Function at 0x14002be10
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, qword [rsp + 0x2c0]
mov rbx, rcx
mov r13, r8
mov r12d, edx
lea rcx, [rsp + 0x51]
mov r8d, 0x1ff
xor edx, edx
mov qword [rsp + 0x40], r9
mov edi, 3
mov byte [rsp + 0x50], 0
call fcn.14000cbf0
xor eax, eax
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 0x200
mov rcx, rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002bee0
test rsi, rsi
je 0x14002c0bf
mov rax, qword [rsi + 8]
test rax, rax
je 0x14002beb7
mov rcx, qword [rsi]
lea edx, [rdi + 0x16]
lea r8d, [rdi - 1]
mov r9d, 0x3ea
call rax
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14002c0bf
mov rcx, qword [rsi]
lea r8, str.Not_able_to_read_message_from_license_service
mov r9d, 0x3eb
mov edx, reloc.WS2_32.dll_inet_ntoa
call rax
jmp 0x14002c0bf
mov ebp, dword [rsp + 0x30]
mov edi, 4
lea r14d, [rbp + 3]
mov edx, edi
shr r14d, 2
mov ecx, r14d
mov ebx, r14d
call fcn.140022b68
mov rsi, rax
test rax, rax
je 0x14002c0ba
lea rdx, [rsp + 0x50]
mov r8d, ebp
mov rcx, rax
call fcn.14000da10
imul ecx, r12d, 0x19660d
add ecx, 0x3c6ef35f
imul r12d, ecx, 0x19660d
add r12d, 0x3c6ef35f
mov r8d, r12d
test r14d, r14d
je 0x14002bf56
mov rdx, rsi
mov ecx, dword [rdx]
lea rdx, [rdx + 4]
mov eax, ecx
xor eax, r8d
mov r8d, ecx
mov dword [rdx - 4], eax
dec rbx
jne 0x14002bf40
xor r8d, r8d
xor eax, eax
xor r10b, r10b
test ebp, ebp
je 0x14002bf96
lea r9, [rsp + 0x50]
nop word [rax + rax]
mov edx, dword [rsi + rax*4]
movzx ecx, r10b
inc r8d
and ecx, 0x1f
mov eax, r8d
add r10b, 8
shr edx, cl
shr eax, 2
lea r9, [r9 + 1]
mov byte [r9 - 1], dl
cmp r8d, ebp
jb 0x14002bf70
mov rcx, rsi
call fcn.1400108e4
cmp rbp, 0x200
jae 0x14002c0ec
mov byte [rsp + rbp + 0x50], 0
mov rax, qword [rsp + 0x50]
cmp rax, qword [str.___FNLSVer]
jne 0x14002c0bf
mov eax, dword [rsp + 0x58]
cmp eax, dword [0x14010e9a0]
jne 0x14002c0bf
movzx eax, byte [rsp + 0x5c]
cmp al, byte [0x14010e9a4]
jne 0x14002c0bf
cmp byte [rsp + 0x5d], 0
je 0x14002c0bf
lea rcx, [rsp + 0x5d]
mov edx, reloc.WS2_32.dll_inet_ntoa
call fcn.14000d684
mov rbx, rax
test rax, rax
je 0x14002c0bf
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x5d]
mov r8d, 0xa
mov byte [rax], 0
call fcn.140018cac
mov rcx, qword [rsp + 0x48]
cmp byte [rcx], 0
jne 0x14002c0bf
inc rbx
je 0x14002c0bf
cmp eax, 1
je 0x14002c044
mov edi, 6
jmp 0x14002c0bf
cmp byte [rbx], 0
je 0x14002c0bf
mov edx, reloc.WS2_32.dll_inet_ntoa
mov rcx, rbx
call fcn.14000d684
mov rsi, rax
test rax, rax
je 0x14002c0bf
lea rdx, [rsp + 0x38]
mov r8d, 0xa
mov rcx, rbx
mov byte [rax], 0
call fcn.140018cac
mov rcx, qword [rsp + 0x38]
cmp byte [rcx], 0
jne 0x14002c0bf
lea rdx, [rsi + 1]
test rdx, rdx
je 0x14002c0bf
cmp eax, r12d
je 0x14002c093
mov edi, 2
jmp 0x14002c0bf
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x14002c097
mov rcx, qword [rsp + 0x40]
lea r8d, [rax + 1]
xor r9d, r9d
mov dword [rcx], eax
mov rcx, r13
call fcn.14002aca0
xor edi, edi
jmp 0x14002c0bf
mov edi, 5
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14000c9f0
mov rbx, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000d948
int3