Function at 0x140003390
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rsi, qword [0x140020bb8]
test rsi, rsi
je 0x14000368c
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000368c
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x14000368c
lea r14, [rsi + rax]
mov qword [rsp + 0xb8], r14
cmp dword [r14], 0x4550
jne 0x14000368c
test r14, r14
je 0x14000368c
movsxd r15, dword [rsi + 0x3c]
add r15, 0xb0
add r15, rsi
xor r13d, r13d
cmp dword [r15], r13d
cmove r15, r13
mov r12, qword [r14 + 0x30]
mov qword [rsp + 0x20], r12
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x2d4
mov eax, dword [rcx + rdi]
mov ebx, 0x360
add rbx, rdi
test al, 1
jne 0x14000345f
or eax, 1
mov dword [rcx + rdi], eax
mov word [rbx + 9], 0x10d
mov dword [rbx], 0x4bad7969
mov dword [rbx + 4], 0xb9d5413b
mov byte [rbx + 8], 0x6b
lea rcx, [0x140013b50]
call fcn.140003bf4
nop
cmp byte [rbx + 0xa], 0
je 0x140003571
mov r8, r13
cmp dword [0x14001f018], 5
jl 0x140003535
movdqa xmm3, xmmword [0x14001bbd0]
movdqa xmm0, xmmword [0x14001bab0]
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
movdqa xmm2, xmmword [0x14001bb00]
pshufb xmm1, xmm2
movzx eax, word [rbx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx], ax
movdqa xmm0, xmmword [0x14001bac0]
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
pshufb xmm1, xmm2
movzx eax, word [rbx + 2]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 2], ax
movdqa xmm0, xmmword [0x14001bad0]
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
pshufb xmm1, xmm2
movzx eax, word [rbx + 4]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 4], ax
movdqa xmm0, xmmword [0x14001bae0]
psllq xmm0, 3
vpsrlvq xmm1, xmm3, xmm0
pshufb xmm1, xmm2
movzx eax, word [rbx + 6]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rbx + 6], ax
mov r8d, 8
mov qword [rsp + 0xb8], r14
movabs r9, 0xd5b16f5727c90d07
nop word [rax + rax]
movzx ecx, r8b
and cl, 7
shl cl, 3
mov rdx, r9
shr rdx, cl
xor byte [rbx + r8], dl
inc r8
cmp r8, 0xa
jb 0x140003550
mov byte [rbx + 0xa], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
movdqa xmm0, xmmword [0x14001bb10]
mov dword [rsp + 0x38], 0x3726bc0b
mov eax, 0x354
mov ecx, dword [rax + rdi]
test cl, 1
jne 0x1400035f3
or ecx, 1
mov dword [rax + rdi], ecx
mov ebx, 0x2e8
mov ecx, ebx
add rcx, rdi
mov byte [rcx + 0x15], 1
lea rax, [rcx + 0x14]
lea rdx, [rsp + 0x3c]
cmp rcx, rdx
ja 0x1400035d6
lea rdx, [rsp + 0x28]
cmp rax, rdx
jb 0x1400035d6
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x38]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], 0x5b
jmp 0x1400035e4
movups xmmword [rcx], xmm0
mov eax, dword [rsp + 0x38]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], 0x5b
lea rcx, [0x140013b30]
call fcn.140003bf4
nop
jmp 0x1400035f8
mov ebx, 0x2e8
mov edx, ebx
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
movups xmm0, xmmword [rdx + rcx]
movups xmmword [rsp + 0x40], xmm0
mov eax, dword [rdx + rcx + 0x10]
mov dword [rsp + 0x50], eax
movzx eax, word [rdx + rcx + 0x14]
mov word [rsp + 0x54], ax
lea rcx, [rsp + 0x40]
call fcn.140003970
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [r14 + 0x30]
mov rcx, 0xffffffffffffffff
call rax
mov edx, dword [r14 + 0x50]
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r12
call qword [0x140020f40]
mov rbp, rax
test rax, rax
jne 0x14000369f
test r15, r15
je 0x14000368c
mov edx, dword [r14 + 0x50]
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [0x140020f40]
mov rbp, rax
test rax, rax
jne 0x14000369f
xor al, al
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [r14 + 0x30], rbp
mov r8d, dword [r14 + 0x54]
mov rdx, rsi
mov rcx, rbp
call fcn.1400122c0
mov edi, r13d
cmp r13w, word [r14 + 6]
jae 0x1400036fc
lea rbx, [r14 + 0x11c]
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rbx - 4]
mov edx, dword [rbx]
add rdx, rsi
mov ecx, dword [rbx - 8]
add rcx, rbp
call fcn.1400122c0
inc edi
lea rbx, [rbx + 0x28]
movzx eax, word [r14 + 6]
cmp edi, eax
jl 0x1400036d0
test rbp, rbp
je 0x14000385a
mov eax, 0x5a4d
cmp word [rbp], ax
jne 0x14000385f
movsxd rax, dword [rbp + 0x3c]
cmp eax, 0x400
jg 0x14000385a
add rax, rbp
cmp dword [rax], 0x4550
jne 0x14000385a
test rax, rax
je 0x14000385a
add rax, 0x90
cmp dword [rax], 0
je 0x14000385a
test rax, rax
je 0x14000385a
mov edx, dword [rax + 4]
mov qword [rsp + 0xc8], rdx
mov ecx, dword [rax]
test rdx, rdx
je 0x14000385a
lea r15, [rbp + 0x10]
add r15, rcx
mov qword [rsp + 0xb0], r15
mov rax, 0xfffffffffffffff0
sub rax, rcx
sub rax, rbp
mov qword [rsp + 0xc0], rax
mov edx, dword [r15 - 0x10]
test edx, edx
jne 0x140003795
cmp dword [r15], edx
je 0x14000384d
mov r14d, dword [r15 - 4]
add r14, rbp
mov ecx, dword [r15]
mov r12d, ecx
test edx, edx
cmovne r12, rdx
lea r13, [rcx + rbp]
mov rsi, r13
movabs r15, 0x8000000080000000
nop dword [rax]
mov rbx, rsi
sub rbx, r13
add rbx, r12
mov rax, qword [rbx + rbp]
test r15, rax
je 0x1400037ec
movzx edi, ax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
mov rax, qword [rsi]
test rax, rax
je 0x140003820
mov rcx, qword [rbx + rbp]
cmp rax, rcx
jne 0x14000381a
lea rbx, [rcx + 2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbx + rbp]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
add rsi, 8
jmp 0x1400037c0
mov r15, qword [rsp + 0xb0]
add r15, 0x14
mov qword [rsp + 0xb0], r15
mov rax, qword [rsp + 0xc0]
add rax, r15
cmp rax, qword [rsp + 0xc8]
jb 0x140003784
mov r14, qword [rsp + 0xb8]
mov r12, qword [rsp + 0x20]
mov eax, 0x5a4d
cmp rbp, r12
je 0x140003947
mov esi, dword [r14 + 0x50]
test rbp, rbp
je 0x140003947
cmp word [rbp], ax
jne 0x140003947
movsxd rax, dword [rbp + 0x3c]
cmp eax, 0x400
jg 0x140003947
add rax, rbp
cmp dword [rax], 0x4550
jne 0x140003947
test rax, rax
je 0x140003947
add rax, 0xb0
cmp dword [rax], 0
je 0x140003947
test rax, rax
je 0x140003947
mov r15d, dword [rax + 4]
mov r13d, dword [rax]
xor edi, edi
test r15, r15
je 0x140003947
nop dword [rax]
lea r11, [rdi + r13]
add r11, rbp
mov ecx, dword [r11]
test ecx, ecx
je 0x140003947
mov eax, dword [r11 + 4]
test eax, eax
je 0x140003947
lea r10, [rax - 8]
shr r10, 1
mov ebx, ecx
lea r8, [r11 + 8]
mov edx, 0
je 0x14000393b
nop word [rax + rax]
movzx ecx, word [r8]
mov r9d, ecx
and r9d, 0xfff
shr rcx, 0xc
add r9, rbx
test rcx, rcx
je 0x14000393b
cmp rcx, 3
jne 0x140003947
cmp r9, rsi
jae 0x140003947
mov rax, rbp
sub rax, r12
add qword [r9 + rbp], rax
add r8, 2
inc rdx
cmp rdx, r10
jb 0x140003900
mov eax, dword [r11 + 4]
add rdi, rax
cmp rdi, r15
jb 0x1400038d0
mov eax, dword [r14 + 0x28]
add rax, rbp
call rax
nop
jmp 0x14000368e