Function at 0x140002470
Capabilities:
Block operations on executable memory pages using arbitrary code guard
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x118]
sub rsp, 0x1f0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14005b010]
xor rax, rsp
mov qword [rbp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x68], 1
mov r8d, 4
lea rdx, [rsp + 0x68]
lea ecx, [r8 + 4]
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
xor r12d, r12d
mov qword [rsp + 0x40], r12
movdqu xmmword [rsp + 0x70], xmm1
mov r13d, r12d
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], r12b
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], r12b
lea rdx, str.u2_F5EHiJId6eK2GTjvEnig6ulvjqEDIqeAVHT_ZrGXU26dHZNfoNy7WWLqQIGsYQSYgm95G5FrDGN5QLRWfiPfaqxRDMbBlxOX_qWJpCKaHqnkF5v6dhwD5f30Xfgyy6R71E9xHlDpLOotz9p07Fb0kzc8RY8mWKmCJN1OjyGpR0ll74LT2RVntJO5bSLUdb6WlBK2jPAF57y7WDPEWrTlCz1GdYaojX5wtXsqQ4zoRbCmB1lkwh3JMrIiF1pYOcszNnCbvVIOH5wPnaReSboT8KpMeOcjP0NAKFCtUbTQ96iaSL43qhd7e66Rg4_unEXKVtwIc2gglA32xoqhg3BqZVw057oM2GbHUuy94IwYeD_5AsUJlWGSFYETrxAzSRZSuxcajyYW7S7qEcWOa2BbJd5djDfm5v84FGd62E7Ll_xoIgbcvv5AKgdXp7Pxy4rXBCL3XAkbXi7Iwp77HHkoAXLrHV8EJfyeNBvroimQplcA4ZakhFl8r6_1Hza_YvLHui_C91rAl5ORjSkaz_IhSJ7ZoIvR8Bzt4D7Elhrlx4_iRlCnC2WQt8JL2HfksYjBqg8V7TfoLDdUGqzrgnz1oREYsZMdkGU0JdKzUcAeGju4ZWJenE9XvlTQRgTSkzQzcfG8zJ7JORr3Qe4xZqO3bCHsjj47ncKfXjpEulBJdCPXhwutTehzXcrP5qm_xkWFu9uGnxHg7f8bxwIUP7A83rbKkLAaWyiyGYGPgfY72ZV9ZadD2O59GmUITTqrxo2lNRahxu9bNmp1sWe725F7p3W9jlo8LVibYuCssI96E9gRoQI23BOordLazdbA8gN9m45TX1WsxKnDLmW6tRago9hQO7wBlWItNRM1sFBIEdrfWSbwD6PSgFJ5n96vEUGNtkBGf6AAPEbTaz9wqFfd4Ia_cj7_fMVVmyoXhFNyL4BKj_ha1nZkWtTxFKHA0avvEhu6qwRfFX9eAVEUqmP2OnwlRBYL25wROS8udCRdiUZFYnfNWKymePbS0jmHmWVbpFdhm657fz04YCosKXiR0Y0wAMbpBAISafZdC6frkZyJci8qb2UdVUo_N1h2dJBM7l9PwY0xJsYlnQGgYj4LNLZJ77kVXgJilRJejjvp9jKoFfLr6GCqZxM0yPWgApyBdxfxODv29Abdiw5P0bWG1Tgkz6c7zGhZPogjlo8zd4peiYC716vzVKGuth67fLc9QY_KdpKfujIm37nT0Th_veKb8BH3WdCGUVnE4zGKRtEq3FnepBviPDQnuLe79ZeiFM_cAWlZGgqq9iNLXnoZfSJ5Ub8O4u6FHILddArnhRtcwTn2h5saAIkPL8Jko0XPVyGE8fb9MlEOaqk8eFJzpSMJ88acGHuKbRONE_B1DSPn2R9WOpdMetHCAQ7s01Wb01TNqik7DU672O_Av9boHIu8gPfnbgVlEMfnUq8roGyA7BmzbHJwVj2maHx3o2NOgcrylUz0ALaG9C7AgXAW3t0dykYOdRWdYllEuRXDxtBg4Cll9_m9uYd_bkOL8R7TzULgq89mWttRESOrY0p8Ld_Cxr1SVJarxjRtT5Jhon80iwmlhYEIPB0T3hvY4USABG1YLYIyus5m2C0b3QwWwBK_YAcTwUDEfnDxYa_zkRPFOMq3irL9pyOeNlvuZ1yozHX4XAGVxA43tvIYgIUwp9NJozd8g2HLeo7v11KaIb7I8JXK_Hgj0Q0xT3gBhr9CW3XuEqddMzWUN6MLYGZRGV5KZTvjr_grcaqVoNnKYaxdHfjlV90uh_LS8YlVLdiB8dzszePtxdzDmYD_jHiuPKPnbJX7b4w5MLLs6NL080qkYFE4HNTwQyCrWU7EB7yxI3VtNTx6cu93FWWqP6mOKPTAeMHeMSKNsCnDs5yXn6olELABhVlsmtKiPhQkYlgzHOP3B09So9OhiseJUiawJbIyB9xq24481qvFrMaA5jWdjWFQguQy_tfYo2vqE3ggZ9HLBbKsyWnIDANmtAdZmL2eRc4Khx22SidV8PH1Rud0KNGICagObmwv20aH39hKlUXsZti4CxhqN5XbtlyXWjlejk4IVqSLl2c8d5_R5TbGje3AvKrFvbc5gBuY4jErYV3EPG4zbriQyhPEtdI6txuGqwKF9dw5d0b_ZVM4C9zMoUPfn3xQOpguRCQrD_DRvuEluggG38CoqzFkLlYZZoFXg73kaojvdiSovFk0vGLOHINtttQT3A1ekde8YyXzH96AGXwg87wMIIBVpf7sC0XZfMe16bD5UC1FZtwC1Ztev2qF7RQzYoXYimpv7QfuT0CSyrFUstH2hiyAp7lbjbN0i2sGcCox22pmSjlT1GEo2PoYB0oejITPYAFobfcIEzgGnRL3jzOnGoqGW7LtjOA7Wwz5bOPUS8c_4mlCSaRmD7ccHpTk9HqsKpMmu_K4JEcaKJCqyt1DdV2J4jHbJH8fmRE3G1noRjpeBqAEnaDWuobN5fKsVFtZQdhR5PqVCnXy3NukNEL1CPI0irvK94zgo65pqHUjTuLSkSZB2GsjoCXIH90sxAEaY4NbASpe4n61qTu8BFXNpbVrhntFqW9u9K6mSghN0hTO0awSGbs5r7I6jj_YvL9xqLa2EvPrLT7MoJDcqZzHSYUjVKKEbdyd8hF6Mt_RVhElQ_7I05yk6NetYiXN8v2zQSGtfKhdrJ9JgP9hCfY5HzYrdutMhQ3vnCVfMBopZH5EB_zRsUIb1pzisxBaOIX7tXBCOw8A3Ml_zMQDVUbwtkXq6A_dCzkfMune3qAmMfQFkATC5rI9VXAdMrV7kssFSo_ZAvTl50lo2SLqkpLSzJcUyCZo9_xr1EZpA5Wmg34ektW6xYvcmhbjYqDTv3zE8m4QG4Hg8sq0QnxgC_NSAsMYkgUl1bWzFiQNz0TNFT16zeJBuDosJ0CFwOFr4LHRHMaBWYV42jBfS0tITcoV2iWd7QcWdrHaMgZfTGCqbYtxSEIsCsJosMf2fA5ScUh3tdZzS_LxcnlBybVdK_JxvQXhZnnjuQoqpSgo5Yr2z1XdxAZyp2j_wUeKZh66EItC4tuWpNrmJQOqCWk7GkFTsoDPD7ehzWPaHVjsJhq9LkiJpNyvraxoKXYkFlzE3AhkgfrcUn0SJnx4u8jjV6i4SI5DbQyBZ2rdjrUU_0H_Vy8AAkhFFaKZ2xtxVDDmWrqKl72UXhko2BeWgXdxuhl4zFl6xdJea3KrzPskiMKqo_eB8whKiVWwg1sQ6Ev8Nv9hstKdnEtwC7wBAFYBdF1crBIkmkVSh_geQTxao9dG_NIN3s9Aw3B_kC9FEI0BDIHw3Hfp_Iof4ihiObJbyPvfOradYfPv_Kf9Za4DCVosA0f4KTGDdVXVxelZJPGNJJSEOXnCbK9XH4YbnO6kUD4NyyYYLH4A8_4oc8Lw9QFF5hvgShU_WIoe220iW1EhUOwQaxKXrN38ia2Lv6BLv9ajUdNxN_pfH2i0cBFfmq3puxKHbuYxFnu63Bd6xQbBrO6EtqP57GIDyodbl5cdaER1zkd8jpHjAZdqmXN4_JbeRpoDoGO8ZvO1l9o0LV9U9azm9lHuJ4DdYmulwMafyr1tNctY7Zo4aDbP27i1YrG6XAv_duJKoXnHp70fW7cdulOnUDIXAB7gaUzYY_3xum7NeSS9tZFczF5gvgywvsY_KSsmPu8GilYV5XEyxst6cXwBgmxYlyEiZZrZtESSHvsEu2tS5pVoiWpvRPSurTysSoYqxRUgma_ypg71ZoKKvLJbvsv6FVYGpj1aUJeclYpVkTeHlt3LWYfYkmBGMZa8AxphdXSwO14joTdAEHrUTB2wzve0cj_YRUXJtBSPSiNpjuTWddSQFD2VEYZdPtx6yMFmwsmERVO56ecc53ZFgzs0VGY983Hths88_eALRyCZTsvQq1iKbisyNW1O844DNGwvZIs2BbF1X35RBIagHlwDTn9L_lccw2MZPFHubtUcBDDIx1wdkBwHHkyoSZ4cwHtZVhU1eFZGl27rDtLiAK_03I99M
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140002530
lea rcx, [rbp - 0x78]
call fcn.140001e50
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0xb0]
call fcn.140001a80
mov rbx, rax
lea rax, [rsp + 0x48]
cmp rax, rbx
je 0x1400025cc
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140002599
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002594
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002604
call fcn.14000384c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x140002610
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000260b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000260b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000384c
mov rbx, qword [rsp + 0x30]
mov rdi, rbx
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
add r14, rdx
lea rsi, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rsi, qword [rsp + 0x48]
cmp rsi, r14
je 0x140002693
nop dword [rax]
movzx eax, byte [rsi]
mov byte [rsp + 0x20], al
cmp rdi, qword [rsp + 0x40]
je 0x14000266f
mov byte [rdi], al
mov rdi, qword [rsp + 0x38]
inc rdi
mov qword [rsp + 0x38], rdi
jmp 0x140002686
lea r8, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140002cd0
mov rdi, qword [rsp + 0x38]
inc rsi
cmp rsi, r14
jne 0x140002650
mov rbx, qword [rsp + 0x30]
mov dword [rbp + 0xb0], 0xfb4aff6d
mov dword [rbp + 0xb4], 0xdd3208d4
mov dword [rbp + 0xb8], 0x2a0a24ed
mov dword [rbp + 0xbc], 0x73579c63
mov dword [rbp + 0xc0], 0x4ee9a1dd
mov dword [rbp + 0xc4], 0x6f002979
mov dword [rbp + 0xc8], 0x39639c02
mov dword [rbp + 0xcc], 0x4afff610
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x50]
call fcn.140001030
mov dword [rbp + 0xa0], 0xd3165570
mov dword [rbp + 0xa4], 0xb12f73b4
mov dword [rbp + 0xa8], 0xb54bda9d
mov dword [rbp + 0xac], 0xb89aac91
mov rax, rdi
sub rax, rbx
mov esi, eax
test eax, eax
je 0x14000278a
lea rdi, [rbp + 0xa0]
sub rdi, rbx
dec rsi
shr rsi, 4
inc rsi
nop dword [rax + rax]
movups xmm6, xmmword [rbx]
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140001740
mov ecx, 0x10
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140002760
movaps xmmword [rbp + 0xa0], xmm6
sub rdi, 0x10
sub rsi, 1
jne 0x140002740
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, r12
mov qword [rsp + 0x78], r12
sub rdi, rbx
mov r15d, r12d
je 0x140002800
mov r14, r12
nop dword [rax]
lea r8, [r14 + rbx]
movzx edx, byte [r8]
cmp dl, 0x90
jne 0x1400027c4
lea rcx, [rdi - 1]
movsxd rax, r15d
cmp rax, rcx
je 0x140002800
cmp dl, dl
jne 0x1400027c4
cmp byte [r14 + rbx + 1], dl
je 0x140002800
cmp rsi, r13
je 0x1400027d5
mov byte [rsi], dl
inc rsi
mov qword [rsp + 0x78], rsi
jmp 0x1400027eb
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140002cd0
mov r13, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x78]
inc r15d
inc r14
movsxd rax, r15d
cmp rax, rdi
jae 0x140002800
mov rbx, qword [rsp + 0x30]
jmp 0x1400027a0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov rbx, qword [rsp + 0x70]
cmp rbx, rsi
je 0x1400028a4
mov rdi, rsi
sub rdi, rbx
cmp rdi, 0x1000
jb 0x14000285b
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1400029f5
call fcn.1400035c0
test rax, rax
je 0x140002854
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140002870
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdi, rdi
je 0x14000286d
mov rcx, rdi
call fcn.1400035c0
mov r14, rax
jmp 0x140002870
mov r14, r12
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], r14
lea rax, [r14 + rdi]
mov qword [rbp + 0xc0], rax
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
sub rsi, rbx
add rsi, r14
mov qword [rbp + 0xb8], rsi
lea rcx, [rbp + 0xb0]
call fcn.140002110
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400028f1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000384c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140002943
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000293d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000293d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000384c
nop
test rbx, rbx
je 0x14000297f
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x140002973
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002973
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r13
mov rcx, rbx
call fcn.14000384c
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400029be
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000384c
xor eax, eax
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140003420
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400019c0
nop
int3