Function at 0x140026850
Capabilities:
Encode data using xor
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
mov rbx, rdx
mov r12, rcx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rcx + 0x48], rdi
mov rax, qword [rdx]
mov edx, dword [rax - 8]
call fcn.14001e440
mov rdx, qword [rbx]
mov eax, dword [rdx - 8]
lea eax, [rax*2 + 2]
movsxd r8, eax
mov rcx, qword [r12]
call fcn.1402d15b0
mov qword [r12 + 0x20], rdi
lea edx, [rdi + 1]
lea ecx, [rdi + 0xa]
call fcn.1402deebc
lea rbx, [rax + 8]
mov qword [rbp - 0x51], rbx
lea edx, [rdi + 1]
lea ecx, [rdi + 0xa]
call fcn.1402deebc
mov r15, rax
lea r13, [rax + 8]
mov qword [rbp - 0x49], r13
lea edx, [rdi + 1]
lea ecx, [rdi + 0xa]
call fcn.1402deebc
mov qword [rbp + 0x7f], rax
lea r14, [rax + 8]
mov qword [rbp - 1], r14
lea edx, [rdi + 1]
lea ecx, [rdi + 0xa]
call fcn.1402deebc
lea rsi, [rax + 8]
mov qword [rbp - 0x71], rsi
lea edx, [rdi + 1]
lea ecx, [rdi + 0xa]
call fcn.1402deebc
lea rdi, [rax + 8]
mov qword [rbp - 0x79], rdi
lea rcx, [r12 + 8]
mov r8d, 0x40
mov rdx, qword [rbp + 0x6f]
mov rdx, qword [rdx]
call fcn.14001e170
test eax, eax
je 0x140026d7e
lea rdx, [rbp + 0x7f]
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, dword [rbp + 0x7f]
shl r14, 0x20
mov eax, eax
add r14, rax
mov r15, qword [rsp + 0x30]
test r15, r15
jns 0x1400269a7
mov qword [rbp + 0x7f], 0xfffffffffffffff8
mov r9d, 2
lea r8, [rbp + 0x7f]
mov rdx, 0xfffffffffffffff8
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor eax, eax
mov dword [rbp + 0x7f], eax
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
lea r8d, [rax + 8]
lea rdx, [rsp + 0x30]
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r15, qword [rsp + 0x30]
lea rax, [r14 - 0x18]
mov qword [rbp + 0x67], rax
cmp r15, rax
jae 0x140026cfc
mov rsi, rax
lea rdi, [r12 + 0x78]
mov qword [rbp + 0x7f], r15
xor r9d, r9d
lea r8, [rbp + 0x7f]
mov rdx, r15
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov qword [rbp - 0x41], r15
xor eax, eax
mov dword [rbp + 0x7f], eax
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
lea r8d, [rax + 4]
lea rdx, [rbp + 0x77]
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r14d, dword [rbp + 0x77]
add r14d, 0xfffce9c0
mov ebx, r14d
mov edx, 1
mov ecx, r14d
call fcn.1402deebc
mov r13, rax
mov edx, 1
mov ecx, r14d
call fcn.1402deebc
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov dword [rbp + 0x7f], ecx
test r14d, r14d
je 0x140026a57
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x7f]
mov r8d, r14d
mov rdx, rax
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, qword [rsp + 0x38]
mov r8, rbx
mov rdx, rax
mov rcx, r13
call fcn.1402d15b0
xor edx, edx
test r14d, r14d
je 0x140026aaa
mov r8, r13
mov r9, rbx
lea rsi, [0x140000000]
nop dword [rax]
movzx eax, byte [rdx + rsi + 0x471270]
xor byte [r8], al
lea r8, [r8 + 1]
mov rax, rdx
lea rcx, [rdx + 1]
xor edx, edx
cmp rax, 0x17
cmovne rdx, rcx
sub r9, 1
jne 0x140026a80
mov rsi, qword [rbp + 0x67]
lea rax, [r14 + 4]
add rax, r15
mov qword [rbp - 0x31], rax
mov rax, qword [r13]
mov qword [rbp - 0x69], rax
mov rax, qword [r13 + 8]
mov qword [rbp - 0x61], rax
mov eax, dword [r13 + 0x10]
mov dword [rbp - 0x59], eax
mov eax, dword [r13 + 0x14]
mov dword [rbp - 0x55], eax
mov rax, qword [r13 + 0x34]
mov qword [rbp - 0x29], rax
mov rax, qword [r13 + 0x3c]
mov qword [rbp - 0x21], rax
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [r13 + rdx*2 + 0x44], 0
jne 0x140026af0
lea rcx, [rbp - 0x51]
call fcn.14001e440
mov rbx, qword [rbp - 0x51]
mov eax, dword [rbx - 8]
lea eax, [rax*2 + 2]
movsxd r8, eax
lea rdx, [r13 + 0x44]
mov rcx, rbx
call fcn.1402d15b0
mov eax, dword [rbx - 8]
add eax, eax
movsxd rbx, eax
add rbx, r13
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2 + 0x46], 0
jne 0x140026b34
lea rcx, [rbp - 0x49]
call fcn.14001e440
mov r15, qword [rbp - 0x49]
mov eax, dword [r15 - 8]
lea eax, [rax*2 + 2]
movsxd r8, eax
lea rdx, [rbx + 0x46]
mov rcx, r15
call fcn.1402d15b0
mov rax, qword [rbp - 0x61]
add qword [r12 + 0x48], rax
mov rax, qword [rbp - 0x69]
add rax, qword [rbp - 0x31]
mov qword [rsp + 0x48], rax
sub rax, qword [rbp - 0x41]
mov qword [rbp - 0x39], rax
mov edx, 1
lea ecx, [rdx + 9]
call fcn.1402deebc
add rax, 8
mov qword [rbp + 0x7f], rax
mov r14, qword [rbp - 0x51]
mov edx, dword [r14 - 8]
add edx, dword [r15 - 8]
lea rcx, [rbp + 0x7f]
call fcn.14001e440
mov eax, dword [r15 - 8]
add eax, eax
movsxd r8, eax
mov rdx, r15
mov rbx, qword [rbp + 0x7f]
mov rcx, rbx
call fcn.1402d15b0
mov eax, dword [r14 - 8]
add eax, eax
movsxd r8, eax
movsxd rax, dword [r15 - 8]
lea rcx, [rbx + rax*2]
mov rdx, r14
call fcn.1402d15b0
nop
xor r8d, r8d
mov ecx, dword [rbx - 8]
test ecx, ecx
jle 0x140026c12
mov rdx, rbx
nop dword [rax]
movzx ecx, word [rdx]
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x140026c03
sub cx, 0x20
mov word [rdx], cx
inc r8d
add rdx, 2
mov ecx, dword [rbx - 8]
cmp r8d, ecx
jl 0x140026bf0
mov r9, rbx
mov rax, 0xffffffffffffffff
lea r8d, [rcx + rcx]
test r8d, r8d
je 0x140026c55
lea rdi, [0x140000000]
nop dword [rax]
movzx ecx, byte [r9]
xor rcx, rax
movzx edx, cl
shr rax, 8
xor rax, qword [rdi + rdx*8 + 0x470a70]
lea r9, [r9 + 1]
add r8d, 0xffffffff
jne 0x140026c30
lea rdi, [r12 + 0x78]
mov qword [rsp + 0x40], rax
mov rdx, qword [r12 + 0x80]
cmp rdx, qword [r12 + 0x88]
je 0x140026c7a
mov qword [rdx], rax
add qword [r12 + 0x80], 8
jmp 0x140026c87
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.140028230
mov rax, qword [r12 + 0x38]
cmp rax, qword [r12 + 0x40]
je 0x140026ca7
lea rdx, [rbp - 0x69]
mov rcx, rax
call fcn.140029150
add qword [r12 + 0x38], 0x78
jmp 0x140026cb8
lea r8, [rbp - 0x69]
mov rdx, rax
lea rcx, [r12 + 0x30]
call fcn.140027fc0
inc qword [r12 + 0x20]
mov rcx, r13
call fcn.1402d83b4
mov rcx, qword [rsp + 0x38]
call fcn.1402d83b4
nop
test rbx, rbx
je 0x140026cde
lea rcx, [rbx - 8]
call fcn.1402d83b4
mov r15, qword [rsp + 0x48]
cmp r15, rsi
jb 0x1400269c0
mov r13, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
mov rdi, qword [rbp - 0x79]
mov rsi, qword [rbp - 0x71]
mov rcx, qword [r12 + 0x10]
test rcx, rcx
je 0x140026d15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12 + 0x10], 0
test rdi, rdi
je 0x140026d24
lea rcx, [rdi - 8]
call fcn.1402d83b4
nop
test rsi, rsi
je 0x140026d33
lea rcx, [rsi - 8]
call fcn.1402d83b4
nop
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x140026d45
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
test r13, r13
je 0x140026d53
lea rcx, [r13 - 8]
call fcn.1402d83b4
test rbx, rbx
je 0x140026d62
lea rcx, [rbx - 8]
call fcn.1402d83b4
nop
mov rax, qword [rbp + 0x6f]
mov rcx, qword [rax]
test rcx, rcx
je 0x140026d77
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
mov eax, 1
jmp 0x140026ddd
test rdi, rdi
je 0x140026d8d
lea rcx, [rdi - 8]
call fcn.1402d83b4
nop
test rsi, rsi
je 0x140026d9c
lea rcx, [rsi - 8]
call fcn.1402d83b4
nop
test r14, r14
je 0x140026daa
mov rcx, qword [rbp + 0x7f]
call fcn.1402d83b4
test r13, r13
je 0x140026db7
mov rcx, r15
call fcn.1402d83b4
test rbx, rbx
je 0x140026dc6
lea rcx, [rbx - 8]
call fcn.1402d83b4
nop
mov rax, qword [rbp + 0x6f]
mov rcx, qword [rax]
test rcx, rcx
je 0x140026ddb
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
xor eax, eax
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret