcx, [rbp + 0x630]
call fcn.14012f4d0
mov al, 1
jmp 0x14012f482
xor al, al
mov rcx, qword [rbp + 0x1a20]
xor rcx, rsp
call fcn.140138160
lea r11, [rsp + 0x1b30]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret